has_helpers 5.0.2

data/db/migrate/20250606173128_update_notification_alert_length_constraint.rb

@@ -0,0 +1,18 @@
+# frozen_string_literal: true
+
+class UpdateNotificationAlertLengthConstraint < ActiveRecord::Migration[6.1]
+  def change
+    remove_check_constraint :notification_alerts, name: "hqmlc_max_length_na_status"
+    remove_check_constraint :notification_alerts, name: "hqmlc_max_length_na_alert_type"
+
+    add_check_constraint :notification_alerts,
+      "LENGTH(status_id) <= 64",
+      name: "hqmlc_max_length_na_status",
+      validate: false
+
+    add_check_constraint :notification_alerts,
+      "LENGTH(alert_type_id) <= 64",
+      name: "hqmlc_max_length_na_alert_type",
+      validate: false
+  end
+end

data/db/migrate/20250606174043_validate_notification_alert_length_constraints.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class ValidateNotificationAlertLengthConstraints < ActiveRecord::Migration[6.1]
+  def change
+    validate_check_constraint :notification_alerts, name: "hqmlc_max_length_na_status"
+    validate_check_constraint :notification_alerts, name: "hqmlc_max_length_na_alert_type"
+  end
+end

data/db/migrate/20250624183000_add_data_import_alert_type.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+class AddDataImportAlertType < ActiveRecord::Migration[6.1]
+  def up
+    HasHelpers::NotificationAlertType.seed!
+  end
+
+  def down
+    HasHelpers::NotificationAlertType.find_by(name: "DataImport")&.destroy
+  end
+end

data/db/migrate/20250722183935_create_organization_options_table.rb

@@ -0,0 +1,38 @@
+# frozen_string_literal: true
+
+class CreateOrganizationOptionsTable < ActiveRecord::Migration[6.1]
+  def change
+    return if ActiveRecord::Base.connection.table_exists?(:organization_options)
+
+    create_table :organization_options, id: :uuid do |t|
+      t.text        :type
+      t.text        :name
+      t.text        :note
+      t.text        :resource
+      t.text        :option_id
+      t.integer     :organization_id,      null: false
+      t.text        :import_key
+      t.uuid        :created_by_id,        null: false
+      t.uuid        :updated_by_id,        null: false
+      t.datetime    :created_at,           null: false, default: -> { "CLOCK_TIMESTAMP()" }
+      t.datetime    :updated_at,           null: false, default: -> { "CLOCK_TIMESTAMP()" }
+    end
+
+    add_column :organization_options, :is_inactive, :bi_state_boolean
+
+    add_foreign_key :organization_options, :options, column: :option_id, validate: false
+
+    add_org_scoped_foreign_key(from_table: :organization_options, to_table: :user_organizations, from_columns: [:created_by_id], to_columns: [:user_id], name: "org_id_fk_org_options_user_orgs_created_by")
+    add_org_scoped_foreign_key(from_table: :organization_options, to_table: :user_organizations, from_columns: [:updated_by_id], to_columns: [:user_id], name: "org_id_fk_org_options_user_orgs_updated_by")
+
+    add_check_constraint :organization_options, "LENGTH(type) < 128", name: "rgmlc_max_length_type", validate: false
+    add_check_constraint :organization_options, "LENGTH(name) < 128", name: "rgmlc_max_length_name", validate: false
+    add_check_constraint :organization_options, "LENGTH(note) < 128", name: "rgmlc_max_length_note", validate: false
+    add_check_constraint :organization_options, "LENGTH(resource) < 128", name: "rgmlc_max_length_resource", validate: false
+    add_check_constraint :organization_options, "LENGTH(import_key) < 128", name: "rgmlc_max_length_import_key", validate: false
+
+    # we are missing change logs trigger, but readygop do not have it implemented yet
+    # Triggers:
+    # "HQLCT_log_change_organization_options_id" AFTER INSERT OR DELETE OR UPDATE ON organization_options DEFERRABLE INITIALLY DEFERRED FOR EACH ROW EXECUTE FUNCTION "HQLCF_log_change_organization_options_id"()
+  end
+end

data/db/migrate/20250722192724_validate_organization_options_fks_and_constraints.rb

