@authhero/drizzle 1.0.0 → 1.2.0

package/drizzle/meta/_journal.json

@@ -8,6 +8,34 @@
       "when": 1784301636273,
       "tag": "0000_init",
       "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "6",
+      "when": 1786036597896,
+      "tag": "0001_scim_inbound_provisioning",
+      "breakpoints": true
+    },
+    {
+      "idx": 2,
+      "version": "6",
+      "when": 1786097448605,
+      "tag": "0002_user_blocked",
+      "breakpoints": true
+    },
+    {
+      "idx": 3,
+      "version": "6",
+      "when": 1786288345643,
+      "tag": "0003_prompt_settings_last_used",
+      "breakpoints": true
+    },
+    {
+      "idx": 4,
+      "version": "6",
+      "when": 1786377042191,
+      "tag": "0004_action_executions_created_at_index",
+      "breakpoints": true
     }
   ]
 }

package/package.json

@@ -11,7 +11,7 @@
     "type": "git",
     "url": "https://github.com/markusahlstrand/authhero"
   },
-  "version": "1.0.0",
+  "version": "1.2.0",
   "files": [
     "dist",
     "src/schema",
@@ -35,8 +35,8 @@
   "dependencies": {
     "drizzle-orm": "^0.45.2",
     "nanoid": "^5.1.11",
-    "@authhero/adapter-interfaces": "4.3.0",
-    "@authhero/proxy": "0.10.0"
+    "@authhero/adapter-interfaces": "4.5.0",
+    "@authhero/proxy": "0.10.2"
   },
   "devDependencies": {
     "@hono/zod-openapi": "^1.4.0",

package/src/schema/sqlite/actions.ts

@@ -92,5 +92,6 @@ export const actionExecutions = sqliteTable(
       columns: [table.tenant_id, table.id],
       name: "action_executions_pk",
     }),
+    index("action_executions_created_at_ts_index").on(table.created_at_ts),
   ],
 );

package/src/schema/sqlite/branding.ts

@@ -225,6 +225,11 @@ export const promptSettings = sqliteTable("prompt_settings", {
   })
     .notNull()
     .default(false),
+  show_last_used_connection: integer("show_last_used_connection", {
+    mode: "boolean",
+  })
+    .notNull()
+    .default(false),
 });
 
 export const emailProviders = sqliteTable("email_providers", {

package/src/schema/sqlite/index.ts

@@ -46,3 +46,6 @@ export * from "./outbox";
 
 // Proxy routes (used by @authhero/proxy)
 export * from "./proxyRoutes";
+
+// SCIM inbound provisioning (#1191)
+export * from "./scim";

package/src/schema/sqlite/scim.ts

@@ -0,0 +1,79 @@
+import {
+  sqliteTable,
+  text,
+  index,
+  uniqueIndex,
+  primaryKey,
+} from "drizzle-orm/sqlite-core";
+
+// One SCIM configuration per connection (SCIM inbound provisioning, #1191).
+// Every key here leads with tenant_id: connection ids are only unique within a
+// tenant, so a tenant-less key would let one tenant's connection block
+// another's — and the composite PK doubles as the tenant-scoped uniqueness
+// constraint the create path relies on.
+export const scimConfigurations = sqliteTable(
+  "scim_configurations",
+  {
+    connection_id: text("connection_id", { length: 255 }).notNull(),
+    tenant_id: text("tenant_id", { length: 255 }).notNull(),
+    user_id_attribute: text("user_id_attribute", { length: 255 })
+      .notNull()
+      .default("externalId"),
+    mapping: text("mapping", { length: 16384 }).notNull().default("[]"),
+    created_at: text("created_at", { length: 35 }).notNull(),
+    updated_at: text("updated_at", { length: 35 }).notNull(),
+  },
+  (table) => [primaryKey({ columns: [table.tenant_id, table.connection_id] })],
+);
+
+// Hashed long-lived bearer tokens used by IdPs to authenticate to /scim/v2.
+export const scimTokens = sqliteTable(
+  "scim_tokens",
+  {
+    token_id: text("token_id", { length: 64 }).notNull(),
+    tenant_id: text("tenant_id", { length: 255 }).notNull(),
+    connection_id: text("connection_id", { length: 255 }).notNull(),
+    token_hash: text("token_hash", { length: 128 }).notNull(),
+    scopes: text("scopes", { length: 4096 }).notNull().default("[]"),
+    valid_until: text("valid_until", { length: 35 }),
+    created_at: text("created_at", { length: 35 }).notNull(),
+    last_used_at: text("last_used_at", { length: 35 }),
+  },
+  (table) => [
+    primaryKey({ columns: [table.tenant_id, table.token_id] }),
+    index("scim_tokens_tenant_connection_idx").on(
+      table.tenant_id,
+      table.connection_id,
+    ),
+    // Authentication resolves a token by hash, and a hash must identify at
+    // most one token within the tenant.
+    uniqueIndex("scim_tokens_tenant_hash_idx").on(
+      table.tenant_id,
+      table.token_hash,
+    ),
+  ],
+);
+
+// Maps an IdP-assigned externalId to an AuthHero user_id, scoped to a
+// connection. Queried both by externalId (IdP lookup before create) and by
+// user_id (to emit externalId on reads).
+export const scimExternalIds = sqliteTable(
+  "scim_external_ids",
+  {
+    tenant_id: text("tenant_id", { length: 255 }).notNull(),
+    connection_id: text("connection_id", { length: 255 }).notNull(),
+    external_id: text("external_id", { length: 255 }).notNull(),
+    user_id: text("user_id", { length: 255 }).notNull(),
+    created_at: text("created_at", { length: 35 }).notNull(),
+  },
+  (table) => [
+    primaryKey({
+      columns: [table.tenant_id, table.connection_id, table.user_id],
+    }),
+    uniqueIndex("scim_external_ids_connection_external_idx").on(
+      table.tenant_id,
+      table.connection_id,
+      table.external_id,
+    ),
+  ],
+);

package/src/schema/sqlite/users.ts

@@ -37,6 +37,8 @@ export const users = sqliteTable(
     connection: text("connection", { length: 255 }),
     email_verified: integer("email_verified", { mode: "boolean" }).notNull(),
     is_social: integer("is_social", { mode: "boolean" }).notNull(),
+    // Auth0-parity account block flag. Nullable; absent/0 means not blocked.
+    blocked: integer("blocked", { mode: "boolean" }),
     app_metadata: text("app_metadata", { length: 4096 })
       .notNull()
       .default("{}"),