refactor(core): remove user credential length limits

Store usernames and password hashes as text instead of fixed-length
strings so their maximum length is not constrained by the database
schema.

Require every user to have a password hash.

2 files changed, 48 insertions, 3 deletions

diff --git a/migrations/versions/be6e229d6a3d_do_not_limit_username_and_password_hash_.py b/migrations/versions/be6e229d6a3d_do_not_limit_username_and_password_hash_.py
new file mode 100644
index 0000000..ac94095
--- /dev/null
+++ b/migrations/versions/be6e229d6a3d_do_not_limit_username_and_password_hash_.py
@@ -0,0 +1,46 @@
+"""Do not limit username and password hash length
+
+Revision ID: be6e229d6a3d
+Revises: 681a2a9a1bc0
+Create Date: 2026-08-16 20:38:27.992624
+
+"""
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision = 'be6e229d6a3d'
+down_revision = '681a2a9a1bc0'
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.alter_column('username',
+               existing_type=sa.VARCHAR(length=64),
+               type_=sa.Text(),
+               existing_nullable=False)
+        batch_op.alter_column('password_hash',
+               existing_type=sa.VARCHAR(length=256),
+               type_=sa.Text(),
+               nullable=False)
+
+    # ### end Alembic commands ###
+
+
+def downgrade():
+    # ### commands auto generated by Alembic - please adjust! ###
+    with op.batch_alter_table('users', schema=None) as batch_op:
+        batch_op.alter_column('password_hash',
+               existing_type=sa.Text(),
+               type_=sa.VARCHAR(length=256),
+               nullable=True)
+        batch_op.alter_column('username',
+               existing_type=sa.Text(),
+               type_=sa.VARCHAR(length=64),
+               existing_nullable=False)
+
+    # ### end Alembic commands ###
diff --git a/webmentions_ssg/models.py b/webmentions_ssg/models.py
index 02c42ef..b6679e8 100644
--- a/webmentions_ssg/models.py
+++ b/webmentions_ssg/models.py
@@ -3,7 +3,6 @@ from __future__ import annotations
 import uuid
 from datetime import datetime, timezone
 from enum import StrEnum
-from typing import Optional
 
 from flask_login import UserMixin
 from sqlalchemy import (
@@ -33,8 +32,8 @@ class User(UserMixin, Base):
     __tablename__ = "users"
 
     id: Mapped[int] = mapped_column(primary_key=True)
-    username: Mapped[str] = mapped_column(String(64), index=True, unique=True)
-    password_hash: Mapped[Optional[str]] = mapped_column(String(256))
+    username: Mapped[str] = mapped_column(Text(), index=True, unique=True)
+    password_hash: Mapped[str] = mapped_column(Text(), nullable=False)
 
     def __repr__(self) -> str:
         return f"<User {self.username}>"