The Blacklist — Storage, Lift, Audit

CREATE TABLE security_blacklist (
  ip          TEXT PRIMARY KEY,
  reason      TEXT,
  blocked_at  INTEGER NOT NULL
);

@app.post("/admin/security/unblock")
async def unblock(request: Request, ip: str = Form(...)):
    require_admin(request)
    db.execute("DELETE FROM security_blacklist WHERE ip = ?", (ip,))
    db.execute("DELETE FROM security_attempts  WHERE ip = ?", (ip,))
    db.commit()
    return RedirectResponse("/admin/security", status_code=302)

RETRY_BLOCK_TTL = 3600   # 1 hour

def auto_lift_blacklist():
    cutoff = now() - RETRY_BLOCK_TTL
    db.execute("""
      DELETE FROM security_blacklist
      WHERE reason = 'exceeded_retry' AND blocked_at < ?
    """, (cutoff,))
    db.commit()

# Run on app startup; or as a periodic task; or before each login attempt