feat(security): implement IP verification and encryption for sensitive tokens

config/schema.sql

@@ -18,6 +18,8 @@ CREATE TABLE IF NOT EXISTS `users` (
   `fociz_widget_layout` TEXT NULL,
   `last_mail_check_at` DATETIME NULL,
   `last_jira_check_at` DATETIME NULL,
+  `last_login_ip` VARCHAR(45) NULL,
+  `last_login_at` DATETIME NULL,
   `created_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
   `updated_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
@@ -257,3 +259,19 @@ CREATE TABLE IF NOT EXISTS `task_subtasks` (
   CONSTRAINT `fk_subtasks_task` FOREIGN KEY (`task_id`) REFERENCES `tasks` (`id`) ON DELETE CASCADE,
   CONSTRAINT `fk_subtasks_user` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
+-- Fociz Beveiliging: Bekende IP-adressen en verificatie per gebruiker
+CREATE TABLE IF NOT EXISTS `user_known_ips` (
+  `id` INT AUTO_INCREMENT PRIMARY KEY,
+  `user_id` INT NOT NULL,
+  `ip_address` VARCHAR(45) NOT NULL,
+  `user_agent` VARCHAR(255) NULL,
+  `is_verified` TINYINT(1) NOT NULL DEFAULT 1,
+  `verify_token` VARCHAR(64) NULL,
+  `verify_token_expires_at` DATETIME NULL,
+  `first_seen_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
+  `last_seen_at` DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP ON UPDATE CURRENT_TIMESTAMP,
+  UNIQUE KEY `uk_user_ip` (`user_id`, `ip_address`),
+  INDEX (`verify_token`),
+  CONSTRAINT `fk_known_ips_user` FOREIGN KEY (`user_id`) REFERENCES `users` (`id`) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;