fix(2fa): apply the local MFA policy to social login

Social login (SocialLoginController::callback) established a full session
for any user that passed canLogin(), so an account with
shouldRequire2FA() true could log in and obtain tokens without ever
passing the 2FA challenge the password flow enforces.

Extract the password flow's challenge issuance (gate check, resend
rate-limit, OTP issuance scoped to the pending OAuth2 client, audit log,
session bookkeeping) from UserController::postLogin into a dedicated
TwoFactorChallengeService, and call it from the social callback before
Auth::login(). An enforced user now gets the same email-OTP challenge and
completes it through the unchanged verify2FA endpoint; non-enforced users
and the two_factor.enabled kill-switch behave as before.

Drop the now-unused ITwoFactorGateService / ITwoFactorRateLimitService
dependencies from UserController.

Author: smarcet

app/Http/Controllers/SocialLoginController.php

@@ -12,7 +12,9 @@
  * limitations under the License.
  **/
 
+use App\Http\Controllers\Traits\MFACookieManager;
 use App\libs\Auth\SocialLoginProviders;
+use App\Services\Auth\ITwoFactorChallengeService;
 use App\Services\Auth\IUserService;
 use Auth\Exceptions\AuthenticationException;
 use Illuminate\Support\Facades\Auth;
@@ -29,6 +31,7 @@
  */
 final class SocialLoginController extends Controller
 {
+    use MFACookieManager;
 
     /**
      * @var IAuthService
@@ -48,22 +51,30 @@ final class SocialLoginController extends Controller
      */
     private $memento_service;
 
+    /**
+     * @var ITwoFactorChallengeService
+     */
+    private $two_factor_challenge_service;
+
     /**
      * SocialLoginController constructor.
      * @param IAuthService $auth_service
      * @param IUserService $user_service
      * @param IMementoOAuth2SerializerService $memento_service
      * @param ILoginStrategyFactory $login_strategy_factory
+     * @param ITwoFactorChallengeService $two_factor_challenge_service
      */
     public function __construct(
         IAuthService $auth_service,
         IUserService $user_service,
         IMementoOAuth2SerializerService $memento_service,
-        ILoginStrategyFactory $login_strategy_factory
+        ILoginStrategyFactory $login_strategy_factory,
+        ITwoFactorChallengeService $two_factor_challenge_service
     ){
         $this->auth_service = $auth_service;
         $this->user_service = $user_service;
         $this->memento_service = $memento_service;
+        $this->two_factor_challenge_service = $two_factor_challenge_service;
         $this->middleware(function ($request, $next) use($login_strategy_factory){
             // we do it here just to ensure that user session is loaded
             Log::debug(sprintf("SocialLoginController::middleware"));
@@ -161,6 +172,24 @@ public function callback($provider)
                 );
             }
 
+            // Social login is primary authentication only - the local MFA
+            // policy still applies on return from the provider, exactly as
+            // it does for the password flow. An enforced user gets the same
+            // challenge (rate-limited, audited, session-flashed) instead of
+            // an immediate session.
+            $payload = $this->two_factor_challenge_service->issueChallengeIfRequired($user, $this->getCookieToken(), true);
+            if (!is_null($payload)) {
+                $payload = array_merge($payload, [
+                    'username'       => $user_email,
+                    'user_fullname'  => $user->getFullName(),
+                    'user_pic'       => $user->getPic(),
+                    'user_verified'  => true,
+                    'user_is_active' => $user->isActive() ? 1 : 0,
+                ]);
+
+                return $this->login_strategy->challengeRequired($payload);
+            }
+
             Auth::login($user, true);
             // and continue the usual flow
             return $this->login_strategy->postLogin(['provider' => $provider]);

app/Http/Controllers/UserController.php

@@ -23,8 +23,7 @@
 use App\Services\Auth\IDeviceTrustService;
 use App\Services\Auth\IRecoveryCodeService;
 use App\Services\Auth\ITwoFactorAuditService;
-use App\Services\Auth\ITwoFactorGateService;
-use App\Services\Auth\ITwoFactorRateLimitService;
+use App\Services\Auth\ITwoFactorChallengeService;
 use App\Services\Auth\IUserService as AuthUserService;
 use Auth\Exceptions\AuthenticationException;
 use Auth\Exceptions\UnverifiedEmailMemberException;
@@ -153,19 +152,14 @@ final class UserController extends OpenIdController
     private $two_factor_audit_service;
 
     /**
-     * @var ITwoFactorGateService
-     */
-    private $mfa_gate_service;
-
-    /**
-     * @var ITwoFactorRateLimitService
+     * @var IRecoveryCodeService
      */
-    private $two_factor_rate_limit_service;
+    private $recovery_code_service;
 
     /**
-     * @var IRecoveryCodeService
+     * @var ITwoFactorChallengeService
      */
-    private $recovery_code_service;
+    private $two_factor_challenge_service;
 
