fix: set IUserSession user after bearer token validation

Signed-off-by: Han Gerrits <han@gerrits.net>

fix: set IUserSession user after bearer token validation" --body "## Summary

  When user_oidc validates a bearer token in Backend::getCurrentUserId(), it returns the correct userId but does not call IUserSession::setUser().
  This leaves the user session in an inconsistent state where getCurrentUserId() succeeds but DI-injected \$userId parameters remain null.

  ## Problem

  OCS controllers and CalDAV plugins that receive \$userId via dependency injection get null instead of the authenticated user's ID when the request
  is authenticated via OIDC bearer token. This causes:

  - **Deck**: TypeError: ...\$userId must be of type string, null given
  - **Talk**: Same TypeError pattern
  - **Tasks** (CalDAV): 500 errors from null userId

  These apps work correctly with session-based OIDC login (where setUser() IS called) but fail with bearer token authentication.

  ## Fix

  Call IUserSession::setUser() after successful bearer token validation at all three return points in getCurrentUserId(). IUserSession is resolved via
   Server::get() rather than constructor injection to avoid a circular dependency.

  ## Testing

  1. Configure an OIDC provider with bearer token validation enabled
  2. Make API requests to Deck, Talk, or CalDAV endpoints using a bearer token
  3. Verify 200 responses instead of 500 errors"

Author: hangerrits

lib/User/Backend.php

@@ -34,6 +34,7 @@
 use OCP\IURLGenerator;
 use OCP\IUser;
 use OCP\IUserManager;
+use OCP\IUserSession;
 use OCP\Server;
 use OCP\User\Backend\ABackend;
 use OCP\User\Backend\ICountUsersBackend;
@@ -339,10 +340,12 @@ public function getCurrentUserId(): string {
 							}
 
 							$this->session->set('last-password-confirm', strtotime('+4 year', time()));
+							$this->setSessionUser($userId);
 							return $userId;
 						} elseif ($this->userExists($tokenUserId)) {
 							$this->checkFirstLogin($tokenUserId);
 							$this->session->set('last-password-confirm', strtotime('+4 year', time()));
+							$this->setSessionUser($tokenUserId);
 							return $tokenUserId;
 						} else {
 							// check if the user exists locally
@@ -364,6 +367,7 @@ public function getCurrentUserId(): string {
 							}
 							$this->checkFirstLogin($tokenUserId);
 							$this->session->set('last-password-confirm', strtotime('+4 year', time()));
+							$this->setSessionUser($tokenUserId);
 							return $tokenUserId;
 						}
 					}
@@ -375,6 +379,26 @@ public function getCurrentUserId(): string {
 		return '';
 	}
 
+	/**
+	 * Set the user in IUserSession after bearer token validation.
+	 * Without this, DI-injected $userId is null in OCS controllers
+	 * and CalDAV plugins, causing 500 errors in Deck, Talk, and Tasks.
+	 *
+	 * Note: IUserSession is resolved via Server::get() rather than constructor
+	 * injection to avoid a circular dependency (IUserSession depends on this Backend).
+	 */
+	private function setSessionUser(string $userId): void {
+		try {
+			$user = $this->userManager->get($userId);
+			if ($user !== null) {
+				$userSession = Server::get(IUserSession::class);
+				$userSession->setUser($user);
+			}
+		} catch (Throwable $e) {
+			$this->logger->debug('Failed to set session user after bearer validation: ' . $e->getMessage());
+		}
+	}
+
 	/**
 	 * Inspired by lib/private/User/Session.php::prepareUserLogin()
 	 *