@astram/identity 0.16.0 → 0.17.1

package/dist/role.object.js

@@ -12,11 +12,11 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Role = void 0;
 const engine_1 = require("@astram/engine");
 const schema_1 = require("./schema");
-/** roles — global catalog. */
+/** roles — each role is owned by one company (G-013); names are unique per company. */
 let Role = class Role {
     uuid;
     name;
-    // The company a role was created for (G-009 T14, SPEC R13); NULL = shared (root-created). Create-only
+    // The company a role was created for (G-009 T14, SPEC R13); NULL = ownerless legacy row, root only. Create-only
     // and server-set (RoleService stamps it from the actor); NOT `trusted`, so the engine never
     // derives it and root's UI-created roles stay unowned. Changed later only by `transitionRoleOwner`.
     ownerCompanyUuid;
@@ -45,19 +45,10 @@ exports.Role = Role = __decorate([
         table: 'roles',
         schema: schema_1.SCHEMA,
         access: { plane: 'control', system: true },
-        // Read-scope wall (ADR-0027, Task 4.1, OQ-2 v1 "bound-in-subtree"): a role is in-scope iff
-        // it is BOUND (via a membership_posting) within the caller's reachable subtree — the SAME
-        // "a role in my subtree" derivation the Task-4.2 grant-admin predicate uses (one consistent
-        // notion). FIXED framework template; the ONLY dynamic values are the `?`-bound subtree node
-        // ids. DECOUPLED from writes. Root spans all.
-        // create:'unscoped' (ADR-0034): a NEW role is bound by no posting yet, so the post-insert
-        // create wall would deny every create; the posting that binds it IS walled.
-        readScope: {
-            kind: 'subtreeSubquery',
-            create: 'unscoped',
-            pkColumn: 'r_uuid',
-            subquerySql: `SELECT mp.mp_role_uuid FROM \`${schema_1.SCHEMA}\`.\`membership_posting\` mp JOIN \`${schema_1.SCHEMA}\`.\`company_membership\` cm ON cm.cm_uuid = mp.mp_membership_uuid WHERE cm.cm_company_uuid IN (${engine_1.READ_SCOPE_NODES_TOKEN})`,
-        },
+        // Read-scope wall (G-013 spec §5.C, ADR-0027): a role is in scope iff its OWNER company is in
+        // the caller's reachable subtree. Walled create (ADR-0034, no `create` key): the owner is a
+        // reached company, so the post-insert wall holds. NULL owner ⇒ root only. Root spans all.
+        readScope: { kind: 'nodeColumn', column: 'r_owner_company_uuid' },
     }),
     (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'r_uuid' })
 ], Role);

package/dist/security-policy.object.d.ts

@@ -0,0 +1,43 @@
+/**
+ * security_policy — one mandatory-2FA policy (auth capabilities R2.1, R2.2, R2.9). Table DDL:
+ * `migrations/1710000000104-CreateSecurityPolicy.cjs` (columns mirror the fields below).
+ *
+ * A policy requires 2FA of everyone in a company subtree (`tenant`), of the holders of a role
+ * (`role`, target = role uuid), or of the holders of any key a permission key or grant wildcard
+ * covers (`permission`). `platform: true` rows are the root-written floor (no node, apply
+ * everywhere). Written only through `SecurityPolicyService` (R2.6 authority, audit, version bump);
+ * guard reads the table on the request path recompute (B-1, task 14).
+ *
+ * `plane: 'control'` — who must use 2FA is security administration, like `user`/`role`; a non-root
+ * admin needs `identity:security_policy:*`. `readScope: nodeColumn(sp_scope_node_uuid)` walls a
+ * non-root list/read/update/delete to policies whose node is in the caller's subtree (a platform
+ * row has no node, so only root sees it), and the create wall re-checks a non-root create.
+ *
+ * Create-only: the node, the creator's node (D-12), the platform flag and the kind (changing them is a delete plus a create,
+ * each with its own authority check). `createdBy` is stamped from the session by the engine.
+ */
+export declare class SecurityPolicy {
+    uuid: string;
+    /** The company node the policy covers (with its subtree); null only for a platform row. */
+    scopeNodeUuid: string | null;
+    /** Platform floor (root only, R2.2). */
+    platform: boolean;
+    /** `tenant` | `role` | `permission`. */
+    targetKind: string;
+    /** Role uuid or permission key / wildcard; null for `tenant`. */
+    targetValue: string | null;
+    /** 0–14 days (R2.4). */
+    graceDays: number;
+    /**
+     * The node the creator acted at (D-12), stamped by the service from the session's active node
+     * (never the body); null for a platform row. Lowering or deleting needs that node or an ancestor.
+     */
+    createdAtNode: string | null;
+    /** Server-stamped author (engine overwrites from the session; never client). */
+    createdBy: string;
+    /** UTC epoch ms, set by the service. */
+    createdAtMs: number;
+    /** UTC epoch ms, set by the service on every write. */
+    updatedAtMs: number;
+}
+//# sourceMappingURL=security-policy.object.d.ts.map