@@ -0,0 +1,32 @@
+# frozen_string_literal: true
+
+class ValidateOrganizationOptionsFksAndConstraints < ActiveRecord::Migration[6.1]
+  def change
+    validate_foreign_key :organization_options, :options, column: :option_id
+
+    validate_foreign_key :organization_options, name: "org_id_fk_org_options_user_orgs_created_by" if fk_exists?("org_id_fk_org_options_user_orgs_created_by")
+    validate_foreign_key :organization_options, name: "org_id_fk_org_options_user_orgs_updated_by" if fk_exists?("org_id_fk_org_options_user_orgs_updated_by")
+
+    validate_check_constraint :organization_options, name: "rgmlc_max_length_type" if constraint_exists?(:organization_options, "rgmlc_max_length_type")
+    validate_check_constraint :organization_options, name: "rgmlc_max_length_name" if constraint_exists?(:organization_options, "rgmlc_max_length_name")
+    validate_check_constraint :organization_options, name: "rgmlc_max_length_note" if constraint_exists?(:organization_options, "rgmlc_max_length_note")
+    validate_check_constraint :organization_options, name: "rgmlc_max_length_resource" if constraint_exists?(:organization_options, "rgmlc_max_length_resource")
+    validate_check_constraint :organization_options, name: "rgmlc_max_length_import_key" if constraint_exists?(:organization_options, "rgmlc_max_length_import_key")
+  end
+
+  def fk_exists?(name)
+    foreign_key_exists?(:organization_options, name: name)
+  end
+
+  def constraint_exists?(table_name, constraint_name)
+    query = <<~SQL
+      SELECT 1
+      FROM information_schema.table_constraints
+      WHERE table_name = '#{table_name}'
+        AND constraint_name = '#{constraint_name}';
+    SQL
+
+    result = ActiveRecord::Base.connection.select_value(query)
+    result.present?
+  end
+end

data/db/migrate/20250722192936_add_indexes_to_organization_options_table.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+class AddIndexesToOrganizationOptionsTable < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+  def change
+    # we are using if_not_exists?: true bc this table already exists in agencies, so it shouldn't run again
+
+    add_index :organization_options, :option_id, algorithm: :concurrently, if_not_exists: true
+    add_index :organization_options, [:organization_id, :id], unique: true, algorithm: :concurrently, if_not_exists: true
+    add_index :organization_options, :type, algorithm: :concurrently, if_not_exists: true
+    add_index :organization_options, [:import_key, :organization_id], unique: true, algorithm: :concurrently, if_not_exists: true
+    add_index :organization_options, [:organization_id, :name, :type, :resource], name: "index_org_options_on_org_id_and_name_and_type_and_resource", unique: true, algorithm: :concurrently, if_not_exists: true
+    add_index :organization_options, :updated_at, algorithm: :concurrently, if_not_exists: true
+  end
+end

data/db/migrate/20250915132448_add_column_restrictions_hash.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddColumnRestrictionsHash < ActiveRecord::Migration[6.1]
+  def change
+    add_column :user_organizations, :restrictions_hash, :jsonb, null: true
+  end
+end

data/db/migrate/20250917143211_add_column_permissions_hash.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddColumnPermissionsHash < ActiveRecord::Migration[6.1]
+  def change
+    add_column :user_organizations, :permissions_hash, :text, null: true
+  end
+end

data/db/migrate/20251001145950_add_trust_this_device.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddTrustThisDevice < ActiveRecord::Migration[6.1]
+  def change
+    add_column :user_sessions, :trust_this_device, :bi_state_boolean, default: nil
+  end
+end