     /**
      * @param IMementoOpenIdSerializerService $openid_memento_service
@@ -205,9 +199,8 @@ public function __construct
         LoginHintProcessStrategy $login_hint_process_strategy,
         IDeviceTrustService $device_trust_service,
         ITwoFactorAuditService $two_factor_audit_service,
-        ITwoFactorGateService $mfa_gate_service,
-        ITwoFactorRateLimitService $two_factor_rate_limit_service,
         IRecoveryCodeService $recovery_code_service,
+        ITwoFactorChallengeService $two_factor_challenge_service,
     )
     {
         $this->openid_memento_service = $openid_memento_service;
@@ -227,9 +220,8 @@ public function __construct
         $this->security_context_service = $security_context_service;
         $this->device_trust_service = $device_trust_service;
         $this->two_factor_audit_service = $two_factor_audit_service;
-        $this->mfa_gate_service = $mfa_gate_service;
-        $this->two_factor_rate_limit_service = $two_factor_rate_limit_service;
         $this->recovery_code_service = $recovery_code_service;
+        $this->two_factor_challenge_service = $two_factor_challenge_service;
 
         $this->middleware(function ($request, $next) use($login_hint_process_strategy){
 
@@ -547,47 +539,8 @@ public function postLogin()
 
                         $cookieToken = $this->getCookieToken();
 
-                        if ($this->mfa_gate_service->requiresChallenge($user, $cookieToken)) {
-                            // Initial issuance shares the resend rate-limit window
-                            // (SDS idp-mfa.md §4.12) - without this, this route
-                            // would be an unthrottled way to mail-bomb the account
-                            // owner with OTP codes.
-                            if ($this->two_factor_rate_limit_service->isRateLimited(
-                                ITwoFactorRateLimitService::ActionResend,
-                                $user->getId()
-                            )) {
-                                throw new AuthenticationException(ITwoFactorRateLimitService::RATE_LIMIT_MESSAGE);
-                            }
-
-                            // Issue a challenge and stop short of session creation.
-                            $client   = $this->resolveClientFromMemento();
-                            $method   = $user->getTwoFactorMethod();
-                            $strategy = MFAChallengeStrategyFactory::create($method);
-                            $payload = $this->auth_service->issueMFAChallenge($user, $strategy, $client, $remember);
-                            $this->two_factor_rate_limit_service->increment(ITwoFactorRateLimitService::ActionResend, $user->getId());
-
-                            // Best-effort: the challenge was already issued and the OTP
-                            // sent, so an audit-logging failure must not 500 the user
-                            // out of the mfa_required response they need to proceed.
-                            try {
-                                $this->two_factor_audit_service->log(
-                                    $user,
-                                    TwoFactorAuditLog::EventChallengeIssued,
-                                    $method,
-                                    IPHelper::getUserIp()
-                                );
-                            } catch (\Throwable $ex) {
-                                Log::warning($ex);
-                            }
-
-                            // Restore-on-refresh: a subsequent GET /login can rehydrate
-                            // the 2FA screen from session instead of dropping back to the
-                            // password form. otp_length/otp_lifetime (part of $payload)
-                            // are flashed by challengeRequired() itself; flow/mfa_method
-                            // aren't part of the challenge payload, so they're set here.
-                            Session::put('flow', IAuthService::AuthenticationFlowMFA);
-                            Session::put('mfa_method', $method);
-
+                        $payload = $this->two_factor_challenge_service->issueChallengeIfRequired($user, $cookieToken, $remember);
+                        if (!is_null($payload)) {
                             // The password step now submits as a native form POST, so this
                             // response is a fresh page load, not a client-side transition -
                             // without these, the React app remounts with no identity state

app/Services/Auth/ITwoFactorChallengeService.php

@@ -0,0 +1,44 @@
+<?php
+
+namespace App\Services\Auth;
+
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use Auth\Exceptions\AuthenticationException;
+use Auth\User;
+
+/**
+ * Interface ITwoFactorChallengeService
+ *
+ * Single source of truth for issuing the local MFA challenge on a primary
+ * authentication that just succeeded (password or social login) - shared
+ * so every primary-auth flow that must honor User::shouldRequire2FA()
+ * applies the exact same challenge (rate limit, OTP issuance, audit log,
+ * session bookkeeping) instead of drifting out of sync.
+ *
+ * @package App\Services\Auth
+ */
+interface ITwoFactorChallengeService
+{
+    /**
+     * @param User $user the user who just completed primary authentication
+     * @param string|null $cookieToken the device-trust cookie value, if any
+     * @param bool $remember
+     * @return array|null null when no challenge is required (the caller should
+     *                     complete the login); otherwise the challenge payload
+     *                     the caller should pass to login_strategy->challengeRequired()
+     * @throws AuthenticationException when the resend rate limit is exceeded
+     */
+    public function issueChallengeIfRequired(User $user, ?string $cookieToken, bool $remember): ?array;
+}

