masks-server 0.7.0

data/config/routes.rb

@@ -0,0 +1,152 @@
+Masks::Server::Engine.routes.draw do
+  get "/.well-known/openid-configuration", to: "discovery#openid"
+  get "/.well-known/oauth-authorization-server", to: "discovery#openid"
+  get "/.well-known/jwks.json", to: "discovery#jwks"
+  get "/.well-known/oauth-protected-resource(/*resource)", to: "discovery#resource"
+  get "/.well-known/ssf-configuration", to: "signal_streams#configuration"
+
+  scope "/ssf", controller: :signal_streams, defaults: { format: :json } do
+    get "/streams", action: :show
+    post "/streams", action: :create
+    match "/streams", action: :update, via: %i[patch put]
+    delete "/streams", action: :destroy
+    get "/status", action: :status
+    post "/status", action: :update_status
+    post "/verify", action: :verify
+  end
+
+  post "/ssf/events", to: "received_signals#create", as: :received_signals
+
+  match "/authorize", to: "authorize#show", via: %i[get post], as: :authorize
+  post "/par", to: "pushed_authorizations#create", as: :pushed_authorization
+  post "/device_authorization", to: "device_authorizations#create", as: :device_authorization
+
+  get "/device", to: "device_verifications#show", as: :device_verification
+  post "/device", to: "device_verifications#create", as: :device_code
+
+  get "/themes/:digest.css", to: "themes#show", as: :theme, format: false,
+                             constraints: { digest: /[0-9a-f]{32}/ }
+
+  get "/login", to: "logins#show", as: :login
+  post "/login", to: "logins#update"
+  delete "/login", to: "logins#destroy"
+  get "/login/provider/:key/callback", to: "logins#provider", as: :login_provider_callback
+  post "/login/provider/:key/callback", to: "logins#posted_provider"
+  get "/login/provider/:key/metadata", to: "provider_metadata#show", as: :login_provider_metadata
+  match "/logout", to: "sessions#destroy", via: %i[get post delete], as: :logout
+
+  get "/invite/:token", to: "links#invitation", as: :invitation
+  get "/reset/:token", to: "links#reset", as: :password_reset
+  get "/verify/:token", to: "links#verify", as: :email_verification
+
+  delete "/account", to: "account#destroy", as: :account
+  post "/account/export", to: "account_exports#create", as: :account_export
+  patch "/account/notifications", to: "notifications#update", as: :account_notifications
+  patch "/account/password", to: "passwords#update", as: :account_password
+  patch "/account/profile", to: "profiles#update", as: :account_profile
+  post "/account/verify", to: "verifications#create", as: :account_verification
+
+  post "/account/passkeys/challenge", to: "passkeys#challenge", as: :passkey_challenge
+  post "/account/passkeys", to: "passkeys#create", as: :passkeys
+  delete "/account/passkeys/:id", to: "passkeys#destroy", as: :passkey
+  patch "/account/passkeys/:id", to: "passkeys#update"
+
+  post "/account/authenticator", to: "authenticator_apps#create", as: :account_authenticator
+  delete "/account/authenticator", to: "authenticator_apps#destroy"
+  post "/account/backup_codes", to: "backup_codes#create", as: :account_backup_codes
+
+  scope constraints: { channel: Regexp.union(Masks::Server::Addresses::CHANNELS.keys) } do
+    post "/account/addresses/:channel", to: "addresses#create", as: :account_address
+    patch "/account/addresses/:channel", to: "addresses#update"
+  end
+  delete "/account/addresses/:channel", to: "addresses#destroy", constraints: { channel: "phone" }
+
+  scope constraints: { factor: Regexp.union(Masks::Server::CodeFactors::FACTORS) } do
+    post "/account/codes/:factor", to: "code_factors#create", as: :account_code_factor
+    delete "/account/codes/:factor", to: "code_factors#destroy"
+  end
+
+  post "/account/approve", to: "sign_in_approvals#create", as: :account_approval
+  patch "/account/approve", to: "sign_in_approvals#update"
+
+  patch "/account/devices/:id", to: "devices#update", as: :device
+  delete "/account/devices/:id", to: "devices#destroy"
+
+  post "/account/avatar", to: "avatars#create", as: :account_avatar
+  delete "/account/avatar", to: "avatars#destroy"
+
+  delete "/account/apps/:client_id", to: "apps#destroy", as: :account_app
