@learncard/lca-api-service 1.6.2 → 1.6.3

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@learncard/lca-api-service",
-    "version": "1.6.2",
+    "version": "1.6.3",
     "description": "",
     "engines": {
         "node": ">=24.12 <25"
@@ -66,15 +66,15 @@
         "@fastify/formbody": "^8.0.2",
         "@fastify/rate-limit": "^10.2.0",
         "@fastify/static": "^10.1.1",
-        "@learncard/core": "9.4.42",
-        "@learncard/did-web-plugin": "1.1.42",
-        "@learncard/didkit-plugin": "1.10.8",
-        "@learncard/didkit-plugin-node": "0.3.8",
+        "@learncard/core": "9.4.43",
+        "@learncard/did-web-plugin": "1.1.43",
+        "@learncard/didkit-plugin": "1.10.9",
+        "@learncard/didkit-plugin-node": "0.3.9",
         "@learncard/email-templates": "1.2.2",
-        "@learncard/helpers": "1.7.2",
-        "@learncard/init": "2.5.8",
-        "@learncard/types": "5.24.1",
-        "@learncard/sss-key-manager": "0.2.6",
+        "@learncard/helpers": "1.7.3",
+        "@learncard/init": "2.5.9",
+        "@learncard/types": "5.24.2",
+        "@learncard/sss-key-manager": "0.2.7",
         "@sentry/serverless": "^7.61.0",
         "@trpc/server": "11.8.0",
         "@types/jsonwebtoken": "^9.0.8",

package/src/routes/escrow.ts

@@ -555,6 +555,11 @@ const removeEscrow = async (
  * convert it to the stored counters for the write's compare-and-set. Rejected with
  * CONFLICT when a wrong entry or another reservation has landed since the client's
  * check, so the refresh never wipes a recorded or in-flight guess.
+ *
+ * `wrongAttempts` may be non-zero (own-typos rule, approved 2026-11-03): the client
+ * sends it only when every recorded wrong entry is one it submitted itself in the same
+ * sign-in flow. lca-api cannot tell whose entries they are; it only guarantees that
+ * nothing changed since the client's check, so a foreign entry still blocks the write.
  */
 const resolveExpectedPinCharges = (
     input: {
@@ -574,8 +579,8 @@ const resolveExpectedPinCharges = (
     const pin = userKey.escrowPin;
     const failedAttempts = ESCROW_PIN_MAX_ATTEMPTS - expected.attemptsRemaining;
     if (
-        expected.wrongAttempts !== 0 ||
         failedAttempts < 0 ||
+        expected.wrongAttempts > failedAttempts ||
         !pin ||
         pin.disabledAt ||
         pin.failedAttempts !== failedAttempts ||
@@ -1606,6 +1611,12 @@ export const escrowRouter = t.router({
                     userKey,
                     tenant: ctx.tenant,
                 });
+                // The record changed under this compare (re-enrolled, rotated or disabled
+                // elsewhere), so no wrong entry was recorded for it. Never answer
+                // "Incorrect PIN." here: clients count those as their own recorded entries
+                // (own-typos rule), and an unrecorded one would later excuse a real guess.
+                if (!failed)
+                    throw new TRPCError({ code: 'CONFLICT', message: escrowChangedMessage });
                 if (locked) {
                     await lockPin(hold, userKey, ctx.tenant);
                     throw new TRPCError({

package/test/keys-escrow.spec.ts

@@ -1971,6 +1971,24 @@ describe('escrow PIN release', () => {
         expect((await record())?.escrowPin?.failedAttempts).toBe(2);
     });
 
+    it('never reports "Incorrect PIN." for a mismatch whose wrong entry was not recorded', async () => {
+        // The record changed under the compare (re-enrolled/rotated elsewhere): clients
+        // count every "Incorrect PIN." as their own recorded entry (own-typos rule).
+        await enrollPin();
+        const hold = await startPin();
+        vi.spyOn(console, 'warn').mockImplementation(() => undefined);
+        vi.spyOn(models, 'recordEscrowPinFailure').mockResolvedValueOnce(null);
+        await expect(completePin(hold, wrongProof)).rejects.toMatchObject({
+            code: 'CONFLICT',
+            message: 'Automatic recovery changed; please refresh.',
+        });
+        expect(await findEscrowHoldById(hold.holdId)).toMatchObject({
+            status: 'cancelled',
+            cancelReason: 'pin-mismatch',
+        });
+        expect((await record())?.escrowPin?.verifiedFailedAttempts ?? 0).toBe(0);
+    });
+
     it('locks after ten mismatches and still permits delayed recovery', async () => {
         await enrollPin();
         let lockingHoldId = '';

package/test/keys-pin-sign-in.spec.ts

@@ -724,8 +724,40 @@ describe('same-PIN budget refresh with expected charges', () => {
         await expect(refresh({ attemptsRemaining: 9, wrongAttempts: 0 })).rejects.toMatchObject({
             code: 'CONFLICT',
         });
-        // Even with the current counts, a PIN with a recorded wrong entry is never refreshed.
-        await expect(refresh({ attemptsRemaining: 8, wrongAttempts: 1 })).rejects.toMatchObject({
+
+        expect(securityState(await record())).toEqual(securityState(before));
+    });
+
+    it("refreshes when the expected charges include the owner's own wrong entry (own-typos rule)", async () => {
+        await enrollPin();
+        // The owner mistypes once in this sign-in, then releases with the right PIN.
+        await expect(completePin(await startPin(), wrongProof)).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await completePin(await startPin());
+        expect(await pinStatus()).toMatchObject({ attemptsRemaining: 8, wrongAttempts: 1 });
+
+        await refresh({ attemptsRemaining: 8, wrongAttempts: 1 });
+
+        expect((await record())?.escrowPin).toMatchObject({
+            salt: otherPinSalt,
+            failedAttempts: 0,
+        });
+    });
+
+    it('refuses a refresh whose wrong entries do not match the record, or exceed the charges', async () => {
+        await enrollPin();
+        await expect(completePin(await startPin(), wrongProof)).rejects.toMatchObject({
+            code: 'FORBIDDEN',
+        });
+        await completePin(await startPin());
+        const before = await record();
+
+        // A foreign wrong entry the client did not count.
+        await expect(refresh({ attemptsRemaining: 8, wrongAttempts: 0 })).rejects.toMatchObject({
+            code: 'CONFLICT',
+        });
+        await expect(refresh({ attemptsRemaining: 8, wrongAttempts: 3 })).rejects.toMatchObject({
             code: 'CONFLICT',
         });