fix: prevent replay of consumed verification values

.github/workflows/ci.yaml

@@ -25,9 +25,26 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-24.04]
-        node: [20.x, 22.x, 24.x, 25.x]
+        node: [22.x, 24.x, 25.x]
     runs-on: ${{matrix.os}}
 
+    services:
+      postgres:
+        image: postgres:16-alpine
+        env:
+          POSTGRES_PASSWORD: adapter-test-only
+          POSTGRES_DB: adapter_consume_regression
+        ports:
+          - 5432:5432
+        options: >-
+          --health-cmd "pg_isready -U postgres"
+          --health-interval 5s
+          --health-timeout 5s
+          --health-retries 10
+
+    env:
+      ADAPTER_TEST_POSTGRES_URL: postgresql://postgres:adapter-test-only@127.0.0.1:5432/adapter_consume_regression
+
     steps:
       - uses: actions/checkout@v6
 

CHANGELOG.md

@@ -1,5 +1,11 @@
 # better-auth-mikro-orm
 
+## 0.5.12
+
+### Patch Changes
+
+- [#10](https://github.com/forklaunch/better-auth-mikro-orm/pull/10) [`abde984`](https://github.com/forklaunch/better-auth-mikro-orm/commit/abde98426542e87e583f5fd7fc0d0c56965acbcc) Thanks [@RohinBhargava](https://github.com/RohinBhargava)! - Prevent consumed verification values from being reinserted by a later EntityManager flush. Read the consumption snapshot without registering it in the identity map, and preserve the guarded delete so concurrent consumers still have exactly one winner.
+
 ## 0.5.11
 
 ### Patch Changes

package.json

@@ -2,7 +2,7 @@
   "private": false,
   "type": "module",
   "name": "@forklaunch/better-auth-mikro-orm-fork",
-  "version": "0.5.11",
+  "version": "0.5.12",
   "description": "Mikro ORM Adapter for Better Auth",
   "keywords": [
     "auth",
@@ -55,6 +55,7 @@
     "@faker-js/faker": "10.4.0",
     "@mikro-orm/core": "7.1.8",
     "@mikro-orm/decorators": "7.1.8",
+    "@mikro-orm/postgresql": "7.1.8",
     "@mikro-orm/sqlite": "7.1.8",
     "@types/node": "25.6.0",
     "@vitest/coverage-v8": "4.1.5",

src/adapter.ts

@@ -227,7 +227,12 @@ const adapter =
         const metadata = getEntityMetadata(model)
         const filter = normalizeWhereClauses(metadata, where)
 
-        const entity = await orm.em.findOne(metadata.class, filter)
+        // This is a snapshot, not an entity to persist. In particular,
+        // unsetting the identity of a transaction's managed entity can make
+        // a parent context reinsert the consumed credential on a later flush.
+        const entity = await orm.em.findOne(metadata.class, filter, {
+          disableIdentityMap: true
+        })
 
         if (!entity) {
           return null
@@ -247,11 +252,6 @@ const adapter =
           return null
         }
 
-        // nativeDelete bypasses the identity map, so the deleted row would
-        // otherwise linger there and be handed back by a later findOne on the
-        // same EntityManager.
-        orm.em.getUnitOfWork().unsetIdentity(entity)
-
         return snapshot
       },