@authup/server-core 1.0.0-beta.58 → 1.0.0-beta.60

package/dist/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.d.ts

@@ -0,0 +1,66 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * The fold of the release window's three migrations (SessionTokenClientId,
+ * AlignSchemaWithEntityMetadata, EventSessionId), squashed into one file per
+ * dialect before release per the migration convention. It does three things.
+ *
+ * Columns: adds auth_session_tokens.client_id, the per-application
+ * attribution one level below the browser session (plan 086; a session on
+ * the IdP origin legitimately serves several applications, so
+ * auth_sessions.client_id can only ever name one of them; the FK cascades
+ * like its sibling, so deleting a client drops the tokens issued for it),
+ * and auth_events.session_id, the auth_sessions row acting or affected, so
+ * audit rows are correlatable per session (plan 093; deliberately NO
+ * foreign key: auth_events is append-only and must survive deletion of
+ * everything it references, so a CASCADE would erase audit history and
+ * SET NULL would destroy the correlation). On both columns NULL means "not
+ * attributable": rows written before this migration, and paths that
+ * legitimately carry no client (an MFA-login completion) or no session (a
+ * failed login, registration, password recovery, the external IdP
+ * callback). Both are created under typeorm's derived constraint names, so
+ * they need no rename below.
+ *
+ * Names: the hand-authored migrations 1783325495597 and 1783769340000
+ * created their indexes, unique constraints and foreign keys under
+ * readable names, while every generated migration before them used
+ * typeorm's table+column hash, so the schema carried two naming regimes
+ * and `migration generate` emitted 32 renames before any real change.
+ * MySQL has no RENAME CONSTRAINT, so each foreign key is dropped and
+ * re-added; it stores a unique constraint as a unique index, so those
+ * rename through RENAME INDEX like the rest.
+ *
+ * Types: those migrations declared uuid columns as varchar(36). MySQL has
+ * no uuid type, and typeorm's mysql driver only shortens to 36 for columns
+ * whose value it generates itself, so a plain `type: 'uuid'` column
+ * derives the generic varchar(255) that every earlier table got.
+ * varchar(36) holds a uuid perfectly well; the problem is that the model
+ * and the schema disagreed, so `migration generate` emitted
+ * `DROP COLUMN auth_events.id` and 14 siblings - data loss that reads as
+ * routine in review. MODIFY COLUMN widens in place, so the values survive.
+ *
+ * The widening runs FIRST, then the column additions, then the renames,
+ * and the order is load-bearing. MySQL commits each DDL statement
+ * regardless of the surrounding transaction, so a boot killed partway
+ * through leaves the migration applied but unrecorded and the whole `up`
+ * re-runs. Widening is re-runnable (a MODIFY COLUMN onto the width a
+ * column already has succeeds) while an addition or a rename is not
+ * (ER_DUP_FIELDNAME / ER_KEY_DOES_NOT_EXITS). Putting the minutes-long
+ * phase first and the instant ones last means a kill during the phase
+ * that can realistically be killed retries cleanly.
+ *
+ * The checks are restored in a `finally`: the setting is per session and
+ * the connection goes back to the pool on failure, so an aborted run
+ * must not hand the next caller a connection that accepts orphans.
+ *
+ * Foreign key checks are disabled for the duration: every constraint is
+ * re-added exactly as it already existed (and the added columns start
+ * NULL), so re-validating would only add a table scan and a failure mode
+ * for rows some past import inserted with the checks off. It is also what
+ * lets a foreign key column be widened while its constraint is in place.
+ */
+export declare class AlignSchemaWithEntityMetadata1785871780234 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1785871780234-AlignSchemaWithEntityMetadata.d.ts.map

package/dist/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1785871780234-AlignSchemaWithEntityMetadata.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AACH,qBAAa,0CAA2C,YAAW,kBAAkB;IACjF,IAAI,SAAgD;IAEvC,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAyD3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CAwD7D"}

package/dist/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.mjs

@@ -0,0 +1,181 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.ts
+/**
+* The fold of the release window's three migrations (SessionTokenClientId,
+* AlignSchemaWithEntityMetadata, EventSessionId), squashed into one file per
+* dialect before release per the migration convention. It does three things.
+*
+* Columns: adds auth_session_tokens.client_id, the per-application
+* attribution one level below the browser session (plan 086; a session on
+* the IdP origin legitimately serves several applications, so
+* auth_sessions.client_id can only ever name one of them; the FK cascades
+* like its sibling, so deleting a client drops the tokens issued for it),
+* and auth_events.session_id, the auth_sessions row acting or affected, so
+* audit rows are correlatable per session (plan 093; deliberately NO
+* foreign key: auth_events is append-only and must survive deletion of
+* everything it references, so a CASCADE would erase audit history and
+* SET NULL would destroy the correlation). On both columns NULL means "not
+* attributable": rows written before this migration, and paths that
+* legitimately carry no client (an MFA-login completion) or no session (a
+* failed login, registration, password recovery, the external IdP
+* callback). Both are created under typeorm's derived constraint names, so
+* they need no rename below.
+*
+* Names: the hand-authored migrations 1783325495597 and 1783769340000
+* created their indexes, unique constraints and foreign keys under
+* readable names, while every generated migration before them used
+* typeorm's table+column hash, so the schema carried two naming regimes
+* and `migration generate` emitted 32 renames before any real change.
