From a705f3015ffbb62e45abb45899da51bf1079f8ce Mon Sep 17 00:00:00 2001
From: Gene Gleyzer <gene@xqiz.it>
Date: Thu, 21 Nov 2024 14:58:42 -0500
Subject: [PATCH] Fix ChainBundle (temporary)

---
 lib_xenia/src/main/x/xenia/ChainBundle.x | 30 +++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/lib_xenia/src/main/x/xenia/ChainBundle.x b/lib_xenia/src/main/x/xenia/ChainBundle.x
index 4be3684a2..9ee766fe7 100644
--- a/lib_xenia/src/main/x/xenia/ChainBundle.x
+++ b/lib_xenia/src/main/x/xenia/ChainBundle.x
@@ -17,6 +17,7 @@ import web.AcceptList;
 import web.Body;
 import web.BodyParam;
 import web.ErrorHandler;
+import web.Header;
 import web.HttpMethod;
 import web.HttpStatus;
 import web.MediaType;
@@ -300,6 +301,7 @@ service ChainBundle {
             }
 
             import Authenticator.Attempt;
+            import Authenticator.AuthResponse;
             import Authenticator.Status as AuthStatus;
 
             Attempt[] attempts = authenticator.authenticate(request);
@@ -331,9 +333,31 @@ service ChainBundle {
 //                        return True, new SimpleResponse(Forbidden);
 //                    }
             } else {
-                  // "authResult" is actually an HTTP response to send back to the client to
-                  // take the next step in the authentication process
-                  return True, attempts[0].response.as(ResponseOut);
+                // REVIEW CP merge
+                MergeAttempts:
+                for (Attempt attempt : attempts) {
+                    AuthResponse? authResponse = attempt.response;
+                    switch (authResponse.is(_)) {
+                    case Nullable:
+                        continue MergeAttempts;
+
+                    case String:
+                        SimpleResponse response = new SimpleResponse(Unauthorized);
+                        response.add(Header.WWWAuthenticate, authResponse);
+                        return True, response;
+
+                    case Array<String>:
+                        SimpleResponse response = new SimpleResponse(Unauthorized);
+                        authResponse.forEach(r -> response.add(Header.WWWAuthenticate, r));
+                        return True, response;
+
+                    case HttpStatus:
+                        return True, new SimpleResponse(authResponse);
+
+                    case ResponseOut:
+                        return True, authResponse;
+                    }
+                }
             }
 
             if (resolvePermission != Null) {