@@ -3,10 +3,10 @@ import { chat, user, verification, workflow, workspace } from '@sim/db/schema'
 import { readTestRedisUrl } from '@sim/db/testing/test-infrastructure'
 import { deleteWorkspaceFixture, insertWorkspaceFixture } from '@sim/db/testing/workspace-fixtures'
 import { createRouteContext } from '@sim/testing/helpers/http'
+import { createMockRequest } from '@sim/testing/mocks/request.mock'
 import { generateId } from '@sim/utils/id'
 import { eq, like } from 'drizzle-orm'
 import Redis from 'ioredis'
-import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const { storage, redisClient } = vi.hoisted(() => ({
@@ -35,10 +35,10 @@ const INVALID = 'Invalid verification code'
 const LOCKED = 'Too many failed attempts. Please request a new code.'
 
 async function verify(otp: string) {
-  const request = new NextRequest(`http://localhost:3000/api/chat/${identifier}/otp`, {
+  const request = createMockRequest({
     method: 'PUT',
-    headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ email, otp }),
+    url: `/api/chat/${identifier}/otp`,
+    body: { email, otp },
   })
   const response = await PUT(request, createRouteContext({ identifier }))
   const body = (await response.json()) as { error?: string; message?: string }
@@ -99,8 +99,8 @@ afterAll(async () => {
 describe.each(['database', 'redis'] as const)('%s chat OTP verification', (backend) => {
   describe.runIf(backend === 'database' || Boolean(redisUrl))('real storage', () => {
     beforeAll(async () => {
-      if (backend === 'redis' && !redisClient.current) {
-        redisClient.current = new Redis(redisUrl!, { lazyConnect: true, maxRetriesPerRequest: 0 })
+      if (backend === 'redis' && redisUrl && !redisClient.current) {
+        redisClient.current = new Redis(redisUrl, { lazyConnect: true, maxRetriesPerRequest: 0 })
         await redisClient.current.connect()
       }
     })
@@ -132,20 +132,25 @@ describe.each(['database', 'redis'] as const)('%s chat OTP verification', (backe
     })
 
     it('keeps the code expiry when a failed attempt is recorded', async () => {
+      if (backend === 'redis') {
+        const key = `otp:${email}:${chatId}`
+        await redisClient.current?.expire(key, 60)
+        expect(await verify('999999')).toMatchObject({ status: 400, error: INVALID })
+        const ttl = await redisClient.current?.ttl(key)
+        expect(ttl).toBeGreaterThan(55)
+        expect(ttl).toBeLessThanOrEqual(60)
+        return
+      }
       const readExpiry = async () =>
-        backend === 'redis'
-          ? redisClient.current?.ttl(`otp:${email}:${chatId}`)
-          : (
-              await db
-                .select({ expiresAt: verification.expiresAt })
-                .from(verification)
-                .where(eq(verification.identifier, `chat-otp:${chatId}:${email}`))
-            )[0]?.expiresAt.getTime()
+        (
+          await db
+            .select({ expiresAt: verification.expiresAt })
+            .from(verification)
+            .where(eq(verification.identifier, `chat-otp:${chatId}:${email}`))
+        )[0]?.expiresAt.getTime()
       const before = await readExpiry()
       expect(await verify('999999')).toMatchObject({ status: 400, error: INVALID })
-      const after = await readExpiry()
-      if (backend === 'redis') expect(after).toBeGreaterThan(0)
-      else expect(after).toBe(before)
+      expect(await readExpiry()).toBe(before)
     })
 
     it.runIf(backend === 'database')('rejects an expired code', async () => {
 
@@ -24,9 +24,6 @@ import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
   mockRedisSet,
-  mockRedisGet,
-  mockRedisDel,
-  mockRedisTtl,
   mockRedisEval,
   mockRedisClient,
   mockSetChatAuthCookie,
@@ -36,15 +33,9 @@ const {
   mockAfterResponse,
 } = vi.hoisted(() => {
   const mockRedisSet = vi.fn()
-  const mockRedisGet = vi.fn()
-  const mockRedisDel = vi.fn()
-  const mockRedisTtl = vi.fn()
   const mockRedisEval = vi.fn()
   const mockRedisClient = {
     set: mockRedisSet,
-    get: mockRedisGet,
-    del: mockRedisDel,
-    ttl: mockRedisTtl,
     eval: mockRedisEval,
   }
   const mockSetChatAuthCookie = vi.fn()
@@ -59,9 +50,6 @@ const {
 