+* MySQL has no RENAME CONSTRAINT, so each foreign key is dropped and
+* re-added; it stores a unique constraint as a unique index, so those
+* rename through RENAME INDEX like the rest.
+*
+* Types: those migrations declared uuid columns as varchar(36). MySQL has
+* no uuid type, and typeorm's mysql driver only shortens to 36 for columns
+* whose value it generates itself, so a plain `type: 'uuid'` column
+* derives the generic varchar(255) that every earlier table got.
+* varchar(36) holds a uuid perfectly well; the problem is that the model
+* and the schema disagreed, so `migration generate` emitted
+* `DROP COLUMN auth_events.id` and 14 siblings - data loss that reads as
+* routine in review. MODIFY COLUMN widens in place, so the values survive.
+*
+* The widening runs FIRST, then the column additions, then the renames,
+* and the order is load-bearing. MySQL commits each DDL statement
+* regardless of the surrounding transaction, so a boot killed partway
+* through leaves the migration applied but unrecorded and the whole `up`
+* re-runs. Widening is re-runnable (a MODIFY COLUMN onto the width a
+* column already has succeeds) while an addition or a rename is not
+* (ER_DUP_FIELDNAME / ER_KEY_DOES_NOT_EXITS). Putting the minutes-long
+* phase first and the instant ones last means a kill during the phase
+* that can realistically be killed retries cleanly.
+*
+* The checks are restored in a `finally`: the setting is per session and
+* the connection goes back to the pool on failure, so an aborted run
+* must not hand the next caller a connection that accepts orphans.
+*
+* Foreign key checks are disabled for the duration: every constraint is
+* re-added exactly as it already existed (and the added columns start
+* NULL), so re-validating would only add a table scan and a failure mode
+* for rows some past import inserted with the checks off. It is also what
+* lets a foreign key column be widened while its constraint is in place.
+*/ var AlignSchemaWithEntityMetadata1785871780234 = class {
+	name = "AlignSchemaWithEntityMetadata1785871780234";
+	async up(queryRunner) {
+		await queryRunner.query("SET FOREIGN_KEY_CHECKS = 0");
+		try {
+			await queryRunner.query("ALTER TABLE `auth_clients` MODIFY COLUMN `access_policy_id` varchar(255) NULL");
+			await queryRunner.query("ALTER TABLE `auth_consents` MODIFY COLUMN `client_id` varchar(255) NOT NULL, MODIFY COLUMN `realm_id` varchar(255) NOT NULL, MODIFY COLUMN `user_id` varchar(255) NULL");
+			await queryRunner.query("ALTER TABLE `auth_events` MODIFY COLUMN `id` varchar(255) NOT NULL, MODIFY COLUMN `client_id` varchar(255) NULL, MODIFY COLUMN `actor_id` varchar(255) NULL, MODIFY COLUMN `realm_id` varchar(255) NULL");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` MODIFY COLUMN `id` varchar(255) NOT NULL, MODIFY COLUMN `session_id` varchar(255) NOT NULL, MODIFY COLUMN `parent_id` varchar(255) NULL, MODIFY COLUMN `refresh_token_id` varchar(255) NULL");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` MODIFY COLUMN `realm_id` varchar(255) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` MODIFY COLUMN `user_id` varchar(255) NOT NULL, MODIFY COLUMN `realm_id` varchar(255) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` ADD `client_id` varchar(255) NULL");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` ADD CONSTRAINT `FK_883cfabf7d5f7466a27625843db` FOREIGN KEY (`client_id`) REFERENCES `auth_clients`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_events` ADD `session_id` varchar(255) NULL");
+			await queryRunner.query("CREATE INDEX `IDX_cac31ef1ae7871c905a3842df4` ON `auth_events` (`session_id`)");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_sub` TO `IDX_482fa13b8f47218a844e333282`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_client_id` TO `IDX_adc5a3c5fa915f59ddac529f2b`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_realm_id` TO `IDX_089778fa70ab97a637b84957a8`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_user_id` TO `IDX_f945cd1ec65cc16e8462384d3a`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_client_id` TO `IDX_e50f1f5e014087edaac7240ba9`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_actor_id` TO `IDX_a5cc98d786bf9fce973ab2594f`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_actor_name` TO `IDX_ce33c3f58b802bb3c7b2668adc`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_request_ip_address` TO `IDX_5fafa06904d87cf1d77bbf4564`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_realm_id` TO `IDX_5a0f436c6949aeb968db4f2473`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_expiring` TO `IDX_0c8183e935c03317f4829cb427`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_expires_at` TO `IDX_1db311adb485ecbefd92c5daf8`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_created_at` TO `IDX_64ac9bded13b2b6b75b128d8e5`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_ref_type_ref_id` TO `IDX_12ed04e1591ed2574d1324070b`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_name_scope` TO `IDX_85536e251a24fe5141925ee3f9`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_auth_session_tokens_session_id` TO `IDX_cdedfe142e7b60c17140fc19d8`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_auth_session_tokens_kind` TO `IDX_37121db8ac9517c083c473b95c`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_auth_session_tokens_expires_at` TO `IDX_2a86161c2eae4ef90aee1fa657`");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` RENAME INDEX `IDX_auth_trust_anchors_realm_id` TO `IDX_68b091bb8e853316ad1f953673`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_auth_user_authenticators_kind` TO `IDX_e89cdcc8924d5fef9ae47d49d8`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_auth_user_authenticators_user_id` TO `IDX_ed232e3a899e0556f1b052bc50`");
