@axiom-lattice/pg-stores 5.0.3 → 5.1.0

package/src/__tests__/PostgreSQLPlatformMemberStore.test.ts

@@ -0,0 +1,146 @@
+import { randomUUID } from "node:crypto";
+import { Pool } from "pg";
+import type { PlatformMember } from "@axiom-lattice/protocols";
+import { createPlatformMembersTable } from "../migrations/platform_member_migration";
+import { PostgreSQLPlatformMemberStore } from "../stores/PostgreSQLPlatformMemberStore";
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = databaseUrl ? describe : describe.skip;
+
+function member(
+  userId: string,
+  overrides: Partial<PlatformMember> = {},
+): PlatformMember {
+  return {
+    userId,
+    role: "admin",
+    grantedBy: "owner-1",
+    grantedAt: new Date("2026-01-01T00:00:00.000Z"),
+    updatedAt: new Date("2026-01-01T00:00:00.000Z"),
+    ...overrides,
+  };
+}
+
+describeIfDatabase("PostgreSQLPlatformMemberStore", () => {
+  let pool: Pool;
+  let store: PostgreSQLPlatformMemberStore;
+  const prefix = `platform-${randomUUID()}`;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const client = await pool.connect();
+    try {
+      await createPlatformMembersTable.up(client);
+    } finally {
+      client.release();
+    }
+    store = new PostgreSQLPlatformMemberStore({ pool });
+  });
+
+  afterEach(async () => {
+    await pool.query(
+      `DELETE FROM lattice_platform_members WHERE user_id LIKE $1`,
+      [`${prefix}%`],
+    );
+  });
+
+  afterAll(async () => {
+    await pool.query(
+      `DELETE FROM lattice_platform_members WHERE user_id LIKE $1`,
+      [`${prefix}%`],
+    );
+    await pool.end();
+  });
+
+  it("upserts, reads and lists platform members by user id", async () => {
+    await store.upsert(member(`${prefix}-b`, { role: "auditor" }));
+    await store.upsert(member(`${prefix}-a`, { role: "owner" }));
+
+    await expect(store.get(`${prefix}-a`)).resolves.toMatchObject({
+      userId: `${prefix}-a`,
+      role: "owner",
+      grantedBy: "owner-1",
+    });
+    await expect(store.get("missing")).resolves.toBeNull();
+
+    const listed = (await store.list()).filter((entry) =>
+      entry.userId.startsWith(prefix),
+    );
+    expect(listed.map((entry) => entry.userId)).toEqual([
+      `${prefix}-a`,
+      `${prefix}-b`,
+    ]);
+    expect(listed.map((entry) => entry.role)).toEqual(["owner", "auditor"]);
+  });
+
+  it("persists role changes with last-write-wins semantics", async () => {
+    const userId = `${prefix}-update`;
+    await store.upsert(member(userId, { role: "admin" }));
+
+    const updated = await store.upsert(
+      member(userId, {
+        role: "owner",
+        grantedBy: "owner-2",
+        grantedAt: new Date("2026-02-01T00:00:00.000Z"),
+        updatedAt: new Date("2026-02-01T00:00:00.000Z"),
+      }),
+    );
+
+    expect(updated).toMatchObject({
+      userId,
+      role: "owner",
+      grantedBy: "owner-2",
+    });
+    await expect(store.get(userId)).resolves.toMatchObject({
+      role: "owner",
+      grantedBy: "owner-2",
+    });
+
+    const listed = (await store.list()).filter((entry) =>
+      entry.userId.startsWith(prefix),
+    );
+    expect(listed).toHaveLength(1);
+
+    const raw = await pool.query<{
+      role: string;
+      granted_by: string;
+    }>(
+      `SELECT role, granted_by FROM lattice_platform_members WHERE user_id = $1`,
+      [userId],
+    );
+    expect(raw.rows[0]).toEqual({ role: "owner", granted_by: "owner-2" });
+  });
+
+  it("round-trips grant and update timestamps", async () => {
+    const userId = `${prefix}-timestamps`;
+    const grantedAt = new Date("2026-03-04T05:06:07.000Z");
+    const updatedAt = new Date("2026-03-05T06:07:08.000Z");
+
+    await store.upsert(member(userId, { grantedAt, updatedAt }));
+
+    const stored = await store.get(userId);
+    expect(stored?.grantedAt).toBeInstanceOf(Date);
+    expect(stored?.grantedAt.getTime()).toBe(grantedAt.getTime());
+    expect(stored?.updatedAt).toBeInstanceOf(Date);
+    expect(stored?.updatedAt.getTime()).toBe(updatedAt.getTime());
+  });
+
+  it("omits grantedBy when it is not provided", async () => {
+    const userId = `${prefix}-no-granter`;
+    const { grantedBy: _grantedBy, ...withoutGrantedBy } = member(userId);
+
+    await store.upsert(withoutGrantedBy);
+
+    const stored = await store.get(userId);
+    expect(stored?.grantedBy).toBeUndefined();
+  });
+
+  it("deletes members", async () => {
+    const userId = `${prefix}-delete`;
+    await store.upsert(member(userId));
+
+    await expect(store.delete(userId)).resolves.toBe(true);
+    await expect(store.get(userId)).resolves.toBeNull();
+    await expect(store.delete(userId)).resolves.toBe(false);
+  });
+});

