fix: Check that password matches in occ user:auth-tokens:add

Otherwise you could create tokens containing an invalid password, which
 was confusing.

Signed-off-by: Côme Chilliet <come.chilliet@nextcloud.com>

Author: come-nc

core/Command/User/AuthTokens/Add.php

@@ -11,8 +11,8 @@
 use OC\Authentication\Events\AppPasswordCreatedEvent;
 use OC\Authentication\Token\IProvider;
 use OC\Authentication\Token\IToken;
+use OC\User\Manager as UserManager;
 use OCP\EventDispatcher\IEventDispatcher;
-use OCP\IUserManager;
 use OCP\Security\ISecureRandom;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Helper\QuestionHelper;
@@ -24,8 +24,8 @@
 
 class Add extends Command {
 	public function __construct(
-		protected IUserManager $userManager,
-		protected IProvider $tokenProvider,
+		private UserManager $userManager,
+		private IProvider $tokenProvider,
 		private ISecureRandom $random,
 		private IEventDispatcher $eventDispatcher,
 	) {
@@ -83,8 +83,19 @@ protected function execute(InputInterface $input, OutputInterface $output): int
 			$password = $helper->ask($input, $output, $question);
 		}
 
+		$loginName = $input->getOption('login-name') ?? $user->getUID();
+
 		if ($password === null) {
 			$output->writeln('<info>No password provided. The generated app password will therefore have limited capabilities. Any operation that requires the login password will fail.</info>');
+		} else {
+			$loggedInUser = $this->userManager->checkPasswordNoLogging($loginName, $password);
+			if ($loggedInUser === false) {
+				$output->writeln('<error>The given password is invalid for login ' . $loginName . '</error>');
+				return self::FAILURE;
+			} elseif ($loggedInUser->getUID() !== $user->getUID()) {
+				$output->writeln('<error>The user ' . $username . ' does not match the given login ' . $loginName . '</error>');
+				return self::FAILURE;
+			}
 		}
 
 		$tokenName = $input->getOption('name') ?: 'cli';