@azlib/identity 0.2.0

package/package.json

@@ -0,0 +1,92 @@
+{
+  "name": "@azlib/identity",
+  "version": "0.2.0",
+  "type": "module",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/hanhn-dev/azlib.git"
+  },
+  "files": [
+    "dist",
+    "schema",
+    "README.md"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.mts",
+      "import": "./dist/index.mjs",
+      "require": "./dist/index.cjs"
+    },
+    "./node": {
+      "types": "./dist/node.d.mts",
+      "import": "./dist/node.mjs",
+      "require": "./dist/node.cjs"
+    },
+    "./express": {
+      "types": "./dist/express.d.mts",
+      "import": "./dist/express.mjs",
+      "require": "./dist/express.cjs"
+    },
+    "./nestjs": {
+      "types": "./dist/nestjs.d.mts",
+      "import": "./dist/nestjs.mjs",
+      "require": "./dist/nestjs.cjs"
+    },
+    "./test-utils": {
+      "types": "./dist/test-utils.d.mts",
+      "import": "./dist/test-utils.mjs",
+      "require": "./dist/test-utils.cjs"
+    },
+    "./schema/*": "./schema/*"
+  },
+  "dependencies": {
+    "jose": "^5.9.6"
+  },
+  "peerDependencies": {
+    "@nestjs/common": "^10.0.0 || ^11.0.0",
+    "@nestjs/core": "^10.0.0 || ^11.0.0",
+    "express": "^4.18.0 || ^5.0.0",
+    "reflect-metadata": "^0.2.0"
+  },
+  "peerDependenciesMeta": {
+    "@nestjs/common": {
+      "optional": true
+    },
+    "@nestjs/core": {
+      "optional": true
+    },
+    "express": {
+      "optional": true
+    },
+    "reflect-metadata": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@nestjs/common": "^11.0.0",
+    "@nestjs/core": "^11.0.0",
+    "@types/express": "^5.0.0",
+    "@types/node": "^22.10.0",
+    "@types/supertest": "^6.0.2",
+    "express": "^5.1.0",
+    "reflect-metadata": "^0.2.2",
+    "rxjs": "^7.8.1",
+    "supertest": "^7.0.0",
+    "tsdown": "^0.22.1",
+    "typescript": "5.5.4",
+    "vitest": "^4.1.5",
+    "@repo/typescript-config": "0.0.0"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsdown",
+    "dev": "tsdown --watch",
+    "lint": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "clean": "rm -rf .turbo node_modules dist"
+  }
+}

package/schema/model.ts

@@ -0,0 +1,100 @@
+/**
+ * Logical description of the relational schema `@azlib/identity` expects.
+ *
+ * Concrete DDL is shipped alongside this module:
+ * - `@azlib/identity/schema/postgres.sql`
+ * - `@azlib/identity/schema/mysql.sql`
+ * - `@azlib/identity/schema/sqlite.sql`
+ * - `@azlib/identity/schema/prisma.schema`
+ *
+ * This object is documentation-as-data so consumers and tooling can introspect the
+ * expected tables without parsing SQL.
+ */
+export interface SchemaColumn {
+  name: string;
+  description: string;
+  nullable: boolean;
+}
+
+export interface SchemaTable {
+  name: string;
+  description: string;
+  columns: readonly SchemaColumn[];
+}
+
+export interface SchemaModel {
+  tables: readonly SchemaTable[];
+}
+
+export const identitySchemaModel: SchemaModel = {
+  tables: [
+    {
+      name: "identity_users",
+      description: "Core user accounts.",
+      columns: [
+        { name: "user_id", description: "Primary key.", nullable: false },
+        { name: "email", description: "Unique, case-insensitive login email.", nullable: false },
+        { name: "display_name", description: "Optional display name.", nullable: true },
+        { name: "status", description: "active | disabled | locked.", nullable: false },
+        { name: "email_verified_at", description: "When email was verified.", nullable: true },
+        { name: "auth_version", description: "Token invalidation counter.", nullable: false },
+        { name: "created_at", description: "Creation timestamp.", nullable: false },
+        { name: "updated_at", description: "Last update timestamp.", nullable: false },
+      ],
+    },
+    {
+      name: "identity_credentials",
+      description: "Password hashes, one per user.",
+      columns: [
+        { name: "user_id", description: "FK to identity_users.", nullable: false },
+        { name: "password_hash", description: "Algorithm-tagged hash.", nullable: false },
+        { name: "updated_at", description: "Last update timestamp.", nullable: false },
+      ],
+    },
+    {
+      name: "identity_sessions",
+      description: "Server-side refresh sessions with hashed tokens.",
+      columns: [
+        { name: "session_id", description: "Primary key.", nullable: false },
+        { name: "user_id", description: "FK to identity_users.", nullable: false },
+        { name: "refresh_token_hash", description: "Hash of the active refresh token.", nullable: false },
+        { name: "created_at", description: "Creation timestamp.", nullable: false },
+        { name: "expires_at", description: "Expiry timestamp.", nullable: false },
+        { name: "revoked_at", description: "Set when rotated or revoked.", nullable: true },
+      ],
+    },
+    {
+      name: "identity_roles",
+      description: "Named roles.",
+      columns: [
+        { name: "role_id", description: "Primary key.", nullable: false },
+        { name: "name", description: "Unique role name.", nullable: false },
+        { name: "description", description: "Optional description.", nullable: true },
+      ],
+    },
+    {
+      name: "identity_user_roles",
+      description: "User-to-role assignments.",
+      columns: [
+        { name: "user_id", description: "FK to identity_users.", nullable: false },
+        { name: "role_id", description: "FK to identity_roles.", nullable: false },
+      ],
+    },
+    {
+      name: "identity_role_permissions",
+      description: "Permissions granted to roles.",
+      columns: [
+        { name: "role_id", description: "FK to identity_roles.", nullable: false },
+        { name: "permission", description: "Permission string.", nullable: false },
+      ],
+    },
+    {
+      name: "identity_user_permissions",
+      description: "Permissions granted directly to users.",
+      columns: [
+        { name: "user_id", description: "FK to identity_users.", nullable: false },
+        { name: "permission", description: "Permission string.", nullable: false },
+      ],
+    },
+  ],
+};