package/src/__tests__/PostgreSQLPlatformSettingsStore.test.ts

@@ -0,0 +1,115 @@
+import { afterAll, beforeAll, describe, expect, it } from "@jest/globals";
+import { Pool } from "pg";
+import { createPlatformSettingsTable } from "../migrations/platform_settings_migration";
+import { PostgreSQLPlatformSettingsStore } from "../stores/PostgreSQLPlatformSettingsStore";
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = databaseUrl ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLPlatformSettingsStore", () => {
+  let pool: Pool;
+  let store: PostgreSQLPlatformSettingsStore;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const client = await pool.connect();
+    try {
+      await createPlatformSettingsTable.up(client);
+      await client.query("DELETE FROM lattice_platform_settings");
+    } finally {
+      client.release();
+    }
+    store = new PostgreSQLPlatformSettingsStore({ pool });
+  });
+
+  afterAll(async () => {
+    await pool.query("DELETE FROM lattice_platform_settings");
+    await pool.end();
+  });
+
+  it("returns null before anything is saved", async () => {
+    await expect(store.get()).resolves.toBeNull();
+  });
+
+  it("creates and CAS-updates the default row", async () => {
+    const first = await store.save(
+      { auth: { emailCompletionEnabled: true } },
+      0,
+      "admin-1",
+    );
+    expect(first.version).toBe(1);
+    expect(first.auth).toEqual({ emailCompletionEnabled: true });
+    expect(first.updatedBy).toBe("admin-1");
+
+    await expect(
+      store.save({ auth: { emailCompletionEnabled: false } }, 0, "admin-2"),
+    ).rejects.toMatchObject({
+      code: "PLATFORM_SETTINGS_VERSION_CONFLICT",
+      actualVersion: 1,
+    });
+
+    const second = await store.save(
+      { rateLimits: { maxActiveRunTasksPerTenant: null } },
+      1,
+      "admin-2",
+    );
+    expect(second.version).toBe(2);
+    expect(second.auth).toBeUndefined();
+    expect(second.rateLimits).toEqual({ maxActiveRunTasksPerTenant: null });
+
+    const reloaded = await store.get();
+    expect(reloaded).toMatchObject({
+      version: 2,
+      rateLimits: { maxActiveRunTasksPerTenant: null },
+      updatedBy: "admin-2",
+    });
+    expect(reloaded?.updatedAt).toBeInstanceOf(Date);
+  });
+
+  it("is idempotent when the migration runs twice", async () => {
+    const client = await pool.connect();
+    try {
+      await expect(createPlatformSettingsTable.up(client)).resolves.toBeUndefined();
+      await expect(createPlatformSettingsTable.up(client)).resolves.toBeUndefined();
+    } finally {
+      client.release();
+    }
+  });
+
+  it("allows exactly one concurrent create at version 0", async () => {
+    await pool.query("DELETE FROM lattice_platform_settings");
+
+    const first = new PostgreSQLPlatformSettingsStore({ pool });
+    const second = new PostgreSQLPlatformSettingsStore({ pool });
+
+    const results = await Promise.allSettled([
+      first.save({ auth: { emailCompletionEnabled: true } }, 0, "admin-1"),
+      second.save({ auth: { emailCompletionEnabled: false } }, 0, "admin-2"),
+    ]);
+
+    const fulfilled = results.filter((r) => r.status === "fulfilled");
+    const rejected = results.filter((r) => r.status === "rejected");
+    expect(fulfilled).toHaveLength(1);
+    expect(rejected).toHaveLength(1);
+    expect((rejected[0] as PromiseRejectedResult).reason).toMatchObject({
+      code: "PLATFORM_SETTINGS_VERSION_CONFLICT",
+      actualVersion: 1,
+    });
+
+    const persisted = await first.get();
+    expect(persisted?.version).toBe(1);
+    expect(persisted?.updatedAt).toBeInstanceOf(Date);
+    expect(["admin-1", "admin-2"]).toContain(persisted?.updatedBy);
+  });
+
+  it("omits empty and whitespace-only updatedBy", async () => {
+    await pool.query("DELETE FROM lattice_platform_settings");
+
+    const first = await store.save({ invite: { defaultMaxUses: 2 } }, 0, "   ");
+    expect(first.updatedBy).toBeUndefined();
+    expect((await store.get())?.updatedBy).toBeUndefined();
+
+    const second = await store.save({ invite: { defaultMaxUses: 3 } }, 1, "");
+    expect(second.updatedBy).toBeUndefined();
+  });
+});

