@authup/server-core 1.0.0-beta.52 → 1.0.0-beta.53

package/dist/adapters/database/migrations/mysql/1783769340000-Default.mjs

@@ -0,0 +1,320 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1783769340000-Default.ts
+/**
+* Security event log (plan 057), MFA — authenticator devices (plan 049) +
+* auth-method claims (plan 050), application access policy (plan 052) +
+* persisted consent (plan 055), realm key store (plans 069 + 071) and
+* RFC 8705 client authentication (plan 072).
+*
+* - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+*   by design: a row must survive deletion of the realm/actor/client it
+*   references. Retention is per-row (`expires_at`, stamped at write from
+*   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+*   event-cleaner component (plan 057).
+* - Adds auth_user_authenticators: polymorphic second-factor device rows
+*   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+*   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+*   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+* - Adds auth_sessions.mfa_at: instant the subject last passed a
+*   second-factor challenge for the session (plan 049).
+* - Adds auth_sessions.auth_method: how the subject authenticated
+*   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+* - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+*   (ON DELETE SET NULL) — the policy that must pass for an identity to
+*   authorize against the client (null = default-allow; plan 052).
+* - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+*   a subject has approved at POST /authorize. Union/keep (missing tokens
+*   only, never deleted on re-approval); built_in clients keep zero rows;
+*   expires_at is dormant (always null in Stage 1) but honored by the
+*   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+*   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+*   plan 055).
+* - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+*   generalizes auth_keys into the per-realm key store. enc rows hold the
+*   realm's auto-generated symmetric at-rest encryption key (oct) that the
+*   MFA seed cipher rides; existing rows default to sig (plan 069).
+* - Adds auth_keys.name (canonical identifier, backfilled from id),
+*   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+*   auth_keys.certificate (PEM chain, Stage B) — key management API
+*   (plan 071 Stage A).
+* - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+*   RFC 8705 PKI client authentication (plan 071 Stage C).
+* - Replaces auth_clients.is_confidential with auth_method
+*   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+*   client authentication and sender-constrained tokens (plan 072).
+*/ var Default1783769340000 = class {
+	name = "Default1783769340000";
+	async up(queryRunner) {
+		await queryRunner.query(`
+            CREATE TABLE \`auth_events\` (
+                \`id\` varchar(36) NOT NULL,
+                \`scope\` varchar(64) NOT NULL,
+                \`name\` varchar(64) NOT NULL,
+                \`ref_type\` varchar(64) NULL,
+                \`ref_id\` varchar(64) NULL,
+                \`client_id\` varchar(36) NULL,
+                \`actor_type\` varchar(16) NULL,
+                \`actor_id\` varchar(36) NULL,
+                \`actor_name\` varchar(128) NULL,
+                \`request_path\` varchar(256) NULL,
+                \`request_method\` varchar(10) NULL,
+                \`request_ip_address\` varchar(45) NULL,
+                \`request_user_agent\` varchar(512) NULL,
+                \`realm_id\` varchar(36) NULL,
+                \`data\` text NULL,
+                \`expiring\` tinyint NOT NULL DEFAULT 0,
+                \`expires_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                INDEX \`IDX_auth_events_name_scope\` (\`name\`, \`scope\`),
+                INDEX \`IDX_auth_events_ref_type_ref_id\` (\`ref_type\`, \`ref_id\`),
+                INDEX \`IDX_auth_events_client_id\` (\`client_id\`),
+                INDEX \`IDX_auth_events_actor_id\` (\`actor_id\`),
+                INDEX \`IDX_auth_events_actor_name\` (\`actor_name\`),
+                INDEX \`IDX_auth_events_request_ip_address\` (\`request_ip_address\`),
+                INDEX \`IDX_auth_events_realm_id\` (\`realm_id\`),
+                INDEX \`IDX_auth_events_expiring\` (\`expiring\`),
+                INDEX \`IDX_auth_events_expires_at\` (\`expires_at\`),
+                INDEX \`IDX_auth_events_created_at\` (\`created_at\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_user_authenticators\` (
+                \`id\` varchar(36) NOT NULL,
+                \`kind\` varchar(16) NOT NULL,
+                \`name\` varchar(128) NULL,
+                \`secret\` text NULL,
+                \`parameters\` text NULL,
+                \`codes\` text NULL,
+                \`confirmed\` tinyint NOT NULL DEFAULT 0,
+                \`last_used_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`user_id\` varchar(36) NOT NULL,
