From 54ae82aa389f237f60fb5b25fde568a8fd783fa2 Mon Sep 17 00:00:00 2001
From: SepehrYahyaee <7heycallmegray@gmail.com>
Date: Sat, 11 Jul 2026 13:16:14 +0330
Subject: [PATCH] YARA-1056

---
 src/captcha/captcha-challenge.service.ts                | 7 ++++++-
 src/captcha/entities/schema/captcha-challenge.schema.ts | 4 ++--
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/src/captcha/captcha-challenge.service.ts b/src/captcha/captcha-challenge.service.ts
index 7c0574c..e534015 100644
--- a/src/captcha/captcha-challenge.service.ts
+++ b/src/captcha/captcha-challenge.service.ts
@@ -32,12 +32,17 @@ export class CaptchaChallengeService {
       this.captchaService.normalizeAnswer(generated.text),
     );
 
+    // expireAt is the MongoDB TTL sentinel. The TTL reaper fires every ~60 s, so
+    // setting it equal to expiresAt means Mongo can delete the document up to 60 s
+    // BEFORE the application-level expiry check runs — causing the intermittent
+    // "captchaId not found" error under load. Adding a 120 s grace buffer ensures
+    // the document is always present when verify() runs its own expiresAt check.
     await this.captchaChallengeDbService.create({
       captchaId,
       answerHash,
       image: generated.image,
       expiresAt: generated.expiresAt,
-      expireAt: new Date(generated.expiresAt),
+      expireAt: new Date(generated.expiresAt + 120_000),
       usedAt: null,
     });
 
diff --git a/src/captcha/entities/schema/captcha-challenge.schema.ts b/src/captcha/entities/schema/captcha-challenge.schema.ts
index ed413e8..5f35e73 100644
--- a/src/captcha/entities/schema/captcha-challenge.schema.ts
+++ b/src/captcha/entities/schema/captcha-challenge.schema.ts
@@ -10,8 +10,8 @@ export class CaptchaChallenge {
   @Prop({ required: true, unique: true, index: true })
   captchaId: string;
 
-  @Prop()
-  answerHash?: string;
+  @Prop({ required: true })
+  answerHash: string;
 
   @Prop({ required: true })
   image: string;