feat: implement API security measures phase 1

api/accounts/models.py

@@ -26,4 +26,34 @@ class User(AbstractUser):
         verbose_name_plural = "Users"
 
     def __str__(self) -> str:
-        return self.email
+        return self.email
+
+    @property
+    def is_admin(self) -> bool:
+        """Check if user belongs to the admin group."""
+        return self.groups.filter(name="admin").exists() or self.is_superuser
+
+
+class BlacklistedToken(models.Model):
+    """Stores blacklisted JWT tokens for revocation."""
+
+    jti = models.UUIDField(unique=True, help_text="JWT ID from the token payload")
+    user = models.ForeignKey(
+        User,
+        on_delete=models.CASCADE,
+        related_name="blacklisted_tokens",
+    )
+    created_at = models.DateTimeField(auto_now_add=True)
+    expires_at = models.DateTimeField(help_text="When the token would have naturally expired")
+
+    class Meta:
+        db_table = "accounts_blacklisted_token"
+        verbose_name = "Blacklisted Token"
+        verbose_name_plural = "Blacklisted Tokens"
+        indexes = [
+            models.Index(fields=["jti"]),
+            models.Index(fields=["expires_at"]),
+        ]
+
+    def __str__(self) -> str:
+        return f"Blacklisted {self.jti} (user {self.user_id})"