data/db/migrate/20251021130835_add_backend_urls_to_applications_table.rb

@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+class AddBackendUrlsToApplicationsTable < ActiveRecord::Migration[6.1]
+  def change
+    add_column :applications, :development_backend_url, :text
+    add_column :applications, :staging_backend_url, :text
+    add_column :applications, :production_backend_url, :text
+
+    add_check_constraint :applications, "LENGTH(development_backend_url) < 256", name: "hqmlc_max_length_development_backend_url", validate: false
+    add_check_constraint :applications, "LENGTH(staging_backend_url) < 256", name: "hqmlc_max_length_staging_backend_url", validate: false
+    add_check_constraint :applications, "LENGTH(production_backend_url) < 256", name: "hqmlc_max_length_production_backend_url", validate: false
+  end
+end

data/db/migrate/20251021172715_validate_backend_urls_constraints_in_applications.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class ValidateBackendUrlsConstraintsInApplications < ActiveRecord::Migration[6.1]
+  def change
+    validate_check_constraint :applications, name: "hqmlc_max_length_development_backend_url"
+    validate_check_constraint :applications, name: "hqmlc_max_length_staging_backend_url"
+    validate_check_constraint :applications, name: "hqmlc_max_length_production_backend_url"
+  end
+end

data/db/migrate/20251030200020_create_card_definitions.rb

@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+class CreateCardDefinitions < ActiveRecord::Migration[6.1]
+  def change
+    create_table :card_definitions, id: :uuid do |t|
+      t.text :name,        null: false
+      t.text   :identifier_id,  null: false
+      t.text   :layout_type_id, null: false
+      t.text   :variant_id
+      t.text    :description
+      t.column  :is_customizable, :bi_state_boolean, default: nil
+      t.integer :position
+      t.timestamps null: false
+    end
+
+    add_foreign_key :card_definitions, :options, column: :identifier_id,  on_delete: :restrict, validate: false
+    add_foreign_key :card_definitions, :options, column: :layout_type_id, on_delete: :restrict, validate: false
+    add_foreign_key :card_definitions, :options, column: :variant_id,     on_delete: :nullify,  validate: false
+
+    add_index :card_definitions, :created_at
+    add_index :card_definitions, :updated_at
+  end
+end

data/db/migrate/20251030201012_create_card_definition_resources.rb

@@ -0,0 +1,24 @@
+# frozen_string_literal: true
+
+class CreateCardDefinitionResources < ActiveRecord::Migration[6.1]
+  def change
+    create_table :card_definition_resources, id: :uuid do |t|
+      t.uuid    :card_definition_id, null: false
+      t.uuid    :resource_id,        null: false
+      t.column :is_mandatory, :bi_state_boolean, default: nil
+      t.integer :default_position
+      t.timestamps null: false
+
+      t.foreign_key :card_definitions, column: :card_definition_id, on_delete: :cascade
+      t.foreign_key :resources, column: :resource_id, on_delete: :cascade
+    end
+
+    add_index :card_definition_resources, :card_definition_id
+    add_index :card_definition_resources, :resource_id
+
+    add_index :card_definition_resources, [:card_definition_id, :resource_id], unique: true, name: "idx_unique_carddef_resource"
+
+    add_index :card_definition_resources, :created_at
+    add_index :card_definition_resources, :updated_at
+  end
+end

