From 5a52e720ab4584701a93b264898cb5318c111a62 Mon Sep 17 00:00:00 2001
From: Tim Basten <tim.basten@rcswa.edu.au>
Date: Thu, 10 Sep 2026 09:41:48 +0800
Subject: [PATCH] fix(auth): allow zero string credentials

---
 src/Auth/Guard.php            |  4 ++--
 tests/Unit/Auth/GuardTest.php | 28 ++++++++++++++++++++++++++++
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/src/Auth/Guard.php b/src/Auth/Guard.php
index 05898183..1c813af5 100644
--- a/src/Auth/Guard.php
+++ b/src/Auth/Guard.php
@@ -44,9 +44,9 @@ public function __construct(LdapInterface $connection, DomainConfiguration $conf
     public function attempt(string $username, string $password, bool $stayBound = false): bool
     {
         switch (true) {
-            case empty($username):
+            case $username === '':
                 throw new UsernameRequiredException('A username must be specified.');
-            case empty($password):
+            case $password === '':
                 throw new PasswordRequiredException('A password must be specified.');
         }
 
diff --git a/tests/Unit/Auth/GuardTest.php b/tests/Unit/Auth/GuardTest.php
index ab02e75e..61f1f3a8 100644
--- a/tests/Unit/Auth/GuardTest.php
+++ b/tests/Unit/Auth/GuardTest.php
@@ -39,6 +39,34 @@ public function test_attempt_throws_exception_with_an_empty_password()
         $guard->attempt('username', '');
     }
 
+    public function test_attempt_allows_zero_string_password()
+    {
+        $ldap = (new LdapFake)
+            ->expect(LdapFake::operation('bind')->once()->with('user', '0')->andReturnResponse())
+            ->expect(LdapFake::operation('bind')->once()->with('foo', 'bar')->andReturnResponse());
+
+        $guard = new Guard($ldap, new DomainConfiguration([
+            'username' => 'foo',
+            'password' => 'bar',
+        ]));
+
+        $this->assertTrue($guard->attempt('user', '0'));
+    }
+
+    public function test_attempt_allows_zero_string_username()
+    {
+        $ldap = (new LdapFake)
+            ->expect(LdapFake::operation('bind')->once()->with('0', 'password')->andReturnResponse())
+            ->expect(LdapFake::operation('bind')->once()->with('foo', 'bar')->andReturnResponse());
+
+        $guard = new Guard($ldap, new DomainConfiguration([
+            'username' => 'foo',
+            'password' => 'bar',
+        ]));
+
+        $this->assertTrue($guard->attempt('0', 'password'));
+    }
+
     public function test_attempt_binds_the_given_credentials_and_rebinds_with_configured_user()
     {
         $ldap = (new LdapFake)