Merge pull request #485 from lenneTech/develop

kaihaase · web-flow · commit 51fdd6d54623 · 2026-01-26T23:29:08.000+01:00
Release 11.11.1
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.11.0",
+  "version": "11.11.1",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
diff --git a/spectaql.yml b/spectaql.yml
@@ -11,7 +11,7 @@ servers:
 info:
   title: lT Nest Server
   description: Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).
-  version: 11.11.0
+  version: 11.11.1
   contact:
     name: lenne.Tech GmbH
     url: https://lenne.tech
diff --git a/src/core/modules/better-auth/core-better-auth-api.middleware.ts b/src/core/modules/better-auth/core-better-auth-api.middleware.ts
@@ -244,9 +244,12 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {
         }
       }
 
-      // Clean up the used challenge mapping after verification (success or failure)
-      if (challengeIdToDelete && this.challengeService) {
+      // Clean up the used challenge mapping only after SUCCESSFUL verification
+      // On failure, keep the challenge so the user can retry with a different passkey
+      if (challengeIdToDelete && this.challengeService && response.ok) {
         await this.challengeService.deleteChallengeMapping(challengeIdToDelete);
+      } else if (challengeIdToDelete && !response.ok) {
+        this.logger.debug(`Keeping challenge mapping after failed verification (status=${response.status}) for retry`);
       }
 
       // Convert Web Standard Response to Express response using shared helper

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "@lenne.tech/nest-server",`
`3`		`- "version": "11.11.0",`
	`3`	`+ "version": "11.11.1",`
`4`	`4`	`"description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",`
`5`	`5`	`"keywords": [`
`6`	`6`	`"node",`
Original file line number	Diff line number	Diff line change
`@@ -244,9 +244,12 @@ export class CoreBetterAuthApiMiddleware implements NestMiddleware {`
`244`	`244`	`}`
`245`	`245`	`}`
`246`	`246`
`247`		`- // Clean up the used challenge mapping after verification (success or failure)`
`248`		`- if (challengeIdToDelete && this.challengeService) {`
	`247`	`+ // Clean up the used challenge mapping only after SUCCESSFUL verification`
	`248`	`+ // On failure, keep the challenge so the user can retry with a different passkey`
	`249`	`+ if (challengeIdToDelete && this.challengeService && response.ok) {`
`249`	`250`	`await this.challengeService.deleteChallengeMapping(challengeIdToDelete);`
	`251`	`+ } else if (challengeIdToDelete && !response.ok) {`
	`252`	+ this.logger.debug(`Keeping challenge mapping after failed verification (status=${response.status}) for retry`);
`250`	`253`	`}`
`251`	`254`
`252`	`255`	`// Convert Web Standard Response to Express response using shared helper`