masks-server 0.7.0

data/db/migrate/20260913020000_add_signup_to_actors.rb

@@ -0,0 +1,10 @@
+class AddSignupToActors < ActiveRecord::Migration[8.1]
+  def change
+    add_column :actors, :phone, :string
+    add_column :actors, :phone_verified_at, :datetime
+    add_column :actors, :signed_up_at, :datetime
+    add_column :actors, :pending_approval_at, :datetime
+
+    add_index :actors, %i[tenant_id phone], unique: true, where: "phone IS NOT NULL"
+  end
+end

data/db/migrate/20260913030000_add_consent_required_to_clients.rb

@@ -0,0 +1,5 @@
+class AddConsentRequiredToClients < ActiveRecord::Migration[8.1]
+  def change
+    add_column :clients, :consent_required, :boolean, null: false, default: true
+  end
+end

data/db/migrate/20260913040000_remove_upstream_tokens.rb

@@ -0,0 +1,9 @@
+class RemoveUpstreamTokens < ActiveRecord::Migration[8.1]
+  def change
+    remove_column :connections, :access_token, :text
+    remove_column :connections, :refresh_token, :text
+    remove_column :connections, :access_token_expires_at, :datetime
+    remove_column :connections, :scopes, :text, null: false, default: ""
+    remove_column :providers, :revocation_url, :string
+  end
+end

data/db/migrate/20260913050000_add_role_to_providers.rb

@@ -0,0 +1,23 @@
+class AddRoleToProviders < ActiveRecord::Migration[8.1]
+  def up
+    add_column :providers, :role, :string, null: false, default: "credential"
+    add_column :providers, :trusts_email, :boolean, null: false, default: false
+
+    execute "UPDATE providers SET role = 'delegate' WHERE provisions"
+
+    remove_index :providers, %i[tenant_id signs_in], if_exists: true
+    remove_column :providers, :signs_in
+    remove_column :providers, :provisions
+  end
+
+  def down
+    add_column :providers, :signs_in, :boolean, null: false, default: false
+    add_column :providers, :provisions, :boolean, null: false, default: false
+
+    execute "UPDATE providers SET provisions = (role = 'delegate'), signs_in = (issuer IS NOT NULL)"
+
+    add_index :providers, %i[tenant_id signs_in]
+    remove_column :providers, :trusts_email
+    remove_column :providers, :role
+  end
+end

data/db/migrate/20260913060000_add_protocols_to_providers.rb

@@ -0,0 +1,19 @@
+class AddProtocolsToProviders < ActiveRecord::Migration[8.1]
+  def change
+    add_column :providers, :protocol, :string, null: false, default: "oidc"
+    add_column :providers, :preset, :string
+    add_column :providers, :claims, :jsonb, null: false, default: {}
+    add_column :providers, :emails_url, :string
+    add_column :providers, :token_auth_method, :string, null: false, default: "client_secret_post"
+    add_column :providers, :response_mode, :string
+    add_column :providers, :team_id, :string
+    add_column :providers, :key_id, :string
+    add_column :providers, :private_key, :text
+
+    remove_column :providers, :label_claim, :string, null: false, default: "email"
+
+    change_column_null :providers, :authorization_url, true
+    change_column_null :providers, :token_url, true
+    change_column_null :providers, :client_id, true
+  end
+end

data/db/migrate/20260913070000_add_saml_to_providers.rb

@@ -0,0 +1,10 @@
+class AddSamlToProviders < ActiveRecord::Migration[8.1]
+  def change
+    add_column :providers, :idp_entity_id, :string
+    add_column :providers, :idp_sso_url, :string
+    add_column :providers, :idp_certificates, :text
+    add_column :providers, :metadata_url, :string
+    add_column :providers, :metadata_fetched_at, :datetime
+    add_column :providers, :name_id_format, :string
+  end
+end