+                \`realm_id\` varchar(36) NOT NULL,
+                INDEX \`IDX_auth_user_authenticators_kind\` (\`kind\`),
+                INDEX \`IDX_auth_user_authenticators_user_id\` (\`user_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\`
+            ADD CONSTRAINT \`FK_auth_user_authenticators_user_id\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\`
+            ADD CONSTRAINT \`FK_auth_user_authenticators_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` ADD \`mfa_at\` varchar(28) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` ADD \`auth_method\` varchar(16) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`access_policy_id\` varchar(36) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\`
+            ADD CONSTRAINT \`FK_auth_clients_access_policy_id\` FOREIGN KEY (\`access_policy_id\`) REFERENCES \`auth_policies\`(\`id\`) ON DELETE SET NULL ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_consents\` (
+                \`id\` varchar(36) NOT NULL,
+                \`sub\` varchar(64) NOT NULL,
+                \`sub_kind\` varchar(64) NOT NULL,
+                \`scope\` varchar(128) NOT NULL,
+                \`expires_at\` varchar(28) NULL,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`client_id\` varchar(36) NOT NULL,
+                \`realm_id\` varchar(36) NOT NULL,
+                \`user_id\` varchar(36) NULL,
+                INDEX \`IDX_auth_consents_sub\` (\`sub\`),
+                INDEX \`IDX_auth_consents_client_id\` (\`client_id\`),
+                INDEX \`IDX_auth_consents_realm_id\` (\`realm_id\`),
+                INDEX \`IDX_auth_consents_user_id\` (\`user_id\`),
+                UNIQUE INDEX \`UQ_auth_consents_subject_scope\` (\`client_id\`, \`sub\`, \`sub_kind\`, \`scope\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_client_id\` FOREIGN KEY (\`client_id\`) REFERENCES \`auth_clients\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\`
+            ADD CONSTRAINT \`FK_auth_consents_user_id\` FOREIGN KEY (\`user_id\`) REFERENCES \`auth_users\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`use\` varchar(64) NOT NULL DEFAULT 'sig'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`name\` varchar(128) NULL
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_keys\` SET \`name\` = \`id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`name\` varchar(128) NOT NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\`
+            ADD UNIQUE INDEX \`UQ_auth_keys_name_realm_id\` (\`name\`, \`realm_id\`)
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`status\` varchar(64) NOT NULL DEFAULT 'active'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` ADD \`certificate\` text NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`decryption_key\` text NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`encryption_key\` text NULL
+        `);
+		await queryRunner.query(`
+            CREATE TABLE \`auth_trust_anchors\` (
+                \`id\` varchar(36) NOT NULL,
+                \`name\` varchar(128) NOT NULL,
+                \`certificate\` text NOT NULL,
+                \`enabled\` tinyint NOT NULL DEFAULT 1,
+                \`created_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),
+                \`updated_at\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),
+                \`realm_id\` varchar(36) NOT NULL,
+                INDEX \`IDX_auth_trust_anchors_realm_id\` (\`realm_id\`),
+                UNIQUE INDEX \`UQ_auth_trust_anchors_name_realm_id\` (\`name\`, \`realm_id\`),
+                PRIMARY KEY (\`id\`)
+            ) ENGINE = InnoDB
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_trust_anchors\`
+            ADD CONSTRAINT \`FK_auth_trust_anchors_realm_id\` FOREIGN KEY (\`realm_id\`) REFERENCES \`auth_realms\`(\`id\`) ON DELETE CASCADE ON UPDATE NO ACTION
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`auth_method\` varchar(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_clients\` SET \`auth_method\` = 'secret' WHERE \`is_confidential\` = 1
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`token_binding_method\` varchar(16) NOT NULL DEFAULT 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`is_confidential\`
+        `);
+	}
+	async down(queryRunner) {
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` ADD \`is_confidential\` tinyint NOT NULL DEFAULT 0
+        `);
+		await queryRunner.query(`
+            UPDATE \`auth_clients\` SET \`is_confidential\` = 1 WHERE \`auth_method\` <> 'none'
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`token_binding_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`auth_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_trust_anchors\` DROP FOREIGN KEY \`FK_auth_trust_anchors_realm_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`UQ_auth_trust_anchors_name_realm_id\` ON \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_trust_anchors_realm_id\` ON \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_trust_anchors\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`encryption_key\` varchar(4096) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` MODIFY \`decryption_key\` varchar(4096) NULL