package/src/__tests__/PostgreSQLUserExternalIdentityStore.test.ts

@@ -0,0 +1,125 @@
+import { randomUUID } from "node:crypto";
+import { Pool } from "pg";
+import { ExternalIdentityConflictError } from "@axiom-lattice/protocols";
+import { createUserExternalIdentityTable } from "../migrations/user_external_identity_migration";
+import { PostgreSQLUserExternalIdentityStore } from "../stores/PostgreSQLUserExternalIdentityStore";
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = databaseUrl ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLUserExternalIdentityStore", () => {
+  let pool: Pool;
+  let store: PostgreSQLUserExternalIdentityStore;
+  const providerId = `oidc-${randomUUID()}`;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const client = await pool.connect();
+    try {
+      await createUserExternalIdentityTable.up(client);
+    } finally {
+      client.release();
+    }
+    store = new PostgreSQLUserExternalIdentityStore({ pool });
+  });
+
+  afterEach(async () => {
+    await pool.query(`DELETE FROM lattice_user_identities WHERE provider_id = $1`, [providerId]);
+  });
+
+  afterAll(async () => {
+    await pool.query(`DELETE FROM lattice_user_identities WHERE provider_id = $1`, [providerId]);
+    await pool.end();
+  });
+
+  it("links, reads, lists and unlinks", async () => {
+    await store.link({
+      userId: "user-1",
+      providerId,
+      issuer: "https://idp.example.com",
+      subject: "sub-1",
+      email: "user@example.com",
+      linkedAt: new Date("2026-01-01T00:00:00.000Z"),
+    });
+
+    const found = await store.getByProviderSubject(
+      providerId,
+      "https://idp.example.com",
+      "sub-1",
+    );
+    expect(found).toMatchObject({
+      userId: "user-1",
+      providerId,
+      issuer: "https://idp.example.com",
+      subject: "sub-1",
+      email: "user@example.com",
+    });
+    expect(found?.linkedAt).toBeInstanceOf(Date);
+
+    await store.unlink(providerId, "https://idp.example.com", "sub-1");
+    expect(
+      await store.getByProviderSubject(providerId, "https://idp.example.com", "sub-1"),
+    ).toBeNull();
+  });
+
+  it("lists all identities for a user ordered by linked_at ascending", async () => {
+    await store.link({
+      userId: "user-list",
+      providerId,
+      issuer: "https://idp-a.example.com",
+      subject: "sub-1",
+      linkedAt: new Date("2026-02-01T00:00:00.000Z"),
+    });
+    await store.link({
+      userId: "user-list",
+      providerId,
+      issuer: "https://idp-b.example.com",
+      subject: "sub-1",
+      linkedAt: new Date("2026-01-01T00:00:00.000Z"),
+    });
+
+    const listed = await store.listByUser("user-list");
+    expect(listed).toHaveLength(2);
+    expect(listed.map((item) => item.issuer)).toEqual([
+      "https://idp-b.example.com",
+      "https://idp-a.example.com",
+    ]);
+  });
+
+  it("isolates the same subject across issuers", async () => {
+    await store.link({
+      userId: "user-a",
+      providerId,
+      issuer: "https://idp-a.example.com",
+      subject: "sub-1",
+      linkedAt: new Date("2026-01-01T00:00:00.000Z"),
+    });
+    await store.link({
+      userId: "user-b",
+      providerId,
+      issuer: "https://idp-b.example.com",
+      subject: "sub-1",
+      linkedAt: new Date("2026-01-01T00:00:00.000Z"),
+    });
+    expect(
+      await store.getByProviderSubject(providerId, "https://idp-a.example.com", "sub-1"),
+    ).toMatchObject({ userId: "user-a" });
+    expect(
+      await store.getByProviderSubject(providerId, "https://idp-b.example.com", "sub-1"),
+    ).toMatchObject({ userId: "user-b" });
+  });
+
+  it("is idempotent for the same user and rejects a different user", async () => {
+    const base = {
+      providerId,
+      issuer: "https://idp.example.com",
+      subject: "sub-1",
+      linkedAt: new Date("2026-01-01T00:00:00.000Z"),
+    };
+    await store.link({ ...base, userId: "user-1" });
+    await expect(store.link({ ...base, userId: "user-1" })).resolves.toBeUndefined();
+    await expect(store.link({ ...base, userId: "user-2" })).rejects.toBeInstanceOf(
+      ExternalIdentityConflictError,
+    );
+  });
+});

