fixup! pam/authentication: Expose used challenge in isAuthenticatedRe…

…sultReceived

pam/internal/adapter/authentication.go

@@ -27,16 +27,11 @@ var (
 // sendIsAuthenticated sends the authentication challenges or wait request to the brokers.
 // The event will contain the returned value from the broker.
 func sendIsAuthenticated(ctx context.Context, client authd.PAMClient, sessionID string,
-	encryptionKey *rsa.PublicKey, authData *isAuthenticatedRequested) tea.Cmd {
+	authData *authd.IARequest_AuthenticationData) tea.Cmd {
 	return func() tea.Msg {
-		challenge, err := authData.encryptChallengeIfPresent(encryptionKey)
-		if err != nil {
-			return sendEvent(pamError{status: pam.ErrSystem, msg: fmt.Sprintf("could not encrypt challenge payload: %v", err)})
-		}
-
 		res, err := client.IsAuthenticated(ctx, &authd.IARequest{
 			SessionId:          sessionID,
-			AuthenticationData: &authd.IARequest_AuthenticationData{Item: authData.item},
+			AuthenticationData: authData,
 		})
 		if err != nil {
 			if st := status.Convert(err); st.Code() == codes.Canceled {
@@ -51,9 +46,8 @@ func sendIsAuthenticated(ctx context.Context, client authd.PAMClient, sessionID
 		}
 
 		return isAuthenticatedResultReceived{
-			access:    res.Access,
-			msg:       res.Msg,
-			challenge: challenge,
+			access: res.Access,
+			msg:    res.Msg,
 		}
 	}
 }
@@ -67,9 +61,8 @@ type isAuthenticatedRequested struct {
 // isAuthenticatedResultReceived is the internal event with the authentication access result
 // and data that was retrieved.
 type isAuthenticatedResultReceived struct {
-	access    string
-	msg       string
-	challenge string
+	access string
+	msg    string
 }
 
 // isAuthenticatedCancelled is the event to cancel the auth request.
@@ -162,7 +155,18 @@ func (m *authenticationModel) Update(msg tea.Msg) (authenticationModel, tea.Cmd)
 		ctx, cancel := context.WithCancel(context.Background())
 		m.cancelIsAuthenticated = cancel
 
-		return *m, sendIsAuthenticated(ctx, m.client, m.currentSessionID, m.encryptionKey, &msg)
+		// Store the current challenge, if present, for password verifications.
+		challenge, ok := msg.item.(*authd.IARequest_AuthenticationData_Challenge)
+		if !ok {
+			challenge = &authd.IARequest_AuthenticationData_Challenge{Challenge: ""}
+		}
+		m.currentChallenge = challenge.Challenge
+
+		// no challenge value, pass it as is
+		if err := msg.encryptChallengeIfPresent(m.encryptionKey); err != nil {
+			return *m, sendEvent(pamError{status: pam.ErrSystem, msg: fmt.Sprintf("could not encrypt challenge payload: %v", err)})
+		}
+		return *m, sendIsAuthenticated(ctx, m.client, m.currentSessionID, &authd.IARequest_AuthenticationData{Item: msg.item})
 
 	case isAuthenticatedCancelled:
 		log.Debugf(context.TODO(), "%#v", msg)
@@ -172,10 +176,12 @@ func (m *authenticationModel) Update(msg tea.Msg) (authenticationModel, tea.Cmd)
 	case isAuthenticatedResultReceived:
 		log.Debugf(context.TODO(), "%#v", msg)
 
-		// Store the current challenge, if present, for password verifications.
-		if msg.access == brokers.AuthGranted || msg.access == brokers.AuthNext {
-			m.currentChallenge = msg.challenge
-		}
+		// Resets challenge if the authentication wasn't successful.
+		defer func() {
+			if msg.access != brokers.AuthGranted && msg.access != brokers.AuthNext {
+				m.currentChallenge = ""
+			}
+		}()
 
 		switch msg.access {
 		case brokers.AuthGranted:
@@ -349,20 +355,20 @@ func dataToMsg(data string) (string, error) {
 	return r, nil
 }
 
-func (authData *isAuthenticatedRequested) encryptChallengeIfPresent(publicKey *rsa.PublicKey) (string, error) {
+func (authData *isAuthenticatedRequested) encryptChallengeIfPresent(publicKey *rsa.PublicKey) error {
 	// no challenge value, pass it as is
 	challenge, ok := authData.item.(*authd.IARequest_AuthenticationData_Challenge)
 	if !ok {
-		return "", nil
+		return nil
 	}
 
 	ciphertext, err := rsa.EncryptOAEP(sha512.New(), rand.Reader, publicKey, []byte(challenge.Challenge), nil)
 	if err != nil {
-		return "", err
+		return err
 	}
 
 	// encrypt it to base64 and replace the challenge with it
 	base64Encoded := base64.StdEncoding.EncodeToString(ciphertext)
 	authData.item = &authd.IARequest_AuthenticationData_Challenge{Challenge: base64Encoded}
-	return challenge.Challenge, nil
+	return nil
 }