fix(auth): check reset link expiry against interactive login timestamp

lib/composer/composer/autoload_classmap.php

@@ -2428,6 +2428,7 @@
     'OC\\User\\Database' => $baseDir . '/lib/private/User/Database.php',
     'OC\\User\\DisabledUserException' => $baseDir . '/lib/private/User/DisabledUserException.php',
     'OC\\User\\DisplayNameCache' => $baseDir . '/lib/private/User/DisplayNameCache.php',
+    'OC\\User\\LastInteractiveLogin' => $baseDir . '/lib/private/User/LastInteractiveLogin.php',
     'OC\\User\\LazyUser' => $baseDir . '/lib/private/User/LazyUser.php',
     'OC\\User\\Listeners\\BeforeUserDeletedListener' => $baseDir . '/lib/private/User/Listeners/BeforeUserDeletedListener.php',
     'OC\\User\\Listeners\\UserChangedListener' => $baseDir . '/lib/private/User/Listeners/UserChangedListener.php',

lib/composer/composer/autoload_static.php

@@ -2469,6 +2469,7 @@ class ComposerStaticInit749170dad3f5e7f9ca158f5a9f04f6a2
         'OC\\User\\Database' => __DIR__ . '/../../..' . '/lib/private/User/Database.php',
         'OC\\User\\DisabledUserException' => __DIR__ . '/../../..' . '/lib/private/User/DisabledUserException.php',
         'OC\\User\\DisplayNameCache' => __DIR__ . '/../../..' . '/lib/private/User/DisplayNameCache.php',
+        'OC\\User\\LastInteractiveLogin' => __DIR__ . '/../../..' . '/lib/private/User/LastInteractiveLogin.php',
         'OC\\User\\LazyUser' => __DIR__ . '/../../..' . '/lib/private/User/LazyUser.php',
         'OC\\User\\Listeners\\BeforeUserDeletedListener' => __DIR__ . '/../../..' . '/lib/private/User/Listeners/BeforeUserDeletedListener.php',
         'OC\\User\\Listeners\\UserChangedListener' => __DIR__ . '/../../..' . '/lib/private/User/Listeners/UserChangedListener.php',

lib/private/Security/VerificationToken/VerificationToken.php

@@ -8,6 +8,7 @@
 
 namespace OC\Security\VerificationToken;
 
+use OC\User\LastInteractiveLogin;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\BackgroundJob\IJobList;
 use OCP\IConfig;
@@ -27,6 +28,7 @@ public function __construct(
 		private ITimeFactory $timeFactory,
 		private ISecureRandom $secureRandom,
 		private IJobList $jobList,
+		private LastInteractiveLogin $lastInteractiveLogin,
 	) {
 	}
 
@@ -71,7 +73,7 @@ public function check(
 		}
 
 		if ($splitToken[0] < ($this->timeFactory->getTime() - self::TOKEN_LIFETIME)
-			|| ($expiresWithLogin && $user->getLastLogin() > $splitToken[0])) {
+			|| ($expiresWithLogin && $this->lastInteractiveLogin->get($user) > $splitToken[0])) {
 			$this->throwInvalidTokenException(InvalidTokenException::TOKEN_EXPIRED);
 		}
 

lib/private/Server.php

@@ -152,6 +152,7 @@
 use OC\Translation\TranslationManager;
 use OC\User\AvailabilityCoordinator;
 use OC\User\DisplayNameCache;
+use OC\User\LastInteractiveLogin;
 use OC\User\Listeners\BeforeUserDeletedListener;
 use OC\User\Listeners\UserChangedListener;
 use OC\User\Session;
@@ -454,6 +455,7 @@ public function __construct(
 				$c->get(ILockdownManager::class),
 				$c->get(LoggerInterface::class),
 				$c->get(IEventDispatcher::class),
+				$c->get(LastInteractiveLogin::class),
 			);
 			/** @deprecated 21.0.0 use BeforeUserCreatedEvent event with the IEventDispatcher instead */
 			$userSession->listen('\OC\User', 'preCreateUser', function ($uid, $password): void {