+  post "/account/connections", to: "connections#create", as: :account_connections
+  delete "/account/connections/:id", to: "connections#detach", as: :account_connection
+  delete "/account/delegations/:id", to: "delegations#destroy", as: :account_delegation
+
+  scope constraints: { key: /[a-z0-9][a-z0-9-]*/ } do
+    post "/account/organizations/:key/members", to: "organization_members#create", as: :account_organization_members
+    patch "/account/organizations/:key/members/:id", to: "organization_members#update", as: :account_organization_member
+    delete "/account/organizations/:key/members/:id", to: "organization_members#destroy"
+    post "/account/organizations/:key/members/:id/resend", to: "organization_members#resend",
+                                                           as: :account_organization_member_resend
+    post "/account/organizations/:key/accept", to: "organization_members#accept", as: :account_organization_acceptance
+  end
+
+  scope constraints: { style: Regexp.union(Masks::Server::Avatars::STYLES), digest: /[0-9a-f]{16}/ } do
+    get "/avatars/:uuid", to: "avatars#show", as: :avatar
+    get "/avatars/:uuid/:style", to: "avatars#show", as: :styled_avatar
+    get "/avatars/:uuid/:style/:digest", to: "avatars#show", as: :stamped_avatar
+  end
+
+  get "/logo", to: "tenant_logos#show", as: :tenant_logo
+  get "/clients/:client_id/logo", to: "client_logos#show", as: :client_logo, constraints: { client_id: %r{[^/]+} }
+
+  get "/handshake", to: "handshakes#show", as: :handshake
+  post "/handshake", to: "handshakes#create"
+
+  post "/token", to: "tokens#create"
+  post "/revoke", to: "revocations#create"
+  post "/introspect", to: "introspections#create"
+  match "/userinfo", to: "userinfo#show", via: %i[get post]
+
+  post "/register", to: "registrations#create"
+  get "/register/:client_id", to: "registrations#show", as: :registration
+  put "/register/:client_id", to: "registrations#update"
+  delete "/register/:client_id", to: "registrations#destroy"
+
+  get "/saml/metadata", to: "saml#metadata", as: :saml_metadata
+  match "/saml/sso", to: "saml#sso", via: %i[get post], as: :saml_sso
+  match "/saml/slo", to: "saml#slo", via: %i[get post], as: :saml_slo
+  get "/saml/resume", to: "saml#resume", as: :saml_resume
+  get "/saml/refused", to: "saml#refused", as: :saml_refused
+  get "/saml/initiate/:client_id", to: "saml#initiate", as: :saml_initiate
+
+  get "/forward-auth", to: "forward_auth#check", as: :forward_auth
+  get "/forward-auth/start", to: "forward_auth#start", as: :forward_auth_start
+  get "/forward-auth/callback", to: "forward_auth#callback", as: :forward_auth_callback
+
+  scope "/scim/v2", module: :scim, defaults: { format: :json } do
+    get "ServiceProviderConfig", to: "metadata#service_provider_config"
+    get "ResourceTypes", to: "metadata#resource_types"
+    get "ResourceTypes/:id", to: "metadata#resource_type"
+    get "Schemas", to: "metadata#schemas"
+    get "Schemas/:id", to: "metadata#schema", constraints: { id: /[^\/]+/ }
+
+    get "Users", to: "users#index"
+    post "Users", to: "users#create"
+    get "Users/:id", to: "users#show"
+    put "Users/:id", to: "users#replace"
+    patch "Users/:id", to: "users#update"
+    delete "Users/:id", to: "users#destroy"
+
+    get "Groups", to: "groups#index"
+    post "Groups", to: "groups#create"
+    get "Groups/:id", to: "groups#show", constraints: { id: %r{[^/]+} }
+    put "Groups/:id", to: "groups#replace", constraints: { id: %r{[^/]+} }
+    patch "Groups/:id", to: "groups#update", constraints: { id: %r{[^/]+} }
+    delete "Groups/:id", to: "groups#destroy", constraints: { id: %r{[^/]+} }
+  end
+
+  post "/manage/graphql", to: "manage/graphql#execute", as: :manage_graphql
+  get "/manage/exports/:token", to: "manage/exports#show", as: :manage_export, constraints: { token: %r{[^/]+} }
+  get "/manage(/*path)", to: "manage#index", as: :manage
+
+  root "account#index"
+end

data/db/authenticators.yml

@@ -0,0 +1,18 @@
+
+adce0002-35bc-c60a-648b-0b25f1f05503: Chrome on Mac
+08987058-cadc-4b81-b6e1-30de50dcbe96: Windows Hello
