[knittingcode]

Summary

Fixes a bypass of the per-account login limits. Some spellings of an e-mail address load the same account but got login-limiter windows of their own. The limiter key now folds case at least as far as the user lookup: every spelling the lookup folds together gets one key.

Motivation and context (security)

• The mismatch:
  • The user lookup is case-insensitive through PostgreSQL lower(email) = lower(?).
  • The limiter key used PHP's full Unicode mapping, mb_strtolower.
  • For İ (U+0130), PostgreSQL gives i and PHP gives i + U+0307. A final capital sigma also differs.
• Proven end to end against real PHP-FPM and PostgreSQL:
  • casİng-…@example.test with the right password logs into the account casing-…@example.test.
  • From one IP, 5 wrong passwords with the plain address and then 5 more with the İ spelling all answered 401 before 429: 10 failures in 15 minutes instead of 5.
  • Each i can be swapped independently, so an address with k is had 2^k windows. That multiplies both the 5-per-15-minutes and the 100-per-day account limits.
  • The per-IP limit of 50 per 15 minutes was not affected.
• How it was found: a read-only gap analysis of the security tests, followed by an exhaustive comparison of PostgreSQL lower() and PHP's mappings over all 1,112,063 non-surrogate code points.
• Policy: the fix enforces the existing, documented per-account limits. No limit or policy changes.

Changes

• LoginRateLimiter::account():
  • Now uses mb_convert_case(…, MB_CASE_LOWER_SIMPLE, 'UTF-8'). Under the database locale (libc, en_US.utf8), no code point now splits an account across windows.
  • 124 characters that PostgreSQL keeps distinct now share a window, which only makes the limits stricter.
  • The docblock records the locale dependency and, like the guide, says "at least as far as the lookup" rather than "exactly like" it, because of those 124 characters.
• Unit test LoginRateLimiterTest::testSpellingsThatTheLookupFoldsTogetherShareTheAccountWindow: İ and final sigma, in upper and lower case.
• Integration test LoginThrottlingTest::testEveryVariantThatResolvesToTheAccountSharesItsWindow: plain, İ, upper case, I, and İ in an upper-case address. The last spelling previously upper-cased before inserting İ and so repeated the third one; it is now distinct.
• Negative control "login key folds case unlike the user lookup", which reverts to mb_strtolower. It sits in the login throttling section of controls.php.
• docs/architecture/authentication.md: the key's case folding and the locale dependency.
• LoginFailureHandler: the failed-login log pseudonym account_ref now folds case the same way, so every spelling of one account has one pseudonym.

Testing

• Local, disposable Compose project (head c1630e9): LoginThrottlingTest, AuthenticationTest and SecurityLoggingTest OK (28 tests, 601 assertions). The 4 login controls are all detected; the new one fails 5 tests.
• Exhaustive folding check, repeated in a throwaway postgres:18.6-alpine3.24 container (libc, en_US.utf8) against PHP 8.5 in the API image: 1,112,063 code points, 124 differ, all in the stricter direction; no spelling that lower() folds together gets two keys.
• Static checks: unit (116), PHPStan, PHP-CS-Fixer, Deptrac and the architecture tests are clean.
• Without the fix, the integration test fails: the variant answers 200 where 429 is expected.
• CI on the exact head is the reference.

Known limitations

• Locale dependency: the result depends on the database locale, the collation provider, the C library's case tables and PHP's Unicode tables. A change of any of them must repeat the check (documented).
• Control count: the documented number of negative controls (BE-18) is not changed here because fix(logging): remove query strings from logged URLs #16 and test(security): pin tenant route permissions and audit every operator user change #22 also add controls. Update the number when they meet on main.