package/dist/security-policy.object.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-policy.object.d.ts","sourceRoot":"","sources":["../src/security-policy.object.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAQa,cAAc;IAEzB,IAAI,EAAG,MAAM,CAAC;IAEd,2FAA2F;IAE3F,aAAa,EAAG,MAAM,GAAG,IAAI,CAAC;IAE9B,wCAAwC;IAExC,QAAQ,EAAG,OAAO,CAAC;IAEnB,wCAAwC;IAExC,UAAU,EAAG,MAAM,CAAC;IAEpB,iEAAiE;IAEjE,WAAW,EAAG,MAAM,GAAG,IAAI,CAAC;IAE5B,wBAAwB;IAExB,SAAS,EAAG,MAAM,CAAC;IAEnB;;;OAGG;IAEH,aAAa,EAAG,MAAM,GAAG,IAAI,CAAC;IAE9B,gFAAgF;IAEhF,SAAS,EAAG,MAAM,CAAC;IAEnB,wCAAwC;IAExC,WAAW,EAAG,MAAM,CAAC;IAErB,uDAAuD;IAEvD,WAAW,EAAG,MAAM,CAAC;CACtB"}

package/dist/security-policy.object.js

@@ -0,0 +1,107 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SecurityPolicy = void 0;
+const engine_1 = require("@astram/engine");
+const schema_1 = require("./schema");
+/**
+ * security_policy — one mandatory-2FA policy (auth capabilities R2.1, R2.2, R2.9). Table DDL:
+ * `migrations/1710000000104-CreateSecurityPolicy.cjs` (columns mirror the fields below).
+ *
+ * A policy requires 2FA of everyone in a company subtree (`tenant`), of the holders of a role
+ * (`role`, target = role uuid), or of the holders of any key a permission key or grant wildcard
+ * covers (`permission`). `platform: true` rows are the root-written floor (no node, apply
+ * everywhere). Written only through `SecurityPolicyService` (R2.6 authority, audit, version bump);
+ * guard reads the table on the request path recompute (B-1, task 14).
+ *
+ * `plane: 'control'` — who must use 2FA is security administration, like `user`/`role`; a non-root
+ * admin needs `identity:security_policy:*`. `readScope: nodeColumn(sp_scope_node_uuid)` walls a
+ * non-root list/read/update/delete to policies whose node is in the caller's subtree (a platform
+ * row has no node, so only root sees it), and the create wall re-checks a non-root create.
+ *
+ * Create-only: the node, the creator's node (D-12), the platform flag and the kind (changing them is a delete plus a create,
+ * each with its own authority check). `createdBy` is stamped from the session by the engine.
+ */
+let SecurityPolicy = class SecurityPolicy {
+    uuid;
+    /** The company node the policy covers (with its subtree); null only for a platform row. */
+    scopeNodeUuid;
+    /** Platform floor (root only, R2.2). */
+    platform;
+    /** `tenant` | `role` | `permission`. */
+    targetKind;
+    /** Role uuid or permission key / wildcard; null for `tenant`. */
+    targetValue;
+    /** 0–14 days (R2.4). */
+    graceDays;
+    /**
+     * The node the creator acted at (D-12), stamped by the service from the session's active node
+     * (never the body); null for a platform row. Lowering or deleting needs that node or an ancestor.
+     */
+    createdAtNode;
+    /** Server-stamped author (engine overwrites from the session; never client). */
+    createdBy;
+    /** UTC epoch ms, set by the service. */
+    createdAtMs;
+    /** UTC epoch ms, set by the service on every write. */
+    updatedAtMs;
+};
+exports.SecurityPolicy = SecurityPolicy;
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_uuid', type: 'uuid', role: 'primaryKey' }),
+    __metadata("design:type", String)