package/src/__tests__/PostgreSQLUserStore.test.ts

@@ -0,0 +1,75 @@
+import { randomUUID } from "node:crypto";
+import { Pool } from "pg";
+import { MigrationManager } from "../migrations/migration";
+import { createUsersTable } from "../migrations/user_migrations";
+import { addUserStatusColumn } from "../migrations/user_status_migration";
+import { createUserEmailLowerUniqueIndex } from "../migrations/user_email_lower_unique_migration";
+import { PostgreSQLUserStore } from "../stores/PostgreSQLUserStore";
+
+const databaseUrl = process.env.TEST_DATABASE_URL;
+const describeIfDatabase = databaseUrl ? describe : describe.skip;
+
+describeIfDatabase("PostgreSQLUserStore", () => {
+  let pool: Pool;
+  let store: PostgreSQLUserStore;
+
+  beforeAll(async () => {
+    pool = new Pool({ connectionString: databaseUrl });
+    const manager = new MigrationManager(pool);
+    manager.register(createUsersTable);
+    manager.register(addUserStatusColumn);
+    manager.register(createUserEmailLowerUniqueIndex);
+    await manager.migrate();
+    store = new PostgreSQLUserStore({ pool });
+  });
+
+  afterAll(async () => {
+    await pool.end();
+  });
+
+  it("matches email case-insensitively", async () => {
+    const id = randomUUID();
+    try {
+      await store.createUser(id, {
+        email: `User-${id}@Example.COM`,
+        name: "User",
+        status: "active",
+      });
+      await expect(store.getUserByEmail(` user-${id}@example.com `)).resolves.toMatchObject({ id });
+    } finally {
+      await pool.query("DELETE FROM lattice_users WHERE id = $1", [id]);
+    }
+  });
+
+  it("creates the case-insensitive unique email index", async () => {
+    const result = await pool.query(
+      `SELECT indexname
+         FROM pg_indexes
+        WHERE schemaname = current_schema()
+          AND tablename = 'lattice_users'
+          AND indexname = 'idx_lattice_users_email_lower'`,
+    );
+    expect(result.rows).toHaveLength(1);
+  });
+
+  it("rejects an email that differs only by case", async () => {
+    const firstId = randomUUID();
+    const secondId = randomUUID();
+    try {
+      await store.createUser(firstId, {
+        email: `Case-${firstId}@Example.COM`,
+        name: "First",
+        status: "active",
+      });
+      await expect(
+        store.createUser(secondId, {
+          email: `case-${firstId}@example.com`,
+          name: "Second",
+          status: "active",
+        }),
+      ).rejects.toThrow();
+    } finally {
+      await pool.query("DELETE FROM lattice_users WHERE id = ANY($1)", [[firstId, secondId]]);
+    }
+  });
+});

