Fix registration broken from earlier hardening. Streamline authentication and registration to avoid duplication of this.

paskia/fastapi/ws.py

@@ -22,6 +22,17 @@ from paskia.globals import passkey
 from paskia.util import hostutil, passphrase
 from paskia.util.crypto import hash_secret
 
+
+def create_exchange_code(session_key: str) -> str:
+    """Create an ephemeral exchange code for session authentication."""
+    now = datetime.now(UTC)
+    cookie_code = CookieCode(
+        session_key=session_key,
+        created=now,
+    )
+    return authcode.store_cookie(cookie_code)
+
+
 # Create a FastAPI subapp for WebSocket endpoints
 app = FastAPI(docs_url=None, redoc_url=None, openapi_url=None)
 
@@ -81,14 +92,17 @@ async def websocket_register_add(
         ip=metadata["ip"],
         user_agent=metadata["user_agent"],
     )
-    auth = token
+    session_key = token
 
-    assert isinstance(auth, str) and len(auth) == 16
+    # Create exchange code (ephemeral, 60s TTL)
+    exchange_code = create_exchange_code(session_key)
+
+    assert isinstance(session_key, str) and len(session_key) == 16
     await ws.send_json(
         {
             "user": str(user.uuid),
             "credential": str(credential.uuid),
-            "session_token": auth,
+            "exchange_code": exchange_code,
             "message": "New credential added successfully",
         }
     )
@@ -242,19 +256,14 @@ async def websocket_authenticate(
         await ws.send_json({"redirect_url": redirect_url})
     else:
         # Normal mode: authenticate and create session
-        ctx, secret = await authenticate_and_login(ws, auth)
+        ctx, session_key = await authenticate_and_login(ws, auth)
 
         # If reauth mode, verify the credential belongs to the session's user
         if session_user_uuid and ctx.user.uuid != session_user_uuid:
             raise ValueError("This passkey belongs to a different account")
 
         # Create exchange code (ephemeral, 60s TTL)
-        now = datetime.now(UTC)
+        exchange_code = create_exchange_code(session_key)
-        cookie_code = CookieCode(
-            session_key=secret,
-            created=now,
-        )
-        exchange_code = authcode.store_cookie(cookie_code)
 
         await ws.send_json(
             {