davideandClaude Sonnet 5
739fc9fed2
Neither self-service password change nor the admin reset invalidated already-issued JWTs — a 24h-lifetime token stayed valid regardless, so a stolen token (or an attacker who already had the old password) kept working past a password change meant to lock them out. The admin reset exists precisely for the "account compromised" case and didn't evict the attacker at all. Add User.token_version (migration 943dbd74d983), embedded in every JWT as a "tv" claim and checked against the DB on every request in get_current_user/get_optional_user; a mismatch reads as session_expired. Both change-password and the admin reset bump it. change-password hands back a freshly minted token so the caller's own session keeps working instead of being logged out by its own request; the admin reset does not, since that session isn't the one making the call. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
41 lines
1.3 KiB
Python
41 lines
1.3 KiB
Python
"""add token_version to users
|
|
|
|
Revision ID: 943dbd74d983
|
|
Revises: 861e76aaf34c
|
|
Create Date: 2026-07-27
|
|
|
|
"""
|
|
from typing import Sequence, Union
|
|
|
|
from alembic import op
|
|
import sqlalchemy as sa
|
|
|
|
|
|
# revision identifiers, used by Alembic.
|
|
revision: str = '943dbd74d983'
|
|
down_revision: Union[str, Sequence[str], None] = '861e76aaf34c'
|
|
branch_labels: Union[str, Sequence[str], None] = None
|
|
depends_on: Union[str, Sequence[str], None] = None
|
|
|
|
|
|
def upgrade() -> None:
|
|
"""Upgrade schema."""
|
|
# server_default backfills every existing user to 0 (their current sessions
|
|
# stay valid, since 0 also matches what already-issued tokens carry
|
|
# implicitly — see the "sub"-only tokens issued before this migration);
|
|
# dropped right after so new rows go through the ORM default instead of a
|
|
# stale constant.
|
|
op.add_column(
|
|
'users', sa.Column('token_version', sa.Integer(), nullable=False, server_default='0')
|
|
)
|
|
with op.batch_alter_table('users') as batch_op:
|
|
batch_op.alter_column('token_version', server_default=None)
|
|
# ### end Alembic commands ###
|
|
|
|
|
|
def downgrade() -> None:
|
|
"""Downgrade schema."""
|
|
# ### commands auto generated by Alembic - please adjust! ###
|
|
op.drop_column('users', 'token_version')
|
|
# ### end Alembic commands ###
|