package/src/createPgStoreConfig.ts

@@ -11,6 +11,12 @@ import { PostgreSQLProjectStore } from "./stores/PostgreSQLProjectStore";
 import { PostgreSQLUserStore } from "./stores/PostgreSQLUserStore";
 import { PostgreSQLTenantStore } from "./stores/PostgreSQLTenantStore";
 import { PostgreSQLUserTenantLinkStore } from "./stores/PostgreSQLUserTenantLinkStore";
+import { PostgreSQLUserExternalIdentityStore } from "./stores/PostgreSQLUserExternalIdentityStore";
+import { PostgreSQLOidcProviderConfigStore } from "./stores/PostgreSQLOidcProviderConfigStore";
+import { PostgreSQLPlatformMemberStore } from "./stores/PostgreSQLPlatformMemberStore";
+import { PostgreSQLPlatformInvitationStore } from "./stores/PostgreSQLPlatformInvitationStore";
+import { PostgreSQLOidcIdentityClaimStore } from "./stores/PostgreSQLOidcIdentityClaimStore";
+import { PostgreSQLInviteLinkStore } from "./stores/PostgreSQLInviteLinkStore";
 import { PostgreSQLWorkflowTrackingStore } from "./stores/PostgreSQLWorkflowTrackingStore";
 import { PostgreSQLEvalStore } from "./stores/PostgreSQLEvalStore";
 import { ThreadMessageQueueStore } from "./stores/ThreadMessageQueueStore";
@@ -67,6 +73,16 @@ import { addApiKeyGrants } from "./migrations/add_api_key_grants";
 import { createOpenAuditTable } from "./migrations/create_open_audit_table";
 import { addShareOpenGrants } from "./migrations/add_share_open_grants";
 import { addShareKind } from "./migrations/add_share_kind";
+import { createUserExternalIdentityTable } from "./migrations/user_external_identity_migration";
+import { createUserEmailLowerUniqueIndex } from "./migrations/user_email_lower_unique_migration";
+import { createOidcProviderConfigsTable } from "./migrations/oidc_provider_config_migration";
+import { createPlatformMembersTable } from "./migrations/platform_member_migration";
+import { createPlatformInvitationsTable } from "./migrations/platform_invitation_migration";
+import { createOidcIdentityClaimsTable } from "./migrations/oidc_identity_claim_migration";
+import { createInviteLinksTable } from "./migrations/invite_link_migration";
+import { addOidcIdentityClaimInviteFields } from "./migrations/oidc_identity_claim_invite_migration";
+import { createPlatformSettingsTable } from "./migrations/platform_settings_migration";
+import { addOidcProviderAllowedHosts } from "./migrations/oidc_provider_allowed_hosts_migration";
 import { taskMigrations } from "./migrations/task_migration";
 import { createMenuItemsTable } from "./migrations/menu_items_migration";
 import { addFileContentType } from "./migrations/menu_items_add_file_type";
@@ -124,6 +140,7 @@ import { PostgreSQLLeaseStore } from "./stores/PostgreSQLLeaseStore";
 import { PostgreSQLOutboxStore } from "./stores/PostgreSQLOutboxStore";
 import { PostgreSQLPluginDeploymentStore } from "./stores/PostgreSQLPluginDeploymentStore";
 import { PostgreSQLAgentRunLedger } from "./stores/PostgreSQLAgentRunLedger";
+import { PostgreSQLPlatformSettingsStore } from "./stores/PostgreSQLPlatformSettingsStore";
 import { PostgreSQLChannelReplyJobStore } from "./stores/PostgreSQLChannelReplyJobStore";
 import { PostgreSQLCheckpointStorage } from "./stores/PostgreSQLCheckpointStorage";
 import { PostgreSQLStore } from "./stores/PostgreSQLStore";
@@ -226,6 +243,16 @@ export async function createPgStoreConfig(connectionString: string) {
   mm.register(agentRunProjectTaskRunningIndexMigration); // v204
   mm.register(addModelProviderKindDefault);     // v207
   mm.register(addShareKind);                    // v208
+  mm.register(createUserExternalIdentityTable); // v209
+  mm.register(createUserEmailLowerUniqueIndex); // v210
+  mm.register(createOidcProviderConfigsTable);  // v211
+  mm.register(createPlatformMembersTable);      // v212
+  mm.register(createPlatformInvitationsTable);  // v213
+  mm.register(createOidcIdentityClaimsTable);   // v214
+  mm.register(createInviteLinksTable);          // v215
+  mm.register(addOidcIdentityClaimInviteFields); // v216
+  mm.register(createPlatformSettingsTable);     // v217
+  mm.register(addOidcProviderAllowedHosts);      // v218
 
