Whitelist all two-factor provider apps for guests, not just four of them

[ernolf]

How to use GitHub

• Please use the 👍 reaction to show that you are interested into the same feature.
• Please don't comment if you have no relevant information to add. It's just extra noise for everyone subscribed to this issue.
• Subscribe to receive notifications on status change and new comments.

---

Feature request

Which Nextcloud Version are you currently using: Nextcloud 32.0.12

Is your feature request related to a problem? Please describe.
AppWhitelist::WHITELIST_ALWAYS hardcodes four two-factor apps (twofactor_totp, twofactor_webauthn, twofactor_backupcodes, twofactor_nextcloud_notification):

guests/lib/AppWhitelist.php

Line 31 in a3bfb3b

public const WHITELIST_ALWAYS = ',core,theming,settings,avatar,files,heartbeat,dav,guests,impersonate,accessibility,terms_of_service,dashboard,weather_status,user_status,apporder,twofactor_totp,twofactor_webauthn,twofactor_backupcodes,twofactor_nextcloud_notification';

Other two-factor provider apps are missing: twofactor_gateway, twofactor_email, twofactor_admin and twofactor_oath. For those providers, every request to /apps/<provider>/… from a guest session is blocked by the whitelist (403, "Access to this resource is forbidden for guests"), so a guest cannot complete the provider's setup or challenge flows. The setup fails with a generic error while the same flow works fine for twofactor_totp. With enforced two-factor authentication this locks guests out of the instance until the administrator finds out that the provider app has to be added to the configurable whitelist by hand.

Describe the solution you'd like
The four hardcoded entries show the intent: two-factor authentication must always work for guests. Instead of maintaining an incomplete name list, treat every app that registers a two-factor provider as always allowed, for example by checking the app's two-factor-providers declaration in its info.xml (the same source the server's ProviderLoader uses).

Describe alternatives you've considered

• Minimal fix: add the missing twofactor_* apps to WHITELIST_ALWAYS.
• Current workaround: the administrator adds the provider app to the configurable whitelist under Settings → Guests. This works, but has to be discovered first, and the failure that points there is a generic error in the provider app.

Additional context
Reproduced with a guest account and a provider app that is not in WHITELIST_ALWAYS: the setup at login fails until the app is whitelisted by hand. I am happy to send a PR for either approach.