+			await queryRunner.query("ALTER TABLE `auth_keys` RENAME INDEX `UQ_auth_keys_name_realm_id` TO `IDX_0b3208b80576419f0b1319de7a`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `UQ_auth_consents_subject_scope` TO `IDX_8f8ad5088770598763efdb2c46`");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` RENAME INDEX `UQ_auth_trust_anchors_name_realm_id` TO `IDX_f3eacccc977b8597cc66db600f`");
+			await queryRunner.query("ALTER TABLE `auth_clients` DROP FOREIGN KEY `FK_auth_clients_access_policy_id`");
+			await queryRunner.query("ALTER TABLE `auth_clients` ADD CONSTRAINT `FK_7e7bca0ba30295b43b02a690511` FOREIGN KEY (`access_policy_id`) REFERENCES `auth_policies`(`id`) ON DELETE SET NULL ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_auth_consents_client_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_adc5a3c5fa915f59ddac529f2b2` FOREIGN KEY (`client_id`) REFERENCES `auth_clients`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_auth_consents_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_089778fa70ab97a637b84957a84` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_auth_consents_user_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_f945cd1ec65cc16e8462384d3a8` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` DROP FOREIGN KEY `FK_auth_session_tokens_session_id`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` ADD CONSTRAINT `FK_cdedfe142e7b60c17140fc19d8a` FOREIGN KEY (`session_id`) REFERENCES `auth_sessions`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` DROP FOREIGN KEY `FK_auth_trust_anchors_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` ADD CONSTRAINT `FK_68b091bb8e853316ad1f9536731` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_auth_user_authenticators_user_id`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_ed232e3a899e0556f1b052bc50e` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_auth_user_authenticators_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_db13de293f01ac8ab7bc0342c4f` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+		} finally {
+			await queryRunner.query("SET FOREIGN_KEY_CHECKS = 1");
+		}
+	}
+	async down(queryRunner) {
+		await queryRunner.query("SET FOREIGN_KEY_CHECKS = 0");
+		try {
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` MODIFY COLUMN `realm_id` varchar(36) NOT NULL, MODIFY COLUMN `user_id` varchar(36) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` MODIFY COLUMN `realm_id` varchar(36) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` MODIFY COLUMN `refresh_token_id` varchar(36) NULL, MODIFY COLUMN `parent_id` varchar(36) NULL, MODIFY COLUMN `session_id` varchar(36) NOT NULL, MODIFY COLUMN `id` varchar(36) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_events` MODIFY COLUMN `realm_id` varchar(36) NULL, MODIFY COLUMN `actor_id` varchar(36) NULL, MODIFY COLUMN `client_id` varchar(36) NULL, MODIFY COLUMN `id` varchar(36) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_consents` MODIFY COLUMN `user_id` varchar(36) NULL, MODIFY COLUMN `realm_id` varchar(36) NOT NULL, MODIFY COLUMN `client_id` varchar(36) NOT NULL");
+			await queryRunner.query("ALTER TABLE `auth_clients` MODIFY COLUMN `access_policy_id` varchar(36) NULL");
+			await queryRunner.query("DROP INDEX `IDX_cac31ef1ae7871c905a3842df4` ON `auth_events`");
+			await queryRunner.query("ALTER TABLE `auth_events` DROP COLUMN `session_id`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` DROP FOREIGN KEY `FK_883cfabf7d5f7466a27625843db`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` DROP COLUMN `client_id`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_db13de293f01ac8ab7bc0342c4f`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_auth_user_authenticators_realm_id` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_ed232e3a899e0556f1b052bc50e`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_auth_user_authenticators_user_id` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` DROP FOREIGN KEY `FK_68b091bb8e853316ad1f9536731`");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` ADD CONSTRAINT `FK_auth_trust_anchors_realm_id` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` DROP FOREIGN KEY `FK_cdedfe142e7b60c17140fc19d8a`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` ADD CONSTRAINT `FK_auth_session_tokens_session_id` FOREIGN KEY (`session_id`) REFERENCES `auth_sessions`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_f945cd1ec65cc16e8462384d3a8`");
+			await queryRunner.query("ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_auth_consents_user_id` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_089778fa70ab97a637b84957a84`");