   await mm.migrate();
 
@@ -247,6 +274,13 @@ export async function createPgStoreConfig(connectionString: string) {
     user: new PostgreSQLUserStore(opts),
     tenant: new PostgreSQLTenantStore(opts),
     userTenantLink: new PostgreSQLUserTenantLinkStore(opts),
+    userExternalIdentity: new PostgreSQLUserExternalIdentityStore(opts),
+    oidcProviderConfig: new PostgreSQLOidcProviderConfigStore(opts),
+    platformMember: new PostgreSQLPlatformMemberStore(opts),
+    platformInvitation: new PostgreSQLPlatformInvitationStore(opts),
+    oidcIdentityClaim: new PostgreSQLOidcIdentityClaimStore(opts),
+    inviteLink: new PostgreSQLInviteLinkStore(opts),
+    platformSettings: new PostgreSQLPlatformSettingsStore(opts),
     channelBinding: new ChannelBindingStore(opts),
     channelInstallation: new PostgreSQLChannelInstallationStore(opts),
     thread: new PostgreSQLThreadStore(opts),

package/src/index.ts

@@ -24,6 +24,22 @@ export * from "./stores/PostgreSQLProjectStore";
 export * from "./stores/PostgreSQLUserStore";
 export * from "./stores/PostgreSQLTenantStore";
 export * from "./stores/PostgreSQLUserTenantLinkStore";
+export * from "./migrations/user_external_identity_migration";
+export * from "./migrations/user_email_lower_unique_migration";
+export * from "./stores/PostgreSQLUserExternalIdentityStore";
+export * from "./migrations/oidc_provider_config_migration";
+export * from "./stores/PostgreSQLOidcProviderConfigStore";
+export * from "./migrations/platform_member_migration";
+export * from "./stores/PostgreSQLPlatformMemberStore";
+export * from "./migrations/platform_invitation_migration";
+export * from "./stores/PostgreSQLPlatformInvitationStore";
+export * from "./migrations/oidc_identity_claim_migration";
+export * from "./stores/PostgreSQLOidcIdentityClaimStore";
+export * from "./migrations/invite_link_migration";
+export * from "./migrations/oidc_identity_claim_invite_migration";
+export * from "./stores/PostgreSQLInviteLinkStore";
+export * from "./migrations/platform_settings_migration";
+export * from "./stores/PostgreSQLPlatformSettingsStore";
 export * from "./migrations/migration";
 export * from "./migrations/thread_migrations";
 export * from "./migrations/thread_tenant_migration";

package/src/migrations/invite_link_migration.ts

@@ -0,0 +1,35 @@
+import type { Migration } from "./migration";
+
+/** Creates durable bearer invitation links. */
+export const createInviteLinksTable: Migration = {
+  version: 215,
+  name: "create_invite_links",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_invite_links (
+        id UUID PRIMARY KEY,
+        scope VARCHAR(16) NOT NULL,
+        token_hash VARCHAR(64) NOT NULL UNIQUE,
+        token_encrypted TEXT NOT NULL,
+        email VARCHAR(320),
+        platform_role VARCHAR(16),
+        tenant_id VARCHAR(255),
+        tenant_role VARCHAR(16),
+        created_by VARCHAR(255),
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        max_uses INTEGER NOT NULL,
+        used_count INTEGER NOT NULL DEFAULT 0,
+        revoked_at TIMESTAMPTZ
+      )
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS lattice_invite_links_created
+        ON lattice_invite_links (created_at DESC)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_invite_links");
+  },
+};

