fix(auth): allow zero string credentials

src/Auth/Guard.php

@@ -44,9 +44,9 @@ public function __construct(LdapInterface $connection, DomainConfiguration $conf
     public function attempt(string $username, string $password, bool $stayBound = false): bool
     {
         switch (true) {
-            case empty($username):
+            case $username === '':
                 throw new UsernameRequiredException('A username must be specified.');
-            case empty($password):
+            case $password === '':
                 throw new PasswordRequiredException('A password must be specified.');
         }
 

tests/Unit/Auth/GuardTest.php

@@ -39,6 +39,34 @@ public function test_attempt_throws_exception_with_an_empty_password()
         $guard->attempt('username', '');
     }
 
+    public function test_attempt_allows_zero_string_password()
+    {
+        $ldap = (new LdapFake)
+            ->expect(LdapFake::operation('bind')->once()->with('user', '0')->andReturnResponse())
+            ->expect(LdapFake::operation('bind')->once()->with('foo', 'bar')->andReturnResponse());
+
+        $guard = new Guard($ldap, new DomainConfiguration([
+            'username' => 'foo',
+            'password' => 'bar',
+        ]));
+
+        $this->assertTrue($guard->attempt('user', '0'));
+    }
+
+    public function test_attempt_allows_zero_string_username()
+    {
+        $ldap = (new LdapFake)
+            ->expect(LdapFake::operation('bind')->once()->with('0', 'password')->andReturnResponse())
+            ->expect(LdapFake::operation('bind')->once()->with('foo', 'bar')->andReturnResponse());
+
+        $guard = new Guard($ldap, new DomainConfiguration([
+            'username' => 'foo',
+            'password' => 'bar',
+        ]));
+
+        $this->assertTrue($guard->attempt('0', 'password'));
+    }
+
     public function test_attempt_binds_the_given_credentials_and_rebinds_with_configured_user()
     {
         $ldap = (new LdapFake)