fix(auth): reject invalid challenge signatures instead of transitioning to AuthOk

server/crates/arbiter-server/src/actors/user_agent/auth/state.rs

@@ -210,13 +210,16 @@ where
             }
         };
 
-        if valid {
-            self.transport
-                .send(Ok(Outbound::AuthSuccess))
-                .await
-                .map_err(|_| Error::Transport)?;
+        if !valid {
+            error!("Invalid challenge solution signature");
+            return Err(Error::InvalidChallengeSolution);
         }
 
+        self.transport
+            .send(Ok(Outbound::AuthSuccess))
+            .await
+            .map_err(|_| Error::Transport)?;
+
         Ok(key.clone())
     }
 }