30 lines
1.3 KiB
SQL
30 lines
1.3 KiB
SQL
-- Migration 018: Proaktive Kontosperren, Sicherheits-Audit und zentrales Rate-Limiting
|
|
--
|
|
-- Additive Migration. Der Migrator toleriert 1050/1060/1061/1062/1091 ("existiert bereits").
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- 1. Kontosperren in dc_users
|
|
-- ---------------------------------------------------------------------------
|
|
-- failed_login_count: Zaehlt konsekutive Fehlversuche fuer dieses Konto.
|
|
-- locked_until: Zeitpunkt (UTC), bis zu dem das Konto gesperrt ist.
|
|
ALTER TABLE dc_users
|
|
ADD COLUMN failed_login_count INT NOT NULL DEFAULT 0 AFTER disabled;
|
|
|
|
ALTER TABLE dc_users
|
|
ADD COLUMN locked_until DATETIME NULL AFTER failed_login_count;
|
|
|
|
ALTER TABLE dc_users
|
|
ADD KEY ix_users_locked (locked_until);
|
|
|
|
-- ---------------------------------------------------------------------------
|
|
-- 2. Zentrales Rate-Limiting fuer alle API-Endpunkte und Auth-Wege
|
|
-- ---------------------------------------------------------------------------
|
|
CREATE TABLE IF NOT EXISTS dc_rate_limits (
|
|
ip VARBINARY(16) NOT NULL,
|
|
bucket VARCHAR(64) NOT NULL DEFAULT 'default',
|
|
window_start DATETIME NOT NULL,
|
|
request_count INT NOT NULL DEFAULT 1,
|
|
PRIMARY KEY (ip, bucket, window_start),
|
|
KEY ix_rate_limits_window (window_start)
|
|
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
|