Aug 26 - Enhance security 2

app/models/user.py

@@ -58,6 +58,14 @@ class User(db.Model, UserMixin):
     # Each code is consumed (removed from the array) on use.
     # NULL means no backup codes have been generated yet.
     mfa_backup_codes = db.Column(db.Text, nullable=True)
+    # Session generation counter. Every issued JWT carries the value current at
+    # the time it was minted; require_jwt rejects tokens whose claim no longer
+    # matches. Incrementing this revokes every outstanding access and refresh
+    # token at once, which is what a master-password change must do — otherwise
+    # a stolen refresh token outlives the password it was obtained under.
+    # Tokens issued before this column existed decode with epoch 0 and stay
+    # valid until the next credential change.
+    token_epoch = db.Column(db.Integer, default=0, nullable=False, server_default='0')
 
     folders = db.relationship('Folder', backref='owner', lazy='dynamic', cascade='all, delete-orphan')
     vault_items = db.relationship('VaultItem', backref='owner', lazy='dynamic', cascade='all, delete-orphan')