fix(otp): don't leak caught error.message; fail-closed on DB retry exhaust

- Chat/form OTP routes: replace `error.message || fallback` with generic
  `Failed to process request` in 500 responses (logger still captures detail).
- otp.ts incrementOTPAttempts DB path: on MAX_RETRIES exhaustion, delete the
  verification row and return `'locked'` instead of trusting a possibly-
  undercounted final read.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/app/api/chat/[identifier]/otp/route.ts

@@ -143,12 +143,9 @@ export const POST = withRouteHandler(
 
       logger.info(`[${requestId}] OTP sent to ${email} for chat ${deployment.id}`)
       return addCorsHeaders(createSuccessResponse({ message: 'Verification code sent' }), request)
-    } catch (error: any) {
+    } catch (error) {
       logger.error(`[${requestId}] Error processing OTP request:`, error)
-      return addCorsHeaders(
-        createErrorResponse(error.message || 'Failed to process request', 500),
-        request
-      )
+      return addCorsHeaders(createErrorResponse('Failed to process request', 500), request)
     }
   }
 )
@@ -239,12 +236,9 @@ export const PUT = withRouteHandler(
       setChatAuthCookie(response, deployment.id, deployment.authType, deployment.password)
 
       return response
-    } catch (error: any) {
+    } catch (error) {
       logger.error(`[${requestId}] Error verifying OTP:`, error)
-      return addCorsHeaders(
-        createErrorResponse(error.message || 'Failed to process request', 500),
-        request
-      )
+      return addCorsHeaders(createErrorResponse('Failed to process request', 500), request)
     }
   }
 )

apps/sim/app/api/form/[identifier]/otp/route.ts

@@ -149,12 +149,9 @@ export const POST = withRouteHandler(
 
       logger.info(`[${requestId}] OTP sent to ${email} for form ${deployment.id}`)
       return addCorsHeaders(createSuccessResponse({ message: 'Verification code sent' }), request)
-    } catch (error: any) {
+    } catch (error) {
       logger.error(`[${requestId}] Error processing OTP request:`, error)
-      return addCorsHeaders(
-        createErrorResponse(error.message || 'Failed to process request', 500),
-        request
-      )
+      return addCorsHeaders(createErrorResponse('Failed to process request', 500), request)
     }
   }
 )
@@ -256,12 +253,9 @@ export const PUT = withRouteHandler(
       setFormAuthCookie(response, deployment.id, deployment.authType, deployment.password)
 
       return response
-    } catch (error: any) {
+    } catch (error) {
       logger.error(`[${requestId}] Error verifying OTP:`, error)
-      return addCorsHeaders(
-        createErrorResponse(error.message || 'Failed to process request', 500),
-        request
-      )
+      return addCorsHeaders(createErrorResponse('Failed to process request', 500), request)
     }
   }
 )

apps/sim/lib/core/security/otp.ts

@@ -220,10 +220,14 @@ export async function incrementOTPAttempts(
     value = fresh
   }
 
-  const final = await getOTP(kind, deploymentId, email)
-  if (!final) return 'locked'
-  const { attempts: finalAttempts } = decodeOTPValue(final)
-  return finalAttempts >= MAX_OTP_ATTEMPTS ? 'locked' : 'incremented'
+  /**
+   * Retry exhaustion under heavy DB-path contention: this request did not
+   * succeed in writing its own +1, so the stored count may not reflect it.
+   * Fail closed — invalidate the OTP rather than return `'incremented'` with
+   * a possibly-undercounted attempt total.
+   */
+  await db.delete(verification).where(eq(verification.identifier, identifier))
+  return 'locked'
 }
 
 export async function deleteOTP(