+], SecurityPolicy.prototype, "uuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_scope_node_uuid', type: 'uuid', immutable: true }),
+    __metadata("design:type", Object)
+], SecurityPolicy.prototype, "scopeNodeUuid", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_platform', type: 'boolean', immutable: true }),
+    __metadata("design:type", Boolean)
+], SecurityPolicy.prototype, "platform", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_target_kind', type: 'string', required: true, immutable: true }),
+    __metadata("design:type", String)
+], SecurityPolicy.prototype, "targetKind", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_target_value', type: 'string' }),
+    __metadata("design:type", Object)
+], SecurityPolicy.prototype, "targetValue", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_grace_days', type: 'number', required: true }),
+    __metadata("design:type", Number)
+], SecurityPolicy.prototype, "graceDays", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_created_at_node', type: 'uuid', immutable: true }),
+    __metadata("design:type", Object)
+], SecurityPolicy.prototype, "createdAtNode", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_created_by', type: 'uuid', trusted: 'actorId' }),
+    __metadata("design:type", String)
+], SecurityPolicy.prototype, "createdBy", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_created_at_ms', type: 'number', required: true }),
+    __metadata("design:type", Number)
+], SecurityPolicy.prototype, "createdAtMs", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'sp_updated_at_ms', type: 'number', required: true }),
+    __metadata("design:type", Number)
+], SecurityPolicy.prototype, "updatedAtMs", void 0);
+exports.SecurityPolicy = SecurityPolicy = __decorate([
+    (0, engine_1.ObjectType)({
+        typeKey: 'security_policy',
+        table: 'security_policy',
+        schema: schema_1.SCHEMA,
+        access: { plane: 'control', system: true },
+        readScope: { kind: 'nodeColumn', column: 'sp_scope_node_uuid' },
+    }),
+    (0, engine_1.PrimaryKey)({ kind: 'uuid', column: 'sp_uuid' })
+], SecurityPolicy);

package/dist/user.object.d.ts

@@ -7,6 +7,12 @@ export declare class User {
     uuid: string;
     username: string;
     email: string;
+    /**
+     * The sign-in handle (auth capabilities R1.2, migration 103): lower-case `[a-z0-9._-]{3,64}`,
+     * globally unique, NULL = none (sign in by email only). Set only by an admin (dominance,
+     * `UserService`) or `bootstrap:org`; never by `/account/*`. Not the display name (`username`).
+     */
+    loginName?: string | null;
     status: string;
     createdAt: string;
 }

package/dist/user.object.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBA0Ba,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAGf,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}
+{"version":3,"file":"user.object.d.ts","sourceRoot":"","sources":["../src/user.object.ts"],"names":[],"mappings":"AAGA;;;;GAIG;AACH,qBA4Ba,IAAI;IAEf,IAAI,EAAG,MAAM,CAAC;IAGd,QAAQ,EAAG,MAAM,CAAC;IAGlB,KAAK,EAAG,MAAM,CAAC;IAEf;;;;OAIG;IAEH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG1B,MAAM,EAAG,MAAM,CAAC;IAGhB,SAAS,EAAG,MAAM,CAAC;CACpB"}

