fix: Handle 2fa enforcement earlier

Signed-off-by: Joas Schilling <coding@schilljs.com>

Author: nickvergessen

lib/private/User/Session.php

@@ -403,10 +403,8 @@ public function logClientIn($user,
 			return false;
 		}
 
-		if (!$isTokenPassword && $this->isTokenAuthEnforced()) {
-			throw new PasswordLoginForbiddenException();
-		}
-		if (!$isTokenPassword && $this->isTwoFactorEnforced($user)) {
+		if (!$isTokenPassword && ($this->isTokenAuthEnforced() || $this->isTwoFactorEnforced($user))) {
+			$this->handleLoginFailed($throttler, $currentDelay, $remoteAddress, $user, $password);
 			throw new PasswordLoginForbiddenException();
 		}
 
@@ -587,7 +585,8 @@ public function tryBasicAuthLogin(IRequest $request,
 				// If credentials were provided, they need to be valid, otherwise we do boom
 				throw new LoginException();
 			} catch (PasswordLoginForbiddenException $ex) {
-				// Nothing to do
+				// If credentials were provided, they need to be valid, otherwise we do boom
+				throw new LoginException(previous: $ex);
 			}
 		}
 		return false;