   return {
     mockRedisSet,
-    mockRedisGet,
-    mockRedisDel,
-    mockRedisTtl,
     mockRedisEval,
     mockRedisClient,
     mockSetChatAuthCookie,
@@ -183,9 +171,6 @@ describe('Chat OTP API Route', () => {
 
     mockGetRedisClient.mockReturnValue(mockRedisClient)
     mockRedisSet.mockResolvedValue('OK')
-    mockRedisGet.mockResolvedValue(null)
-    mockRedisDel.mockResolvedValue(1)
-    mockRedisTtl.mockResolvedValue(600)
 
     mockGetStorageMethod.mockReturnValue('redis')
 
 
@@ -1,7 +1,6 @@
 import { db } from '@sim/db'
 import { chat } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { safeCompare } from '@sim/security/compare'
 import { normalizeEmail } from '@sim/utils/string'
 import { and, eq, isNull } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
@@ -11,14 +10,12 @@ import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { RateLimiter } from '@/lib/core/rate-limiter'
 import { isEmailAllowed } from '@/lib/core/security/deployment'
 import {
-  deleteOTP,
   generateOTP,
-  MAX_OTP_ATTEMPTS,
   OTP_EMAIL_RATE_LIMIT,
   OTP_IP_RATE_LIMIT,
   OTP_RESOURCE_RATE_LIMIT,
-  reserveOTPAttempt,
   storeOTP,
+  verifyOTP,
 } from '@/lib/core/security/otp'
 import { afterResponse } from '@/lib/core/utils/after-response'
 import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
@@ -195,24 +192,18 @@ export const PUT = withRouteHandler(
         return createCodedErrorResponse('Email not authorized', 403)
       }
 
-      const reserved = await reserveOTPAttempt('chat', deployment.id, email)
-      if (!reserved) {
+      const verification = await verifyOTP('chat', deployment.id, email, otp)
+      if (verification === 'missing') {
         return createCodedErrorResponse('No verification code found, request a new one', 400)
       }
-
-      if (!safeCompare(reserved.otp, otp)) {
-        if (reserved.attempts >= MAX_OTP_ATTEMPTS) {
-          logger.warn(`OTP invalidated after max failed attempts for ${email}`)
-          return createCodedErrorResponse(
-            'Too many failed attempts. Please request a new code.',
-            429
-          )
-        }
+      if (verification === 'locked') {
+        logger.warn('OTP invalidated after max failed attempts', { chatId: deployment.id })
+        return createCodedErrorResponse('Too many failed attempts. Please request a new code.', 429)
+      }
+      if (verification === 'invalid') {
         return createCodedErrorResponse('Invalid verification code', 400)
       }
 
-      await deleteOTP('chat', deployment.id, email)
-
       const response = createSuccessResponse({
         id: deployment.id,
         title: deployment.title,
 
@@ -1,6 +1,7 @@
 import { randomInt } from 'crypto'
 import { db } from '@sim/db'
 import { verification } from '@sim/db/schema'
+import { safeCompare } from '@sim/security/compare'
 import { generateId } from '@sim/utils/id'
 import { and, eq, gt, lt, sql } from 'drizzle-orm'
 import { getRedisClient } from '@/lib/core/config/redis'
@@ -70,7 +71,7 @@ function encodeOTPValue(otp: string, attempts: number): string {
   return `${otp}:${attempts}`
 }
 
-export function decodeOTPValue(value: string): { otp: string; attempts: number } {
+function decodeOTPValue(value: string): { otp: string; attempts: number } {
   const lastColon = value.lastIndexOf(':')
   if (lastColon === -1) return { otp: value, attempts: 0 }
   const attempts = Number.parseInt(value.slice(lastColon + 1), 10)
@@ -115,40 +116,9 @@ export async function storeOTP(
   })
 }
 
