timandClaude Sonnet 5 fbe0c3aa18 Add login lockout and encrypt Player.totp_secret/auth_token at rest ...

Per-username lockout (5 failed TOTP attempts / 5 min) stops account-targeted
brute force regardless of source IP. Player.totp_secret is now Fernet-
encrypted (ENCRYPTION_KEY env, db/crypto.py) instead of stored in plaintext,
and auth_token is stored as a SHA-256 hash rather than the raw session token.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-01 19:49:56 +02:00

..

__init__.py

Add persistence layer: TOTP auth, game history, restore

2026-06-23 23:09:50 +02:00

crypto.py

Add login lockout and encrypt Player.totp_secret/auth_token at rest

2026-07-01 19:49:56 +02:00

db.py

Add persistence layer: TOTP auth, game history, restore

2026-06-23 23:09:50 +02:00

models.py

Add login lockout and encrypt Player.totp_secret/auth_token at rest

2026-07-01 19:49:56 +02:00