+9ddd1817-af5a-4672-a2b9-3e3dd95000a9: Windows Hello
+6028b017-b1d4-4c02-b4b3-afcdafc96bb2: Windows Hello
+dd4ec289-e01d-41c9-bb89-70fa845d4bf2: iCloud Keychain (Managed)
+fbfc3007-154e-4ecc-8c0b-6e020557d7bd: iCloud Keychain
+ea9b8d66-4d01-1d21-3ce4-b6b48cb575d4: Google Password Manager
+bada5566-a7aa-401f-bd96-45619a55120d: 1Password
+d548826e-79b4-db40-a3d8-11116f7e8349: Bitwarden
+531126d6-e717-415c-9320-3d9aa6981239: Dashlane
+b84e4048-15dc-4dd0-8640-f4f60813c8af: NordPass
+0ea242b4-43c4-4a1b-8b17-dd6d0b6baec6: Keeper
+f3809540-7f14-49c1-a8b3-8f813b225541: Enpass
+cc45f64e-52a2-451b-831a-4edd8022a202: ToothPic Passkey Provider
+39a5647e-1853-446c-a1f6-a79bae9f5bc7: IDmelon
+50726f74-6f6e-5061-7373-50726f746f6e: Proton Pass
+fdb141b2-5d84-443e-8a35-4698c205a502: KeePassXC

data/db/migrate/20260912000000_create_masks_schema.rb

@@ -0,0 +1,425 @@
+class CreateMasksSchema < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  ISOLATED = %w[
+    signing_keys
+    actors
+    clients
+    tokens
+    sessions
+    consents
+    providers
+    connections
+    passkeys
+    devices
+    device_factors
+    avatars
+    namespaces
+    events
+    subjects
+  ].freeze
+
+  def up
+    if table_exists?(:tenants)
+      raise ActiveRecord::MigrationError,
+            "this database was built by the migrations masks collapsed before 1.0. " \
+            "Dump what it holds, drop it, and let db:prepare load db/structure.sql"
+    end
+
+    enable_extension "pgcrypto" unless extension_enabled?("pgcrypto")
+
+    create_table :tenants do |t|
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.string :subdomain, null: false
+      t.string :name, null: false
+      t.jsonb :settings, null: false, default: {}
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.text :dynamic_client_scopes
+      t.text :pairwise_salt
+      t.string :named_by
+      t.string :dynamic_registration
+      t.string :mail_from
+      t.string :smtp_address
+      t.integer :smtp_port
+      t.string :smtp_username
+      t.text :smtp_password
+      t.string :smtp_authentication
+      t.string :smtp_domain
+      t.boolean :smtp_tls, null: false, default: false
+      t.boolean :browsers_only, null: false, default: false
+      t.text :blocked_agents
+
+      t.index :uuid, unique: true
+      t.index :subdomain, unique: true
+    end
+
+    create_table :actors do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.string :nickname
+      t.string :name
+      t.string :email
+      t.string :password_digest
+      t.text :scopes, null: false, default: ""
+      t.text :otp_secret
+      t.datetime :otp_enabled_at
+      t.datetime :email_verified_at
+      t.datetime :last_login_at
+
+      t.timestamps
+
+      t.string :given_name
+      t.string :family_name
+      t.string :middle_name
+      t.string :profile_url
+      t.string :picture_url
+      t.string :website_url
+      t.string :gender
+      t.string :birthdate
+      t.string :zoneinfo
+      t.string :locale
+      t.jsonb :backup_code_digests, null: false, default: []
+      t.datetime :backup_codes_generated_at
+      t.datetime :activated_at
+      t.string :webauthn_id
+      t.bigint :otp_last_step
+      t.jsonb :muted_notifications, null: false, default: []
+
+      t.check_constraint "nickname IS NOT NULL OR email IS NOT NULL",
+                         name: "actors_are_named"
+
+      t.index :uuid, unique: true
+      t.index [ :tenant_id, :nickname ], unique: true
+      t.index [ :tenant_id, :email ], unique: true
+    end
+
+    create_table :signing_keys do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :kid, null: false
+      t.string :algorithm, null: false, default: "RS256"
+      t.text :private_pem, null: false
+      t.jsonb :public_jwk, null: false
+      t.datetime :activated_at
+      t.datetime :retired_at
+
+      t.timestamps
+
+      t.index [ :tenant_id, :kid ], unique: true
+      t.index [ :tenant_id, :activated_at ]
+    end
+
+    create_table :clients do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :client_id, null: false
+      t.string :secret_digest
+      t.string :name, null: false