-export async function getOTP(
-  kind: DeploymentKind,
-  deploymentId: string,
-  email: string
-): Promise<string | null> {
-  const keys = OTP_KEYS[kind]
-  const storageMethod = getStorageMethod()
-
-  if (storageMethod === 'redis') {
-    const redis = getRedisClient()
-    if (!redis) throw new Error('Redis configured but client unavailable')
-    return redis.get(keys.redisKey(email, deploymentId))
-  }
-
-  const now = new Date()
-  const [record] = await db
-    .select({ value: verification.value })
-    .from(verification)
-    .where(
-      and(
-        eq(verification.identifier, keys.dbIdentifier(email, deploymentId)),
-        gt(verification.expiresAt, now)
-      )
-    )
-    .limit(1)
-
-  return record?.value ?? null
-}
-
 /**
  * Lua script that reserves one verification attempt in Redis. Returns the
- * code with the reserved attempt number, or nil when no code exists or every
- * attempt is already spent. The reservation that spends the last attempt
- * deletes the key, so later requests find no code.
+ * code with the reserved attempt number, or nil when no code exists.
  */
 const RESERVE_ATTEMPT_SCRIPT = `
 local val = redis.call('GET', KEYS[1])
@@ -163,13 +133,8 @@ else
   attempts = 0
 end
 attempts = attempts + 1
-local max = tonumber(ARGV[1])
-if attempts > max then
-  redis.call('DEL', KEYS[1])
-  return nil
-end
 local newVal = otp .. ':' .. attempts
-if attempts == max then
+if attempts >= tonumber(ARGV[1]) then
   redis.call('DEL', KEYS[1])
 else
   local ttl = redis.call('TTL', KEYS[1])
@@ -184,12 +149,11 @@ return newVal
 
 /**
  * Atomically spends one of the code's {@link MAX_OTP_ATTEMPTS} attempts and
- * returns the stored code for the caller to compare, or `null` when no live
- * code is left. Reserving before comparing bounds the guesses checked against
- * one code to the attempt limit however many requests run concurrently. The
- * reservation that spends the last attempt also deletes the code.
+ * returns the stored code with its reserved attempt count, or `null` when no
+ * live code is left. The reservation that spends the last attempt also
+ * deletes the code.
  */
-export async function reserveOTPAttempt(
+async function reserveOTPAttempt(
   kind: DeploymentKind,
   deploymentId: string,
   email: string
@@ -233,6 +197,29 @@ export async function reserveOTPAttempt(
   return decoded
 }
 
+export type OTPVerification = 'valid' | 'invalid' | 'locked' | 'missing'
+
+/**
+ * Checks a submitted code and consumes it on a match. An attempt is reserved
+ * before the comparison, so at most {@link MAX_OTP_ATTEMPTS} guesses are ever
+ * compared against one code however many requests run concurrently.
+ * `'locked'` means this guess spent the last attempt and the code is gone.
+ */
+export async function verifyOTP(
+  kind: DeploymentKind,
+  deploymentId: string,
+  email: string,
+  code: string
+): Promise<OTPVerification> {
+  const reserved = await reserveOTPAttempt(kind, deploymentId, email)
+  if (!reserved) return 'missing'
+  if (safeCompare(reserved.otp, code)) {
+    await deleteOTP(kind, deploymentId, email)
+    return 'valid'
+  }
+  return reserved.attempts >= MAX_OTP_ATTEMPTS ? 'locked' : 'invalid'
+}
+
 export async function deleteOTP(
   kind: DeploymentKind,
   deploymentId: string,
 
