feat: add email-based authentication

app/models.py

@@ -12,6 +12,10 @@ class User(UserMixin, db.Model):
 
     id = db.Column(db.Integer, primary_key=True)
     username = db.Column(db.String(100), unique=True, nullable=False)
+    email = db.Column(db.String(254), unique=True, index=True)
+    email_verified_at = db.Column(db.DateTime)
+    is_active_account = db.Column(db.Boolean, default=False, nullable=False)
+    auth_version = db.Column(db.Integer, default=1, nullable=False)
     password_hash = db.Column(db.String(255), nullable=False)
     is_admin = db.Column(db.Boolean, default=False, nullable=False)
     created_at = db.Column(db.DateTime, default=utc_now)
@@ -22,6 +26,13 @@ class User(UserMixin, db.Model):
     def check_password(self, password: str) -> bool:
         return check_password_hash(self.password_hash, password)
 
+    @property
+    def is_active(self) -> bool:
+        return self.is_active_account
+
+    def revoke_authentication(self) -> None:
+        self.auth_version += 1
+
 
 class PasswordResetToken(db.Model):
     __tablename__ = "password_reset_tokens"
@@ -42,6 +53,34 @@ class PasswordResetToken(db.Model):
     created_by = db.relationship("User", foreign_keys=[created_by_id])
 
 
+class EmailVerificationCode(db.Model):
+    __tablename__ = "email_verification_codes"
+
+    id = db.Column(db.Integer, primary_key=True)
+    email = db.Column(db.String(254), nullable=False, index=True)
+    purpose = db.Column(db.String(32), nullable=False, index=True)
+    code_hash = db.Column(db.String(64), nullable=False)
+    expires_at = db.Column(db.DateTime, nullable=False)
+    attempts = db.Column(db.Integer, default=0, nullable=False)
+    used_at = db.Column(db.DateTime)
+    requested_ip = db.Column(db.String(64))
+    created_at = db.Column(db.DateTime, default=utc_now, nullable=False, index=True)
+
+
+class TrustedDevice(db.Model):
+    __tablename__ = "trusted_devices"
+
+    id = db.Column(db.Integer, primary_key=True)
+    user_id = db.Column(db.Integer, db.ForeignKey("users.id"), nullable=False, index=True)
+    token_hash = db.Column(db.String(64), unique=True, nullable=False, index=True)
+    expires_at = db.Column(db.DateTime, nullable=False, index=True)
+    auth_version = db.Column(db.Integer, nullable=False)
+    created_at = db.Column(db.DateTime, default=utc_now, nullable=False)
+    last_used_at = db.Column(db.DateTime, default=utc_now, nullable=False)
+
+    user = db.relationship("User", backref=db.backref("trusted_devices", lazy=True))
+
+
 class UploadRecord(db.Model):
     __tablename__ = "upload_records"