package/schema/mysql.sql

@@ -0,0 +1,102 @@
+-- @azlib/identity — MySQL schema
+-- Apply with: mysql DATABASE < mysql.sql
+
+CREATE TABLE IF NOT EXISTS identity_users (
+    user_id                VARCHAR(64) PRIMARY KEY,
+    email                  VARCHAR(320) NOT NULL,
+    display_name           VARCHAR(255),
+    status                 ENUM('active', 'disabled', 'locked') NOT NULL DEFAULT 'active',
+    email_verified_at      DATETIME,
+    auth_version           INT NOT NULL DEFAULT 0,
+    failed_login_attempts  INT NOT NULL DEFAULT 0,
+    locked_until           DATETIME,
+    two_factor_enabled     TINYINT(1) NOT NULL DEFAULT 0,
+    created_at             DATETIME NOT NULL,
+    updated_at             DATETIME NOT NULL,
+    UNIQUE KEY identity_users_email_key (email)
+);
+
+CREATE TABLE IF NOT EXISTS identity_credentials (
+    user_id       VARCHAR(64) PRIMARY KEY,
+    password_hash VARCHAR(512) NOT NULL,
+    updated_at    DATETIME NOT NULL,
+    CONSTRAINT fk_credentials_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_sessions (
+    session_id         VARCHAR(64) PRIMARY KEY,
+    user_id            VARCHAR(64) NOT NULL,
+    refresh_token_hash VARCHAR(512) NOT NULL,
+    created_at         DATETIME NOT NULL,
+    expires_at         DATETIME NOT NULL,
+    revoked_at         DATETIME,
+    KEY identity_sessions_user_idx (user_id),
+    CONSTRAINT fk_sessions_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_roles (
+    role_id     VARCHAR(64) PRIMARY KEY,
+    name        VARCHAR(128) NOT NULL UNIQUE,
+    description VARCHAR(512)
+);
+
+CREATE TABLE IF NOT EXISTS identity_user_roles (
+    user_id VARCHAR(64) NOT NULL,
+    role_id VARCHAR(64) NOT NULL,
+    PRIMARY KEY (user_id, role_id),
+    CONSTRAINT fk_user_roles_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    CONSTRAINT fk_user_roles_role FOREIGN KEY (role_id)
+        REFERENCES identity_roles (role_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_role_permissions (
+    role_id    VARCHAR(64) NOT NULL,
+    permission VARCHAR(255) NOT NULL,
+    PRIMARY KEY (role_id, permission),
+    CONSTRAINT fk_role_permissions_role FOREIGN KEY (role_id)
+        REFERENCES identity_roles (role_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_user_permissions (
+    user_id    VARCHAR(64) NOT NULL,
+    permission VARCHAR(255) NOT NULL,
+    PRIMARY KEY (user_id, permission),
+    CONSTRAINT fk_user_permissions_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_linked_accounts (
+    user_id          VARCHAR(64) NOT NULL,
+    provider         VARCHAR(64) NOT NULL,
+    provider_user_id VARCHAR(255) NOT NULL,
+    email            VARCHAR(320),
+    display_name     VARCHAR(255),
+    linked_at        DATETIME NOT NULL,
+    PRIMARY KEY (provider, provider_user_id),
+    KEY identity_oauth_user_idx (user_id),
+    CONSTRAINT fk_oauth_links_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_verification_tokens (
+    token_hash VARCHAR(128) PRIMARY KEY,
+    user_id    VARCHAR(64) NOT NULL,
+    type       ENUM('email_verification', 'password_reset') NOT NULL,
+    expires_at DATETIME NOT NULL,
+    used_at    DATETIME,
+    KEY identity_vtokens_user_idx (user_id),
+    CONSTRAINT fk_vtokens_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE
+);
+
+CREATE TABLE IF NOT EXISTS identity_totp_secrets (
+    user_id       VARCHAR(64) PRIMARY KEY,
+    secret_base32 VARCHAR(128) NOT NULL,
+    enabled_at    DATETIME,
+    created_at    DATETIME NOT NULL,
+    CONSTRAINT fk_totp_user FOREIGN KEY (user_id)
+        REFERENCES identity_users (user_id) ON DELETE CASCADE
+);