data/db/migrate/20251030201236_create_card_fields.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+class CreateCardFields < ActiveRecord::Migration[6.1]
+  def change
+    create_table :card_fields, id: :uuid do |t|
+      t.uuid    :card_definition_id, null: false
+      t.uuid    :field_id
+      t.text    :field_custom_name
+      t.text    :field_custom_key_id
+      t.text    :data_type_id, null: false
+
+      t.column :is_required, :bi_state_boolean, default: nil
+      t.integer :default_position
+      t.column :default_visibility, :bi_state_boolean, default: true
+      t.timestamps
+
+      t.foreign_key :card_definitions, column: :card_definition_id, on_delete: :cascade
+      t.foreign_key :resources, column: :field_id, on_delete: :cascade
+    end
+
+    add_foreign_key :card_fields, :options, column: :field_custom_key_id,  on_delete: :cascade, validate: false
+    add_foreign_key :card_fields, :options, column: :data_type_id,  on_delete: :restrict, validate: false
+
+    add_index :card_fields, :card_definition_id
+    add_index :card_fields, :field_id
+
+    add_index :card_fields, [:card_definition_id, :default_position], name: "idx_card_fields_sorting"
+    add_index :card_fields, [:card_definition_id, :field_custom_key_id], unique: true, name: "idx_unique_card_field_key"
+    add_index :card_fields, [:card_definition_id, :field_id], unique: true, name: "idx_unique_card_field"
+
+    add_index :card_fields, :created_at
+    add_index :card_fields, :updated_at
+  end
+end

data/db/migrate/20251103194317_create_role_resource_cards.rb

@@ -0,0 +1,37 @@
+# frozen_string_literal: true
+
+class CreateRoleResourceCards < ActiveRecord::Migration[6.1]
+  def change
+    create_table :role_resource_cards, id: :uuid do |t|
+      t.uuid      :role_id,            null: false
+      t.uuid      :resource_id,        null: false
+      t.uuid      :card_definition_id, null: false
+      t.integer   :organization_id,    null: false
+      t.column    :is_visible, :bi_state_boolean, default: true
+      t.integer   :position
+      t.uuid      :created_by_id,      null: false
+      t.uuid      :updated_by_id,      null: false
+      t.timestamps
+
+      t.foreign_key :roles, column: :role_id, on_delete: :cascade
+      t.foreign_key :resources, column: :resource_id, on_delete: :cascade
+      t.foreign_key :card_definitions, column: :card_definition_id, on_delete: :cascade
+
+      t.foreign_key :organizations, column: :organization_id, validate: false
+    end
+
+
+    add_index :role_resource_cards, :role_id
+    add_index :role_resource_cards, :resource_id
+    add_index :role_resource_cards, :card_definition_id
+
+    add_index :role_resource_cards, [:organization_id, :role_id, :resource_id, :card_definition_id], unique: true, name: "idx_unique_rrc_scope" # Only one config per org-role-resource-carddef
+    add_index :role_resource_cards, [:role_id, :resource_id, :position], name: "idx_rrc_sorting" # Depending on the frontend sorting needs
+
+    add_index :role_resource_cards, :created_at
+    add_index :role_resource_cards, :updated_at
+
+    add_org_scoped_foreign_key from_table: :role_resource_cards, to_table: :user_organizations, from_columns: :created_by_id, to_columns: :user_id
+    add_org_scoped_foreign_key from_table: :role_resource_cards, to_table: :user_organizations, from_columns: :updated_by_id, to_columns: :user_id
+  end
+end

data/db/migrate/20251103194426_create_role_card_fields.rb

@@ -0,0 +1,34 @@
+# frozen_string_literal: true
+
+class CreateRoleCardFields < ActiveRecord::Migration[6.1]
+  def change
+    create_table :role_card_fields, id: :uuid do |t|
+      t.uuid    :role_resource_card_id, null: false
+      t.uuid    :card_field_id,         null: false
+      t.integer :organization_id,       null: false
+      t.column :is_visible, :bi_state_boolean, default: true
+      t.integer :position
+      t.uuid :created_by_id,          null: false
+      t.uuid :updated_by_id,          null: false
+      t.timestamps
+
+      t.foreign_key :role_resource_cards, column: :role_resource_card_id, on_delete: :cascade
+      t.foreign_key :card_fields, column: :card_field_id, on_delete: :cascade
+
+      t.foreign_key :organizations, column: :organization_id, validate: false
+    end
+
+    add_index :role_card_fields, :role_resource_card_id
+    add_index :role_card_fields, :card_field_id
+    add_index :role_card_fields, :organization_id
+
+    add_index :role_card_fields, [:role_resource_card_id, :card_field_id], unique: true, name: "idx_unique_rcf_scope" # Avoid same field multiple times in a card
+    add_index :role_card_fields, [:role_resource_card_id, :position], name: "idx_rcf_sorting"
+
+    add_index :role_card_fields, :created_at
+    add_index :role_card_fields, :updated_at
+
+    add_org_scoped_foreign_key from_table: :role_card_fields, to_table: :user_organizations, from_columns: :created_by_id, to_columns: :user_id
+    add_org_scoped_foreign_key from_table: :role_card_fields, to_table: :user_organizations, from_columns: :updated_by_id, to_columns: :user_id
+  end
+end