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`certificate\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`status\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP INDEX \`UQ_auth_keys_name_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`name\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_keys\` DROP COLUMN \`use\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_user_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_consents\` DROP FOREIGN KEY \`FK_auth_consents_client_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`UQ_auth_consents_subject_scope\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_user_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_realm_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_client_id\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_consents_sub\` ON \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_consents\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP FOREIGN KEY \`FK_auth_clients_access_policy_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_clients\` DROP COLUMN \`access_policy_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`auth_method\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_sessions\` DROP COLUMN \`mfa_at\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\` DROP FOREIGN KEY \`FK_auth_user_authenticators_realm_id\`
+        `);
+		await queryRunner.query(`
+            ALTER TABLE \`auth_user_authenticators\` DROP FOREIGN KEY \`FK_auth_user_authenticators_user_id\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_user_authenticators_user_id\` ON \`auth_user_authenticators\`
+        `);
+		await queryRunner.query(`
+            DROP INDEX \`IDX_auth_user_authenticators_kind\` ON \`auth_user_authenticators\`
+        `);
+		await queryRunner.query(`
+            DROP TABLE \`auth_user_authenticators\`
+        `);
+		await queryRunner.query("DROP TABLE `auth_events`");
+	}
+};
+//#endregion
+export { Default1783769340000 };
+
+//# sourceMappingURL=1783769340000-Default.mjs.map

package/dist/adapters/database/migrations/mysql/1783769340000-Default.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.mjs","names":["Default1783769340000","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1783769340000-Default.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * Security event log (plan 057), MFA — authenticator devices (plan 049) +\n * auth-method claims (plan 050), application access policy (plan 052) +\n * persisted consent (plan 055), realm key store (plans 069 + 071) and\n * RFC 8705 client authentication (plan 072).\n *\n * - Adds auth_events: append-only, PII-stripped security audit log. No FKs\n *   by design: a row must survive deletion of the realm/actor/client it\n *   references. Retention is per-row (`expires_at`, stamped at write from\n *   `eventLogRetentionDays`; NULL = keep forever) and swept by the\n *   event-cleaner component (plan 057).\n * - Adds auth_user_authenticators: polymorphic second-factor device rows\n *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed\n *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.\n *   FKs to auth_users / auth_realms (ON DELETE CASCADE).\n * - Adds auth_sessions.mfa_at: instant the subject last passed a\n *   second-factor challenge for the session (plan 049).\n * - Adds auth_sessions.auth_method: how the subject authenticated\n *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.\n * - Adds auth_clients.access_policy_id: nullable FK to auth_policies\n *   (ON DELETE SET NULL) — the policy that must pass for an identity to\n *   authorize against the client (null = default-allow; plan 052).\n * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)\n *   a subject has approved at POST /authorize. Union/keep (missing tokens\n *   only, never deleted on re-approval); built_in clients keep zero rows;\n *   expires_at is dormant (always null in Stage 1) but honored by the\n *   covering check. FKs to auth_clients / auth_realms and a nullable user_id\n *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;\n *   plan 055).\n * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —\n *   generalizes auth_keys into the per-realm key store. enc rows hold the\n *   realm's auto-generated symmetric at-rest encryption key (oct) that the\n *   MFA seed cipher rides; existing rows default to sig (plan 069).\n * - Adds auth_keys.name (canonical identifier, backfilled from id),\n *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant\n *   auth_keys.certificate (PEM chain, Stage B) — key management API\n *   (plan 071 Stage A).\n * - Adds auth_trust_anchors: realm-scoped public CA certificates used by\n *   RFC 8705 PKI client authentication (plan 071 Stage C).