package/schema/postgres.sql

@@ -0,0 +1,92 @@
+-- @azlib/identity — PostgreSQL schema
+-- Apply with: psql "$DATABASE_URL" -f postgres.sql
+
+CREATE TABLE IF NOT EXISTS identity_users (
+    user_id                TEXT PRIMARY KEY,
+    email                  TEXT NOT NULL,
+    display_name           TEXT,
+    status                 TEXT NOT NULL DEFAULT 'active'
+                               CHECK (status IN ('active', 'disabled', 'locked')),
+    email_verified_at      TIMESTAMPTZ,
+    auth_version           INTEGER NOT NULL DEFAULT 0,
+    failed_login_attempts  INTEGER NOT NULL DEFAULT 0,
+    locked_until           TIMESTAMPTZ,
+    two_factor_enabled     BOOLEAN NOT NULL DEFAULT FALSE,
+    created_at             TIMESTAMPTZ NOT NULL,
+    updated_at             TIMESTAMPTZ NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS identity_users_email_key
+    ON identity_users (LOWER(email));
+
+CREATE TABLE IF NOT EXISTS identity_credentials (
+    user_id       TEXT PRIMARY KEY REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    password_hash TEXT NOT NULL,
+    updated_at    TIMESTAMPTZ NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_sessions (
+    session_id         TEXT PRIMARY KEY,
+    user_id            TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    refresh_token_hash TEXT NOT NULL,
+    created_at         TIMESTAMPTZ NOT NULL,
+    expires_at         TIMESTAMPTZ NOT NULL,
+    revoked_at         TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS identity_sessions_user_idx ON identity_sessions (user_id);
+
+CREATE TABLE IF NOT EXISTS identity_roles (
+    role_id     TEXT PRIMARY KEY,
+    name        TEXT NOT NULL UNIQUE,
+    description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS identity_user_roles (
+    user_id TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    role_id TEXT NOT NULL REFERENCES identity_roles (role_id) ON DELETE CASCADE,
+    PRIMARY KEY (user_id, role_id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_role_permissions (
+    role_id    TEXT NOT NULL REFERENCES identity_roles (role_id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,
+    PRIMARY KEY (role_id, permission)
+);
+
+CREATE TABLE IF NOT EXISTS identity_user_permissions (
+    user_id    TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,
+    PRIMARY KEY (user_id, permission)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_linked_accounts (
+    user_id          TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    provider         TEXT NOT NULL,
+    provider_user_id TEXT NOT NULL,
+    email            TEXT,
+    display_name     TEXT,
+    linked_at        TIMESTAMPTZ NOT NULL,
+    PRIMARY KEY (provider, provider_user_id)
+);
+
+CREATE INDEX IF NOT EXISTS identity_oauth_user_idx
+    ON identity_oauth_linked_accounts (user_id);
+
+CREATE TABLE IF NOT EXISTS identity_verification_tokens (
+    token_hash TEXT PRIMARY KEY,
+    user_id    TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    type       TEXT NOT NULL CHECK (type IN ('email_verification', 'password_reset')),
+    expires_at TIMESTAMPTZ NOT NULL,
+    used_at    TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS identity_vtokens_user_idx
+    ON identity_verification_tokens (user_id);
+
+CREATE TABLE IF NOT EXISTS identity_totp_secrets (
+    user_id       TEXT PRIMARY KEY REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    secret_base32 TEXT NOT NULL,
+    enabled_at    TIMESTAMPTZ,
+    created_at    TIMESTAMPTZ NOT NULL DEFAULT NOW()
+);