data/db/migrate/20251107173218_validate_columns_from_cards.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class ValidateColumnsFromCards < ActiveRecord::Migration[6.1]
+  def change
+    # role_resource_cards
+    validate_foreign_key :role_resource_cards, :organizations, column: :organization_id
+
+    # card_fields
+    validate_foreign_key :card_fields, :options, column: :field_custom_key_id
+    validate_foreign_key :card_fields, :options, column: :data_type_id
+
+    # card_definitions
+    validate_foreign_key :card_definitions, :options, column: :identifier_id
+    validate_foreign_key :card_definitions, :options, column: :layout_type_id
+    validate_foreign_key :card_definitions, :options, column: :variant_id
+  end
+end

data/db/migrate/20251111173212_add_column_application_array.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddColumnApplicationArray < ActiveRecord::Migration[6.1]
+  def change
+    add_column :user_organizations, :applications_array, :string, array: true, default: [], null: false
+  end
+end

data/db/migrate/20251112203326_add_card_types.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddCardTypes < ActiveRecord::Migration[6.1]
+  def change
+    ::HasHelpers::Cards::CardDataType.seed!
+    ::HasHelpers::Cards::CardIdentifier.seed!
+    ::HasHelpers::Cards::CardLayoutType.seed!
+    ::HasHelpers::Cards::CardVariantType.seed!
+  end
+end

data/db/migrate/20251115120000_add_virtual_cards_support.rb

@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+class AddVirtualCardsSupport < ActiveRecord::Migration[6.1]
+  def up
+    safety_assured do
+      change_table :card_definitions, bulk: true do |t|
+        t.jsonb  :definition_json
+        t.text   :definition_checksum
+        t.column :is_virtual, :bi_state_boolean
+      end
+
+      remove_foreign_key :card_fields, column: :field_custom_key_id rescue nil
+      remove_index :card_fields, name: "idx_unique_card_field_key" rescue nil
+
+      change_table :card_fields, bulk: true do |t|
+        t.text :virtual_ref
+        t.remove :field_custom_key_id
+      end
+
+      add_index :card_fields, [:card_definition_id, :field_custom_name], unique: true, name: "idx_unique_card_field_custom_name"
+      add_index :card_fields, [:card_definition_id, :virtual_ref], unique: true, name: "idx_unique_card_field_virtual"
+    end
+  end
+
+  def down
+    raise ActiveRecord::IrreversibleMigration, "This migration is irreversible"
+  end
+end

data/db/migrate/20251202231256_add_org_scoped_fk_role_resource_cards_to_roles.rb

@@ -0,0 +1,14 @@
+# frozen_string_literal: true
+
+class AddOrgScopedFkRoleResourceCardsToRoles < ActiveRecord::Migration[6.1]
+  def change
+    remove_foreign_key :role_resource_cards, :roles
+
+    add_org_scoped_foreign_key(
+      from_table:   :role_resource_cards,
+      to_table:     :roles,
+      from_columns: :role_id,
+      to_columns:   :id
+    )
+  end
+end

data/db/migrate/20260105134504_add_accessor_field_resource_type.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddAccessorFieldResourceType < ActiveRecord::Migration[6.1]
+  def change
+    HasHelpers::ResourceType.seed!
+  end
+end

