chore(cypress): Try to analyze failures on login

Assisted-by: ClaudeCode:claude-fable-5
Signed-off-by: David Dreschner <david.dreschner@nextcloud.com>

Author: DerDreschner

core/Controller/CSRFTokenController.php

@@ -56,6 +56,23 @@ public function index(): JSONResponse {
 
 		$requestToken = $this->tokenManager->getToken();
 
+		// [login-diag] Record the session this token was issued into, so a later
+		// csrfCheckFailed on /login can be matched against it: if the /login
+		// session/sessCookie differs from what /csrftoken issued into, the token
+		// legitimately isn't in /login's session (a session-mismatch race).
+		try {
+			$session = \OCP\Server::get(\OCP\ISession::class);
+			$raw = $this->request->getCookie(session_name());
+			\OCP\Server::get(\Psr\Log\LoggerInterface::class)->error(
+				'[login-diag] CSRFTOKEN issued remote=' . $this->request->getRemoteAddress()
+				. ' session=' . substr(md5((string)$session->getId()), 0, 8)
+				. ' sessCookie=' . ($raw !== null ? substr(md5($raw), 0, 8) : 'none'),
+				['app' => 'login-diag'],
+			);
+		} catch (\Throwable) {
+			// diagnostics must never affect the token endpoint
+		}
+
 		return new JSONResponse([
 			'token' => $requestToken->getEncryptedValue(),
 		]);

core/Controller/LoginController.php

@@ -391,11 +391,39 @@ private function logLoginDiag(string $what, string $user): void {
 			} catch (\Throwable) {
 				$session = 'n/a';
 			}
+			// Break down passesCSRFCheck() so a csrfCheckFailed tells us WHICH
+			// sub-check failed: the strict same-site cookie check, or the token
+			// validation (a missing session 'requesttoken' means the /login
+			// request landed on a different session than /csrftoken issued into).
+			try {
+				$strictCookie = $this->request->passesStrictCookieCheck() ? '1' : '0';
+			} catch (\Throwable) {
+				$strictCookie = 'err';
+			}
+			try {
+				$sessHasReqToken = $this->session->exists('requesttoken') ? '1' : '0';
+			} catch (\Throwable) {
+				$sessHasReqToken = 'err';
+			}
+			// Hash of the session cookie the client actually sent, to compare the
+			// /csrftoken-issuing session against the /login session.
+			$sessCookie = 'none';
+			try {
+				$raw = $this->request->getCookie(session_name());
+				if ($raw !== null) {
+					$sessCookie = substr(md5($raw), 0, 8);
+				}
+			} catch (\Throwable) {
+				$sessCookie = 'err';
+			}
 			\OCP\Server::get(\Psr\Log\LoggerInterface::class)->error(
 				'[login-diag] ' . $what
 				. ' user=' . $user
 				. ' remote=' . $remote
 				. ' session=' . $session
+				. ' sessCookie=' . $sessCookie
+				. ' strictCookie=' . $strictCookie
+				. ' sessHasReqToken=' . $sessHasReqToken
 				. ' csrf=' . ($this->request->passesCSRFCheck() ? '1' : '0')
 				. ' origin=' . $this->request->getHeader('Origin')
 				. ' delay=' . $this->throttler->getDelay($remote, 'login'),