package/dist/user.object.js

@@ -21,6 +21,12 @@ let User = class User {
     uuid;
     username;
     email;
+    /**
+     * The sign-in handle (auth capabilities R1.2, migration 103): lower-case `[a-z0-9._-]{3,64}`,
+     * globally unique, NULL = none (sign in by email only). Set only by an admin (dominance,
+     * `UserService`) or `bootstrap:org`; never by `/account/*`. Not the display name (`username`).
+     */
+    loginName;
     status;
     createdAt;
 };
@@ -37,6 +43,10 @@ __decorate([
     (0, engine_1.Field)({ column: 'u_email', type: 'string' }),
     __metadata("design:type", String)
 ], User.prototype, "email", void 0);
+__decorate([
+    (0, engine_1.Field)({ column: 'u_login_name', type: 'string' }),
+    __metadata("design:type", Object)
+], User.prototype, "loginName", void 0);
 __decorate([
     (0, engine_1.Field)({ column: 'u_status', type: 'string', role: 'status' }),
     __metadata("design:type", String)
@@ -56,7 +66,9 @@ exports.User = User = __decorate([
         access: { plane: 'control', system: true },
         // G-010 R11 (ADR-0038): `invite` (`identity:user:invite`, POST /identity/users/:uuid/invite) next
         // to CRUD. Roles holding `identity:*` or `identity:user:*` gain it on upgrade; exact keys do not.
-        actions: ['invite'],
+        // Auth capabilities R11.2 (task 18): the admin sign-in controls `reset_mfa`, `unlock`,
+        // `end_sessions` (POST /identity/users/:uuid/{reset-mfa,unlock,end-sessions}), same rule.
+        actions: ['invite', 'reset_mfa', 'unlock', 'end_sessions'],
         // Read-scope wall (ADR-0027, Task 4.1): a user has no company column (they belong to many
         // companies via `company_membership`) — a user is in-scope iff they have a membership in
         // the caller's reachable subtree. A multi-tenant user correctly appears for each subtree

package/migrations/1710000000103-AddUserLoginName.cjs

@@ -0,0 +1,87 @@
+/**
+ * Framework identity migration — `users.u_login_name` (auth capabilities R1.2, R1.4; AC-5).
+ *
+ * WHY: sign-in by username needs a login handle that is not the display name (`u_username` stays
+ * a display name, D-1). The handle is `[a-z0-9._-]{3,64}`, stored lower-case, never containing
+ * `@` (so it can never equal an email). It is globally unique, like `u_email`. Login resolves a
+ * handle by joining `users` to `identity_credential` on `ic_principal_id`, which had no index.
+ *
+ * Steps (idempotent; a half-applied state is completed, nothing is dropped or overwritten):
+ *   1. ADD `u_login_name VARCHAR(64) NULL` (collation `utf8mb4_unicode_ci`, as the table) when
+ *      absent. Every existing row starts NULL, so no existing data can clash (R1.9).
+ *   2. ADD UNIQUE `uq_users_login_name` when absent (NULLs may repeat). A non-unique index under
+ *      that name is refused rather than trusted.