lib/private/User/LastInteractiveLogin.php

@@ -0,0 +1,50 @@
+<?php
+
+declare(strict_types=1);
+
+/**
+ * SPDX-FileCopyrightText: 2026 Nextcloud GmbH and Nextcloud contributors
+ * SPDX-License-Identifier: AGPL-3.0-or-later
+ */
+
+namespace OC\User;
+
+use OCP\AppFramework\Utility\ITimeFactory;
+use OCP\Config\IUserConfig;
+use OCP\IUser;
+
+/**
+ * Timestamp of the last time an account actually authenticated.
+ *
+ * Distinct from {@see IUser::getLastLogin()}, which is also refreshed while
+ * revalidating an already authenticated session and therefore keeps moving for
+ * any account that merely has a session open somewhere. Verification tokens
+ * expire on login, so they must be compared against this value instead.
+ */
+class LastInteractiveLogin {
+	private const string CONFIG_APP = 'login';
+	private const string CONFIG_KEY = 'lastInteractiveLogin';
+
+	public function __construct(
+		private IUserConfig $userConfig,
+		private ITimeFactory $timeFactory,
+	) {
+	}
+
+	public function record(IUser $user): void {
+		$this->userConfig->setValueInt(
+			$user->getUID(),
+			self::CONFIG_APP,
+			self::CONFIG_KEY,
+			$this->timeFactory->getTime(),
+		);
+	}
+
+	public function get(IUser $user): int {
+		return $this->userConfig->getValueInt(
+			$user->getUID(),
+			self::CONFIG_APP,
+			self::CONFIG_KEY,
+		);
+	}
+}

lib/private/User/Session.php

@@ -82,6 +82,7 @@ public function __construct(
 		private ILockdownManager $lockdownManager,
 		private LoggerInterface $logger,
 		private IEventDispatcher $dispatcher,
+		private LastInteractiveLogin $lastInteractiveLogin,
 	) {
 	}
 
@@ -371,6 +372,9 @@ public function completeLogin(IUser $user, array $loginDetails, $regenerateSessi
 			$isToken,
 		]);
 		if ($this->isLoggedIn()) {
+			if (!$isToken) {
+				$this->lastInteractiveLogin->record($user);
+			}
 			$this->prepareUserLogin($firstTimeLogin, $regenerateSessionId);
 			return true;
 		}
@@ -963,6 +967,7 @@ public function loginWithCookie($uid, $currentToken, $oldSessionId) {
 		$this->setToken($token->getId());
 		$this->lockdownManager->setToken($token);
 		$user->updateLastLoginTimestamp();
+		$this->lastInteractiveLogin->record($user);
 		$password = null;
 		try {
 			$password = $this->tokenProvider->getPassword($token, $sessionId);

tests/lib/Security/VerificationToken/VerificationTokenTest.php

@@ -10,6 +10,7 @@
 namespace Test\Security\VerificationToken;
 
 use OC\Security\VerificationToken\VerificationToken;
+use OC\User\LastInteractiveLogin;
 use OCP\AppFramework\Utility\ITimeFactory;
 use OCP\BackgroundJob\IJobList;
 use OCP\IConfig;
@@ -33,6 +34,8 @@ class VerificationTokenTest extends TestCase {
 	protected $timeFactory;
 	/** @var IJobList|MockObject */
 	protected $jobList;
+	/** @var LastInteractiveLogin|MockObject */
+	protected $lastInteractiveLogin;
 
 	#[\Override]
 	protected function setUp(): void {
@@ -43,16 +46,24 @@ protected function setUp(): void {
 		$this->timeFactory = $this->createMock(ITimeFactory::class);
 		$this->secureRandom = $this->createMock(ISecureRandom::class);
 		$this->jobList = $this->createMock(IJobList::class);
+		$this->lastInteractiveLogin = $this->createMock(LastInteractiveLogin::class);
 
