From d2bd01e633c5f7204bd6fa2510d9b3fc9f517475 Mon Sep 17 00:00:00 2001 From: vedant7007 Date: Wed, 5 Aug 2026 10:56:28 +0530 Subject: [PATCH] fix: bind verified Codeforces handle from the pending profile MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit verifyConnection loaded the pending profile by userId but then used the handle from req.body for the CF re-fetch, setUserCodeforcesHandle and the background sync. The duplicate-handle uniqueness guard only runs in initiateConnection against the initiate handle, so the verify path could bind a different handle than the one that passed the uniqueness check — inconsistent state / uniqueness bypass. Rebind handle to profile.handle right after loading the profile so the whole verify flow uses the vetted handle. Closes #304 --- server/modules/codeforces/service.js | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/server/modules/codeforces/service.js b/server/modules/codeforces/service.js index ccded31..855fd2d 100644 --- a/server/modules/codeforces/service.js +++ b/server/modules/codeforces/service.js @@ -205,6 +205,12 @@ class CodeforcesService { throw new ApiError(400, "No pending verification. Please re-initiate connection."); } + // Bind to the handle vetted during initiateConnection (the one the + // duplicate-handle uniqueness guard ran against), not whatever the client + // re-sends now. Otherwise the finally-bound handle can diverge from the one + // that passed the uniqueness check, producing inconsistent state. + handle = profile.handle; + if (new Date() > profile.verificationExpiry) { throw new ApiError(400, "Verification code expired. Please re-initiate connection."); }