Add brute-force protection to login endpoint #637

Open

pook wants to merge 62 commits from feat/login-brute-force-protection into main

pook commented

2026-04-11 07:59:57 -04:00

Owner

Summary

Adds POST /api/auth/login endpoint with account lockout after 5 consecutive failed password attempts (15-minute lockout window)
Adds password_hash, failed_login_attempts, and locked_until columns to users table via Drizzle schema + SQL migration
IP-based rate limiting (10 req/min) on /api/auth/* using existing rate limiter middleware
Returns 429 when locked, generic 401 for wrong credentials (no information leakage about email existence)
Successful login resets the failed attempt counter

Test plan

11 unit tests covering: missing fields (400), wrong password (401), non-existent user (401), no email existence leak, failed attempt counter increment, lockout after 5 failures, 429 on locked account, login after lockout expires, counter reset on success, no sensitive fields in response, no lock under 5 attempts
TypeScript type check passes (npx tsc --noEmit)
All existing tests remain green (219/220 pass — 1 pre-existing failure in document-generator unrelated to this change)

🤖 Generated with Claude Code

## Summary - Adds `POST /api/auth/login` endpoint with account lockout after 5 consecutive failed password attempts (15-minute lockout window) - Adds `password_hash`, `failed_login_attempts`, and `locked_until` columns to users table via Drizzle schema + SQL migration - IP-based rate limiting (10 req/min) on `/api/auth/*` using existing rate limiter middleware - Returns 429 when locked, generic 401 for wrong credentials (no information leakage about email existence) - Successful login resets the failed attempt counter ## Test plan - [x] 11 unit tests covering: missing fields (400), wrong password (401), non-existent user (401), no email existence leak, failed attempt counter increment, lockout after 5 failures, 429 on locked account, login after lockout expires, counter reset on success, no sensitive fields in response, no lock under 5 attempts - [x] TypeScript type check passes (`npx tsc --noEmit`) - [x] All existing tests remain green (219/220 pass — 1 pre-existing failure in document-generator unrelated to this change) 🤖 Generated with [Claude Code](https://claude.com/claude-code)

pook added 1 commit

2026-04-11 07:59:57 -04:00

Add brute-force protection to login endpoint

CI Quality Gate / Lint / Typecheck / Test / Build (pull_request) Waiting to run

Details

3cd7c73679

Implements account lockout after 5 consecutive failed login attempts,
locking the account for 15 minutes. Adds password_hash, failed_login_attempts,
and locked_until columns to users table. Returns 429 when locked and generic
401 for wrong credentials to prevent information leakage. Includes IP-based
rate limiting (10 req/min) on the auth endpoint and 11 unit tests covering
lockout, unlock, counter reset, and no-leak behavior.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

agent-bot added 1 commit

2026-04-11 08:00:08 -04:00