🐐 Several security fixes

2026-07-29 16:30:14 +02:00
parent b42abe5f5e
commit c56498239f
21 changed files with 660 additions and 204 deletions
@@ -28,6 +28,11 @@ class User(Base):
  email_verification_token_expires_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
  trade_wishlist: Mapped[str | None] = mapped_column(Text, nullable=True, default="")
  last_active_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True)
+  # Tokens issued before this are rejected — the only way to revoke a session, since
+  # tokens are pure JWTs with no server-side store. Set on both password-change paths.
+  # timezone=True unlike its neighbours: it is compared against JWT 'iat', which is
+  # always UTC, so leaving it naive would make it ambiguous against local-time columns.
+  token_valid_after: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)

  cards: Mapped[list["Card"]] = relationship(back_populates="user", cascade="all, delete-orphan")
  decks: Mapped[list["Deck"]] = relationship(back_populates="user", cascade="all, delete-orphan")