+ *   3. ADD `idx_identity_credential_principal` on `identity_credential (ic_principal_id)` when
+ *      absent (non-unique; "one credential per account" stays the provisioner's locked check).
+ *
+ * `down` drops both indexes, then the column, each with IF EXISTS (a second run, or a database
+ * that never had them, does nothing).
+ *
+ * Database names come from `ctx.schemas` (namespace or single layout); no literal names, no ids.
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+const MIGRATION = '1710000000103-AddUserLoginName';
+const COLUMN = 'u_login_name';
+const UNIQUE_INDEX = 'uq_users_login_name';
+const PRINCIPAL_INDEX = 'idx_identity_credential_principal';
+
+/** `null` = no index of that name; otherwise whether it is UNIQUE. */
+async function indexState(query, schema, table, index) {
+  const rows = await query(
+    `SELECT NON_UNIQUE AS non_unique FROM information_schema.STATISTICS
+      WHERE TABLE_SCHEMA = ? AND TABLE_NAME = ? AND INDEX_NAME = ? LIMIT 1`,
+    [schema, table, index],
+  );
+  if (!Array.isArray(rows) || rows.length === 0) return null;
+  return { unique: Number(rows[0].non_unique) === 0 };
+}
+
+async function up(ctx) {
+  const { query } = ctx;
+  const schemas = frameworkSchemasForMigration(ctx, process.env);
+  const APP = schemas.app;
+  const IDENTITY = schemas.identity;
+
+  const columns = await query(
+    `SELECT 1 AS n FROM information_schema.COLUMNS
+      WHERE TABLE_SCHEMA = ? AND TABLE_NAME = 'users' AND COLUMN_NAME = ? LIMIT 1`,
+    [APP, COLUMN],
+  );
+  if (!Array.isArray(columns) || columns.length === 0) {
+    await query(
+      `ALTER TABLE \`${APP}\`.\`users\`
+        ADD COLUMN ${COLUMN} VARCHAR(64) CHARACTER SET utf8mb4 COLLATE utf8mb4_unicode_ci NULL`,
+    );
+  }
+
+  const unique = await indexState(query, APP, 'users', UNIQUE_INDEX);
+  if (unique === null) {
+    await query(`CREATE UNIQUE INDEX ${UNIQUE_INDEX} ON \`${APP}\`.\`users\` (${COLUMN})`);
+  } else if (!unique.unique) {
+    throw new Error(
+      `${MIGRATION}: ${APP}.users has a NON-unique index named ${UNIQUE_INDEX}; ` +
+        'drop or rename it, then re-run astram-migrate.',
+    );
+  }
+
+  const principal = await indexState(query, IDENTITY, 'identity_credential', PRINCIPAL_INDEX);
+  if (principal === null) {
+    await query(
+      `CREATE INDEX ${PRINCIPAL_INDEX} ON \`${IDENTITY}\`.\`identity_credential\` (ic_principal_id)`,
+    );
+  }
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const schemas = frameworkSchemasForMigration(ctx, process.env);
+  await query(
+    `DROP INDEX IF EXISTS ${PRINCIPAL_INDEX} ON \`${schemas.identity}\`.\`identity_credential\``,
+  );
+  await query(`DROP INDEX IF EXISTS ${UNIQUE_INDEX} ON \`${schemas.app}\`.\`users\``);
+  await query(`ALTER TABLE \`${schemas.app}\`.\`users\` DROP COLUMN IF EXISTS ${COLUMN}`);
+}
+
+module.exports = { up, down };