+      t.jsonb :redirect_uris, null: false, default: []
+      t.jsonb :grant_types, null: false, default: [ "authorization_code" ]
+      t.jsonb :response_types, null: false, default: [ "code" ]
+      t.jsonb :resources, null: false, default: []
+      t.text :allowed_scopes, null: false, default: ""
+      t.string :token_endpoint_auth_method, null: false, default: "client_secret_basic"
+      t.string :application_type, null: false, default: "web"
+      t.string :client_uri
+      t.string :logo_uri
+      t.string :tos_uri
+      t.string :policy_uri
+      t.boolean :dynamic, null: false, default: false
+      t.string :registration_token_digest
+      t.datetime :secret_expires_at
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.datetime :approved_at
+      t.references :approved_by, foreign_key: { to_table: :actors }
+      t.text :required_scopes, null: false, default: ""
+      t.jsonb :post_logout_redirect_uris, null: false, default: []
+      t.string :backchannel_logout_uri
+      t.boolean :backchannel_logout_session_required, null: false, default: false
+      t.boolean :require_pushed_authorization_requests, null: false, default: false
+      t.string :subject_type, null: false, default: "public"
+      t.string :sector_identifier_uri
+      t.boolean :dpop_bound_access_tokens, null: false, default: false
+
+      t.index [ :tenant_id, :client_id ], unique: true
+      t.index :registration_token_digest
+    end
+
+    create_table :devices do |t|
+      t.references :tenant, null: false, foreign_key: true
+
+      t.string :public_id, null: false
+      t.string :version, null: false
+      t.string :name
+      t.string :user_agent
+      t.string :ip_address
+      t.datetime :last_seen_at, null: false
+      t.datetime :blocked_at
+
+      t.timestamps
+
+      t.index [ :tenant_id, :public_id ], unique: true
+      t.index [ :tenant_id, :last_seen_at ]
+    end
+
+    create_table :device_factors do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :device, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+
+      t.string :factor, null: false
+      t.datetime :satisfied_at, null: false
+      t.datetime :expires_at, null: false
+
+      t.timestamps
+
+      t.index [ :device_id, :actor_id, :factor ],
+              unique: true, name: "index_device_factors_on_device_and_actor_and_factor"
+    end
+
+    create_table :sessions do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+      t.string :digest, null: false
+      t.string :user_agent
+      t.string :ip_address
+      t.datetime :authenticated_at, null: false
+      t.datetime :expires_at, null: false
+      t.datetime :revoked_at
+
+      t.timestamps
+
+      t.jsonb :amr, null: false, default: []
+      t.references :device, foreign_key: true
+      t.string :device_version
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.string :origin
+
+      t.index :digest, unique: true
+      t.index [ :tenant_id, :uuid ], unique: true
+    end
+
+    create_table :tokens do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :kind, null: false
+      t.references :actor, foreign_key: true
+      t.references :client, foreign_key: true
+      t.references :parent, foreign_key: { to_table: :tokens }
+      t.string :digest, null: false
+      t.text :scopes, null: false, default: ""
+      t.jsonb :audience, null: false, default: []
+      t.string :redirect_uri
+      t.string :nonce
+      t.string :code_challenge
+      t.string :code_challenge_method
+      t.datetime :expires_at, null: false
+      t.datetime :consumed_at
+
+      t.timestamps
+
+      t.datetime :authenticated_at
+      t.jsonb :requested_claims
+      t.jsonb :payload
+      t.references :device, foreign_key: true
+      t.references :session, foreign_key: { on_delete: :nullify }
+      t.string :user_code_digest
+      t.string :jkt
+
+      t.index :digest, unique: true
+      t.index [ :tenant_id, :kind, :expires_at ]
+      t.index [ :tenant_id, :user_code_digest ],
+              unique: true, where: "user_code_digest IS NOT NULL"
+    end
+
+    create_table :consents do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+      t.references :client, null: false, foreign_key: true