data/db/migrate/20260913080000_grant_identities_to_actors.rb

@@ -0,0 +1,14 @@
+class GrantIdentitiesToActors < ActiveRecord::Migration[8.1]
+  def up
+    execute <<~SQL
+      UPDATE actors
+         SET scopes = btrim(scopes || ' identities')
+       WHERE ' ' || scopes || ' ' LIKE '% openid %'
+         AND ' ' || scopes || ' ' NOT LIKE '% identities %'
+    SQL
+  end
+
+  def down
+    execute "UPDATE actors SET scopes = btrim(regexp_replace(' ' || scopes || ' ', ' identities ', ' '))"
+  end
+end

data/db/migrate/20260913090000_create_delegations.rb

@@ -0,0 +1,56 @@
+class CreateDelegations < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    change_table :providers do |t|
+      t.boolean :delegates, null: false, default: false
+      t.string :delegated_scopes, null: false, default: ""
+      t.jsonb :delegation_params, null: false, default: {}
+      t.string :resource_url
+      t.string :registration_url
+      t.datetime :registered_at
+    end
+
+    change_table :connections do |t|
+      t.text :access_token
+      t.text :refresh_token
+      t.datetime :access_token_expires_at
+      t.string :delegated_scopes
+      t.datetime :tokens_refreshed_at
+    end
+
+    create_table :delegations do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.references :client, null: false, foreign_key: true
+      t.references :actor, null: false, foreign_key: true
+      t.references :connection, null: false, foreign_key: true
+      t.string :scopes, null: false, default: ""
+      t.datetime :consented_at, null: false
+      t.datetime :released_at
+      t.datetime :revoked_at
+      t.string :revoked_reason
+
+      t.timestamps
+
+      t.index %i[tenant_id uuid], unique: true
+      t.index %i[client_id actor_id connection_id], unique: true, where: "revoked_at IS NULL",
+                                                    name: "index_delegations_one_live"
+    end
+
+    enable_row_level_security(:delegations)
+  end
+
+  def down
+    disable_row_level_security(:delegations)
+    drop_table :delegations
+
+    change_table :connections do |t|
+      t.remove :access_token, :refresh_token, :access_token_expires_at, :delegated_scopes, :tokens_refreshed_at
+    end
+
+    change_table :providers do |t|
+      t.remove :delegates, :delegated_scopes, :delegation_params, :resource_url, :registration_url, :registered_at
+    end
+  end
+end

data/db/migrate/20260914000000_add_keys_to_clients.rb

@@ -0,0 +1,8 @@
+class AddKeysToClients < ActiveRecord::Migration[8.1]
+  def change
+    change_table :clients do |t|
+      t.jsonb :jwks
+      t.string :jwks_uri
+    end
+  end
+end

data/db/migrate/20260914010000_add_require_signed_request_object_to_clients.rb

@@ -0,0 +1,5 @@
+class AddRequireSignedRequestObjectToClients < ActiveRecord::Migration[8.1]
+  def change
+    add_column :clients, :require_signed_request_object, :boolean, null: false, default: false
+  end
+end

data/db/migrate/20260914020000_add_provisioning_to_actors.rb

@@ -0,0 +1,10 @@
+class AddProvisioningToActors < ActiveRecord::Migration[8.1]
+  def change
+    change_table :actors do |t|
+      t.string :external_id
+      t.datetime :suspended_at
+
+      t.index %i[tenant_id external_id], unique: true, where: "external_id IS NOT NULL"
+    end
+  end
+end

data/db/migrate/20260914030000_add_saml_to_clients.rb

@@ -0,0 +1,17 @@
+class AddSamlToClients < ActiveRecord::Migration[8.1]
+  def change
+    change_table :clients do |t|
+      t.string :protocol, null: false, default: "oidc"
+      t.string :saml_entity_id
+      t.text :saml_certificate
+      t.string :saml_name_id_format
+      t.boolean :saml_requests_signed, null: false, default: false
+      t.boolean :saml_idp_initiated, null: false, default: false
+      t.jsonb :saml_attributes, null: false, default: {}
+
+      t.index %i[tenant_id saml_entity_id], unique: true, where: "saml_entity_id IS NOT NULL"
+    end
+
+    add_column :signing_keys, :certificate_pem, :text
+  end
+end

