@@ -720,29 +720,29 @@ handleChallenge : PubkeyHex -> Text -> IO {rw *authGlobalRateCount, rw *authGlob
720720handleChallenge = \pubkey clientIp -> do
721721 t <- now
722722 preErr <- authPreCheck clientIp t
723− if preErr != ""
724− then yield (Err {error: {status: 429, message: preErr}})
725− else do
723+ if preErr == ""
724+ then do
726725 challenge <- genToken
727726 result <- atomic (do
728727 ch <- *challenges
729728 let cappedActive = capPerKey (filter (\c -> c.expiresAt > t) ch) pubkey maxChallengesPerKey
730− if count cappedActive >= maxChallenges
731− then yield "capacity"
732− else do
729+ if not (count cappedActive >= maxChallenges)
730+ then do
733731 chRates <- *challengeRates
734732 let chR = checkRate chRates pubkey maxChallengeRatePerKey challengeRateWindowMs t
735733 *challengeRates = chR.entries
736− if chR.limited
737− then yield "rate_limited"
738− else do
734+ if not chR.limited
735+ then do
739736 *challenges = union cappedActive [
740737 {pubkey, challenge, expiresAt: t + challengeExpiry, ip: clientIp}
741738 ]
742− yield "")
739+ yield ""
740+ else yield "rate_limited"
741+ else yield "capacity")
743742 if result == ""
744743 then yield (Ok {value: {challenge, expiresAt: t + challengeExpiry}})
745744 else yield (Err {error: {status: if result == "capacity" then 503 else 429, message: result}})
745+ else yield (Err {error: {status: 429, message: preErr}})
746746
747747-- POST /auth/verify: validate `signature` over `challenge` for `pubkey`.
748748-- On success, mints a session token, records local presence (`pubkey` is now