fix: verify the password once per panel sign-in

[shaheenfawzy]

Description

Login::authenticate() verifies the submitted password twice on every successful sign-in.

The first Timebox retrieves the user and calls validateCredentials(), so by the time it returns the credentials are known to be good and the panel access check has already run:

$user = app(Timebox::class)->call(function (Timebox $timebox) use (...): ?Authenticatable {
    // retrieveByCredentials() + validateCredentials() + isUserAllowedToAccessPanel()
    return $user;
}, $timeboxDuration);

Those same credentials are then handed to the guard:

if (! $authGuard->attemptWhen($credentials, fn (Authenticatable $user): bool => $this->isUserAllowedToAccessPanel($user), $remember)) {

attemptWhen() runs retrieveByCredentials() and validateCredentials() from scratch, so every sign-in pays two bcrypt comparisons and two SELECTs, fires Attempting twice, and runs the panel access check twice. At a production bcrypt cost of 12 the redundant hash alone is around 200ms.

Since nothing is left for the guard to establish, the user is logged in directly with $authGuard->login(). The behaviour the guard would have contributed is kept:

• SessionGuard::hasValidCredentials() dispatches Validated, and is protected, so Validated is now dispatched from authenticate() at the point the guard would have dispatched it.
• SessionGuard::$rehashOnLogin is protected, so the rehash reads config('hashing.rehash_on_login', true) directly, which is the same value AuthManager passes to the guard when it constructs it.

One deliberate difference: SessionGuard::$lastAttempted is protected with no setter, so it is no longer populated by a panel login. Nothing in Filament reads it.

Reproduction: https://github.com/shaheenfawzy/filament-login-double-hash (composer setup && php artisan test --filter=LoginPerformanceTest)

The same method also pads every sign-in with the multi-factor timebox; that is a separate concern and is fixed in #20348.

Visual changes

None.

Functional changes

• Code style has been fixed by running the composer cs command.
• Changes have been tested to not break existing functionality.
• Documentation is up-to-date.

tests/src/Panels/Auth/LoginTest.php gains three tests: Attempting and Validated each fire exactly once on a successful sign-in, a password stored at a lower bcrypt cost is rehashed, and it is left alone when hashing.rehash_on_login is disabled. The first fails on 5.x without this change, seeing Attempting twice. The two rehash tests pass either way and are regression guards, since attemptWhen() rehashed too.