From bcecb390e1bdf82fbadc92d4cb49a97a28fc5411 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Mon, 16 Feb 2026 21:26:24 +0000
Subject: [PATCH] Fix registration broken from earlier hardening. Streamline
 authentication and registration to avoid duplication of this.

---
 paskia/fastapi/ws.py | 29 +++++++++++++++++++----------
 1 file changed, 19 insertions(+), 10 deletions(-)

diff --git a/paskia/fastapi/ws.py b/paskia/fastapi/ws.py
index 4a9770a..87d82e3 100644
--- a/paskia/fastapi/ws.py
+++ b/paskia/fastapi/ws.py
@@ -22,6 +22,17 @@ from paskia.globals import passkey
 from paskia.util import hostutil, passphrase
 from paskia.util.crypto import hash_secret
 
+
+def create_exchange_code(session_key: str) -> str:
+    """Create an ephemeral exchange code for session authentication."""
+    now = datetime.now(UTC)
+    cookie_code = CookieCode(
+        session_key=session_key,
+        created=now,
+    )
+    return authcode.store_cookie(cookie_code)
+
+
 # Create a FastAPI subapp for WebSocket endpoints
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
 
@@ -81,14 +92,17 @@ async def websocket_register_add(
         ip=metadata["ip"],
         user_agent=metadata["user_agent"],
     )
-    auth = token
+    session_key = token
 
-    assert isinstance(auth, str) and len(auth) == 16
+    # Create exchange code (ephemeral, 60s TTL)
+    exchange_code = create_exchange_code(session_key)
+
+    assert isinstance(session_key, str) and len(session_key) == 16
     await ws.send_json(
         {
             "user": str(user.uuid),
             "credential": str(credential.uuid),
-            "session_token": auth,
+            "exchange_code": exchange_code,
             "message": "New credential added successfully",
         }
     )
@@ -242,19 +256,14 @@ async def websocket_authenticate(
         await ws.send_json({"redirect_url": redirect_url})
     else:
         # Normal mode: authenticate and create session
-        ctx, secret = await authenticate_and_login(ws, auth)
+        ctx, session_key = await authenticate_and_login(ws, auth)
 
         # If reauth mode, verify the credential belongs to the session's user
         if session_user_uuid and ctx.user.uuid != session_user_uuid:
             raise ValueError("This passkey belongs to a different account")
 
         # Create exchange code (ephemeral, 60s TTL)
-        now = datetime.now(UTC)
-        cookie_code = CookieCode(
-            session_key=secret,
-            created=now,
-        )
-        exchange_code = authcode.store_cookie(cookie_code)
+        exchange_code = create_exchange_code(session_key)
 
         await ws.send_json(
             {