Clear pending two factor tokens also from configuration

[danxuliu]

Clearing pending two factor tokens removed them from the database, but not from the configuration. Due to that, if the password was reset again, the pending tokens were got again from the configuration and tried to be cleared again from the database, which caused an exception to be thrown.

The fix is split in two commits. The first one removes the token from the configuration as well as from the database, and the second commits handles the exception thrown if a token was already removed from the database but not from the configuration, as it could be the case on an existing instance.

Note that invalidateTokenById does not declare any exception to be thrown, and the DoesNotExistException comes from the PublicKeyTokenMapper. Therefore rather than catching the exception in clearTwoFactorPending it might be better to catch it in invalidateTokenById (or to transform it into another exception, as right now a database exception is being exposed to the upper layers). However I am not familiar at all with this code and any possible side effect of doing that, so I just went the safe route (specially given that this should be backported) and caught it in clearTwoFactorPending.

How to test:

• Install and enable twofactor_nextcloud_notification (any two factor authentication app would be probably enough, but this is a convenient one)
• Log errors when reseting the password adding the following to LostController::setException:

$this->logger->error('Password could not be reset', ['app' => 'core', 'exception' => $e]);

• In a private window, log in as a user
• Open the settings
• Set an e-mail address
• Open security section
• Enable two factor authentication with notifications
• Log out
• Log in again
• When the two factor authentication challenge appears, close the private window
• Open a private window again
• Open Nextcloud login page
• Request a lost password
• Open the link sent by e-mail
• Set the new password
• Instead of login, open Nextcloud login page again
• Request a lost password
• Open the link sent by e-mail
• Set the new password

Result with this pull request:

The password is reset and the login page is shown again

Result without this pull request:

token does not exist is shown below the request password form. However, if the login page is open and the new password is used it works. In the logs it can be seen that the exception was thrown by PublicKeyTokenMapper::getTokenById, which was called by TwoFactorAuth\Manager::clearTwoFactorPending, so at that point the password was already changed.

[danxuliu]

/backport to stable30

[danxuliu]

/backport to stable29

[danxuliu]

/backport to stable28

[danxuliu]

Failing CI is unrelated (Imagick and live photos).

[st3iny]

Looks good. I'm not sure about possible side effects.

[nickvergessen]

Rebasing to make CI green