Aug 26 - Update password detect against off field 2

migrations/versions/m3n4o5p6q7r8_add_login_attempts.py

@@ -0,0 +1,52 @@
+"""add login_attempts table (per-IP lockout)
+
+Revision ID: m3n4o5p6q7r8
+Revises: l2m3n4o5p6q7
+Create Date: 2026-08-26 00:00:00.000000
+
+Moves failed-login lockout from a global per-account counter to per (account, IP).
+
+The old design was a denial-of-service primitive: anyone who knew an email
+address could send five wrong passwords and lock the real owner out for 15
+minutes, repeatedly and indefinitely, at near-zero cost. Locking someone out of
+their password manager is a serious harm in itself.
+
+Scoping by IP means an attacker locks out only their own address. The legitimate
+owner signing in from their own IP is unaffected, and a distributed attacker
+still faces Flask-Limiter (10/min per IP on /login) plus the Nginx auth_limit
+zone on every address they rotate through.
+
+users.failed_login_count / users.locked_until are left in place and still
+maintained as an aggregate signal for the audit log, but no longer gate
+authentication.
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects.mysql import INTEGER
+
+
+revision = 'm3n4o5p6q7r8'
+down_revision = 'l2m3n4o5p6q7'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        'login_attempts',
+        sa.Column('id', INTEGER(unsigned=True), autoincrement=True, primary_key=True),
+        sa.Column('user_id', INTEGER(unsigned=True), nullable=False),
+        sa.Column('ip_address', sa.String(45), nullable=False, server_default=''),
+        sa.Column('failed_count', sa.Integer, nullable=False, server_default='0'),
+        sa.Column('locked_until', sa.DateTime, nullable=True),
+        sa.Column('updated_at', sa.DateTime, nullable=False),
+        sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
+        sa.UniqueConstraint('user_id', 'ip_address', name='uq_login_attempt_user_ip'),
+    )
+    # The cleanup job sweeps by updated_at.
+    op.create_index('ix_login_attempts_updated_at', 'login_attempts', ['updated_at'])
+
+
+def downgrade():
+    op.drop_index('ix_login_attempts_updated_at', table_name='login_attempts')
+    op.drop_table('login_attempts')