Tahinli/forge

public

0 watching

★ 0

790 bytes

1	-- Two-factor authentication (TOTP) and single-use recovery codes. Applied by store/migrate.rs.
2	-- totp_secret_sealed holds the instance-key sealed secret (secret::seal output, UTF-8 bytes).
3	-- totp_enabled stays 0 until the user confirms a code. totp_last_step is the replay guard.
4
5	ALTER TABLE users ADD COLUMN totp_secret_sealed BLOB NULL;
6	ALTER TABLE users ADD COLUMN totp_enabled INTEGER NOT NULL DEFAULT 0;
7	ALTER TABLE users ADD COLUMN totp_last_step INTEGER NOT NULL DEFAULT 0;
8
9	CREATE TABLE recovery_codes (
10	id TEXT PRIMARY KEY,
11	user_id TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
12	code_hash TEXT NOT NULL, -- hex sha256 of the normalized code
13	used_at TEXT NULL
14	);
15	CREATE INDEX recovery_codes_user_id ON recovery_codes(user_id);