security + reponsive

database/setup.sql

@@ -1,7 +1,6 @@
 -- ===========================================
 -- SQL Server Setup Script for AccManager
 -- Database: AccManager
--- Server: 172.20.235.176
 -- ===========================================
 
 -- Create Database
@@ -39,6 +38,24 @@ BEGIN
     PRINT 'Table Users created successfully.';
 END
 
+-- Server-side authentication sessions. Only SHA-256 token hashes are stored.
+IF NOT EXISTS (SELECT * FROM sys.tables WHERE name = 'AuthSessions')
+BEGIN
+    CREATE TABLE AuthSessions (
+        SessionId BIGINT PRIMARY KEY IDENTITY(1,1),
+        TokenHash CHAR(64) UNIQUE NOT NULL,
+        UserId INT NOT NULL,
+        ExpiresAt DATETIME2 NOT NULL,
+        CreatedAt DATETIME2 NOT NULL DEFAULT SYSUTCDATETIME(),
+        UserAgent NVARCHAR(500),
+        IpAddress NVARCHAR(64),
+        FOREIGN KEY (UserId) REFERENCES Users(UserId) ON DELETE CASCADE
+    );
+    CREATE INDEX IX_AuthSessions_UserId ON AuthSessions(UserId);
+    CREATE INDEX IX_AuthSessions_ExpiresAt ON AuthSessions(ExpiresAt);
+    PRINT 'Table AuthSessions created successfully.';
+END
+
 -- ===========================================
 -- 2. CREATE APPLICATIONS TABLE
 -- ===========================================
@@ -67,7 +84,7 @@ BEGIN
         UserId INT NOT NULL,
         AppId INT NOT NULL,
         AccountUsername NVARCHAR(100),
-        AccountPassword NVARCHAR(255),
+        AccountPassword NVARCHAR(2048),
         Email NVARCHAR(100),
         AccessLevel NVARCHAR(50),
         Status NVARCHAR(20) DEFAULT 'Active',
@@ -80,6 +97,11 @@ BEGIN
     PRINT 'Table Accounts created successfully.';
 END
 
+IF COL_LENGTH('dbo.Accounts', 'AccountPassword') IS NOT NULL
+BEGIN
+    ALTER TABLE Accounts ALTER COLUMN AccountPassword NVARCHAR(2048) NULL;
+END
+
 -- ===========================================
 -- 4. CREATE ASSET INVENTORY TABLE
 -- ===========================================