05/02/2026 updated code for security

2026-05-02 15:30:33 -04:00
parent 9af7435cab
commit c7b1806ec8
6 changed files with 594 additions and 124 deletions
@@ -0,0 +1,49 @@
+"""add lockout columns and mfa_backup_codes to users
+
+Revision ID: d4e5f6a7b8c9
+Revises: c3d4e5f6a7b8
+Create Date: 2026-05-02 00:00:00.000000
+
+Adds three nullable/defaulted columns to users:
+  - failed_login_count  INTEGER  NOT NULL DEFAULT 0
+      Incremented on every failed login, reset on success or lockout expiry.
+  - locked_until        DATETIME NULL
+      When set (and in the future), login is rejected with HTTP 429.
+  - mfa_backup_codes    TEXT     NULL
+      JSON array of Argon2id-hashed one-time backup codes generated at
+      MFA enrollment. NULL = no codes generated / MFA not enabled.
+      Cleared when MFA is disabled.
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = 'd4e5f6a7b8c9'
+down_revision = 'c3d4e5f6a7b8'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                'failed_login_count',
+                sa.Integer(),
+                nullable=False,
+                server_default='0',
+            )
+        )
+        batch_op.add_column(
+            sa.Column('locked_until', sa.DateTime(), nullable=True)
+        )
+        batch_op.add_column(
+            sa.Column('mfa_backup_codes', sa.Text(), nullable=True)
+        )
+
+
+def downgrade():
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.drop_column('mfa_backup_codes')
+        batch_op.drop_column('locked_until')
+        batch_op.drop_column('failed_login_count')