+      t.text :scopes, null: false, default: ""
+      t.jsonb :audience, null: false, default: []
+      t.datetime :revoked_at
+
+      t.timestamps
+
+      t.index [ :actor_id, :client_id ], unique: true
+    end
+
+    create_table :providers do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :key, null: false
+      t.string :name, null: false
+      t.string :authorization_url, null: false
+      t.string :token_url, null: false
+      t.string :revocation_url
+      t.string :userinfo_url
+      t.string :client_id, null: false
+      t.text :client_secret
+      t.text :scopes, null: false, default: ""
+      t.jsonb :authorize_params, null: false, default: {}
+      t.string :subject_claim, null: false, default: "sub"
+      t.string :label_claim, null: false, default: "email"
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.string :issuer
+      t.string :jwks_uri
+      t.jsonb :jwks, null: false, default: {}
+      t.datetime :jwks_fetched_at
+      t.boolean :signs_in, null: false, default: false
+      t.boolean :provisions, null: false, default: false
+      t.text :email_domains, null: false, default: ""
+      t.text :signup_scopes, null: false, default: ""
+
+      t.index [ :tenant_id, :key ], unique: true
+      t.index [ :tenant_id, :signs_in ]
+    end
+
+    create_table :connections do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :provider, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.string :subject, null: false
+      t.string :label
+      t.text :scopes, null: false, default: ""
+      t.text :refresh_token
+      t.text :access_token
+      t.datetime :access_token_expires_at
+      t.datetime :connected_at
+      t.datetime :revoked_at
+      t.string :revoked_reason
+
+      t.timestamps
+
+      t.string :email
+      t.boolean :email_verified, null: false, default: false
+      t.datetime :signed_in_at
+
+      t.index [ :tenant_id, :provider_id, :subject ], unique: true
+      t.index :uuid, unique: true
+    end
+
+    create_table :passkeys do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+
+      t.string :name
+      t.string :external_id, null: false
+      t.text :public_key, null: false
+      t.bigint :sign_count, null: false, default: 0
+      t.string :aaguid
+      t.boolean :discoverable, null: false, default: false
+      t.boolean :user_verified, null: false, default: false
+      t.datetime :last_used_at
+
+      t.timestamps
+
+      t.index [ :tenant_id, :external_id ], unique: true
+    end
+
+    create_table :authenticators do |t|
+      t.string :aaguid, null: false
+      t.string :name, null: false
+      t.string :source, null: false
+      t.text :icon
+      t.string :certification
+      t.jsonb :statuses, null: false, default: []
+      t.datetime :compromised_at
+
+      t.timestamps
+
+      t.index :aaguid, unique: true
+    end
+
+    create_table :avatars do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+
+      t.string :content_type, null: false
+      t.string :digest, null: false
+      t.integer :byte_size, null: false
+      t.binary :data, null: false
+
+      t.timestamps
+
+      t.index [ :tenant_id, :actor_id ], unique: true
+    end
+
+    create_table :namespaces do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :client, foreign_key: { on_delete: :nullify }
+
+      t.string :name, null: false
+      t.string :resource, null: false
+      t.datetime :claimed_at, null: false
+
+      t.timestamps
+
+      t.index [ :tenant_id, :name ], unique: true
+      t.index [ :tenant_id, :resource ]
+    end
+
+    create_table :events do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :actor, foreign_key: { on_delete: :nullify }
+      t.references :by, foreign_key: { to_table: :actors, on_delete: :nullify }
+      t.references :client, foreign_key: { on_delete: :nullify }
+      t.references :device, foreign_key: { on_delete: :nullify }
+
+      t.string :action, null: false
+      t.string :ip_address
+      t.string :user_agent
+      t.jsonb :details, null: false, default: {}
+
+      t.datetime :created_at, null: false
+