\n * - Replaces auth_clients.is_confidential with auth_method\n *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705\n *   client authentication and sender-constrained tokens (plan 072).\n */\nexport class Default1783769340000 implements MigrationInterface {\n    name = 'Default1783769340000';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        // security event log (plan 057)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_events\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`scope\\` varchar(64) NOT NULL,\n                \\`name\\` varchar(64) NOT NULL,\n                \\`ref_type\\` varchar(64) NULL,\n                \\`ref_id\\` varchar(64) NULL,\n                \\`client_id\\` varchar(36) NULL,\n                \\`actor_type\\` varchar(16) NULL,\n                \\`actor_id\\` varchar(36) NULL,\n                \\`actor_name\\` varchar(128) NULL,\n                \\`request_path\\` varchar(256) NULL,\n                \\`request_method\\` varchar(10) NULL,\n                \\`request_ip_address\\` varchar(45) NULL,\n                \\`request_user_agent\\` varchar(512) NULL,\n                \\`realm_id\\` varchar(36) NULL,\n                \\`data\\` text NULL,\n                \\`expiring\\` tinyint NOT NULL DEFAULT 0,\n                \\`expires_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                INDEX \\`IDX_auth_events_name_scope\\` (\\`name\\`, \\`scope\\`),\n                INDEX \\`IDX_auth_events_ref_type_ref_id\\` (\\`ref_type\\`, \\`ref_id\\`),\n                INDEX \\`IDX_auth_events_client_id\\` (\\`client_id\\`),\n                INDEX \\`IDX_auth_events_actor_id\\` (\\`actor_id\\`),\n                INDEX \\`IDX_auth_events_actor_name\\` (\\`actor_name\\`),\n                INDEX \\`IDX_auth_events_request_ip_address\\` (\\`request_ip_address\\`),\n                INDEX \\`IDX_auth_events_realm_id\\` (\\`realm_id\\`),\n                INDEX \\`IDX_auth_events_expiring\\` (\\`expiring\\`),\n                INDEX \\`IDX_auth_events_expires_at\\` (\\`expires_at\\`),\n                INDEX \\`IDX_auth_events_created_at\\` (\\`created_at\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        // MFA authenticator devices (plan 049)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_user_authenticators\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`kind\\` varchar(16) NOT NULL,\n                \\`name\\` varchar(128) NULL,\n                \\`secret\\` text NULL,\n                \\`parameters\\` text NULL,\n                \\`codes\\` text NULL,\n                \\`confirmed\\` tinyint NOT NULL DEFAULT 0,\n                \\`last_used_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`user_id\\` varchar(36) NOT NULL,\n                \\`realm_id\\` varchar(36) NOT NULL,\n                INDEX \\`IDX_auth_user_authenticators_kind\\` (\\`kind\\`),\n                INDEX \\`IDX_auth_user_authenticators_user_id\\` (\\`user_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\`\n            ADD CONSTRAINT \\`FK_auth_user_authenticators_user_id\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\`\n            ADD CONSTRAINT \\`FK_auth_user_authenticators_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` ADD \\`mfa_at\\` varchar(28) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` ADD \\`auth_method\\` varchar(16) NULL\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`access_policy_id\\` varchar(36) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\`\n            ADD CONSTRAINT \\`FK_auth_clients_access_policy_id\\` FOREIGN KEY (\\`access_policy_id\\`) REFERENCES \\`auth_policies\\`(\\`id\\`) ON DELETE SET NULL ON UPDATE NO ACTION\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_consents\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`sub\\` varchar(64) NOT NULL,\n                \\`sub_kind\\` varchar(64) NOT NULL,\n                \\`scope\\` varchar(128) NOT NULL,\n                \\`expires_at\\` varchar(28) NULL,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`client_id\\` varchar(36) NOT NULL,\n                \\`realm_id\\` varchar(36) NOT NULL,\n                \\`user_id\\` varchar(36) NULL,\n                INDEX \\`IDX_auth_consents_sub\\` (\\`sub\\`),\n                INDEX \\`IDX_auth_consents_client_id\\` (\\`client_id\\`),\n                INDEX \\`IDX_auth_consents_realm_id\\` (\\`realm_id\\`),\n                INDEX \\`IDX_auth_consents_user_id\\` (\\`user_id\\`),\n                UNIQUE INDEX \\`UQ_auth_consents_subject_scope\\` (\\`client_id\\`, \\`sub\\`, \\`sub_kind\\`, \\`scope\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_client_id\\` FOREIGN KEY (\\`client_id\\`) REFERENCES \\`auth_clients\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\`\n            ADD CONSTRAINT \\`FK_auth_consents_user_id\\` FOREIGN KEY (\\`user_id\\`) REFERENCES \\`auth_users\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`use\\` varchar(64) NOT NULL DEFAULT 'sig'\n        `);\n\n        // key management API (plan 071 Stage A)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`name\\` varchar(128) NULL\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_keys\\` SET \\`name\\` = \\`id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`name\\` varchar(128) NOT NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\`\n            ADD UNIQUE INDEX \\`UQ_auth_keys_name_realm_id\\` (\\`name\\`, \\`realm_id\\`)\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`status\\` varchar(64) NOT NULL DEFAULT 'active'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` ADD \\`certificate\\` text NULL\n        `);\n        // Widen the key-material columns: an imported RSA-4096 private key\n        // wrapped under a SECRETS_ENCRYPTION_KEY exceeds varchar(4096).