From 63782e673a6732d7e7aabc8e47eaf5a616dc2927 Mon Sep 17 00:00:00 2001
From: despiegk <kristof@incubaid.com>
Date: Wed, 17 Sep 2025 07:51:18 +0200
Subject: [PATCH] ...

---
 lib/hero/heroserver/auth.v    | 8 ++++----
 lib/hero/heroserver/factory.v | 1 +
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/lib/hero/heroserver/auth.v b/lib/hero/heroserver/auth.v
index 423d98ab..fe71323f 100644
--- a/lib/hero/heroserver/auth.v
+++ b/lib/hero/heroserver/auth.v
@@ -27,7 +27,7 @@ pub fn (mut server HeroServer) auth_request(pubkey string) !AuthResponse {
 	challenge := md5.hexhash(challenge_data)
 	
 	// Store challenge with expiration
-	challenges[pubkey] = AuthChallenge{
+	server.challenges[pubkey] = AuthChallenge{
 		pubkey: pubkey
 		challenge: challenge
 		created_at: time.now()
@@ -42,13 +42,13 @@ pub fn (mut server HeroServer) auth_request(pubkey string) !AuthResponse {
 // Submit signed challenge for authentication
 pub fn (mut server HeroServer) auth_submit(pubkey string, signature string) !AuthSubmitResponse {
 	// Get stored challenge
-	challenge_data := challenges[pubkey] or {
+	challenge_data := server.challenges[pubkey] or {
 		return error('No active challenge for this public key')
 	}
 	
 	// Check if challenge expired
 	if time.now() > challenge_data.expires_at {
-		challenges.delete(pubkey)
+		server.challenges.delete(pubkey)
 		return error('Challenge expired')
 	}
 	
@@ -78,7 +78,7 @@ pub fn (mut server HeroServer) auth_submit(pubkey string, signature string) !Aut
 	server.sessions[session_key] = session
 	
 	// Clean up challenge
-	challenges.delete(pubkey)
+	server.challenges.delete(pubkey)
 	
 	return AuthSubmitResponse{
 		session_key: session_key
diff --git a/lib/hero/heroserver/factory.v b/lib/hero/heroserver/factory.v
index 8e52fcf6..f1be2ecb 100644
--- a/lib/hero/heroserver/factory.v
+++ b/lib/hero/heroserver/factory.v
@@ -22,6 +22,7 @@ pub fn new(config HeroServerConfig) !&HeroServer {
 		sessions: map[string]Session{}
 		handlers: map[string]openrpc.OpenRPCHandler{}
 		app: app
+		challenges: map[string]AuthChallenge{}
 	}
 	
 	return server