+			await queryRunner.query("ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_auth_consents_realm_id` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_adc5a3c5fa915f59ddac529f2b2`");
+			await queryRunner.query("ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_auth_consents_client_id` FOREIGN KEY (`client_id`) REFERENCES `auth_clients`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_clients` DROP FOREIGN KEY `FK_7e7bca0ba30295b43b02a690511`");
+			await queryRunner.query("ALTER TABLE `auth_clients` ADD CONSTRAINT `FK_auth_clients_access_policy_id` FOREIGN KEY (`access_policy_id`) REFERENCES `auth_policies`(`id`) ON DELETE SET NULL ON UPDATE NO ACTION");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` RENAME INDEX `IDX_f3eacccc977b8597cc66db600f` TO `UQ_auth_trust_anchors_name_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_8f8ad5088770598763efdb2c46` TO `UQ_auth_consents_subject_scope`");
+			await queryRunner.query("ALTER TABLE `auth_keys` RENAME INDEX `IDX_0b3208b80576419f0b1319de7a` TO `UQ_auth_keys_name_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_ed232e3a899e0556f1b052bc50` TO `IDX_auth_user_authenticators_user_id`");
+			await queryRunner.query("ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_e89cdcc8924d5fef9ae47d49d8` TO `IDX_auth_user_authenticators_kind`");
+			await queryRunner.query("ALTER TABLE `auth_trust_anchors` RENAME INDEX `IDX_68b091bb8e853316ad1f953673` TO `IDX_auth_trust_anchors_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_2a86161c2eae4ef90aee1fa657` TO `IDX_auth_session_tokens_expires_at`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_37121db8ac9517c083c473b95c` TO `IDX_auth_session_tokens_kind`");
+			await queryRunner.query("ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_cdedfe142e7b60c17140fc19d8` TO `IDX_auth_session_tokens_session_id`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_85536e251a24fe5141925ee3f9` TO `IDX_auth_events_name_scope`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_12ed04e1591ed2574d1324070b` TO `IDX_auth_events_ref_type_ref_id`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_64ac9bded13b2b6b75b128d8e5` TO `IDX_auth_events_created_at`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_1db311adb485ecbefd92c5daf8` TO `IDX_auth_events_expires_at`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_0c8183e935c03317f4829cb427` TO `IDX_auth_events_expiring`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_5a0f436c6949aeb968db4f2473` TO `IDX_auth_events_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_5fafa06904d87cf1d77bbf4564` TO `IDX_auth_events_request_ip_address`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_ce33c3f58b802bb3c7b2668adc` TO `IDX_auth_events_actor_name`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_a5cc98d786bf9fce973ab2594f` TO `IDX_auth_events_actor_id`");
+			await queryRunner.query("ALTER TABLE `auth_events` RENAME INDEX `IDX_e50f1f5e014087edaac7240ba9` TO `IDX_auth_events_client_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_f945cd1ec65cc16e8462384d3a` TO `IDX_auth_consents_user_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_089778fa70ab97a637b84957a8` TO `IDX_auth_consents_realm_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_adc5a3c5fa915f59ddac529f2b` TO `IDX_auth_consents_client_id`");
+			await queryRunner.query("ALTER TABLE `auth_consents` RENAME INDEX `IDX_482fa13b8f47218a844e333282` TO `IDX_auth_consents_sub`");
+		} finally {
+			await queryRunner.query("SET FOREIGN_KEY_CHECKS = 1");
+		}
+	}
+};
+//#endregion
+export { AlignSchemaWithEntityMetadata1785871780234 };
+
+//# sourceMappingURL=1785871780234-AlignSchemaWithEntityMetadata.mjs.map

package/dist/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"1785871780234-AlignSchemaWithEntityMetadata.mjs","names":["AlignSchemaWithEntityMetadata1785871780234","name","up","queryRunner","query","down"],"sources":["../../../../../src/adapters/database/migrations/mysql/1785871780234-AlignSchemaWithEntityMetadata.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { MigrationInterface, QueryRunner } from 'typeorm';\n\n/**\n * The fold of the release window's three migrations (SessionTokenClientId,\n * AlignSchemaWithEntityMetadata, EventSessionId), squashed into one file per\n * dialect before release per the migration convention. It does three things.\n *\n * Columns: adds auth_session_tokens.client_id, the per-application\n * attribution one level below the browser session (plan 086; a session on\n * the IdP origin legitimately serves several applications, so\n * auth_sessions.client_id can only ever name one of them; the FK cascades\n * like its sibling, so deleting a client drops the tokens issued for it),\n * and auth_events.session_id, the auth_sessions row acting or affected, so\n * audit rows are correlatable per session (plan 093; deliberately NO\n * foreign key: auth_events is append-only and must survive deletion of\n * everything it references, so a CASCADE would erase audit history and\n * SET NULL would destroy the correlation). On both columns NULL means \"not\n * attributable\": rows written before this migration, and paths that\n * legitimately carry no client (an MFA-login completion) or no session (a\n * failed login, registration, password recovery, the external IdP\n * callback). Both are created under typeorm's derived constraint names, so\n * they need no rename below.