fix(auth): keep remember-me cookies pointing at a live session token

lib/private/Session/Internal.php

@@ -12,6 +12,7 @@
 
 use OC\Authentication\Token\IProvider;
 use OC\Diagnostics\TLogSlowOperation;
+use OC\User\Session as UserSession;
 use OCP\Authentication\Exceptions\InvalidTokenException;
 use OCP\Server;
 use OCP\Session\Exceptions\SessionNotAvailableException;
@@ -149,6 +150,7 @@ public function regenerateId(bool $deleteOldSession = true, bool $updateToken =
 
 			try {
 				$tokenProvider->renewSessionToken($oldId, $newId);
+				Server::get(UserSession::class)->renewMagicSessionId($oldId);
 			} catch (InvalidTokenException $e) {
 				// Just ignore
 			}

lib/private/User/Session.php

@@ -1073,6 +1073,21 @@ public function setMagicInCookie($username, $token) {
 		}
 	}
 
+	/**
+	 * Point the remember-me cookie at the regenerated session id, so cookie
+	 * login can still find the token that was renewed along with it.
+	 */
+	public function renewMagicSessionId(string $oldSessionId): void {
+		$request = Server::get(IRequest::class);
+		$username = $request->getCookie('nc_username');
+		$token = $request->getCookie('nc_token');
+		$sessionId = $request->getCookie('nc_session_id');
+		if ($username === null || $token === null || $sessionId !== $oldSessionId) {
+			return;
+		}
+		$this->setMagicInCookie($username, $token);
+	}
+
 	/**
 	 * Remove cookie for "remember username"
 	 */

lib/private/legacy/OC_User.php

@@ -165,7 +165,7 @@ public static function loginWithApache(IApacheBackend $backend): bool {
 
 				$dispatcher->dispatchTyped(new BeforeUserLoggedInEvent($uid, $password, $backend));
 
-				$userSession->createSessionToken($request, $uid, $uid, $password);
+				$userSession->createSessionToken($request, $uid, $uid, $password, IToken::REMEMBER);
 				$userSession->completeLogin(
 					$user,
 					['loginName' => $uid, 'password' => $password ?? ''],

tests/lib/User/SessionTest.php

@@ -1214,6 +1214,27 @@ public function testCreateRememberMeToken(): void {
 		$this->userSession->createRememberMeToken($user);
 	}
 
+	public static function renewMagicSessionIdData(): array {
+		return [
+			'cookie holds the old session id' => [['nc_username' => 'u', 'nc_token' => 't', 'nc_session_id' => 'old'], true],
+			'cookie holds another session id' => [['nc_username' => 'u', 'nc_token' => 't', 'nc_session_id' => 'other'], false],
+			'no remember-me cookies' => [[], false],
+		];
+	}
+
+	#[\PHPUnit\Framework\Attributes\DataProvider(methodName: 'renewMagicSessionIdData')]
+	public function testRenewMagicSessionId(array $cookies, bool $expectRenewal): void {
+		$this->userSession->expects($expectRenewal ? $this->once() : $this->never())
+			->method('setMagicInCookie')
+			->with('u', 't');
+
+		$request = $this->createMock(IRequest::class);
+		$request->method('getCookie')->willReturnCallback(fn (string $key) => $cookies[$key] ?? null);
+		$this->overwriteService(IRequest::class, $request);
+
+		$this->userSession->renewMagicSessionId('old');
+	}
+
 	public function testTryBasicAuthLoginValid(): void {
 		$request = $this->createMock(Request::class);
 		$request->method('__get')