Do you mean an email field? Unless something went horribly wrong, password should be in PasswordAuthenticationRequest and nowhere else.

Hmm. It looks like you don't have 'realname' in $wgHiddenPrefs on translatewiki, so you'll need to add a value for 'realname' to your $data array for UserDataAuthenticationRequest to properly load. It can be the empty string if you don't have any other value for it.

Maybe that should be fixed in AuthManager? Omitting optional fields from the array seems convenient when programmatically creating requests. Or maybe we could log something to make it less surprising - the current code treats missing array fields as an error condition but doesn't behave the way you would except from error-handling code.

UserDataAuthenticationRequest as a whole is optional, so there's no error if it fails to load. But the default loading for AuthenticationRequests insists on all (non-checkbox) fields being present in the submission even if optional, because otherwise there's no way to differentiate "Request wasn't submitted" and "Request was submitted but all fields were empty/default" if something needs to do that.

Corrected password -> email in description.

It's not all fields in this case though. But I guess with potential overlaps between different requests, the sanest way the case when some fields are missing but others are not is to assume that the present ones are for some other request.

Change 306660 had a related patch set uploaded (by Nikerabbit):
Sandbox: Quick workaround for emails not being saved

https://gerrit.wikimedia.org/r/306660

I made a quick patch to make this work again. Are you planning further fixes on core?

Change 306660 merged by jenkins-bot:
Sandbox: Quick workaround for emails not being saved

https://gerrit.wikimedia.org/r/306660

In T143551#2573021, @Tgr wrote:

But I guess with potential overlaps between different requests, the sanest way the case when some fields are missing but others are not is to assume that the present ones are for some other request.

Exactly. For example, PasswordDomainAuthenticationRequest has 'username', 'password', 'retype', and 'domain' fields (depending on the action), but if 'domain' is missing it's still a valid PasswordAuthenticationRequest and if all except 'username' are missing it could still be a UsernameAuthenticationRequest.

In T143551#2582269, @Nikerabbit wrote:

Are you planning further fixes on core?

I'm not planning on any. I don't know if @Tgr is thinking of trying anything.

Okay, I propose @Tgr to file a new task(s) if he thinks it is worth it. We can then close this in our sprint.

In T143551#2582721, @Nikerabbit wrote:

Okay, I propose @Tgr to file a new task(s) if he thinks it is worth it.

I don't think anything else could be done about this.