+      t.index [ :tenant_id, :created_at ]
+      t.index [ :tenant_id, :actor_id, :created_at ]
+      t.index [ :tenant_id, :action, :created_at ]
+    end
+
+    create_table :subjects do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: { on_delete: :cascade }
+
+      t.string :sector, null: false
+      t.string :sub, null: false
+
+      t.timestamps
+
+      t.index [ :tenant_id, :actor_id, :sector ], unique: true
+      t.index [ :tenant_id, :sub ], unique: true
+    end
+
+    ISOLATED.each { |table| enable_row_level_security(table) }
+  end
+
+  def down
+    ISOLATED.each { |table| disable_row_level_security(table) }
+
+    %i[
+      subjects
+      events
+      namespaces
+      avatars
+      authenticators
+      passkeys
+      connections
+      providers
+      consents
+      tokens
+      sessions
+      device_factors
+      devices
+      clients
+      signing_keys
+      actors
+      tenants
+    ].each { |table| drop_table(table) }
+  end
+end

data/db/migrate/20260913000000_create_adapters.rb

@@ -0,0 +1,46 @@
+class CreateAdapters < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  SMTP = %i[mail_from smtp_address smtp_port smtp_username smtp_password
+            smtp_authentication smtp_domain smtp_tls].freeze
+
+  def up
+    create_table :adapters do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :service, null: false
+      t.string :kind, null: false
+      t.string :key, null: false
+      t.string :name, null: false
+      t.jsonb :settings, null: false, default: {}
+      t.text :secrets
+      t.boolean :primary, null: false, default: false
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.index %i[tenant_id key], unique: true
+      t.index %i[tenant_id kind], unique: true, where: "\"primary\" AND archived_at IS NULL",
+                                  name: "index_adapters_one_primary_per_kind"
+    end
+
+    enable_row_level_security(:adapters)
+
+    SMTP.each { |column| remove_column :tenants, column }
+  end
+
+  def down
+    disable_row_level_security(:adapters)
+    drop_table :adapters
+
+    change_table :tenants do |t|
+      t.string :mail_from
+      t.string :smtp_address
+      t.integer :smtp_port
+      t.string :smtp_username
+      t.text :smtp_password
+      t.string :smtp_authentication
+      t.string :smtp_domain
+      t.boolean :smtp_tls, null: false, default: false
+    end
+  end
+end

data/db/migrate/20260913010000_create_sign_in_policies.rb

@@ -0,0 +1,44 @@
+class CreateSignInPolicies < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :sign_in_policies do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :key, null: false
+      t.string :name, null: false
+      t.boolean :signup, null: false, default: false
+      t.string :nickname, null: false, default: "optional"
+      t.string :email, null: false, default: "required"
+      t.boolean :email_verified, null: false, default: false
+      t.string :phone, null: false, default: "off"
+      t.boolean :phone_verified, null: false, default: false
+      t.integer :password_minimum, null: false, default: 8
+      t.boolean :refuse_common_passwords, null: false, default: true
+      t.jsonb :first_factors, null: false, default: %w[password passkey provider]
+      t.jsonb :second_factors, null: false, default: %w[otp passkey backup_codes]
+      t.boolean :second_factor_required, null: false, default: false
+      t.jsonb :email_domains, null: false, default: []
+      t.jsonb :providers
+      t.string :confirmation, null: false, default: "none"
+      t.boolean :hidden, null: false, default: false
+      t.text :signup_scopes
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.index %i[tenant_id key], unique: true
+    end
+
+    enable_row_level_security(:sign_in_policies)
+
+    add_reference :tenants, :sign_in_policy, foreign_key: { on_delete: :nullify }
+    add_reference :clients, :sign_in_policy, foreign_key: { on_delete: :nullify }
+  end
+
+  def down
+    remove_reference :clients, :sign_in_policy
+    remove_reference :tenants, :sign_in_policy
+    disable_row_level_security(:sign_in_policies)
+    drop_table :sign_in_policies
+  end
+end