Function incrementOTPAttempts

apps/sim/lib/core/security/otp.ts:177–230

(
  kind: DeploymentKind,
  deploymentId: string,
  email: string,
  currentValue: string
)

 * `'incremented'` otherwise. The DB path uses optimistic locking with retry.
 */
export async function incrementOTPAttempts(
  kind: DeploymentKind,
  deploymentId: string,
  email: string,
  currentValue: string
): Promise<'locked' | 'incremented'> {
  const keys = OTP_KEYS[kind]
  const storageMethod = getStorageMethod()

  if (storageMethod === 'redis') {
    const redis = getRedisClient()
    if (!redis) throw new Error('Redis configured but client unavailable')
    const key = keys.redisKey(email, deploymentId)
    const result = await redis.eval(ATOMIC_INCREMENT_SCRIPT, 1, key, MAX_OTP_ATTEMPTS)
    if (result === null || result === 'LOCKED') return 'locked'
    return 'incremented'
  }

  const identifier = keys.dbIdentifier(email, deploymentId)
  const MAX_RETRIES = 3
  let value = currentValue

  for (let attempt = 0; attempt < MAX_RETRIES; attempt++) {
    const { otp, attempts } = decodeOTPValue(value)
    const newAttempts = attempts + 1

    if (newAttempts >= MAX_OTP_ATTEMPTS) {
      await db.delete(verification).where(eq(verification.identifier, identifier))
      return 'locked'
    }

    const newValue = encodeOTPValue(otp, newAttempts)
    const updated = await db
      .update(verification)
      .set({ value: newValue, updatedAt: new Date() })
      .where(and(eq(verification.identifier, identifier), eq(verification.value, value)))
      .returning({ id: verification.id })

    if (updated.length > 0) return 'incremented'

    const fresh = await getOTP(kind, deploymentId, email)
    if (!fresh) return 'locked'
    value = fresh
  }

  /**
   * Retry exhaustion under heavy DB-path contention: this request did not
   * succeed in writing its own +1, so the stored count may not reflect it.
   * Fail closed — invalidate the OTP rather than return `'incremented'` with
   * a possibly-undercounted attempt total.
   */
  await db.delete(verification).where(eq(verification.identifier, identifier))
  return 'locked'
}

export async function deleteOTP(
  kind: DeploymentKind,