fix: restore login throttling after lock expiry

app/security.py

@@ -182,6 +182,7 @@ def authenticate(db: Session, username: str, password: str, settings: Settings)
         return None
     if not valid:
         if locked_until:
+            user.locked_until = None
             user.failed_login_attempts = 0
         user.failed_login_attempts += 1
         if user.failed_login_attempts >= 5:

app/version.py

@@ -1,3 +1,3 @@
-APP_VERSION = "1.2.0"
-FRONTEND_VERSION = "1.2.0"
-BACKEND_VERSION = "1.2.0"
+APP_VERSION = "1.2.1"
+FRONTEND_VERSION = "1.2.1"
+BACKEND_VERSION = "1.2.1"

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "miem-workers"
-version = "1.2.0"
+version = "1.2.1"
 description = "MIEM employees parser, admin API, and web admin"
 requires-python = ">=3.11"
 dependencies = [

tests/test_api.py

@@ -18,7 +18,7 @@ def test_health_returns_versions():
     response = TestClient(app).get("/api/health")
 
     assert response.status_code == 200
-    assert response.json()["backend_version"] == "1.2.0"
+    assert response.json()["backend_version"] == "1.2.1"
 
 
 def test_api_employees_and_stats_require_admin_session():

tests/test_council.py

@@ -223,7 +223,7 @@ def test_public_page_data_minimization_and_safe_links(db_session, export):
         assert "javascript:" not in fragment.text and "private@example.org" not in fragment.text
         assert "javascript:" not in response.text and "private@example.org" not in response.text
         assert "/admin/employees/" not in response.text and "/admin/logout" not in response.text
-        assert "Backend 1.2.0 · Frontend 1.2.0" in response.text
+        assert "Backend 1.2.1 · Frontend 1.2.1" in response.text
         assert "Вход в систему" in response.text
         assert client.get("/admin/directory", follow_redirects=False).status_code in (302, 303, 401, 403)
         assert "Сотрудники не найдены" in client.get("/admin/council?q=missing").text

tests/test_users.py

@@ -205,7 +205,19 @@ def test_csrf_duplicate_user_validation_and_login_throttling(accounts):
     assert login(client, user.username, 'Initial user password').status_code == 401
     user.locked_until = utcnow() - timedelta(minutes=1)
     db.commit()
+    for attempt in range(1, 6):
+        assert login(client, user.username, 'wrong password').status_code == 401
+        db.refresh(user)
+        assert user.failed_login_attempts == attempt
+        assert bool(user.locked_until) == (attempt == 5)
+    assert login(client, user.username, 'Initial user password').status_code == 401
+    db.refresh(user)
+    assert user.failed_login_attempts == 5
+    user.locked_until = utcnow() - timedelta(minutes=1)
+    db.commit()
     assert login(client, user.username, 'Initial user password').status_code == 303
+    db.refresh(user)
+    assert user.failed_login_attempts == 0 and user.locked_until is None
 
 
 def test_bootstrap_admin_first_login_and_changed_password_no_env_fallback(accounts):