app/Services/Auth/TwoFactorChallengeService.php

@@ -0,0 +1,126 @@
+<?php
+
+namespace App\Services\Auth;
+
+/**
+ * Copyright 2026 OpenStack Foundation
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ **/
+
+use App\libs\Auth\Models\TwoFactorAuditLog;
+use Auth\Exceptions\AuthenticationException;
+use Auth\User;
+use Illuminate\Support\Facades\Log;
+use Illuminate\Support\Facades\Session;
+use models\exceptions\ValidationException;
+use Models\OAuth2\Client;
+use OAuth2\Factories\OAuth2AuthorizationRequestFactory;
+use OAuth2\OAuth2Message;
+use OAuth2\Repositories\IClientRepository;
+use OAuth2\Services\IMementoOAuth2SerializerService;
+use Strategies\MFA\MFAChallengeStrategyFactory;
+use Utils\IPHelper;
+use Utils\Services\IAuthService;
+
+/**
+ * Class TwoFactorChallengeService
+ * @package App\Services\Auth
+ */
+final class TwoFactorChallengeService implements ITwoFactorChallengeService
+{
+    public function __construct(
+        private readonly ITwoFactorGateService $mfa_gate_service,
+        private readonly ITwoFactorRateLimitService $rate_limit_service,
+        private readonly ITwoFactorAuditService $audit_service,
+        private readonly IAuthService $auth_service,
+        private readonly IMementoOAuth2SerializerService $oauth2_memento_service,
+        private readonly IClientRepository $client_repository
+    ) {
+    }
+
+    public function issueChallengeIfRequired(User $user, ?string $cookieToken, bool $remember): ?array
+    {
+        if (!$this->mfa_gate_service->requiresChallenge($user, $cookieToken)) {
+            return null;
+        }
+
+        // Initial issuance shares the resend rate-limit window
+        // (SDS idp-mfa.md §4.12) - without this, this would be an
+        // unthrottled way to mail-bomb the account owner with OTP codes.
+        if ($this->rate_limit_service->isRateLimited(
+            ITwoFactorRateLimitService::ActionResend,
+            $user->getId()
+        )) {
+            throw new AuthenticationException(ITwoFactorRateLimitService::RATE_LIMIT_MESSAGE);
+        }
+
+        // Issue a challenge and stop short of session creation.
+        $client   = $this->resolveClientFromMemento();
+        $method   = $user->getTwoFactorMethod();
+        $strategy = MFAChallengeStrategyFactory::create($method);
+        $payload  = $this->auth_service->issueMFAChallenge($user, $strategy, $client, $remember);
+        $this->rate_limit_service->increment(ITwoFactorRateLimitService::ActionResend, $user->getId());
+
+        // Best-effort: the challenge was already issued and the OTP sent, so
+        // an audit-logging failure must not fail the caller out of the
+        // mfa_required response the user needs to proceed.
+        try {
+            $this->audit_service->log(
+                $user,
+                TwoFactorAuditLog::EventChallengeIssued,
+                $method,
+                IPHelper::getUserIp()
+            );
+        } catch (\Throwable $ex) {
+            Log::warning($ex);
+        }
+
+        // Restore-on-refresh: a subsequent GET /login can rehydrate the 2FA
+        // screen from session instead of dropping back to the primary-auth
+        // screen. otp_length/otp_lifetime (part of $payload) are flashed by
+        // challengeRequired() itself; flow/mfa_method aren't part of the
+        // challenge payload, so they're set here.
+        Session::put('flow', IAuthService::AuthenticationFlowMFA);
+        Session::put('mfa_method', $method);
+
+        return $payload;
+    }
+
+    /**
+     * Own copy of UserController::resolveClientFromMemento() - resolves the
+     * OAuth2 client for a pending authorization request, if any, so the
+     * challenge (and its later verification) can be scoped to that client
+     * the same way the password flow already does.
+     */
+    private function resolveClientFromMemento(): ?Client
+    {
+        if (!$this->oauth2_memento_service->exists()) {
+            return null;
+        }
+
+        $oauth_auth_request = OAuth2AuthorizationRequestFactory::getInstance()->build(
+            OAuth2Message::buildFromMemento($this->oauth2_memento_service->load())
+        );
+
+        if (!$oauth_auth_request->isValid()) {
+            return null;
+        }
+
+        $client = $this->client_repository->getClientById($oauth_auth_request->getClientId());
+        if (is_null($client)) {
+            throw new ValidationException("client does not exists");
+        }
+
+        $this->oauth2_memento_service->serialize($oauth_auth_request->getMessage()->createMemento());
+
+        return $client;
+    }
+}

app/Services/Auth/TwoFactorServiceProvider.php

@@ -43,6 +43,7 @@ public function register(): void
         $this->app->singleton(ITwoFactorGateService::class, MFAGateService::class);
         $this->app->singleton(ITwoFactorRateLimitService::class, TwoFactorRateLimitService::class);
         $this->app->singleton(IRecoveryCodeService::class, RecoveryCodeService::class);
+        $this->app->singleton(ITwoFactorChallengeService::class, TwoFactorChallengeService::class);
     }
 
     /**
@@ -112,6 +113,7 @@ public function provides(): array
             ITwoFactorGateService::class,
             ITwoFactorRateLimitService::class,
             IRecoveryCodeService::class,
+            ITwoFactorChallengeService::class,
         ];
     }
 }