A role with an expiration of "0" requires a password change on every login

If you set a roles expiration time to "0" in the Force Password Change config, you are still required to change your password and you have to do it at every login.

Looks like it's a bug in the ForcePasswordChangeService::checkForForce() method.

When the method is checking if the user's password has expired we're missing parenthesis causing the condition to be parsed as:

if (($expiry && $expiration_condition) || $expiration_condition2)

The second expiration condition is just current request time - $expiry (0) > account creation time. Which is always going to return true (except the immediate login after account creation).

Instead, the condition should be:

if ($expiry && ($expiration_condition || $expiration_condition2)) so roles with a "0" expiration time can never expire.

Patch to follow.