paul
e35ac6a41c
Security Enhancements: - Fix SQL injection vulnerabilities by replacing whereRaw queries with parameterized queries - Add LIKE pattern escaping to prevent SQL injection in search functionality - Implement account lockout protection (5 failed attempts = 30 min lockout) - Add comprehensive login attempt tracking and audit trail - Enhance JWT tokens with issuer validation, IP tracking, and password change detection - Add logout endpoint and session management - Prevent user enumeration with generic error messages Database Changes: - Add login_attempts table for authentication tracking - Add security columns to admin_users (password_changed_at, last_login_ip, two_factor_enabled) New Security Features: - Brute force protection with configurable lockout duration - Automatic cleanup of old login attempts - Enhanced authentication middleware with stricter validation - Monitoring scripts for security health checks All fixes are backward compatible and production-ready with rollback plans included. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude <noreply@anthropic.com>
25 lines
777 B
JavaScript
25 lines
777 B
JavaScript
exports.up = function(knex) {
|
|
return knex.schema.table('admin_users', table => {
|
|
// Add password change tracking
|
|
table.timestamp('password_changed_at').nullable();
|
|
|
|
// Add last login IP for security monitoring
|
|
table.string('last_login_ip', 45).nullable();
|
|
|
|
// Add account security flags
|
|
table.boolean('two_factor_enabled').defaultTo(false);
|
|
table.string('two_factor_secret').nullable();
|
|
|
|
// Add index for performance
|
|
table.index('password_changed_at');
|
|
});
|
|
};
|
|
|
|
exports.down = function(knex) {
|
|
return knex.schema.table('admin_users', table => {
|
|
table.dropColumn('password_changed_at');
|
|
table.dropColumn('last_login_ip');
|
|
table.dropColumn('two_factor_enabled');
|
|
table.dropColumn('two_factor_secret');
|
|
});
|
|
}; |