derekc
3022bc328b
- TV tokens upgraded from 4 to 6 digits; Regen Token button in Admin - Nginx rate limiting on TV dashboard and WebSocket endpoints - Login lockout after 5 failed attempts (15 min); clears on admin password reset - HSTS header added; CSP unsafe-inline removed from script-src; CORS restricted to explicit methods/headers - Dependency CVE fixes: PyJWT 2.12.0, aiomysql 0.3.0, cryptography 46.0.5, python-multipart 0.0.22 - datetime.utcnow() replaced with datetime.now(timezone.utc) throughout - SQL identifier whitelist for startup migration queries - README updated: security notes section, lockout docs, token regen, NPM proxy guidance Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
26 lines
1.4 KiB
Python
26 lines
1.4 KiB
Python
from datetime import datetime
|
|
from sqlalchemy import String, Boolean, DateTime, Integer
|
|
from sqlalchemy.orm import Mapped, mapped_column, relationship
|
|
from app.models.base import Base, TimestampMixin
|
|
|
|
|
|
class User(TimestampMixin, Base):
|
|
__tablename__ = "users"
|
|
|
|
id: Mapped[int] = mapped_column(primary_key=True, autoincrement=True)
|
|
email: Mapped[str] = mapped_column(String(255), unique=True, nullable=False, index=True)
|
|
hashed_password: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
full_name: Mapped[str] = mapped_column(String(255), nullable=False)
|
|
is_active: Mapped[bool] = mapped_column(Boolean, default=True)
|
|
is_admin: Mapped[bool] = mapped_column(Boolean, default=False)
|
|
timezone: Mapped[str] = mapped_column(String(64), nullable=False, default="UTC")
|
|
last_active_at: Mapped[datetime | None] = mapped_column(DateTime, nullable=True, default=None)
|
|
failed_login_attempts: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
|
|
locked_until: Mapped[datetime | None] = mapped_column(DateTime, nullable=True, default=None)
|
|
|
|
children: Mapped[list["Child"]] = relationship("Child", back_populates="user") # noqa: F821
|
|
subjects: Mapped[list["Subject"]] = relationship("Subject", back_populates="user") # noqa: F821
|
|
schedule_templates: Mapped[list["ScheduleTemplate"]] = relationship( # noqa: F821
|
|
"ScheduleTemplate", back_populates="user"
|
|
)
|