feat: improve account security

Support TOTP 2fa, allow for changing password, add session management
and account removal.

drizzle/migrations/20261008133030_two-factor/migration.sql

@@ -0,0 +1,14 @@
+CREATE TABLE "two_factors" (
+	"id" text PRIMARY KEY,
+	"secret" text NOT NULL,
+	"backup_codes" text NOT NULL,
+	"user_id" text NOT NULL,
+	"verified" boolean DEFAULT true,
+	"failed_verification_count" integer DEFAULT 0,
+	"locked_until" timestamp with time zone
+);
+--> statement-breakpoint
+ALTER TABLE "users" ADD COLUMN "two_factor_enabled" boolean DEFAULT false;--> statement-breakpoint
+CREATE INDEX "two_factors_secret_idx" ON "two_factors" ("secret");--> statement-breakpoint
+CREATE INDEX "two_factors_userId_idx" ON "two_factors" ("user_id");--> statement-breakpoint
+ALTER TABLE "two_factors" ADD CONSTRAINT "two_factors_user_id_users_id_fkey" FOREIGN KEY ("user_id") REFERENCES "users"("id") ON DELETE CASCADE;

drizzle/schema.ts

@@ -253,6 +253,7 @@ export const users = pgTable("users", {
     email: text("email").notNull().unique(),
     emailVerified: boolean("email_verified").default(false).notNull(),
     image: text("image"),
+    twoFactorEnabled: boolean("two_factor_enabled").default(false),
     createdAt: timestamptz("created_at").defaultNow().notNull(),
     updatedAt: timestamptz("updated_at")
         .defaultNow()
@@ -260,6 +261,25 @@ export const users = pgTable("users", {
         .notNull(),
 });
 
+export const twoFactors = pgTable(
+    "two_factors",
+    {
+        id: text("id").primaryKey(),
+        secret: text("secret").notNull(),
+        backupCodes: text("backup_codes").notNull(),
+        userId: text("user_id")
+            .notNull()
+            .references(() => users.id, { onDelete: "cascade" }),
+        verified: boolean("verified").default(true),
+        failedVerificationCount: integer("failed_verification_count").default(0),
+        lockedUntil: timestamptz("locked_until"),
+    },
+    (table) => [
+        index("two_factors_secret_idx").on(table.secret),
+        index("two_factors_userId_idx").on(table.userId),
+    ],
+);
+
 export const sessions = pgTable(
     "sessions",
     {