-- Brute-force protection: track failed login attempts by IP for rate limiting.
-- Run once: mysql -u root cmr_ecommerce < database/migrate_login_attempts.sql

USE cmr_ecommerce;

CREATE TABLE IF NOT EXISTS login_attempts (
    id BIGINT AUTO_INCREMENT PRIMARY KEY,
    ip_address VARCHAR(45) NOT NULL,
    attempted_at DATETIME NOT NULL DEFAULT CURRENT_TIMESTAMP,
    INDEX idx_login_attempts_ip_time (ip_address, attempted_at)
);