\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`decryption_key\\` text NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`encryption_key\\` text NULL\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            CREATE TABLE \\`auth_trust_anchors\\` (\n                \\`id\\` varchar(36) NOT NULL,\n                \\`name\\` varchar(128) NOT NULL,\n                \\`certificate\\` text NOT NULL,\n                \\`enabled\\` tinyint NOT NULL DEFAULT 1,\n                \\`created_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6),\n                \\`updated_at\\` datetime(6) NOT NULL DEFAULT CURRENT_TIMESTAMP(6) ON UPDATE CURRENT_TIMESTAMP(6),\n                \\`realm_id\\` varchar(36) NOT NULL,\n                INDEX \\`IDX_auth_trust_anchors_realm_id\\` (\\`realm_id\\`),\n                UNIQUE INDEX \\`UQ_auth_trust_anchors_name_realm_id\\` (\\`name\\`, \\`realm_id\\`),\n                PRIMARY KEY (\\`id\\`)\n            ) ENGINE = InnoDB\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_trust_anchors\\`\n            ADD CONSTRAINT \\`FK_auth_trust_anchors_realm_id\\` FOREIGN KEY (\\`realm_id\\`) REFERENCES \\`auth_realms\\`(\\`id\\`) ON DELETE CASCADE ON UPDATE NO ACTION\n        `);\n\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`auth_method\\` varchar(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_clients\\` SET \\`auth_method\\` = 'secret' WHERE \\`is_confidential\\` = 1\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`token_binding_method\\` varchar(16) NOT NULL DEFAULT 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`is_confidential\\`\n        `);\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        // RFC 8705 client authentication and token binding (plan 072)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` ADD \\`is_confidential\\` tinyint NOT NULL DEFAULT 0\n        `);\n        await queryRunner.query(`\n            UPDATE \\`auth_clients\\` SET \\`is_confidential\\` = 1 WHERE \\`auth_method\\` <> 'none'\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`token_binding_method\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`auth_method\\`\n        `);\n\n        // RFC 8705 realm trust anchors (plan 071 Stage C)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_trust_anchors\\` DROP FOREIGN KEY \\`FK_auth_trust_anchors_realm_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`UQ_auth_trust_anchors_name_realm_id\\` ON \\`auth_trust_anchors\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_trust_anchors_realm_id\\` ON \\`auth_trust_anchors\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_trust_anchors\\`\n        `);\n\n        // key management API (plan 071 Stage A) — reverse last-in-first-out\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`encryption_key\\` varchar(4096) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` MODIFY \\`decryption_key\\` varchar(4096) NULL\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`certificate\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`status\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP INDEX \\`UQ_auth_keys_name_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`name\\`\n        `);\n\n        // realm key store use discriminator (plan 069)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_keys\\` DROP COLUMN \\`use\\`\n        `);\n\n        // persisted per-scope consent (plan 055)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_user_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_consents\\` DROP FOREIGN KEY \\`FK_auth_consents_client_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`UQ_auth_consents_subject_scope\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_user_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_realm_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_client_id\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_consents_sub\\` ON \\`auth_consents\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_consents\\`\n        `);\n\n        // application access policy (plan 052)\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP FOREIGN KEY \\`FK_auth_clients_access_policy_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_clients\\` DROP COLUMN \\`access_policy_id\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`auth_method\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_sessions\\` DROP COLUMN \\`mfa_at\\`\n        `);\n\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\` DROP FOREIGN KEY \\`FK_auth_user_authenticators_realm_id\\`\n        `);\n        await queryRunner.query(`\n            ALTER TABLE \\`auth_user_authenticators\\` DROP FOREIGN KEY \\`FK_auth_user_authenticators_user_id\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_user_authenticators_user_id\\` ON \\`auth_user_authenticators\\`\n        `);\n        await queryRunner.query(`\n            DROP INDEX \\`IDX_auth_user_authenticators_kind\\` ON \\`auth_user_authenticators\\`\n        `);\n        await queryRunner.query(`\n            DROP TABLE \\`auth_user_authenticators\\`\n        `);\n\n        // security event log (plan 057)\n        await queryRunner.query('DROP TABLE `auth_events`');\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDA,IAAaA,uBAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EAErD,MAAMA,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;SAgCvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;SAkBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;;;;;;;SAmBvB;EAED,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;;;;;;;;;;;;SAavB;EACD,MAAMD,YAAYC,MAAM;;;SAGvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;CACL;CAEA,MAAaC,KAAKF,aAAyC;EAEvD,MAAMA,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAED,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EACD,MAAMD,YAAYC,MAAM;;SAEvB;EAGD,MAAMD,YAAYC,MAAM,0BAAA;CAC5B;AACJ"}

package/dist/adapters/database/migrations/postgres/1783769340000-Default.d.ts

@@ -0,0 +1,50 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Security event log (plan 057), MFA — authenticator devices (plan 049) +
+ * auth-method claims (plan 050), application access policy (plan 052) +
+ * persisted consent (plan 055), realm key store (plans 069 + 071) and
+ * RFC 8705 client authentication (plan 072).
+ *
+ * - Adds auth_events: append-only, PII-stripped security audit log. No FKs
+ *   by design: a row must survive deletion of the realm/actor/client it
+ *   references. Retention is per-row (`expires_at`, stamped at write from
+ *   `eventLogRetentionDays`; NULL = keep forever) and swept by the
+ *   event-cleaner component (plan 057).
+ * - Adds auth_user_authenticators: polymorphic second-factor device rows
+ *   (kind: totp/recovery/email/webauthn) hanging off a user. The TOTP seed
+ *   (secret) is symmetrically encrypted at rest; recovery codes are hashed.
+ *   FKs to auth_users / auth_realms (ON DELETE CASCADE).
+ * - Adds auth_sessions.mfa_at: instant the subject last passed a
+ *   second-factor challenge for the session (plan 049).
+ * - Adds auth_sessions.auth_method: how the subject authenticated
+ *   (pwd/ldap/ext/client/robot — plan 050); NULL for pre-existing sessions.
+ * - Adds auth_clients.access_policy_id: nullable FK to auth_policies
+ *   (ON DELETE SET NULL) — the policy that must pass for an identity to
+ *   authorize against the client (null = default-allow; plan 052).
+ * - Adds auth_consents: one row per (client_id, sub, sub_kind, scope token)
+ *   a subject has approved at POST /authorize. Union/keep (missing tokens
+ *   only, never deleted on re-approval); built_in clients keep zero rows;
+ *   expires_at is dormant (always null in Stage 1) but honored by the
+ *   covering check. FKs to auth_clients / auth_realms and a nullable user_id
+ *   FK (all ON DELETE CASCADE, so a user deletion drops its consents;
+ *   plan 055).
+ * - Adds auth_keys.use: JWK-use discriminator (sig | enc, RFC 7517 §4.2) —
+ *   generalizes auth_keys into the per-realm key store. enc rows hold the
+ *   realm's auto-generated symmetric at-rest encryption key (oct) that the
+ *   MFA seed cipher rides; existing rows default to sig (plan 069).
+ * - Adds auth_keys.name (canonical identifier, backfilled from id),
+ *   auth_keys.status (lifecycle: active/passive/disabled) and the dormant
+ *   auth_keys.certificate (PEM chain, Stage B) — key management API
+ *   (plan 071 Stage A).
+ * - Adds auth_trust_anchors: realm-scoped public CA certificates used by
+ *   RFC 8705 PKI client authentication (plan 071 Stage C).
+ * - Replaces auth_clients.is_confidential with auth_method
+ *   (none/secret/tls) and adds token_binding_method (none/tls) for RFC 8705
+ *   client authentication and sender-constrained tokens (plan 072).
+ */
+export declare class Default1783769340000 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1783769340000-Default.d.ts.map

package/dist/adapters/database/migrations/postgres/1783769340000-Default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1783769340000-Default.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/postgres/1783769340000-Default.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC3D,IAAI,SAA0B;IAEjB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IA0L3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CA2G7D"}