fix(otp): keep sub-second code lifetimes and drop unused deleteOTP export

TTL rounds a key with under a second left to 0, so the reservation script
rewrote it without an expiry and the code never expired. Read PTTL and
rewrite with PX, deleting a code with no remaining lifetime. deleteOTP is
now only used inside the module.

Author: waleedlatif1

apps/sim/app/api/chat/[identifier]/otp/route.integration.ts

@@ -134,11 +134,11 @@ describe.each(['database', 'redis'] as const)('%s chat OTP verification', (backe
     it('keeps the code expiry when a failed attempt is recorded', async () => {
       if (backend === 'redis') {
         const key = `otp:${email}:${chatId}`
-        await redisClient.current?.expire(key, 60)
+        await redisClient.current?.pexpire(key, 900)
         expect(await verify('999999')).toMatchObject({ status: 400, error: INVALID })
-        const ttl = await redisClient.current?.ttl(key)
-        expect(ttl).toBeGreaterThan(55)
-        expect(ttl).toBeLessThanOrEqual(60)
+        const ttl = await redisClient.current?.pttl(key)
+        expect(ttl).toBeGreaterThan(0)
+        expect(ttl).toBeLessThanOrEqual(900)
         return
       }
       const readExpiry = async () =>

apps/sim/lib/core/security/otp.ts

@@ -118,7 +118,9 @@ export async function storeOTP(
 
 /**
  * Lua script that reserves one verification attempt in Redis. Returns the
- * code with the reserved attempt number, or nil when no code exists.
+ * code with the reserved attempt number, or nil when no code exists. Rewrites
+ * keep the remaining lifetime to the millisecond; a code without one is
+ * treated as expired so it can never become permanent.
  */
 const RESERVE_ATTEMPT_SCRIPT = `
 local val = redis.call('GET', KEYS[1])
@@ -136,14 +138,14 @@ attempts = attempts + 1
 local newVal = otp .. ':' .. attempts
 if attempts >= tonumber(ARGV[1]) then
   redis.call('DEL', KEYS[1])
-else
-  local ttl = redis.call('TTL', KEYS[1])
-  if ttl > 0 then
-    redis.call('SET', KEYS[1], newVal, 'EX', ttl)
-  else
-    redis.call('SET', KEYS[1], newVal)
-  end
+  return newVal
+end
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl <= 0 then
+  redis.call('DEL', KEYS[1])
+  return nil
 end
+redis.call('SET', KEYS[1], newVal, 'PX', ttl)
 return newVal
 `
 
@@ -220,11 +222,7 @@ export async function verifyOTP(
   return reserved.attempts >= MAX_OTP_ATTEMPTS ? 'locked' : 'invalid'
 }
 
-export async function deleteOTP(
-  kind: DeploymentKind,
-  deploymentId: string,
-  email: string
-): Promise<void> {
+async function deleteOTP(kind: DeploymentKind, deploymentId: string, email: string): Promise<void> {
   const keys = OTP_KEYS[kind]
   const storageMethod = getStorageMethod()