Aug 26 - Enhance security 2

migrations/versions/k1l2m3n4o5p6_add_token_epoch.py

@@ -0,0 +1,50 @@
+"""add token_epoch to users
+
+Revision ID: k1l2m3n4o5p6
+Revises: j0k1l2m3n4o5
+Create Date: 2026-08-26 00:00:00.000000
+
+Adds a monotonic session-generation counter so credential changes can revoke
+every token issued before them.
+
+Previously, changing the master password left all outstanding access and refresh
+tokens valid — a stolen refresh token kept working for its full 7-day lifetime
+after the victim changed their password. The response said "Please log in again"
+but nothing enforced it.
+
+Every JWT now carries an `epoch` claim. require_jwt (and /refresh) compare it
+against users.token_epoch and reject on mismatch. change_password and /recover
+increment the column, which invalidates every previously issued token at once.
+
+A counter rather than a timestamp: JWT `iat` has one-second granularity, so a
+token minted in the same second as the password change could otherwise slip
+through the comparison.
+
+Existing tokens predate the claim and decode with epoch 0, which matches the
+server_default — so deploying this does not sign everyone out. The first
+password change moves them to 1 and invalidates them as intended.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = 'k1l2m3n4o5p6'
+down_revision = 'j0k1l2m3n4o5'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.add_column(
+        'users',
+        sa.Column(
+            'token_epoch',
+            sa.Integer,
+            nullable=False,
+            server_default='0',
+        ),
+    )
+
+
+def downgrade():
+    op.drop_column('users', 'token_epoch')