🐐 Several security fixes

backend/alembic/env.py

@@ -1,83 +1,88 @@
+import os
+
 from dotenv import load_dotenv
 load_dotenv()
 
 from logging.config import fileConfig
 
-from sqlalchemy import engine_from_config
 from sqlalchemy import pool, create_engine
 
 from alembic import context
 from core.models import Base
 
-import os
-from dotenv import load_dotenv
-load_dotenv()
+# Migrations run as the schema owner (wikitcg), which is a different role from the
+# one the app runs as (wikitcg_app, DML only). Deliberately no fallback to
+# DATABASE_URL: falling back would connect as the app role and fail somewhere deep
+# inside a CREATE/ALTER with a permissions error, instead of telling you plainly
+# that the environment is misconfigured.
+MIGRATION_DATABASE_URL = os.environ.get("MIGRATION_DATABASE_URL")
+if not MIGRATION_DATABASE_URL:
+  raise RuntimeError(
+    "MIGRATION_DATABASE_URL is not set. Migrations must run as the schema owner "
+    "(wikitcg), not as the application role (wikitcg_app), which has no DDL "
+    "rights. In Docker: docker compose run --rm backend alembic upgrade head"
+  )
 
 # this is the Alembic Config object, which provides
 # access to the values within the .ini file in use.
 config = context.config
 
+# Note: the URL is passed straight to create_engine / context.configure rather than
+# through config.set_main_option. alembic.ini is a configparser file, so a password
+# containing '%' would be mangled by interpolation on the way through.
+
 # Interpret the config file for Python logging.
 # This line sets up loggers basically.
 if config.config_file_name is not None:
-    fileConfig(config.config_file_name)
+  fileConfig(config.config_file_name)
 
 # add your model's MetaData object here
 # for 'autogenerate' support
-# from myapp import mymodel
-# target_metadata = mymodel.Base.metadata
 target_metadata = Base.metadata
 
-# other values from the config, defined by the needs of env.py,
-# can be acquired:
-# my_important_option = config.get_main_option("my_important_option")
-# ... etc.
-
 
 def run_migrations_offline() -> None:
-    """Run migrations in 'offline' mode.
+  """Run migrations in 'offline' mode.
 
-    This configures the context with just a URL
-    and not an Engine, though an Engine is acceptable
-    here as well.  By skipping the Engine creation
-    we don't even need a DBAPI to be available.
+  This configures the context with just a URL
+  and not an Engine, though an Engine is acceptable
+  here as well.  By skipping the Engine creation
+  we don't even need a DBAPI to be available.
 
-    Calls to context.execute() here emit the given string to the
-    script output.
+  Calls to context.execute() here emit the given string to the
+  script output.
 
-    """
-    url = os.environ["DATABASE_URL"]
-    print(url)
-    context.configure(
-        url=url,
-        target_metadata=target_metadata,
-        literal_binds=True,
-        dialect_opts={"paramstyle": "named"},
-    )
+  """
+  context.configure(
+    url=MIGRATION_DATABASE_URL,
+    target_metadata=target_metadata,
+    literal_binds=True,
+    dialect_opts={"paramstyle": "named"},
+  )
 
-    with context.begin_transaction():
-        context.run_migrations()
+  with context.begin_transaction():
+    context.run_migrations()
 
 
 def run_migrations_online() -> None:
-    """Run migrations in 'online' mode.
+  """Run migrations in 'online' mode.
 
-    In this scenario we need to create an Engine
-    and associate a connection with the context.
+  In this scenario we need to create an Engine
+  and associate a connection with the context.
 
-    """
-    connectable = create_engine(os.environ["DATABASE_URL"], poolclass=pool.NullPool)
+  """
+  connectable = create_engine(MIGRATION_DATABASE_URL, poolclass=pool.NullPool)
 
-    with connectable.connect() as connection:
-        context.configure(
-            connection=connection, target_metadata=target_metadata
-        )
+  with connectable.connect() as connection:
+    context.configure(
+      connection=connection, target_metadata=target_metadata
+    )
 
-        with context.begin_transaction():
-            context.run_migrations()
+    with context.begin_transaction():
+      context.run_migrations()
 
 
 if context.is_offline_mode():
-    run_migrations_offline()
+  run_migrations_offline()
 else:
-    run_migrations_online()
+  run_migrations_online()

backend/alembic/versions/c9a17b4e2d80_add_token_valid_after_to_users.py

@@ -0,0 +1,34 @@
+"""add token_valid_after to users
+
+Revocation cutoff for JWTs. Tokens are stateless, so before this there was no way
+to invalidate a session at all — a password reset left every outstanding access and
+refresh token working, including one an attacker had already stolen.
+
+Nullable with no default: NULL means "nothing revoked", which is the correct state
+for every existing user, so this is a cheap ADD COLUMN with no table rewrite.
+
+Revision ID: c9a17b4e2d80
+Revises: f657d45be3ae
+Create Date: 2026-07-29
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'c9a17b4e2d80'
+down_revision: Union[str, None] = 'f657d45be3ae'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+  # timezone=True: compared against the JWT 'iat' claim, which is always UTC.
+  op.add_column('users', sa.Column('token_valid_after', sa.DateTime(timezone=True), nullable=True))
+
+
+def downgrade() -> None:
+  op.drop_column('users', 'token_valid_after')