feat(identities): Universal Auth Login Lockout

backend/src/db/migrations/20250815022242_identity-lockouts.ts

@@ -0,0 +1,25 @@
+import { Knex } from "knex";
+
+import { TableName } from "../schemas";
+
+export async function up(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.IdentityUniversalAuth)) {
+    await knex.schema.alterTable(TableName.IdentityUniversalAuth, (t) => {
+      t.boolean("lockoutEnabled").notNullable().defaultTo(true);
+      t.integer("lockoutThreshold").notNullable().defaultTo(3);
+      t.integer("lockoutDuration").notNullable().defaultTo(300); // 5 minutes (in seconds)
+      t.integer("lockoutCounterReset").notNullable().defaultTo(30); // 30 seconds
+    });
+  }
+}
+
+export async function down(knex: Knex): Promise<void> {
+  if (await knex.schema.hasTable(TableName.IdentityUniversalAuth)) {
+    await knex.schema.alterTable(TableName.IdentityUniversalAuth, (t) => {
+      t.dropColumn("lockoutEnabled");
+      t.dropColumn("lockoutThreshold");
+      t.dropColumn("lockoutDuration");
+      t.dropColumn("lockoutCounterReset");
+    });
+  }
+}

backend/src/db/schemas/identity-universal-auths.ts

@@ -18,7 +18,11 @@ export const IdentityUniversalAuthsSchema = z.object({
   createdAt: z.date(),
   updatedAt: z.date(),
   identityId: z.string().uuid(),
-  accessTokenPeriod: z.coerce.number().default(0)
+  accessTokenPeriod: z.coerce.number().default(0),
+  lockoutEnabled: z.boolean().default(true),
+  lockoutThreshold: z.number().default(3),
+  lockoutDuration: z.number().default(300),
+  lockoutCounterReset: z.number().default(30)
 });
 
 export type TIdentityUniversalAuths = z.infer<typeof IdentityUniversalAuthsSchema>;