0022_step_up_mfa.sql9 lines · main

1	-- 0022_step_up_mfa — last_mfa_at column on users for step-up auth.
2	-- CLAUDE.md §5.4 requires admin actions to carry recent (≤10 min)
3	-- re-authentication. The middleware reads this column on the route;
4	-- POST /v1/auth/step-up bumps it after a successful password prompt.
5	-- No index — every admin request reads this single field from the
6	-- already-loaded user row.
7
8	ALTER TABLE "users"
9	ADD COLUMN IF NOT EXISTS "last_mfa_at" timestamp with time zone;