data/db/migrate/20260115123000_add_default_visibility_to_card_definitions.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddDefaultVisibilityToCardDefinitions < ActiveRecord::Migration[6.1]
+  def change
+    add_column :card_definitions, :default_visibility, :bi_state_boolean
+
+    ::HasHelpers::Cards::CardLayoutType.seed!
+  end
+end

data/db/migrate/20260120175037_is_new_admin.rb

@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class IsNewAdmin < ActiveRecord::Migration[6.1]
+  def change
+    safety_assured do
+      add_column :organizations, :is_new_admin, :bi_state_boolean, default: nil
+    end
+  end
+end

data/db/migrate/20260122392008_add_stats_table.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddStatsTable < ActiveRecord::Migration[6.1]
+  def change
+    # rubocop:disable Rails/CreateTableWithTimestamps
+    create_table :stats, id: :serial, if_not_exists: true do |t|
+      t.string      :maintype,    null: false,   limit: 32
+      t.string      :subtype,     limit: 32
+      t.string      :name,        null: false,   limit: 256
+      t.interval    :duration
+      t.jsonb       :data,        null: false,   default: "{}"
+      t.timestamp   :created_at,  null: false,   default: -> { "CURRENT_TIMESTAMP" }
+      t.timestamp   :updated_at,  null: false,   default: -> { "CURRENT_TIMESTAMP" }
+    end
+    # rubocop:enable Rails/CreateTableWithTimestamps
+  end
+end

data/db/migrate/20260414204718_add_index_to_stats_table.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddIndexToStatsTable < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+  def change
+    return unless ActiveRecord::Base.connection.column_exists?(:stats, :maintype)
+    add_index :stats, [:maintype, :subtype, :created_at], algorithm: :concurrently
+    add_index :stats, [:maintype, :subtype, :name], algorithm: :concurrently
+  end
+end

data/db/migrate/20260509120000_create_service_trust_keys.rb

@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+class CreateServiceTrustKeys < ActiveRecord::Migration[6.1]
+  def change
+    create_table :service_trust_keys, id: :uuid, if_not_exists: true do |t|
+      t.string :kid, null: false
+      t.string :environment, null: false
+      t.text :private_key_pem, null: false
+      t.text :public_key_pem, null: false
+      t.string :algorithm, null: false, default: "RS256"
+      t.boolean :active, null: false, default: true
+      t.datetime :verifiable_until
+      t.datetime :retired_at
+      t.timestamps
+    end
+
+    add_index :service_trust_keys, [:environment, :active], if_not_exists: true
+    add_index :service_trust_keys, [:environment, :kid], unique: true, if_not_exists: true
+    add_index :service_trust_keys, :environment,
+              unique: true,
+              where: "active = TRUE AND retired_at IS NULL",
+              name: "idx_service_trust_keys_one_active_per_env",
+              if_not_exists: true
+  end
+end

data/db/migrate/20260509120001_create_service_trust_audit_logs.rb

@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+class CreateServiceTrustAuditLogs < ActiveRecord::Migration[6.1]
+  def change
+    # rubocop:disable Rails/CreateTableWithTimestamps
+    create_table :service_trust_audit_logs, id: :uuid, if_not_exists: true do |t|
+      t.string :issuer, null: false
+      t.string :audience, null: false
+      t.string :subject
+      t.string :jti
+      t.string :kid
+      t.string :outcome, null: false
+      t.string :rejection_reason
+      t.string :remote_ip
+      t.string :user_agent
+      t.datetime :token_iat
+      t.datetime :token_exp
+      t.datetime :occurred_at, null: false
+    end
+    # rubocop:enable Rails/CreateTableWithTimestamps
+
+    add_index :service_trust_audit_logs, :occurred_at, if_not_exists: true
+    add_index :service_trust_audit_logs, [:issuer, :occurred_at], if_not_exists: true
+    add_index :service_trust_audit_logs, :jti, if_not_exists: true
+  end
+end

