- Add username field
- Add password_hash for bcrypt hash storage
- Add email_verified and email_verification_token for email verification
- Add password_reset_token and password_reset_expires_at for password reset
- Add last_login_at and last_login_ip for login tracking
- Backward compatible with existing code (all new fields have defaults)
Phase 4 Task 5/68 completed
- Implement EmailService class with configurable SMTP
- Support verification/password-reset/invitation email templates
- Support HTML and plain text fallback
- Support CC/BCC recipients
- Add 8 comprehensive unit tests with Mock SMTP (all passed)
Phase 4 Task 4/68 completed
- Implement SessionStore class with Redis backend
- Support save/get/delete session and refresh_token
- Support user multi-device sessions management
- Add last_active tracking and force logout all devices
- Add 10 comprehensive unit tests with Mock Redis (all passed)
- Install redis dependency
Phase 4 Task 3/68 completed
- Implement JWTService class with access_token and refresh_token support
- Add token type validation (access vs refresh)
- Add comprehensive unit tests (9 tests all passed)
- Install PyJWT dependency
Phase 4 Task 1/68 completed
- domain: Asset.tags field with add_tag/remove_tag methods
- validation: no empty tags, auto deduplication
- tests: 5 integration tests (add/remove/duplicate/empty/idempotent)
- all 13 tests passing
Xiaoxia AI