Add password hashing, user settings with 2FA, and project image lightbox.

Hardens auth with PBKDF2, lockouts, local QR setup, and safer embeds while moving account security under the username menu.

database/add-2fa.sql

@@ -0,0 +1,8 @@
+IF COL_LENGTH('dbo.admins', 'two_factor_enabled') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD two_factor_enabled BIT NOT NULL CONSTRAINT DF_admins_two_factor_enabled DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'two_factor_secret') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD two_factor_secret NVARCHAR(64) NULL;
+END

database/harden-auth.sql

@@ -0,0 +1,24 @@
+IF COL_LENGTH('dbo.admins', 'two_factor_secret') IS NOT NULL
+BEGIN
+    ALTER TABLE dbo.admins ALTER COLUMN two_factor_secret NVARCHAR(512) NULL;
+END
+IF COL_LENGTH('dbo.admins', 'password') IS NOT NULL
+BEGIN
+    ALTER TABLE dbo.admins ALTER COLUMN password NVARCHAR(255) NOT NULL;
+END
+IF COL_LENGTH('dbo.admins', 'login_failed_count') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD login_failed_count INT NOT NULL CONSTRAINT DF_admins_login_failed_count DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'login_lock_until') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD login_lock_until DATETIME2 NULL;
+END
+IF COL_LENGTH('dbo.admins', 'totp_failed_count') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD totp_failed_count INT NOT NULL CONSTRAINT DF_admins_totp_failed_count DEFAULT(0);
+END
+IF COL_LENGTH('dbo.admins', 'totp_lock_until') IS NULL
+BEGIN
+    ALTER TABLE dbo.admins ADD totp_lock_until DATETIME2 NULL;
+END

database/schema.sql

@@ -17,9 +17,15 @@ GO
 -- Admin users (used for the /login and /admin panel)
 -- =========================================================
 CREATE TABLE dbo.admins (
-    id       INT IDENTITY(1,1) NOT NULL PRIMARY KEY,
-    username NVARCHAR(100)     NOT NULL,
-    password NVARCHAR(255)     NOT NULL
+    id                  INT IDENTITY(1,1) NOT NULL PRIMARY KEY,
+    username            NVARCHAR(100)     NOT NULL,
+    password            NVARCHAR(255)     NOT NULL,
+    two_factor_enabled  BIT               NOT NULL CONSTRAINT DF_admins_two_factor_enabled DEFAULT(0),
+    two_factor_secret   NVARCHAR(512)      NULL,
+    login_failed_count  INT               NOT NULL CONSTRAINT DF_admins_login_failed_count DEFAULT(0),
+    login_lock_until    DATETIME2         NULL,
+    totp_failed_count   INT               NOT NULL CONSTRAINT DF_admins_totp_failed_count DEFAULT(0),
+    totp_lock_until     DATETIME2         NULL
 );
 GO