olsch01
19fb2c037c
- L2: Add server_tokens off to nginx configs to hide version - M1: Add X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy headers to all nginx routes - L3: Add global NoCacheInterceptor (Cache-Control: no-store) on all API responses to prevent caching of sensitive financial data - C1: Disable open registration by default (ALLOW_OPEN_REGISTRATION env) - H3: Add logout endpoint with correct HTTP 200 status code - M2: Implement full password reset flow (forgot-password, reset-password, change-password) with hashed tokens, 15-min expiry, single-use - Reduce JWT access token expiry from 24h to 1h - Add EmailService stub (logs to shared.email_log) - Add DB migration 016 for password_reset_tokens table Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
26 lines
1.0 KiB
SQL
26 lines
1.0 KiB
SQL
-- Migration 016: Password Reset Tokens
|
|
-- Adds table for password reset token storage (hashed, single-use, short-lived).
|
|
|
|
CREATE TABLE IF NOT EXISTS shared.password_reset_tokens (
|
|
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
|
|
user_id UUID NOT NULL REFERENCES shared.users(id) ON DELETE CASCADE,
|
|
token_hash VARCHAR(255) UNIQUE NOT NULL,
|
|
expires_at TIMESTAMPTZ NOT NULL,
|
|
used_at TIMESTAMPTZ,
|
|
created_at TIMESTAMPTZ DEFAULT NOW()
|
|
);
|
|
|
|
CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_hash ON shared.password_reset_tokens(token_hash);
|
|
CREATE INDEX IF NOT EXISTS idx_password_reset_tokens_user ON shared.password_reset_tokens(user_id);
|
|
|
|
-- Also ensure email_log table exists (may not exist if migration 015 hasn't been applied)
|
|
CREATE TABLE IF NOT EXISTS shared.email_log (
|
|
id UUID PRIMARY KEY DEFAULT uuid_generate_v4(),
|
|
to_email VARCHAR(255) NOT NULL,
|
|
subject VARCHAR(500) NOT NULL,
|
|
body TEXT,
|
|
template VARCHAR(100),
|
|
metadata JSONB,
|
|
sent_at TIMESTAMPTZ DEFAULT NOW()
|
|
);
|