mirror of
https://github.com/jhd3197/ServerKit.git
synced 2026-10-29 08:07:37 +09:00
Juan Denis
c8c93a8e0c
Add session-family revocation and migration 097, require current credentials for password changes, constrain API keys, and require verified WebAuthn authentication. Update browser token handling and add boundary regressions. Existing JWTs require fresh login; restricted keys deny undeclared endpoints.
14 lines
568 B
Python
14 lines
568 B
Python
"""Persistent session-family revocations (access and refresh share an id)."""
|
|
from datetime import datetime
|
|
from app import db
|
|
|
|
|
|
class RevokedSession(db.Model):
|
|
__tablename__ = 'revoked_sessions'
|
|
|
|
session_id = db.Column(db.String(32), primary_key=True)
|
|
user_id = db.Column(db.Integer, db.ForeignKey('users.id', ondelete='CASCADE'),
|
|
nullable=False, index=True)
|
|
revoked_at = db.Column(db.DateTime, default=datetime.utcnow, nullable=False)
|
|
user = db.relationship('User', backref=db.backref('revoked_sessions', lazy='dynamic'))
|