Add user session management and auditing

models/migrations/migrations.go

@@ -402,6 +402,7 @@ func prepareMigrationTasks() []*migration {
 		newMigration(325, "Fix missed repo_id when migrate attachments", v1_26.FixMissedRepoIDWhenMigrateAttachments),
 		newMigration(326, "Migrate commit status target URL to use run ID and job ID", v1_26.FixCommitStatusTargetURLToUseRunAndJobID),
 		newMigration(327, "Add disabled state to action runners", v1_26.AddDisabledToActionRunner),
+		newMigration(328, "Add database-backed user session tracking", v1_26.AddUserSessionTable),
 	}
 	return preparedMigrations
 }

models/migrations/v1_26/v328.go

@@ -0,0 +1,27 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package v1_26
+
+import "xorm.io/xorm"
+
+func AddUserSessionTable(x *xorm.Engine) error {
+	type UserSession struct {
+		ID             string `xorm:"pk VARCHAR(64)"`
+		UserID         int64  `xorm:"INDEX NOT NULL"`
+		LoginIP        string `xorm:"VARCHAR(45)"`
+		LastIP         string `xorm:"VARCHAR(45)"`
+		PrevIP         string `xorm:"VARCHAR(45)"`
+		UserAgent      string `xorm:"TEXT"`
+		LoginMethod    string `xorm:"VARCHAR(64)"`
+		AuthTokenID    string `xorm:"VARCHAR(64)"`
+		CreatedUnix    int64  `xorm:"INDEX NOT NULL"`
+		LastAccessUnix int64  `xorm:"INDEX NOT NULL"`
+		LogoutUnix     int64  `xorm:"INDEX NOT NULL DEFAULT 0"`
+	}
+
+	_, err := x.SyncWithOptions(xorm.SyncOptions{
+		IgnoreDropIndices: true,
+	}, new(UserSession))
+	return err
+}