fix: Login view for challenge with missing user

Author: distantnative

src/Panel/Controller/View/LoginViewController.php

@@ -7,6 +7,7 @@
 use Kirby\Auth\Pending;
 use Kirby\Auth\State;
 use Kirby\Auth\Status;
+use Kirby\Cms\User;
 use Kirby\Exception\LogicException;
 use Kirby\Panel\Controller\ViewController;
 use Kirby\Panel\Panel;
@@ -62,9 +63,8 @@ private function challenge(string|null $name): Challenge
 		}
 
 		$challenges = $this->kirby->auth()->challenges();
-		$email      = $this->status->email();
-		$user       = $this->kirby->user($email);
 		$mode       = $this->status->mode();
+		$user       = $this->user();
 
 		return $challenges->get($type, $user, $mode);
 	}
@@ -75,9 +75,8 @@ private function challenges(): array
 			return [];
 		}
 
-		$email       = $this->status->email();
-		$user        = $this->kirby->user($email);
 		$mode        = $this->status->mode();
+		$user        = $this->user();
 		$challenges  = $this->kirby->auth()->challenges();
 		$available   = $challenges->available($user, $mode);
 		$currentType = $this->status->challenge();
@@ -172,4 +171,22 @@ protected function value(): array
 	{
 		return [];
 	}
+
+	/**
+	 * Returns the user the pending challenge belongs to.
+	 *
+	 * The challenge email may not belong to an existing user:
+	 * the account could have been deleted after the challenge
+	 * was created, or it never existed and the pending state
+	 * was only created to avoid leaking whether
+	 * the user exists (see `Auth::createChallenge()`).
+	 *
+	 * A virtual user lets the view render the form and
+	 * resolve challenge availability identically in that case.
+	 */
+	protected function user(): User
+	{
+		$email = $this->status->email();
+		return $this->kirby->user($email) ?? new User(['email' => $email]);
+	}
 }

tests/Panel/Controller/View/LoginViewControllerTest.php

@@ -89,6 +89,34 @@ public function render(): array|null
 	}
 }
 
+class TestSecretChallenge extends Challenge
+{
+	// mirrors TotpChallenge: only available once the user has set it up
+	public static function isAvailable(User $user, string $mode): bool
+	{
+		return $user->secret('totp') !== null;
+	}
+
+	public function create(): Pending|null
+	{
+		return null;
+	}
+
+	public function form(Pending $pending): Component
+	{
+		return new Component(
+			component: 'k-login-test-secret-challenge-form',
+			submit:    $this->submit(),
+			user:      $this->user->email(),
+		);
+	}
+
+	public function verify(mixed $input, Pending $data): bool
+	{
+		return true;
+	}
+}
+
 #[CoversClass(LoginViewController::class)]
 class LoginViewControllerTest extends TestCase
 {
@@ -100,6 +128,7 @@ public function setUp(): void
 		Challenges::$challenges['test']           = TestChallenge::class;
 		Challenges::$challenges['test2']          = TestChallenge2::class;
 		Challenges::$challenges['test-null-form'] = TestNullFormChallenge::class;
+		Challenges::$challenges['test-secret']    = TestSecretChallenge::class;
 	}
 
 	public function tearDown(): void
@@ -109,7 +138,8 @@ public function tearDown(): void
 		unset(
 			Challenges::$challenges['test'],
 			Challenges::$challenges['test2'],
-			Challenges::$challenges['test-null-form']
+			Challenges::$challenges['test-null-form'],
+			Challenges::$challenges['test-secret']
 		);
 	}
 
@@ -329,6 +359,74 @@ public function testLoadWithChallenge(): void
 		$this->assertFalse($props['challenges'][1]['active']);
 	}
 
+	public function testLoadWithChallengeForNonExistentUser(): void
+	{
+		// A pending challenge whose email belongs to no user: either the
+		// account was deleted after the challenge was created, or it never
+		// existed and the pending state is only shown to avoid leaking
+		// whether the user exists (see Auth::createChallenge()). The view
+		// must still render (no TypeError) and, because both challenges are
+		// available to any user, the list must look exactly like it does
+		// for a real account (cf. testChallenges) so existence cannot leak.
+		$this->app = $this->app->clone([
+			'options' => [
+				'auth' => [
+					'challenges' => ['test', 'test2']
+				]
+			],
+			'users' => [] // no users at all
+		]);
+
+		$this->app->session()->set('kirby.challenge.email', 'ghost@example.com');
+		$this->app->session()->set('kirby.challenge.type', 'test');
+		$this->app->session()->set('kirby.challenge.mode', 'login');
+
+		$props = (new LoginViewController('challenge', 'test'))->load()->props();
+
+		$this->assertSame('pending', $props['state']);
+
+		// the form renders from a virtual user carrying the submitted email
+		$this->assertSame('k-login-test-challenge-form', $props['form']['component']);
+		$this->assertSame('ghost@example.com', $props['form']['props']['user']);
+
+		$this->assertCount(2, $props['challenges']);
+		$this->assertSame('test', $props['challenges'][0]['type']);
+		$this->assertTrue($props['challenges'][0]['active']);
+		$this->assertSame('test2', $props['challenges'][1]['type']);
+		$this->assertFalse($props['challenges'][1]['active']);
+	}
+
+	public function testLoadExcludesUserSpecificChallengeForNonExistentUser(): void
+	{
+		// 'test-secret' is only available once the user set it up (like TOTP),
+		// 'test2' is always available. For a non-existent user the virtual
+		// user has no secret, so 'test-secret' is excluded just as it would
+		// be for an existing account that never enabled it - leaving the
+		// fallback challenge ('test2', the last enabled) as the only entry.
+		$this->app = $this->app->clone([
+			'options' => [
+				'auth' => [
+					'challenges' => ['test-secret', 'test2']
+				]
+			],
+			'users' => []
+		]);
+
+		$session = $this->app->session();
+		$session->set('kirby.challenge.email', 'ghost@example.com');
+		$session->set('kirby.challenge.mode', 'login');
+		// note: no kirby.challenge.type, fallback to last enabled ('test2')
+
+		$props = (new LoginViewController('challenge', 'test2'))->load()->props();
+
+		$this->assertSame('k-login-test-challenge2-form', $props['form']['component']);
+		$this->assertSame('ghost@example.com', $props['form']['props']['user']);
+
+		$types = array_column($props['challenges'], 'type');
+		$this->assertSame(['test2'], $types);
+		$this->assertNotContains('test-secret', $types);
+	}
+
 	public function testLoadAppliesValueToForm(): void
 	{
 		// subclass that returns a value() so form props get prefilled