\n *\n * Names: the hand-authored migrations 1783325495597 and 1783769340000\n * created their indexes, unique constraints and foreign keys under\n * readable names, while every generated migration before them used\n * typeorm's table+column hash, so the schema carried two naming regimes\n * and `migration generate` emitted 32 renames before any real change.\n * MySQL has no RENAME CONSTRAINT, so each foreign key is dropped and\n * re-added; it stores a unique constraint as a unique index, so those\n * rename through RENAME INDEX like the rest.\n *\n * Types: those migrations declared uuid columns as varchar(36). MySQL has\n * no uuid type, and typeorm's mysql driver only shortens to 36 for columns\n * whose value it generates itself, so a plain `type: 'uuid'` column\n * derives the generic varchar(255) that every earlier table got.\n * varchar(36) holds a uuid perfectly well; the problem is that the model\n * and the schema disagreed, so `migration generate` emitted\n * `DROP COLUMN auth_events.id` and 14 siblings - data loss that reads as\n * routine in review. MODIFY COLUMN widens in place, so the values survive.\n *\n * The widening runs FIRST, then the column additions, then the renames,\n * and the order is load-bearing. MySQL commits each DDL statement\n * regardless of the surrounding transaction, so a boot killed partway\n * through leaves the migration applied but unrecorded and the whole `up`\n * re-runs. Widening is re-runnable (a MODIFY COLUMN onto the width a\n * column already has succeeds) while an addition or a rename is not\n * (ER_DUP_FIELDNAME / ER_KEY_DOES_NOT_EXITS). Putting the minutes-long\n * phase first and the instant ones last means a kill during the phase\n * that can realistically be killed retries cleanly.\n *\n * The checks are restored in a `finally`: the setting is per session and\n * the connection goes back to the pool on failure, so an aborted run\n * must not hand the next caller a connection that accepts orphans.\n *\n * Foreign key checks are disabled for the duration: every constraint is\n * re-added exactly as it already existed (and the added columns start\n * NULL), so re-validating would only add a table scan and a failure mode\n * for rows some past import inserted with the checks off. It is also what\n * lets a foreign key column be widened while its constraint is in place.\n */\nexport class AlignSchemaWithEntityMetadata1785871780234 implements MigrationInterface {\n    name = 'AlignSchemaWithEntityMetadata1785871780234';\n\n    public async up(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query('SET FOREIGN_KEY_CHECKS = 0');\n        try {\n            await queryRunner.query('ALTER TABLE `auth_clients` MODIFY COLUMN `access_policy_id` varchar(255) NULL');\n            await queryRunner.query('ALTER TABLE `auth_consents` MODIFY COLUMN `client_id` varchar(255) NOT NULL, MODIFY COLUMN `realm_id` varchar(255) NOT NULL, MODIFY COLUMN `user_id` varchar(255) NULL');\n            await queryRunner.query('ALTER TABLE `auth_events` MODIFY COLUMN `id` varchar(255) NOT NULL, MODIFY COLUMN `client_id` varchar(255) NULL, MODIFY COLUMN `actor_id` varchar(255) NULL, MODIFY COLUMN `realm_id` varchar(255) NULL');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` MODIFY COLUMN `id` varchar(255) NOT NULL, MODIFY COLUMN `session_id` varchar(255) NOT NULL, MODIFY COLUMN `parent_id` varchar(255) NULL, MODIFY COLUMN `refresh_token_id` varchar(255) NULL');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` MODIFY COLUMN `realm_id` varchar(255) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` MODIFY COLUMN `user_id` varchar(255) NOT NULL, MODIFY COLUMN `realm_id` varchar(255) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` ADD `client_id` varchar(255) NULL');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` ADD CONSTRAINT `FK_883cfabf7d5f7466a27625843db` FOREIGN KEY (`client_id`) REFERENCES `auth_clients`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_events` ADD `session_id` varchar(255) NULL');\n            await queryRunner.query('CREATE INDEX `IDX_cac31ef1ae7871c905a3842df4` ON `auth_events` (`session_id`)');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_sub` TO `IDX_482fa13b8f47218a844e333282`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_client_id` TO `IDX_adc5a3c5fa915f59ddac529f2b`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_realm_id` TO `IDX_089778fa70ab97a637b84957a8`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_auth_consents_user_id` TO `IDX_f945cd1ec65cc16e8462384d3a`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_client_id` TO `IDX_e50f1f5e014087edaac7240ba9`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_actor_id` TO `IDX_a5cc98d786bf9fce973ab2594f`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_actor_name` TO `IDX_ce33c3f58b802bb3c7b2668adc`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_request_ip_address` TO `IDX_5fafa06904d87cf1d77bbf4564`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_realm_id` TO `IDX_5a0f436c6949aeb968db4f2473`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_expiring` TO `IDX_0c8183e935c03317f4829cb427`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_expires_at` TO `IDX_1db311adb485ecbefd92c5daf8`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_created_at` TO `IDX_64ac9bded13b2b6b75b128d8e5`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_ref_type_ref_id` TO `IDX_12ed04e1591ed2574d1324070b`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_auth_events_name_scope` TO `IDX_85536e251a24fe5141925ee3f9`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_auth_session_tokens_session_id` TO `IDX_cdedfe142e7b60c17140fc19d8`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_auth_session_tokens_kind` TO `IDX_37121db8ac9517c083c473b95c`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_auth_session_tokens_expires_at` TO `IDX_2a86161c2eae4ef90aee1fa657`');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` RENAME INDEX `IDX_auth_trust_anchors_realm_id` TO `IDX_68b091bb8e853316ad1f953673`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_auth_user_authenticators_kind` TO `IDX_e89cdcc8924d5fef9ae47d49d8`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_auth_user_authenticators_user_id` TO `IDX_ed232e3a899e0556f1b052bc50`');\n            await queryRunner.query('ALTER TABLE `auth_keys` RENAME INDEX `UQ_auth_keys_name_realm_id` TO `IDX_0b3208b80576419f0b1319de7a`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `UQ_auth_consents_subject_scope` TO `IDX_8f8ad5088770598763efdb2c46`');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` RENAME INDEX `UQ_auth_trust_anchors_name_realm_id` TO `IDX_f3eacccc977b8597cc66db600f`');\n            await queryRunner.query('ALTER TABLE `auth_clients` DROP FOREIGN KEY `FK_auth_clients_access_policy_id`');\n            await queryRunner.query('ALTER TABLE `auth_clients` ADD CONSTRAINT `FK_7e7bca0ba30295b43b02a690511` FOREIGN KEY (`access_policy_id`) REFERENCES `auth_policies`(`id`) ON DELETE SET NULL ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_auth_consents_client_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_adc5a3c5fa915f59ddac529f2b2` FOREIGN KEY (`client_id`) REFERENCES `auth_clients`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_auth_consents_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_089778fa70ab97a637b84957a84` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_auth_consents_user_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_f945cd1ec65cc16e8462384d3a8` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` DROP FOREIGN KEY `FK_auth_session_tokens_session_id`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` ADD CONSTRAINT `FK_cdedfe142e7b60c17140fc19d8a` FOREIGN KEY (`session_id`) REFERENCES `auth_sessions`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` DROP FOREIGN KEY `FK_auth_trust_anchors_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` ADD CONSTRAINT `FK_68b091bb8e853316ad1f9536731` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_auth_user_authenticators_user_id`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_ed232e3a899e0556f1b052bc50e` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_auth_user_authenticators_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_db13de293f01ac8ab7bc0342c4f` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n        } finally {\n            await queryRunner.query('SET FOREIGN_KEY_CHECKS = 1');\n        }\n    }\n\n    public async down(queryRunner: QueryRunner): Promise<void> {\n        await queryRunner.query('SET FOREIGN_KEY_CHECKS = 0');\n        try {\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` MODIFY COLUMN `realm_id` varchar(36) NOT NULL, MODIFY COLUMN `user_id` varchar(36) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` MODIFY COLUMN `realm_id` varchar(36) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` MODIFY COLUMN `refresh_token_id` varchar(36) NULL, MODIFY COLUMN `parent_id` varchar(36) NULL, MODIFY COLUMN `session_id` varchar(36) NOT NULL, MODIFY COLUMN `id` varchar(36) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_events` MODIFY COLUMN `realm_id` varchar(36) NULL, MODIFY COLUMN `actor_id` varchar(36) NULL, MODIFY COLUMN `client_id` varchar(36) NULL, MODIFY COLUMN `id` varchar(36) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_consents` MODIFY COLUMN `user_id` varchar(36) NULL, MODIFY COLUMN `realm_id` varchar(36) NOT NULL, MODIFY COLUMN `client_id` varchar(36) NOT NULL');\n            await queryRunner.query('ALTER TABLE `auth_clients` MODIFY COLUMN `access_policy_id` varchar(36) NULL');\n            await queryRunner.query('DROP INDEX `IDX_cac31ef1ae7871c905a3842df4` ON `auth_events`');\n            await queryRunner.query('ALTER TABLE `auth_events` DROP COLUMN `session_id`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` DROP FOREIGN KEY `FK_883cfabf7d5f7466a27625843db`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` DROP COLUMN `client_id`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_db13de293f01ac8ab7bc0342c4f`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_auth_user_authenticators_realm_id` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` DROP FOREIGN KEY `FK_ed232e3a899e0556f1b052bc50e`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` ADD CONSTRAINT `FK_auth_user_authenticators_user_id` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` DROP FOREIGN KEY `FK_68b091bb8e853316ad1f9536731`');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` ADD CONSTRAINT `FK_auth_trust_anchors_realm_id` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` DROP FOREIGN KEY `FK_cdedfe142e7b60c17140fc19d8a`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` ADD CONSTRAINT `FK_auth_session_tokens_session_id` FOREIGN KEY (`session_id`) REFERENCES `auth_sessions`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_f945cd1ec65cc16e8462384d3a8`');\n            await queryRunner.query('ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_auth_consents_user_id` FOREIGN KEY (`user_id`) REFERENCES `auth_users`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_089778fa70ab97a637b84957a84`');\n            await queryRunner.query('ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_auth_consents_realm_id` FOREIGN KEY (`realm_id`) REFERENCES `auth_realms`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_consents` DROP FOREIGN KEY `FK_adc5a3c5fa915f59ddac529f2b2`');\n            await queryRunner.query('ALTER TABLE `auth_consents` ADD CONSTRAINT `FK_auth_consents_client_id` FOREIGN KEY (`client_id`) REFERENCES `auth_clients`(`id`) ON DELETE CASCADE ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_clients` DROP FOREIGN KEY `FK_7e7bca0ba30295b43b02a690511`');\n            await queryRunner.query('ALTER TABLE `auth_clients` ADD CONSTRAINT `FK_auth_clients_access_policy_id` FOREIGN KEY (`access_policy_id`) REFERENCES `auth_policies`(`id`) ON DELETE SET NULL ON UPDATE NO ACTION');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` RENAME INDEX `IDX_f3eacccc977b8597cc66db600f` TO `UQ_auth_trust_anchors_name_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_8f8ad5088770598763efdb2c46` TO `UQ_auth_consents_subject_scope`');\n            await queryRunner.query('ALTER TABLE `auth_keys` RENAME INDEX `IDX_0b3208b80576419f0b1319de7a` TO `UQ_auth_keys_name_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_ed232e3a899e0556f1b052bc50` TO `IDX_auth_user_authenticators_user_id`');\n            await queryRunner.query('ALTER TABLE `auth_user_authenticators` RENAME INDEX `IDX_e89cdcc8924d5fef9ae47d49d8` TO `IDX_auth_user_authenticators_kind`');\n            await queryRunner.query('ALTER TABLE `auth_trust_anchors` RENAME INDEX `IDX_68b091bb8e853316ad1f953673` TO `IDX_auth_trust_anchors_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_2a86161c2eae4ef90aee1fa657` TO `IDX_auth_session_tokens_expires_at`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_37121db8ac9517c083c473b95c` TO `IDX_auth_session_tokens_kind`');\n            await queryRunner.query('ALTER TABLE `auth_session_tokens` RENAME INDEX `IDX_cdedfe142e7b60c17140fc19d8` TO `IDX_auth_session_tokens_session_id`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_85536e251a24fe5141925ee3f9` TO `IDX_auth_events_name_scope`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_12ed04e1591ed2574d1324070b` TO `IDX_auth_events_ref_type_ref_id`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_64ac9bded13b2b6b75b128d8e5` TO `IDX_auth_events_created_at`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_1db311adb485ecbefd92c5daf8` TO `IDX_auth_events_expires_at`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_0c8183e935c03317f4829cb427` TO `IDX_auth_events_expiring`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_5a0f436c6949aeb968db4f2473` TO `IDX_auth_events_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_5fafa06904d87cf1d77bbf4564` TO `IDX_auth_events_request_ip_address`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_ce33c3f58b802bb3c7b2668adc` TO `IDX_auth_events_actor_name`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_a5cc98d786bf9fce973ab2594f` TO `IDX_auth_events_actor_id`');\n            await queryRunner.query('ALTER TABLE `auth_events` RENAME INDEX `IDX_e50f1f5e014087edaac7240ba9` TO `IDX_auth_events_client_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_f945cd1ec65cc16e8462384d3a` TO `IDX_auth_consents_user_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_089778fa70ab97a637b84957a8` TO `IDX_auth_consents_realm_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_adc5a3c5fa915f59ddac529f2b` TO `IDX_auth_consents_client_id`');\n            await queryRunner.query('ALTER TABLE `auth_consents` RENAME INDEX `IDX_482fa13b8f47218a844e333282` TO `IDX_auth_consents_sub`');\n        } finally {\n            await queryRunner.query('SET FOREIGN_KEY_CHECKS = 1');\n        }\n    }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEA,IAAaA,6CAAb,MAAaA;CACTC,OAAO;CAEP,MAAaC,GAAGC,aAAyC;EACrD,MAAMA,YAAYC,MAAM,4BAAA;EACxB,IAAI;GACA,MAAMD,YAAYC,MAAM,+EAAA;GACxB,MAAMD,YAAYC,MAAM,wKAAA;GACxB,MAAMD,YAAYC,MAAM,yMAAA;GACxB,MAAMD,YAAYC,MAAM,+NAAA;GACxB,MAAMD,YAAYC,MAAM,iFAAA;GACxB,MAAMD,YAAYC,MAAM,sIAAA;GACxB,MAAMD,YAAYC,MAAM,qEAAA;GACxB,MAAMD,YAAYC,MAAM,mLAAA;GACxB,MAAMD,YAAYC,MAAM,8DAAA;GACxB,MAAMD,YAAYC,MAAM,+EAAA;GACxB,MAAMD,YAAYC,MAAM,sGAAA;GACxB,MAAMD,YAAYC,MAAM,4GAAA;GACxB,MAAMD,YAAYC,MAAM,2GAAA;GACxB,MAAMD,YAAYC,MAAM,0GAAA;GACxB,MAAMD,YAAYC,MAAM,wGAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,iHAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,8GAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,yHAAA;GACxB,MAAMD,YAAYC,MAAM,mHAAA;GACxB,MAAMD,YAAYC,MAAM,yHAAA;GACxB,MAAMD,YAAYC,MAAM,qHAAA;GACxB,MAAMD,YAAYC,MAAM,6HAAA;GACxB,MAAMD,YAAYC,MAAM,gIAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,+GAAA;GACxB,MAAMD,YAAYC,MAAM,yHAAA;GACxB,MAAMD,YAAYC,MAAM,gFAAA;GACxB,MAAMD,YAAYC,MAAM,qLAAA;GACxB,MAAMD,YAAYC,MAAM,2EAAA;GACxB,MAAMD,YAAYC,MAAM,6KAAA;GACxB,MAAMD,YAAYC,MAAM,0EAAA;GACxB,MAAMD,YAAYC,MAAM,2KAAA;GACxB,MAAMD,YAAYC,MAAM,yEAAA;GACxB,MAAMD,YAAYC,MAAM,yKAAA;GACxB,MAAMD,YAAYC,MAAM,wFAAA;GACxB,MAAMD,YAAYC,MAAM,qLAAA;GACxB,MAAMD,YAAYC,MAAM,oFAAA;GACxB,MAAMD,YAAYC,MAAM,gLAAA;GACxB,MAAMD,YAAYC,MAAM,+FAAA;GACxB,MAAMD,YAAYC,MAAM,oLAAA;GACxB,MAAMD,YAAYC,MAAM,gGAAA;GACxB,MAAMD,YAAYC,MAAM,sLAAA;EAC5B,UAAU;GACN,MAAMD,YAAYC,MAAM,4BAAA;EAC5B;CACJ;CAEA,MAAaC,KAAKF,aAAyC;EACvD,MAAMA,YAAYC,MAAM,4BAAA;EACxB,IAAI;GACA,MAAMD,YAAYC,MAAM,oIAAA;GACxB,MAAMD,YAAYC,MAAM,gFAAA;GACxB,MAAMD,YAAYC,MAAM,2NAAA;GACxB,MAAMD,YAAYC,MAAM,qMAAA;GACxB,MAAMD,YAAYC,MAAM,qKAAA;GACxB,MAAMD,YAAYC,MAAM,8EAAA;GACxB,MAAMD,YAAYC,MAAM,8DAAA;GACxB,MAAMD,YAAYC,MAAM,oDAAA;GACxB,MAAMD,YAAYC,MAAM,qFAAA;GACxB,MAAMD,YAAYC,MAAM,2DAAA;GACxB,MAAMD,YAAYC,MAAM,0FAAA;GACxB,MAAMD,YAAYC,MAAM,4LAAA;GACxB,MAAMD,YAAYC,MAAM,0FAAA;GACxB,MAAMD,YAAYC,MAAM,yLAAA;GACxB,MAAMD,YAAYC,MAAM,oFAAA;GACxB,MAAMD,YAAYC,MAAM,gLAAA;GACxB,MAAMD,YAAYC,MAAM,qFAAA;GACxB,MAAMD,YAAYC,MAAM,wLAAA;GACxB,MAAMD,YAAYC,MAAM,+EAAA;GACxB,MAAMD,YAAYC,MAAM,mKAAA;GACxB,MAAMD,YAAYC,MAAM,+EAAA;GACxB,MAAMD,YAAYC,MAAM,sKAAA;GACxB,MAAMD,YAAYC,MAAM,+EAAA;GACxB,MAAMD,YAAYC,MAAM,yKAAA;GACxB,MAAMD,YAAYC,MAAM,8EAAA;GACxB,MAAMD,YAAYC,MAAM,uLAAA;GACxB,MAAMD,YAAYC,MAAM,yHAAA;GACxB,MAAMD,YAAYC,MAAM,+GAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,gIAAA;GACxB,MAAMD,YAAYC,MAAM,6HAAA;GACxB,MAAMD,YAAYC,MAAM,qHAAA;GACxB,MAAMD,YAAYC,MAAM,yHAAA;GACxB,MAAMD,YAAYC,MAAM,mHAAA;GACxB,MAAMD,YAAYC,MAAM,yHAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,8GAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,iHAAA;GACxB,MAAMD,YAAYC,MAAM,yGAAA;GACxB,MAAMD,YAAYC,MAAM,uGAAA;GACxB,MAAMD,YAAYC,MAAM,wGAAA;GACxB,MAAMD,YAAYC,MAAM,0GAAA;GACxB,MAAMD,YAAYC,MAAM,2GAAA;GACxB,MAAMD,YAAYC,MAAM,4GAAA;GACxB,MAAMD,YAAYC,MAAM,sGAAA;EAC5B,UAAU;GACN,MAAMD,YAAYC,MAAM,4BAAA;EAC5B;CACJ;AACJ"}

package/dist/adapters/database/migrations/mysql/1786436332251-QueryIndexes.d.ts

@@ -0,0 +1,44 @@
+import type { MigrationInterface, QueryRunner } from 'typeorm';
+/**
+ * Indexes for the query surface and the foreign-key graph.
+ *
+ * Query surface: backs the rapiq schema `indexes` declarations (rapiq
+ * 2.0.0-beta.20 indexed filters/sort, tada5hi/rapiq#895) — every key in a
+ * schema's filter/sort allow-list must LEAD a real database index, so the
+ * parse-time index policy never rejects a query the allow-lists permit.
+ *
+ * Foreign-key graph: indexes every remaining FK scalar column (junction
+ * *_realm_id and policy_id columns, client.access_policy_id, the EA and
+ * identity-provider mapping tables). MySQL always keeps an implicit FK
+ * index, so these matter on Postgres, where realm deletion
+ * (crypto-shredding) and cascade deletes otherwise full-scan every
+ * junction, and EA tree loads sit on the permission-evaluation hot path.
+ *
+ * display_name is indexed wherever the column exists, alongside name:
+ * the console searches both at once (`or(contains(name), contains(
+ * display_name))`), and anchor mode passes an OR only when EVERY branch
+ * leads an index, so one missing index would reject the whole search.
+ *
+ * Compound access paths: (actor_name, request_ip_address, created_at) on
+ * auth_events serves the login-throttle countRecent key and replaces the
+ * redundant actor_name single; auth_session_tokens.parent_id serves the
+ * grace-window hasConsumedChild lookup; auth_sessions gains its three FK
+ * indexes; (provider_user_id, provider_id) serves the federated-login
+ * account lookup.
+ *
+ * Cleanup: drops the three orphaned legacy tables no entity has described
+ * since their reworks — auth_authorization_codes (codes moved to cache
+ * blobs), auth_refresh_tokens (superseded by auth_session_tokens),
+ * auth_identity_provider_roles (superseded by
+ * auth_identity_provider_role_mappings). down() recreates them exactly as
+ * the pre-existing chain leaves them, so older down() paths keep working.
+ *
+ * Generated with `migration generate`; derived IDX_<hash> names, generated
+ * DDL untouched (hand-authored blocks are marked).
+ */
+export declare class QueryIndexes1786436332251 implements MigrationInterface {
+    name: string;
+    up(queryRunner: QueryRunner): Promise<void>;
+    down(queryRunner: QueryRunner): Promise<void>;
+}
+//# sourceMappingURL=1786436332251-QueryIndexes.d.ts.map

package/dist/adapters/database/migrations/mysql/1786436332251-QueryIndexes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"1786436332251-QueryIndexes.d.ts","sourceRoot":"","sources":["../../../../../src/adapters/database/migrations/mysql/1786436332251-QueryIndexes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,qBAAa,yBAA0B,YAAW,kBAAkB;IAChE,IAAI,SAA+B;IAEtB,EAAE,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAub3C,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;CA8zB7D"}