OTWO-7722 Safeguard JWT auth endpoint against brute force attacks

[bd-vaibhav]

No description provided.

[Copilot]

Pull request overview

Adds account-level lockout tracking to the JWT authentication endpoint to mitigate brute-force login attempts, including persistence of attempt state and user notification when a lockout is triggered.

Changes:

• Adds JWT lockout state to accounts (failed attempt counter, rolling window start, and lock-until timestamp).
• Introduces JwtLoginLockout concern and integrates it into Api::V1::JwtController to enforce lockouts and reset state on success.
• Adds mailer + templates and controller tests covering lockout behavior and notifications.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
test/controllers/api_v1_jwt_controller_test.rb	Adds test coverage for JWT lockout behavior (attempt counting, lock timing, reset semantics, email notification).
db/structure.sql	Updates schema dump to include new account columns; also introduces \restrict/\unrestrict directives and reorders schema_migrations inserts.
db/migrate/20260727000000_add_jwt_lockout_columns_to_accounts.rb	Adds new columns required to persist JWT lockout state on accounts.
config/locales/account_mailer.en.yml	Adds i18n subject for the JWT temporary lockout email.
app/views/account_mailer/notify_jwt_temporary_lockout.text.erb	Adds plaintext lockout notification email body.
app/views/account_mailer/notify_jwt_temporary_lockout.html.erb	Adds HTML lockout notification email body.
app/mailers/account_mailer.rb	Adds notify_jwt_temporary_lockout mailer method.
app/controllers/concerns/jwt_login_lockout.rb	Introduces lockout logic: windowing, increment/reset, lock setting, and notifications.
app/controllers/api/v1/jwt_controller.rb	Integrates lockout checks into JWT auth flow and resets lockout state on successful auth.

Comments suppressed due to low confidence (1)

db/structure.sql:27609

• \unrestrict is also a psql meta-command and has the same portability/noise concerns as the \restrict header. If not required, comment it out or regenerate the dump without these commands.

\unrestrict 18JpI3xcXEwZCu404bBwX6d42bviCgVSHTgUWxl5ABgigAqOQkyUCA9g6HYcmp7

SET search_path TO oh,oa,fis,public;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.