fix: print out reauth plugin error and raise if challenge output is N…

…one (#1265)

* fix: print out reauth plugin error and raise if challenge output is None

* chore: add test

* chore: update sys test cred

google/oauth2/challenges.py

@@ -169,7 +169,8 @@ def obtain_challenge_input(self, metadata):
                     )
                 else:
                     raise e
-            except pyu2f.errors.PluginError:
+            except pyu2f.errors.PluginError as e:
+                sys.stderr.write("Plugin error: {}.\n".format(e))
                 continue
             except pyu2f.errors.NoDeviceFoundError:
                 sys.stderr.write("No security key found.\n")

google/oauth2/reauth.py

@@ -225,6 +225,8 @@ def _obtain_rapt(request, access_token, requested_scopes):
 
         msg = _run_next_challenge(msg, request, access_token)
 
+        if not msg:
+            raise exceptions.ReauthFailError("Failed to obtain rapt token.")
         if msg["status"] == _AUTHENTICATED:
             return msg["encodedProofOfReauthToken"]
 

tests/oauth2/test_reauth.py

@@ -204,6 +204,20 @@ def test__obtain_rapt_unsupported_status():
         assert excinfo.match(r"API error: STATUS_UNSPECIFIED")
 
 
+def test__obtain_rapt_no_challenge_output():
+    challenges_response = copy.deepcopy(CHALLENGES_RESPONSE_TEMPLATE)
+    with mock.patch(
+        "google.oauth2.reauth._get_challenges", return_value=challenges_response
+    ):
+        with mock.patch("google.oauth2.reauth.is_interactive", return_value=True):
+            with mock.patch(
+                "google.oauth2.reauth._run_next_challenge", return_value=None
+            ):
+                with pytest.raises(exceptions.ReauthFailError) as excinfo:
+                    reauth._obtain_rapt(MOCK_REQUEST, "token", None)
+        assert excinfo.match(r"Failed to obtain rapt token")
+
+
 def test__obtain_rapt_not_interactive():
     with mock.patch(
         "google.oauth2.reauth._get_challenges",