-- ============================================================
-- HeardCheck — Auth upgrade migration
-- Renames pin_hash to password_hash, adds login rate limiting
-- Run: mysql -u heardcheck -p heardcheck_db < auth_upgrade.sql
-- ============================================================

USE heardcheck_db;

-- Rename pin_hash to password_hash (more accurate since we support both PINs and passwords)
ALTER TABLE users CHANGE COLUMN pin_hash password_hash VARCHAR(255) NOT NULL;

-- Add login attempt tracking for rate limiting
ALTER TABLE users
  ADD COLUMN login_attempts TINYINT UNSIGNED NOT NULL DEFAULT 0 AFTER password_hash,
  ADD COLUMN locked_until DATETIME DEFAULT NULL AFTER login_attempts;