 		$this->token = new VerificationToken(
 			$this->config,
 			$this->crypto,
 			$this->timeFactory,
 			$this->secureRandom,
-			$this->jobList
+			$this->jobList,
+			$this->lastInteractiveLogin
 		);
 	}
 
+	protected function mockLastInteractiveLogin(int $timestamp): void {
+		$this->lastInteractiveLogin->expects($this->atLeastOnce())
+			->method('get')
+			->willReturn($timestamp);
+	}
+
 	public function testTokenUserUnknown(): void {
 		$this->expectException(InvalidTokenException::class);
 		$this->expectExceptionCode(InvalidTokenException::USER_UNKNOWN);
@@ -148,9 +159,6 @@ public function testTokenExpired(): void {
 		$user->expects($this->atLeastOnce())
 			->method('getUID')
 			->willReturn('alice');
-		$user->expects($this->any())
-			->method('getLastLogin')
-			->willReturn(604803);
 
 		$this->config->expects($this->atLeastOnce())
 			->method('getUserValue')
@@ -182,9 +190,7 @@ public function testTokenExpiredByLogin(): void {
 		$user->expects($this->atLeastOnce())
 			->method('getUID')
 			->willReturn('alice');
-		$user->expects($this->any())
-			->method('getLastLogin')
-			->willReturn(604803);
+		$this->mockLastInteractiveLogin(604803);
 
 		$this->config->expects($this->atLeastOnce())
 			->method('getUserValue')
@@ -208,6 +214,39 @@ public function testTokenExpiredByLogin(): void {
 		$this->token->check('encryptedToken', $user, 'fingerprintToken', 'foobar', true);
 	}
 
+	public function testTokenNotExpiredBySessionRevalidation(): void {
+		$user = $this->createMock(IUser::class);
+		$user->expects($this->atLeastOnce())
+			->method('isEnabled')
+			->willReturn(true);
+		$user->expects($this->atLeastOnce())
+			->method('getUID')
+			->willReturn('alice');
+		$user->expects($this->never())
+			->method('getLastLogin');
+		// last actual authentication predates the token
+		$this->mockLastInteractiveLogin(604700);
+
+		$this->config->expects($this->atLeastOnce())
+			->method('getUserValue')
+			->with('alice', 'core', 'fingerprintToken', null)
+			->willReturn('encryptedToken');
+		$this->config->expects($this->any())
+			->method('getSystemValueString')
+			->with('secret')
+			->willReturn('357111317');
+
+		$this->crypto->method('decrypt')
+			->with('encryptedToken', 'foobar' . '357111317')
+			->willReturn('604800:barfoo');
+
+		$this->timeFactory->expects($this->any())
+			->method('getTime')
+			->willReturn(604801);
+
+		$this->token->check('barfoo', $user, 'fingerprintToken', 'foobar', true);
+	}
+
 	public function testTokenMismatch(): void {
 		$user = $this->createMock(IUser::class);
 		$user->expects($this->atLeastOnce())
@@ -216,9 +255,6 @@ public function testTokenMismatch(): void {
 		$user->expects($this->atLeastOnce())
 			->method('getUID')
 			->willReturn('alice');
-		$user->expects($this->any())
-			->method('getLastLogin')
-			->willReturn(604703);
 
 		$this->config->expects($this->atLeastOnce())
 			->method('getUserValue')
@@ -250,9 +286,6 @@ public function testTokenSuccess(): void {
 		$user->expects($this->atLeastOnce())
 			->method('getUID')
 			->willReturn('alice');
-		$user->expects($this->any())
-			->method('getLastLogin')
-			->willReturn(604703);
 
 		$this->config->expects($this->atLeastOnce())
 			->method('getUserValue')