package/migrations/1710000000104-CreateSecurityPolicy.cjs

@@ -0,0 +1,90 @@
+/**
+ * Framework identity migration — mandatory 2FA policy storage (auth capabilities R2.4, R2.9, D-2;
+ * AC-8, AC-10).
+ *
+ * 1. `<app>.security_policy` — one row per policy, managed only through
+ *    `/identity/security-policies` (identity object type `security_policy`, engine pipe). It lives
+ *    in the app database with every other identity object type (the engine's `FRAMEWORK_SCHEMA.app`
+ *    token); guard reads it with its runtime account, which already holds DML there.
+ *      - sp_scope_node_uuid: the company (scope node) the policy applies to, with its subtree.
+ *        NULL only for a platform-floor row (sp_platform = 1, root only, R2.2), which applies
+ *        everywhere. The CHECK holds the pairing; a deleted company takes its policies with it.
+ *      - sp_target_kind: 'tenant' (everyone in the subtree) | 'role' | 'permission'.
+ *      - sp_target_value: the role uuid or the permission key (wildcards allowed, e.g.
+ *        `identity:*`); NULL exactly when the kind is 'tenant'.
+ *      - sp_grace_days: 0–14 (R2.4), default 0.
+ *      - sp_created_at_node: the node the creator acted at (D-12), stamped from the session; NULL
+ *        for a platform row (or a row written before the column, judged at its scope node). No
+ *        FK: a deleted creator node leaves no actor "at or above" it, so only root can lower it.
+ *    Indexes serve guard's reads (B-1): by scope node, by target, and the platform floor.
+ * 2. `<identity>.mfa_requirement_state` — the per-user grace clock (R2.4): when the user was first
+ *    found required and not enrolled. Deleted when they enrol or stop being required. Credential
+ *    adjacent, written by guard at lifecycle events; a deleted user takes the row with it.
+ * 3. `<identity>.session.s_restriction` — the restricted-session reason (D-2: 'reenroll' |
+ *    'mfa_enrollment'), NULL = unrestricted. `s_must_reenroll` (migration 019) is kept and still
+ *    read, so an upgrade needs no back-fill.
+ *
+ * Idempotent (CREATE TABLE IF NOT EXISTS / ADD COLUMN IF NOT EXISTS); `down` drops the column and
+ * both tables with IF EXISTS. No rows are written, no ids are hard-coded. Database names come from
+ * `ctx.schemas` (namespace or single layout, ADR-0037/ADR-0041); both tables are listed in core
+ * `FRAMEWORK_TABLES`.
+ */
+
+const { frameworkSchemasForMigration } = require('@astram/core');
+
+async function up(ctx) {
+  const { query } = ctx;
+  const { app: APP, identity: IDENTITY } = frameworkSchemasForMigration(ctx, process.env);
+
+  await query(
+    `CREATE TABLE IF NOT EXISTS \`${APP}\`.\`security_policy\` (
+      sp_uuid            VARCHAR(36)  NOT NULL,
+      sp_scope_node_uuid VARCHAR(36)  NULL,
+      sp_platform        TINYINT(1)   NOT NULL DEFAULT 0,
+      sp_target_kind     VARCHAR(16)  NOT NULL,
+      sp_target_value    VARCHAR(255) NULL,
+      sp_grace_days      TINYINT UNSIGNED NOT NULL DEFAULT 0,
+      sp_created_at_node VARCHAR(36)  NULL,
+      sp_created_by      VARCHAR(36)  NOT NULL,
+      sp_created_at_ms   BIGINT       NOT NULL,
+      sp_updated_at_ms   BIGINT       NOT NULL,
+      PRIMARY KEY (sp_uuid),
+      INDEX idx_security_policy_scope (sp_scope_node_uuid),
+      INDEX idx_security_policy_target (sp_target_kind, sp_target_value),
+      INDEX idx_security_policy_platform (sp_platform),
+      CONSTRAINT ck_security_policy_grace CHECK (sp_grace_days BETWEEN 0 AND 14),
+      CONSTRAINT ck_security_policy_kind CHECK (sp_target_kind IN ('tenant', 'role', 'permission')),
+      CONSTRAINT ck_security_policy_scope CHECK ((sp_platform = 1 AND sp_scope_node_uuid IS NULL) OR (sp_platform = 0 AND sp_scope_node_uuid IS NOT NULL)),
+      CONSTRAINT ck_security_policy_target CHECK ((sp_target_kind = 'tenant' AND sp_target_value IS NULL) OR (sp_target_kind <> 'tenant' AND sp_target_value IS NOT NULL)),
+      CONSTRAINT FK_security_policy_scope_node
+        FOREIGN KEY (sp_scope_node_uuid) REFERENCES \`${APP}\`.\`companies\` (c_uuid)
+        ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  );
+
+  await query(
+    `CREATE TABLE IF NOT EXISTS \`${IDENTITY}\`.\`mfa_requirement_state\` (
+      mrs_principal_id      VARCHAR(36) NOT NULL,
+      mrs_required_since_ms BIGINT      NOT NULL,
+      PRIMARY KEY (mrs_principal_id),
+      CONSTRAINT FK_mfa_requirement_state_user
+        FOREIGN KEY (mrs_principal_id) REFERENCES \`${APP}\`.\`users\` (u_uuid)
+        ON DELETE CASCADE
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci`,
+  );
+
+  await query(
+    `ALTER TABLE \`${IDENTITY}\`.\`session\`
+       ADD COLUMN IF NOT EXISTS \`s_restriction\` VARCHAR(32) NULL`,
+  );
+}
+
+async function down(ctx) {
+  const { query } = ctx;
+  const { app: APP, identity: IDENTITY } = frameworkSchemasForMigration(ctx, process.env);
+  await query(`ALTER TABLE \`${IDENTITY}\`.\`session\` DROP COLUMN IF EXISTS \`s_restriction\``);
+  await query(`DROP TABLE IF EXISTS \`${IDENTITY}\`.\`mfa_requirement_state\``);
+  await query(`DROP TABLE IF EXISTS \`${APP}\`.\`security_policy\``);
+}
+
+module.exports = { up, down };