data/db/migrate/20260921000000_create_client_logos.rb

@@ -0,0 +1,30 @@
+class CreateClientLogos < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :client_logos do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :client, null: false, foreign_key: true
+      t.string :source_uri, null: false
+      t.string :content_type, null: false
+      t.string :digest, null: false
+      t.integer :byte_size, null: false
+      t.binary :data, null: false
+
+      t.timestamps
+
+      t.index %i[tenant_id client_id], unique: true
+    end
+
+    enable_row_level_security(:client_logos)
+
+    add_column :clients, :logo_digest, :string
+  end
+
+  def down
+    remove_column :clients, :logo_digest
+
+    disable_row_level_security(:client_logos)
+    drop_table :client_logos
+  end
+end

data/db/migrate/20260921010000_add_setup_token_to_tenants.rb

@@ -0,0 +1,5 @@
+class AddSetupTokenToTenants < ActiveRecord::Migration[8.1]
+  def change
+    add_column :tenants, :setup_token, :text
+  end
+end

data/db/migrate/20260926000000_add_code_factors_to_actors.rb

@@ -0,0 +1,8 @@
+class AddCodeFactorsToActors < ActiveRecord::Migration[8.1]
+  def change
+    change_table :actors do |t|
+      t.datetime :email_factor_at
+      t.datetime :phone_factor_at
+    end
+  end
+end

data/db/migrate/20260926010000_add_idle_accounts.rb

@@ -0,0 +1,14 @@
+class AddIdleAccounts < ActiveRecord::Migration[8.1]
+  def change
+    change_table :tenants do |t|
+      t.integer :suspend_after
+      t.integer :delete_after
+    end
+
+    change_table :actors do |t|
+      t.datetime :last_active_at
+      t.datetime :idle_warned_at
+      t.string :suspension_reason
+    end
+  end
+end

data/db/migrate/20260926020000_create_event_streams.rb

@@ -0,0 +1,28 @@
+class CreateEventStreams < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :event_streams do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.string :key, null: false
+      t.string :name, null: false
+      t.string :url, null: false
+      t.text :secret, null: false
+      t.jsonb :actions, null: false, default: []
+      t.datetime :last_delivered_at
+      t.string :last_failure
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.index %i[tenant_id key], unique: true
+    end
+
+    enable_row_level_security(:event_streams)
+  end
+
+  def down
+    disable_row_level_security(:event_streams)
+    drop_table :event_streams
+  end
+end

data/db/migrate/20260927000000_add_apps_require_second_factor_to_sign_in_policies.rb

@@ -0,0 +1,5 @@
+class AddAppsRequireSecondFactorToSignInPolicies < ActiveRecord::Migration[8.1]
+  def change
+    add_column :sign_in_policies, :apps_require_second_factor, :boolean, null: false, default: false
+  end
+end

data/db/migrate/20260927010000_add_session_policies.rb

@@ -0,0 +1,14 @@
+class AddSessionPolicies < ActiveRecord::Migration[8.1]
+  def change
+    change_table :sign_in_policies do |t|
+      t.integer :session_lifetime
+      t.integer :session_idle_timeout
+    end
+
+    change_table :sessions do |t|
+      t.datetime :last_seen_at
+      t.integer :idle_timeout
+      t.boolean :bounded, null: false, default: false
+    end
+  end
+end

