-- Migration 018: Proaktive Kontosperren, Sicherheits-Audit und zentrales Rate-Limiting
--
-- Additive Migration. Der Migrator toleriert 1050/1060/1061/1062/1091 ("existiert bereits").

-- ---------------------------------------------------------------------------
-- 1. Kontosperren in dc_users
-- ---------------------------------------------------------------------------
-- failed_login_count: Zaehlt konsekutive Fehlversuche fuer dieses Konto.
-- locked_until: Zeitpunkt (UTC), bis zu dem das Konto gesperrt ist.
ALTER TABLE dc_users
  ADD COLUMN failed_login_count INT NOT NULL DEFAULT 0 AFTER disabled;

ALTER TABLE dc_users
  ADD COLUMN locked_until DATETIME NULL AFTER failed_login_count;

ALTER TABLE dc_users
  ADD KEY ix_users_locked (locked_until);

-- ---------------------------------------------------------------------------
-- 2. Zentrales Rate-Limiting fuer alle API-Endpunkte und Auth-Wege
-- ---------------------------------------------------------------------------
CREATE TABLE IF NOT EXISTS dc_rate_limits (
  ip            VARBINARY(16) NOT NULL,
  bucket        VARCHAR(64)   NOT NULL DEFAULT 'default',
  window_start  DATETIME      NOT NULL,
  request_count INT           NOT NULL DEFAULT 1,
  PRIMARY KEY (ip, bucket, window_start),
  KEY ix_rate_limits_window (window_start)
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;