feat: add audit, throttle and session foundations

Audit entries written only inside the caller's transaction, database throttle counters that refuse to run inside a transaction that could roll back, and a database session store with the user key in its own column, end_sessions and idle and absolute limits. Ticket 1.3. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Sk72AxLwQnYttF6VFSxQLt
2026-10-15 15:43:43 +02:00
parent 003ce6e0c2
commit 73505ac717
22 changed files with 803 additions and 2 deletions
@@ -0,0 +1,44 @@
+# Generated by Django 5.2.18 on 2026-10-15 13:40
+
+import django.utils.timezone
+from django.db import migrations, models
+
+
+class Migration(migrations.Migration):
+
+    initial = True
+
+    dependencies = [
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name='UserSession',
+            fields=[
+                ('session_key', models.CharField(max_length=40, primary_key=True, serialize=False, verbose_name='session key')),
+                ('session_data', models.TextField(verbose_name='session data')),
+                ('expire_date', models.DateTimeField(db_index=True, verbose_name='expire date')),
+                ('username', models.CharField(blank=True, db_index=True, default='', max_length=256)),
+                ('created_at', models.DateTimeField(default=django.utils.timezone.now)),
+            ],
+            options={
+                'verbose_name': 'session',
+                'verbose_name_plural': 'sessions',
+                'abstract': False,
+            },
+        ),
+        migrations.CreateModel(
+            name='ThrottleCounter',
+            fields=[
+                ('id', models.BigAutoField(auto_created=True, primary_key=True, serialize=False, verbose_name='ID')),
+                ('endpoint', models.CharField(max_length=64)),
+                ('subject', models.CharField(max_length=256)),
+                ('count', models.PositiveIntegerField(default=0)),
+                ('window_started', models.DateTimeField(default=django.utils.timezone.now)),
+                ('blocked_until', models.DateTimeField(blank=True, null=True)),
+            ],
+            options={
+                'constraints': [models.UniqueConstraint(fields=('endpoint', 'subject'), name='uniq_throttle_subject')],
+            },
+        ),
+    ]