package/src/migrations/oidc_identity_claim_invite_migration.ts

@@ -0,0 +1,29 @@
+import type { Migration } from "./migration";
+
+/** Adds invite-link request context to pending identity claims. */
+export const addOidcIdentityClaimInviteFields: Migration = {
+  version: 216,
+  name: "add_oidc_identity_claim_invite_fields",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_identity_claims
+        ADD COLUMN IF NOT EXISTS source VARCHAR(32),
+        ADD COLUMN IF NOT EXISTS invite_link_id UUID,
+        ADD COLUMN IF NOT EXISTS requested_user_id VARCHAR(255),
+        ADD COLUMN IF NOT EXISTS requested_platform_role VARCHAR(16),
+        ADD COLUMN IF NOT EXISTS requested_tenant_id VARCHAR(255),
+        ADD COLUMN IF NOT EXISTS requested_tenant_role VARCHAR(16)
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_identity_claims
+        DROP COLUMN IF EXISTS source,
+        DROP COLUMN IF EXISTS invite_link_id,
+        DROP COLUMN IF EXISTS requested_user_id,
+        DROP COLUMN IF EXISTS requested_platform_role,
+        DROP COLUMN IF EXISTS requested_tenant_id,
+        DROP COLUMN IF EXISTS requested_tenant_role
+    `);
+  },
+};

package/src/migrations/oidc_identity_claim_migration.ts

@@ -0,0 +1,39 @@
+import type { Migration } from "./migration";
+
+/** Creates pending enterprise-SSO identity claims. */
+export const createOidcIdentityClaimsTable: Migration = {
+  version: 214,
+  name: "create_oidc_identity_claims",
+  up: async (client) => {
+    await client.query(`
+      CREATE TABLE IF NOT EXISTS lattice_oidc_identity_claims (
+        id UUID PRIMARY KEY,
+        provider_id VARCHAR(64) NOT NULL,
+        issuer TEXT NOT NULL,
+        subject TEXT NOT NULL,
+        email VARCHAR(320) NOT NULL,
+        name TEXT,
+        picture TEXT,
+        status VARCHAR(16) NOT NULL,
+        created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+        expires_at TIMESTAMPTZ NOT NULL,
+        reviewed_by VARCHAR(255),
+        reviewed_at TIMESTAMPTZ,
+        linked_user_id VARCHAR(255)
+      )
+    `);
+    await client.query(`
+      CREATE UNIQUE INDEX IF NOT EXISTS lattice_oidc_identity_claims_pending_subject
+        ON lattice_oidc_identity_claims (provider_id, issuer, subject)
+        WHERE status = 'pending'
+    `);
+    await client.query(`
+      CREATE INDEX IF NOT EXISTS lattice_oidc_identity_claims_status_created
+        ON lattice_oidc_identity_claims (status, created_at)
+    `);
+  },
+  down: async (client) => {
+    await client.query("DROP TABLE IF EXISTS lattice_oidc_identity_claims");
+  },
+};

package/src/migrations/oidc_provider_allowed_hosts_migration.ts

@@ -0,0 +1,19 @@
+import type { Migration } from "./migration";
+
+/** Adds the per-provider private-network issuer allowlist to OIDC providers. */
+export const addOidcProviderAllowedHosts: Migration = {
+  version: 218,
+  name: "add_oidc_provider_allowed_hosts",
+  up: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_provider_configs
+      ADD COLUMN IF NOT EXISTS allowed_private_hosts JSONB
+    `);
+  },
+  down: async (client) => {
+    await client.query(`
+      ALTER TABLE lattice_oidc_provider_configs
+      DROP COLUMN IF EXISTS allowed_private_hosts
+    `);
+  },
+};