Brendan Chen f4eaf88495 feat(auth): add login_attempts schema, lockout config, dummy-hash helper ...

Lays the foundation for brute-force defense: per-username attempt tracking
table, configurable lockout/rate-limit thresholds, and a memoized dummy
bcrypt hash so unknown-user paths can be timed identically to wrong-password
paths in a later step.

Adds @fastify/rate-limit dependency for upcoming per-IP rate-limit on
login routes.

2026-05-03 03:26:46 -07:00

904 B

Raw Blame History

View Raw