fix: persist identity chip fallback for new passwordless-OTP users

Root cause: UserController.php:410-414 (emitOTP()) gated
Session::put('user_fullname', ...) behind an existing-user check, so a
not-yet-registered email never got a persisted display name - but
login.js:165-167 (emitOtpAction()) already falls back to the submitted
email as the chip's display name in live client state. This asymmetry
made the identity chip visible right after opting into OTP, then vanish
entirely on a page refresh.

Moves the user_fullname Session::put() outside the existing-user
conditional, using the same email fallback the client already applies.
user_pic/user_is_active remain conditional - confirmed login.js has no
equivalent avatar fallback, so no client/server asymmetry existed there.

Inverts the existing (bug-encoding) assertion in
testEmitOtpForNewUserStillPersistsRefreshState rather than adding a new
test - it covers the exact same code path.

Author: smarcet

app/Http/Controllers/UserController.php

@@ -404,11 +404,16 @@ public function emitOTP()
             Session::put('flow', IAuthService::AuthenticationFlowPasswordless);
             Session::put('username', $username);
             Session::put('user_verified', true);
+            // Mirrors login.js's emitOtpAction(), which falls back to the
+            // submitted email as the chip's display name when there's no real
+            // full name yet - persisting the same fallback here keeps the
+            // identity chip (visible right after opting into OTP) from
+            // vanishing on a refresh for a not-yet-registered email.
+            Session::put('user_fullname', !is_null($existing_user) ? $existing_user->getFullName() : $username);
             Session::put('otp_length', $otp->getLength());
             Session::put('otp_lifetime', $otp->getLifetime());
             Session::put('otp_issued_at', $otp->getCreatedAt()?->getTimestamp() ?? time());
             if (!is_null($existing_user)) {
-                Session::put('user_fullname', $existing_user->getFullName());
                 Session::put('user_pic', $existing_user->getPic());
                 Session::put('user_is_active', $existing_user->isActive() ? 1 : 0);
             }

tests/TwoFactorLoginFlowTest.php

@@ -271,9 +271,14 @@ public function testEmitOtpForNewUserStillPersistsRefreshState(): void
         $this->assertNotNull(Session::get('otp_issued_at'));
         $this->assertSame($email, Session::get('username'));
 
-        $this->assertNull(Session::get('user_fullname'), 'no identity to persist for a not-yet-registered user');
-        $this->assertNull(Session::get('user_pic'));
-        $this->assertNull(Session::get('user_is_active'));
+        // login.js's emitOtpAction() falls back to the submitted email as the
+        // chip's display name when there's no real full name yet (login.js:165-167) -
+        // the persisted session state must match that same fallback, or the
+        // identity chip (visible right after opting into OTP) vanishes on refresh
+        // instead of being restored identically.
+        $this->assertSame($email, Session::get('user_fullname'), 'must fall back to the submitted email, matching emitOtpAction()\'s client-side fallback');
+        $this->assertNull(Session::get('user_pic'), 'no picture to persist for a not-yet-registered user');
+        $this->assertNull(Session::get('user_is_active'), 'no active-status to persist for a not-yet-registered user');
     }
 
     public function testSuccessfulPasswordlessLoginClearsOtpSessionState(): void