fix: cancel and session-expiry now correctly return to the password screen

Root cause was two-layered:

1. resetToPasswordFlow() reset authFlow to FLOW.PASSWORD but also cleared
   user_name/user_pic/user_fullname/user_verified in the same setState call.
   isPasswordFlow's render condition requires user_verified === true, so
   wiping it forced the render logic to showDefaultFlow (the email screen)
   regardless of authFlow being correct.

2. That alone wasn't sufficient: since the password step now submits as a
   native form POST (see the earlier native-submit fix), the mfa_required
   transition is a full page reload, not a client-side setState - the React
   app remounts from scratch and only recovers state the backend flashed to
   session. issueChallenge() (EmailOTPMFAChallengeStrategy/AbstractMFA
   ChallengeStrategy) only returns otp_length/otp_lifetime, so
   challengeRequired()'s session flash never carried username/user_fullname/
   user_pic/user_verified in the first place - user_verified was already
   false the moment the 2FA screen first rendered, before Cancel was ever
   clicked. Fix #1 alone had nothing to preserve.

Fix: postLogin()'s mfa_required branch now merges the same identity fields
into the challengeRequired() payload that the AuthenticationException
errorLogin() branch already flashes (same fields, same getters: username,
user_fullname, user_pic, user_verified, user_is_active) - restoring the
identity chip on the 2FA screen and giving resetToPasswordFlow() correct
state to preserve. resetToPasswordFlow() no longer clears user_name/user_pic/
user_fullname/user_verified.

Verified live: 2FA screen now shows the identity chip from first render:
Cancel from the 2FA screen now returns directly to the password screen with
the same user still identified, instead of resetting to the email-entry
screen. tests/TwoFactorLoginFlowTest.php passes in full (31 tests, 120
assertions) - unaffected, since no test asserted the previously-missing
identity fields.

Author: smarcet

app/Http/Controllers/UserController.php

@@ -531,6 +531,21 @@ public function postLogin()
                             Session::put('flow', IAuthService::AuthenticationFlowMFA);
                             Session::put('mfa_method', $method);
 
+                            // The password step now submits as a native form POST, so this
+                            // response is a fresh page load, not a client-side transition -
+                            // without these, the React app remounts with no identity state
+                            // at all (no chip, and Cancel/session-expiry can't return to the
+                            // password screen because it looks like the user was never
+                            // verified). Same fields/getters as the AuthenticationException
+                            // errorLogin() branch below.
+                            $payload = array_merge($payload, [
+                                'username'       => $username,
+                                'user_fullname'  => $user->getFullName(),
+                                'user_pic'       => $user->getPic(),
+                                'user_verified'  => true,
+                                'user_is_active' => $user->isActive() ? 1 : 0,
+                            ]);
+
                             return $this->login_strategy->challengeRequired($payload);
                         }
 

resources/js/login/login.js

@@ -295,11 +295,7 @@ class LoginPage extends React.Component {
       authFlow: FLOW.PASSWORD,
       disableInput: false,
       twoFactorCode: "",
-      user_name: "",
       user_password: "",
-      user_pic: "",
-      user_fullname: "",
-      user_verified: false,
       recoveryCode: "",
       trustDevice: false,
       errors: {