05/02/2026 updated code for security

app/models/user.py

@@ -39,6 +39,15 @@ class User(db.Model, UserMixin):
     # The server never sees the recovery code — only the ciphertext of enc_key_salt.
     recovery_enc_salt = db.Column(db.String(128), nullable=True)
     recovery_iv = db.Column(db.String(64), nullable=True)
+    # Brute-force lockout — incremented on every failed login attempt,
+    # reset to 0 on success.  locked_until is set to now()+15min after
+    # MAX_FAILED_LOGINS consecutive failures.
+    failed_login_count = db.Column(db.Integer, default=0, nullable=False, server_default='0')
+    locked_until = db.Column(db.DateTime, nullable=True)
+    # MFA backup codes — JSON array of Argon2id-hashed one-time codes.
+    # Each code is consumed (removed from the array) on use.
+    # NULL means no backup codes have been generated yet.
+    mfa_backup_codes = db.Column(db.Text, nullable=True)
 
     folders = db.relationship('Folder', backref='owner', lazy='dynamic', cascade='all, delete-orphan')
     vault_items = db.relationship('VaultItem', backref='owner', lazy='dynamic', cascade='all, delete-orphan')
@@ -51,4 +60,4 @@ class User(db.Model, UserMixin):
             return False
 
     def __repr__(self):
-        return f'<User {self.email}>'
+        return f'<User {self.email}>'