data/db/migrate/20260927020000_create_organizations.rb

@@ -0,0 +1,47 @@
+class CreateOrganizations < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :organizations do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.string :key, null: false
+      t.string :name, null: false
+      t.jsonb :roles, null: false, default: []
+      t.datetime :archived_at
+
+      t.timestamps
+
+      t.index %i[tenant_id key], unique: true
+      t.index %i[tenant_id uuid], unique: true
+    end
+
+    create_table :memberships do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :organization, null: false, foreign_key: { on_delete: :cascade }
+      t.references :actor, null: false, foreign_key: { on_delete: :cascade }
+      t.references :invited_by, foreign_key: { to_table: :actors, on_delete: :nullify }
+      t.string :role, null: false
+      t.boolean :provisioned, null: false, default: false
+      t.boolean :pending, null: false, default: false
+      t.string :invited_as
+
+      t.timestamps
+
+      t.index %i[organization_id actor_id], unique: true
+    end
+
+    add_reference :tokens, :organization, foreign_key: { on_delete: :cascade }
+
+    enable_row_level_security(:organizations)
+    enable_row_level_security(:memberships)
+  end
+
+  def down
+    remove_reference :tokens, :organization
+    disable_row_level_security(:memberships)
+    disable_row_level_security(:organizations)
+    drop_table :memberships
+    drop_table :organizations
+  end
+end

data/db/migrate/20260927030000_add_organizations_to_policies_and_providers.rb

@@ -0,0 +1,12 @@
+class AddOrganizationsToPoliciesAndProviders < ActiveRecord::Migration[8.1]
+  def change
+    add_reference :organizations, :sign_in_policy, foreign_key: { on_delete: :nullify }
+
+    change_table :providers do |t|
+      t.references :organization, foreign_key: { on_delete: :cascade }
+      t.string :role_claim
+      t.jsonb :role_map, null: false, default: {}
+      t.string :unmapped_role
+    end
+  end
+end

data/db/migrate/20260927040000_add_organizations_to_events_and_streams.rb

@@ -0,0 +1,8 @@
+class AddOrganizationsToEventsAndStreams < ActiveRecord::Migration[8.1]
+  def change
+    add_reference :events, :organization, foreign_key: { on_delete: :nullify }, index: false
+    add_index :events, %i[tenant_id organization_id created_at]
+
+    add_reference :event_streams, :organization, foreign_key: { on_delete: :cascade }
+  end
+end

data/db/migrate/20260927050000_create_domain_claims.rb

@@ -0,0 +1,27 @@
+class CreateDomainClaims < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :domain_claims do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :provider, foreign_key: { on_delete: :nullify }
+      t.string :domain, null: false
+      t.string :token, null: false
+      t.datetime :verified_at
+      t.datetime :checked_at
+      t.datetime :missing_since
+
+      t.timestamps
+
+      t.index %i[tenant_id domain], unique: true
+      t.index :domain, unique: true, where: "verified_at IS NOT NULL", name: "index_domain_claims_verified_once"
+    end
+
+    enable_row_level_security(:domain_claims)
+  end
+
+  def down
+    disable_row_level_security(:domain_claims)
+    drop_table :domain_claims
+  end
+end

data/db/migrate/20260927060000_add_event_retention_to_tenants.rb

@@ -0,0 +1,5 @@
+class AddEventRetentionToTenants < ActiveRecord::Migration[8.1]
+  def change
+    add_column :tenants, :event_retention_days, :integer
+  end
+end

data/db/migrate/20260927070000_add_risk_to_sign_in_policies.rb

@@ -0,0 +1,11 @@
+class AddRiskToSignInPolicies < ActiveRecord::Migration[8.1]
+  def change
+    change_table :sign_in_policies do |t|
+      t.boolean :refuse_breached_passwords, null: false, default: false
+      t.integer :risk_step_up_at
+      t.integer :risk_refuse_at
+    end
+
+    add_column :tenants, :risky_networks, :text
+  end
+end

