FIWARE / VCVerifier / 40342561543

74%

main: 74%

Build Type

Pull #134

github

Committed by Mortega5

Commit Message

fix(openapi): reject a reconnect to a redeemed session in warn mode

Since the pending login is kept until its code is used, it also outlives
a write to a dead socket in warn mode, where no page is handed a pending
login. A page reconnecting then got the session message and showed a QR
code that only yields no_such_session. In warn mode the WebSocket checks
for an open session again, so the page is told that its session is gone.

Delivering the pending login in warn mode instead would race the release
of its code: the page could redirect with a code that was discarded.

The log of an unexchanged pending login now names both causes - the page
did not collect it, or the client did not redeem the code - and the docs
say that it comes up on the cache's cleanup interval.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Pull Request Pull Request #134: feat: hand a completed login to a login page that reconnects

Coverage Stats

111 of 118 new or added lines in 3 files covered. (94.07%)

2 existing lines in 1 file now uncovered.

9462 of 12767 relevant lines covered (74.11%)

0.85 hits per line