From f59451d3b4d9c42455e2c42bff3b1cfeeb6c1713 Mon Sep 17 00:00:00 2001
From: Leo Vasanko <leo@git>
Date: Wed, 28 Jan 2026 02:27:26 +0000
Subject: [PATCH] Debug DB problem

---
 paskia/fastapi/remote.py |  6 +++---
 paskia/fastapi/ws.py     |  4 ++--
 paskia/fastapi/wschat.py | 12 ++++++++----
 paskia/sansio.py         | 10 ++++------
 4 files changed, 17 insertions(+), 15 deletions(-)

diff --git a/paskia/fastapi/remote.py b/paskia/fastapi/remote.py
index baa2d63..fd5a8ab 100644
--- a/paskia/fastapi/remote.py
+++ b/paskia/fastapi/remote.py
@@ -310,7 +310,7 @@ async def websocket_remote_auth_permit(ws: WebSocket):
 
             # Handle authenticate request (no PoW needed - already validated during lookup)
             if msg.get("authenticate") and request is not None:
-                cred = await authenticate_chat(ws, origin)
+                cred, new_sign_count = await authenticate_chat(ws, origin)
 
                 # Create a session for the REQUESTING device
                 assert cred.uuid is not None
@@ -335,7 +335,7 @@ async def websocket_remote_auth_permit(ws: WebSocket):
                     session_token = db.login(
                         user_uuid=cred.user,
                         credential_uuid=cred.uuid,
-                        sign_count=cred.sign_count,
+                        sign_count=new_sign_count,
                         host=normalized_host,
                         ip=request.ip,
                         user_agent=request.user_agent,
@@ -348,7 +348,7 @@ async def websocket_remote_auth_permit(ws: WebSocket):
                     session_token = db.login(
                         user_uuid=cred.user,
                         credential_uuid=cred.uuid,
-                        sign_count=cred.sign_count,
+                        sign_count=new_sign_count,
                         host=normalized_host,
                         ip=request.ip,
                         user_agent=request.user_agent,
diff --git a/paskia/fastapi/ws.py b/paskia/fastapi/ws.py
index 2f01b8b..f1b3de4 100644
--- a/paskia/fastapi/ws.py
+++ b/paskia/fastapi/ws.py
@@ -96,7 +96,7 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
             session_user_uuid = ctx.user.uuid
             credential_ids = db.get_user_credential_ids(session_user_uuid) or None
 
-    cred = await authenticate_chat(ws, origin, credential_ids)
+    cred, new_sign_count = await authenticate_chat(ws, origin, credential_ids)
 
     # If reauth mode, verify the credential belongs to the session's user
     if session_user_uuid and cred.user != session_user_uuid:
@@ -116,7 +116,7 @@ async def websocket_authenticate(ws: WebSocket, auth=AUTH_COOKIE):
     token = db.login(
         user_uuid=cred.user,
         credential_uuid=cred.uuid,
-        sign_count=cred.sign_count,
+        sign_count=new_sign_count,
         host=normalized_host,
         ip=metadata["ip"],
         user_agent=metadata["user_agent"],
diff --git a/paskia/fastapi/wschat.py b/paskia/fastapi/wschat.py
index 5443264..b2e4fff 100644
--- a/paskia/fastapi/wschat.py
+++ b/paskia/fastapi/wschat.py
@@ -33,8 +33,12 @@ async def authenticate_chat(
     ws: WebSocket,
     origin: str,
     credential_ids: list[bytes] | None = None,
-) -> Credential:
-    """Run WebAuthn authentication flow and return the verified credential."""
+) -> tuple[Credential, int]:
+    """Run WebAuthn authentication flow and return the credential and new sign count.
+    
+    Returns:
+        tuple of (credential, new_sign_count) where new_sign_count comes from WebAuthn verification
+    """
     options, challenge = passkey.instance.auth_generate_options(
         credential_ids=credential_ids
     )
@@ -54,5 +58,5 @@ async def authenticate_chat(
             f"This passkey is no longer registered with {passkey.instance.rp_name}"
         )
 
-    passkey.instance.auth_verify(authcred, challenge, cred, origin)
-    return cred
+    verification = passkey.instance.auth_verify(authcred, challenge, cred, origin)
+    return cred, verification.new_sign_count
diff --git a/paskia/sansio.py b/paskia/sansio.py
index f2ac7c8..2308dcd 100644
--- a/paskia/sansio.py
+++ b/paskia/sansio.py
@@ -231,8 +231,11 @@ class Passkey:
         Args:
             credential: The authentication credential response from the client
             expected_challenge: The earlier generated challenge bytes
-            stored_cred: The server stored credential record (modified by this function)
+            stored_cred: The server stored credential record (NOT modified)
             origin: The origin URL (required, must be pre-validated)
+            
+        Returns:
+            VerifiedAuthentication with new_sign_count and user_verified status
         """
         # Verify the authentication response
         verification = verify_authentication_response(
@@ -243,11 +246,6 @@ class Passkey:
             credential_public_key=stored_cred.public_key,
             credential_current_sign_count=stored_cred.sign_count,
         )
-        stored_cred.sign_count = verification.new_sign_count
-        now = datetime.now(timezone.utc)
-        stored_cred.last_used = now
-        if verification.user_verified:
-            stored_cred.last_verified = now
         return verification