Phil Skentelbery
9135edfe84
CRITICAL SECURITY FIX: - Email code required EVERY login (authentication, not verification) - DNS TXT check cached separately (domain verification) - New auth_sessions table for per-login state - Codes hashed with SHA-256, constant-time comparison - Max 3 attempts, 10-minute session expiry - OAuth params stored server-side (security improvement) New files: - services/auth_session.py - migrations 004, 005 - ADR-010: domain verification vs user authentication 312 tests passing, 86.21% coverage 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
13 lines
635 B
SQL
13 lines
635 B
SQL
-- Migration 005: Add last_checked column to domains table
|
|
-- Enables cache expiration for DNS verification (separate from user authentication)
|
|
-- See ADR-010 for the domain verification vs user authentication distinction
|
|
|
|
-- Add last_checked column for DNS verification cache expiration
|
|
ALTER TABLE domains ADD COLUMN last_checked TIMESTAMP;
|
|
|
|
-- Update existing verified domains to set last_checked = verified_at
|
|
UPDATE domains SET last_checked = verified_at WHERE verified = 1;
|
|
|
|
-- Record this migration
|
|
INSERT INTO migrations (version, description) VALUES (5, 'Add last_checked column to domains table for DNS verification cache');
|