2 files changed, 49 insertions, 0 deletions
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py
new file mode 100644
index 0000000..2fead6c
--- /dev/null
+++ b/packages/meshbay-hub/src/meshbay_hub/db/migrations/versions/a9b8c7d6e5f4_add_login_throttle.py
@@ -0,0 +1,33 @@
+"""add login_throttle
+
+Wrong passphrases per username, for the per-account sign-in lockout. Keyed by a
+hash of the name as typed, so unknown names are counted like real ones.
+
+Revision ID: a9b8c7d6e5f4
+Revises: e5f6a7b8c9d0
+"""
+
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "a9b8c7d6e5f4"
+down_revision: Union[str, Sequence[str], None] = "e5f6a7b8c9d0"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "login_throttle",
+        sa.Column("key", sa.String(64), primary_key=True),
+        sa.Column("failures", sa.Integer(), nullable=False, server_default="0"),
+        sa.Column("last_failure_at", sa.DateTime(timezone=True), nullable=False),
+    )
+
+
+def downgrade() -> None:
+    # Dropping this forgets every count in progress, which unlocks everyone —
+    # the limits themselves live in `hub_settings`.
+    op.drop_table("login_throttle")
diff --git a/packages/meshbay-hub/src/meshbay_hub/db/models.py b/packages/meshbay-hub/src/meshbay_hub/db/models.py
index b052e00..f1fff41 100644
--- a/packages/meshbay-hub/src/meshbay_hub/db/models.py
+++ b/packages/meshbay-hub/src/meshbay_hub/db/models.py
@@ -330,6 +330,22 @@ class MailQuota(Base):
     last_sent:    Mapped[datetime | None] = mapped_column(DateTime(timezone=True))
 
 
+class LoginThrottle(Base):
+    """Wrong passphrases per username, for the sign-in lockout (`login_throttle.py`).
+
+    Keyed by a hash of the name as typed rather than by account, so an unknown
+    name is counted — and locked — exactly like a real one (M1), and so a
+    passphrase typed into the username field is never stored. Rows age out with
+    the lockout window and are purged by the cleanup task.
+    """
+
+    __tablename__ = "login_throttle"
+
+    key:             Mapped[str] = mapped_column(String(64), primary_key=True)
+    failures:        Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    last_failure_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), nullable=False)
+
+
 class HubSetting(Base):
     """
     Instance-wide settings an admin changes at runtime from the panel.