Fix: Execute auth backends sequentially to prevent spurious push notifications

[Copilot]

Auth backends were executing in parallel via Promise.all(), causing all providers to fire regardless of earlier failures. With AUTH_BACKENDS=sql,notification, incorrect passwords triggered push notifications because the notification provider ran before the password check completed.

Changes

LdapEngine.js - Sequential execution with early termination

// Before: All providers execute in parallel
return Promise.all(
  this.authProviders.map(provider => provider.authenticate(username, password, req))
).then(authResults => {
  const isAuthenticated = authResults.every(result => result === true);
  // ...
});

// After: Sequential execution, stop on first failure
const authenticateSequentially = async () => {
  for (const provider of this.authProviders) {
    const result = await provider.authenticate(username, password, req);
    if (result !== true) {
      return false;
    }
  }
  return true;
};

Test coverage

• Verifies sequential execution timing (50ms delay between providers)
• Confirms early termination (notification provider never called on password failure)
• Validates complete execution when all providers succeed

MockAuthProvider

• Fixed return type from object to boolean (matches production providers)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Incorrect passwords still trigger Push notification</issue_title>
<issue_description>All attempts at authenticating to the LDAP server with a valid username trigger a notification, even those that don't succeed password verification. This makes it look like the password has succeeded but then authentication fails when the Notification is approved. AUTH_BACKENDS should be checked in sequence, not parellel so that any failing backend prevents the next one from firing.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Incorrect passwords still trigger Push notification #136

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[runleveldev]

LGTM