@@ -16,6 +16,7 @@ import {
   publicShare,
   subscription,
   user,
+  verification,
   workspace,
   workspaceFileSecretProvenance,
   workspaceFiles,
@@ -574,7 +575,14 @@ describe('Public file shares against PostgreSQL and private storage', () => {
       await (
         await requestPublicFileShareOtp({ token: share.token, email: 'outsider@shared.invalid' })
       ).deliver()
-      expect(await otpStore.getOTP('file', share.id, 'outsider@shared.invalid')).toBeNull()
+      const storedCode = async (address: string) => {
+        const [row] = await db
+          .select({ value: verification.value })
+          .from(verification)
+          .where(eq(verification.identifier, `file-otp:${share.id}:${address}`))
+        return row?.value.split(':')[0]
+      }
+      expect(await storedCode('outsider@shared.invalid')).toBeUndefined()
       const failure = { authorized: false, status: 400, error: 'Invalid verification code' }
       expect(
         await verifyPublicFileShareOtp({
@@ -587,9 +595,8 @@ describe('Public file shares against PostgreSQL and private storage', () => {
         failure
       )
       await (await requestPublicFileShareOtp({ token: share.token, email })).deliver()
-      const stored = await otpStore.getOTP('file', share.id, email)
-      if (!stored) throw new Error('Allowed email received no code')
-      const { otp } = otpStore.decodeOTPValue(stored)
+      const otp = await storedCode(email)
+      if (!otp) throw new Error('Allowed email received no code')
       expect(
         await verifyPublicFileShareOtp({ token: share.token, email, otp: '000000' })
       ).toMatchObject({ authorized: false, status: 400 })
@@ -606,9 +613,9 @@ describe('Public file shares against PostgreSQL and private storage', () => {
         status: 400,
       })
       await otpStore.storeOTP('file', share.id, email, '123456')
-      const reserve = otpStore.reserveOTPAttempt
-      const spy = vi.spyOn(otpStore, 'reserveOTPAttempt').mockImplementation(async (...args) => {
-        const result = await reserve(...args)
+      const verifyCode = otpStore.verifyOTP
+      const spy = vi.spyOn(otpStore, 'verifyOTP').mockImplementation(async (...args) => {
+        const result = await verifyCode(...args)
         await db
           .update(publicShare)
           .set({ allowedEmails: ['replacement@shared.invalid'] })
@@ -619,7 +626,7 @@ describe('Public file shares against PostgreSQL and private storage', () => {
         verifyPublicFileShareOtp({ token: share.token, email, otp: '123456' })
       ).rejects.toMatchObject({ code: 'not_found' })
       spy.mockRestore()
-      await otpStore.deleteOTP('file', share.id, email)
+      expect(await storedCode(email)).toBeUndefined()
     }
   )
 
 
@@ -1,16 +1,14 @@
 import { createLogger } from '@sim/logger'
-import { safeCompare } from '@sim/security/compare'
 import { normalizeEmail } from '@sim/utils/string'
 import { getOtpSubject, renderOTPEmail } from '@/components/emails'
 import { RateLimiter, type TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { createDeploymentAuthCookie, isEmailAllowed } from '@/lib/core/security/deployment'
 import {
-  deleteOTP,
   generateOTP,
   OTP_EMAIL_RATE_LIMIT,
   OTP_RESOURCE_RATE_LIMIT,
-  reserveOTPAttempt,
   storeOTP,
+  verifyOTP,
 } from '@/lib/core/security/otp'
 import { sendEmail } from '@/lib/messaging/email/mailer'
 import {
@@ -111,10 +109,9 @@ export async function verifyPublicFileShareOtp({
     isEmailAllowed(normalizedEmail, share.allowedEmails)
   )
   if (!allowed) return OTP_FAILURE
-  const reserved = await reserveOTPAttempt('file', challenge.shareId, normalizedEmail)
+  const verification = await verifyOTP('file', challenge.shareId, normalizedEmail, otp)
   await challenge.withCurrentPolicy(() => undefined)
-  if (!reserved || !safeCompare(reserved.otp, otp)) return OTP_FAILURE
-  await deleteOTP('file', challenge.shareId, normalizedEmail)
+  if (verification !== 'valid') return OTP_FAILURE
   const resource = await challenge.withCurrentPolicy(({ share }) => share)
   const cookie = await createDeploymentAuthCookie({
     cookiePrefix: 'file',