data/db/migrate/20260511120000_add_direction_to_service_trust_audit_logs.rb

@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+class AddDirectionToServiceTrustAuditLogs < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+
+  def up
+    add_column :service_trust_audit_logs, :direction, :string, null: false, default: "inbound", if_not_exists: true
+    add_column :service_trust_audit_logs, :capabilities, :string, if_not_exists: true
+    add_index :service_trust_audit_logs, :direction, if_not_exists: true, algorithm: :concurrently
+  end
+
+  def down
+    remove_index :service_trust_audit_logs, :direction, algorithm: :concurrently if index_exists?(:service_trust_audit_logs, :direction)
+    remove_column :service_trust_audit_logs, :capabilities if column_exists?(:service_trust_audit_logs, :capabilities)
+    remove_column :service_trust_audit_logs, :direction if column_exists?(:service_trust_audit_logs, :direction)
+  end
+end

data/db/migrate/20260511121000_remove_role_fk_from_role_resource_cards.rb

@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class RemoveRoleFkFromRoleResourceCards < ActiveRecord::Migration[6.1]
+  ORG_SCOPED_FK_NAME = "org_id_fk_9151571ff8884e5c1639ec9cb52200f0"
+
+  def up
+    safety_assured { execute "ALTER TABLE role_resource_cards DROP CONSTRAINT IF EXISTS #{ORG_SCOPED_FK_NAME}" }
+    remove_foreign_key :role_resource_cards, :roles if foreign_key_exists?(:role_resource_cards, :roles)
+  end
+
+  def down
+    add_org_scoped_foreign_key(
+      from_table:   :role_resource_cards,
+      to_table:     :roles,
+      from_columns: :role_id,
+      to_columns:   :id
+    )
+  end
+end

data/db/migrate/20260511121001_add_disabled_at_to_role_resource_cards.rb

@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddDisabledAtToRoleResourceCards < ActiveRecord::Migration[6.1]
+  disable_ddl_transaction!
+
+  def change
+    add_column :role_resource_cards, :disabled_at, :datetime unless column_exists?(:role_resource_cards, :disabled_at)
+    add_index :role_resource_cards, :disabled_at, algorithm: :concurrently, if_not_exists: true
+  end
+end

data/db/migrate/20260605120100_seed_hover_card_options.rb

@@ -0,0 +1,8 @@
+# frozen_string_literal: true
+
+class SeedHoverCardOptions < ActiveRecord::Migration[6.1]
+  def change
+    ::HasHelpers::Cards::CardDataType.seed!
+    ::HasHelpers::Cards::CardLayoutType.seed!
+  end
+end

data/db/migrate/20260608120000_seed_badge_list_card_data_type.rb

@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class SeedBadgeListCardDataType < ActiveRecord::Migration[6.1]
+  def change
+    ::HasHelpers::Cards::CardDataType.seed!
+  end
+end

data/db/migrate/20260727000000_add_two_factor_trust_id_to_user_sessions.rb

@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+# Stores the FusionAuth two-factor "trust" identifier returned when a user opts to
+# trust the device during MFA
+class AddTwoFactorTrustIdToUserSessions < ActiveRecord::Migration[6.1]
+  def change
+    unless column_exists?(:user_sessions, :two_factor_trust_id)
+      add_column :user_sessions, :two_factor_trust_id, :text
+    end
+  end
+end

data/db/seeds.rb

@@ -0,0 +1,14 @@
+# typed: strict
+# frozen_string_literal: true
+
+if ActiveRecord::Base.connection.tables.include?("options")
+  [
+    ::Color,
+    ::FileFormat,
+    ::Icon,
+  ].each(&:seed!)
+end
+
+::HasHelpers::ResourceType.seed!
+::HasHelpers::LinkType.seed!
+::TimeZone.seed! if ActiveRecord::Base.connection.tables.include?("time_zones")