🐐 Several security fixes

backend/alembic/versions/c9a17b4e2d80_add_token_valid_after_to_users.py

@@ -0,0 +1,34 @@
+"""add token_valid_after to users
+
+Revocation cutoff for JWTs. Tokens are stateless, so before this there was no way
+to invalidate a session at all — a password reset left every outstanding access and
+refresh token working, including one an attacker had already stolen.
+
+Nullable with no default: NULL means "nothing revoked", which is the correct state
+for every existing user, so this is a cheap ADD COLUMN with no table rewrite.
+
+Revision ID: c9a17b4e2d80
+Revises: f657d45be3ae
+Create Date: 2026-07-29
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'c9a17b4e2d80'
+down_revision: Union[str, None] = 'f657d45be3ae'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+  # timezone=True: compared against the JWT 'iat' claim, which is always UTC.
+  op.add_column('users', sa.Column('token_valid_after', sa.DateTime(timezone=True), nullable=True))
+
+
+def downgrade() -> None:
+  op.drop_column('users', 'token_valid_after')