data/db/migrate/20260927110000_create_signal_streams.rb

@@ -0,0 +1,31 @@
+class CreateSignalStreams < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :signal_streams do |t|
+      t.references :tenant, null: false, foreign_key: true
+      t.references :client, null: false, foreign_key: { on_delete: :cascade }, index: { unique: true }
+      t.uuid :uuid, null: false, default: -> { "gen_random_uuid()" }
+      t.string :issuer, null: false
+      t.string :endpoint_url, null: false
+      t.text :authorization_header
+      t.jsonb :events_requested, null: false, default: []
+      t.string :status, null: false, default: "enabled"
+      t.string :status_reason
+      t.string :description
+      t.datetime :last_delivered_at
+      t.string :last_failure
+
+      t.timestamps
+
+      t.index %i[tenant_id uuid], unique: true
+    end
+
+    enable_row_level_security(:signal_streams)
+  end
+
+  def down
+    disable_row_level_security(:signal_streams)
+    drop_table :signal_streams
+  end
+end

data/db/migrate/20260927120000_add_custom_host_to_tenants.rb

@@ -0,0 +1,6 @@
+class AddCustomHostToTenants < ActiveRecord::Migration[8.1]
+  def change
+    add_column :tenants, :custom_host, :string
+    add_index :tenants, :custom_host, unique: true, where: "custom_host IS NOT NULL"
+  end
+end

data/db/migrate/20260927140500_add_first_factor_to_sessions.rb

@@ -0,0 +1,6 @@
+class AddFirstFactorToSessions < ActiveRecord::Migration[8.1]
+  def change
+    add_column :sessions, :first_factor, :string
+    add_column :sessions, :provider_id, :bigint
+  end
+end

data/db/migrate/20260927160000_add_invited_at_to_memberships.rb

@@ -0,0 +1,15 @@
+class AddInvitedAtToMemberships < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    add_column :memberships, :invited_at, :datetime
+
+    across_tenants(:memberships) do
+      execute "UPDATE memberships SET invited_at = created_at WHERE pending AND invited_at IS NULL"
+    end
+  end
+
+  def down
+    remove_column :memberships, :invited_at
+  end
+end

data/db/migrate/20260927170000_grant_identities_to_actors_in_every_tenant.rb

@@ -0,0 +1,17 @@
+class GrantIdentitiesToActorsInEveryTenant < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    across_tenants(:actors) do
+      execute <<~SQL
+        UPDATE actors
+           SET scopes = btrim(scopes || ' identities')
+         WHERE ' ' || scopes || ' ' LIKE '% openid %'
+           AND ' ' || scopes || ' ' NOT LIKE '% identities %'
+      SQL
+    end
+  end
+
+  def down
+  end
+end

data/db/migrate/20260927180000_move_directory_ids_to_memberships.rb

@@ -0,0 +1,46 @@
+class MoveDirectoryIdsToMemberships < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    add_column :memberships, :external_id, :string
+    add_index :memberships, %i[organization_id external_id], unique: true, where: "external_id IS NOT NULL"
+
+    across_tenants(:memberships) do
+      across_tenants(:actors) do
+        execute <<~SQL
+          UPDATE memberships
+             SET external_id = actors.external_id
+            FROM actors
+           WHERE actors.id = memberships.actor_id
+             AND actors.external_id IS NOT NULL
+             AND memberships.provisioned
+             AND NOT memberships.pending
+             AND (SELECT count(*) FROM memberships held WHERE held.actor_id = actors.id AND held.provisioned) = 1
+        SQL
+
+        execute <<~SQL
+          UPDATE actors
+             SET external_id = NULL
+           WHERE EXISTS (SELECT 1 FROM memberships WHERE memberships.actor_id = actors.id AND memberships.external_id IS NOT NULL)
+        SQL
+      end
+    end
+  end
+
+  def down
+    across_tenants(:memberships) do
+      across_tenants(:actors) do
+        execute <<~SQL
+          UPDATE actors
+             SET external_id = memberships.external_id
+            FROM memberships
+           WHERE memberships.actor_id = actors.id
+             AND memberships.external_id IS NOT NULL
+             AND actors.external_id IS NULL
+        SQL
+      end
+    end
+
+    remove_column :memberships, :external_id
+  end
+end

data/db/migrate/20261003120000_add_metadata_expires_at_to_clients.rb

@@ -0,0 +1,5 @@
+class AddMetadataExpiresAtToClients < ActiveRecord::Migration[8.1]
+  def change
+    add_column :clients, :metadata_expires_at, :datetime
+  end
+end

data/db/migrate/20261003130000_create_mail_templates.rb

@@ -0,0 +1,23 @@
+class CreateMailTemplates < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    create_table :mail_templates do |t|
+      t.references :tenant, null: false, foreign_key: true, index: false
+      t.string :kind, null: false
+      t.string :subject
+      t.text :message
+
+      t.timestamps
+
+      t.index %i[tenant_id kind], unique: true
+    end
+
+    enable_row_level_security(:mail_templates)
+  end
+
+  def down
+    disable_row_level_security(:mail_templates)
+    drop_table :mail_templates
+  end
+end

data/db/migrate/20261003140000_add_authorization_details.rb

@@ -0,0 +1,7 @@
+class AddAuthorizationDetails < ActiveRecord::Migration[8.1]
+  def change
+    add_column :tokens, :authorization_details, :jsonb
+    add_column :clients, :authorization_details_types, :jsonb, null: false, default: []
+    add_column :clients, :authorization_details_schemas, :jsonb, null: false, default: {}
+  end
+end

data/db/migrate/20261004120000_add_remembering_to_consents.rb

@@ -0,0 +1,7 @@
+class AddRememberingToConsents < ActiveRecord::Migration[8.1]
+  def change
+    add_column :consents, :authorization_details, :jsonb, null: false, default: []
+    add_column :consents, :expires_at, :datetime
+    add_column :clients, :consent_lifetime, :integer
+  end
+end

data/db/migrate/20261004130000_add_receives_signals_to_providers.rb

@@ -0,0 +1,5 @@
+class AddReceivesSignalsToProviders < ActiveRecord::Migration[8.1]
+  def change
+    add_column :providers, :receives_signals, :boolean, null: false, default: false
+  end
+end

data/db/migrate/20261010120000_add_root_to_tokens.rb

@@ -0,0 +1,27 @@
+class AddRootToTokens < ActiveRecord::Migration[8.1]
+  include Masks::Server::TenantIsolation
+
+  def up
+    add_reference :tokens, :root, foreign_key: { to_table: :tokens, on_delete: :nullify }, index: false
+    add_index :tokens, %i[tenant_id root_id]
+
+    across_tenants(:tokens) do
+      execute <<~SQL
+        WITH RECURSIVE chains(id, root_id) AS (
+          SELECT id, id FROM tokens WHERE parent_id IS NULL
+          UNION ALL
+          SELECT tokens.id, chains.root_id FROM tokens JOIN chains ON tokens.parent_id = chains.id
+        )
+        UPDATE tokens SET root_id = chains.root_id
+        FROM chains
+        WHERE tokens.id = chains.id AND chains.root_id <> tokens.id
+      SQL
+    end
+  end
+
+  def down
+    remove_foreign_key :tokens, column: :root_id
+    remove_index :tokens, %i[tenant_id root_id]
+    remove_column :tokens, :root_id
+  end
+end

data/db/migrate/20261010130000_add_recovery_requested_at_to_actors.rb

@@ -0,0 +1,6 @@
+class AddRecoveryRequestedAtToActors < ActiveRecord::Migration[8.1]
+  def change
+    add_column :actors, :recovery_requested_at, :datetime
+    add_index :actors, %i[tenant_id recovery_requested_at], where: "recovery_requested_at IS NOT NULL"
+  end
+end