package/schema/prisma.schema

@@ -0,0 +1,122 @@
+// @azlib/identity — Prisma schema fragment
+// Copy these models into your schema.prisma and adjust the datasource as needed.
+
+model IdentityUser {
+  userId               String    @id @map("user_id")
+  email                String    @unique
+  displayName          String?   @map("display_name")
+  status               String    @default("active")
+  emailVerifiedAt      DateTime? @map("email_verified_at")
+  authVersion          Int       @default(0) @map("auth_version")
+  failedLoginAttempts  Int       @default(0) @map("failed_login_attempts")
+  lockedUntil          DateTime? @map("locked_until")
+  twoFactorEnabled     Boolean   @default(false) @map("two_factor_enabled")
+  createdAt            DateTime  @map("created_at")
+  updatedAt            DateTime  @map("updated_at")
+
+  credential      IdentityCredential?
+  sessions        IdentitySession[]
+  roles           IdentityUserRole[]
+  permissions     IdentityUserPermission[]
+  oauthLinks      IdentityOAuthLinkedAccount[]
+  verificationTokens IdentityVerificationToken[]
+  totpSecret      IdentityTotpSecret?
+
+  @@map("identity_users")
+}
+
+model IdentityCredential {
+  userId       String   @id @map("user_id")
+  passwordHash String   @map("password_hash")
+  updatedAt    DateTime @map("updated_at")
+  user         IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+
+  @@map("identity_credentials")
+}
+
+model IdentitySession {
+  sessionId        String    @id @map("session_id")
+  userId           String    @map("user_id")
+  refreshTokenHash String    @map("refresh_token_hash")
+  createdAt        DateTime  @map("created_at")
+  expiresAt        DateTime  @map("expires_at")
+  revokedAt        DateTime? @map("revoked_at")
+  user             IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+
+  @@index([userId])
+  @@map("identity_sessions")
+}
+
+model IdentityRole {
+  roleId      String  @id @map("role_id")
+  name        String  @unique
+  description String?
+  users       IdentityUserRole[]
+  permissions IdentityRolePermission[]
+
+  @@map("identity_roles")
+}
+
+model IdentityUserRole {
+  userId String @map("user_id")
+  roleId String @map("role_id")
+  user   IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+  role   IdentityRole @relation(fields: [roleId], references: [roleId], onDelete: Cascade)
+
+  @@id([userId, roleId])
+  @@map("identity_user_roles")
+}
+
+model IdentityRolePermission {
+  roleId     String @map("role_id")
+  permission String
+  role       IdentityRole @relation(fields: [roleId], references: [roleId], onDelete: Cascade)
+
+  @@id([roleId, permission])
+  @@map("identity_role_permissions")
+}
+
+model IdentityUserPermission {
+  userId     String @map("user_id")
+  permission String
+  user       IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+
+  @@id([userId, permission])
+  @@map("identity_user_permissions")
+}
+
+model IdentityOAuthLinkedAccount {
+  userId         String   @map("user_id")
+  provider       String
+  providerUserId String   @map("provider_user_id")
+  email          String?
+  displayName    String?  @map("display_name")
+  linkedAt       DateTime @map("linked_at")
+  user           IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+
+  @@id([provider, providerUserId])
+  @@index([userId])
+  @@map("identity_oauth_linked_accounts")
+}
+
+model IdentityVerificationToken {
+  tokenHash String    @id @map("token_hash")
+  userId    String    @map("user_id")
+  type      String    // 'email_verification' | 'password_reset'
+  expiresAt DateTime  @map("expires_at")
+  usedAt    DateTime? @map("used_at")
+  user      IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+
+  @@index([userId])
+  @@map("identity_verification_tokens")
+}
+
+model IdentityTotpSecret {
+  userId       String    @id @map("user_id")
+  secretBase32 String    @map("secret_base32")
+  enabledAt    DateTime? @map("enabled_at")
+  createdAt    DateTime  @default(now()) @map("created_at")
+  user         IdentityUser @relation(fields: [userId], references: [userId], onDelete: Cascade)
+
+  @@map("identity_totp_secrets")
+}

package/schema/sqlite.sql

@@ -0,0 +1,92 @@
+-- @azlib/identity — SQLite schema
+-- Apply with: sqlite3 app.db < sqlite.sql
+
+CREATE TABLE IF NOT EXISTS identity_users (
+    user_id                TEXT PRIMARY KEY,
+    email                  TEXT NOT NULL,
+    display_name           TEXT,
+    status                 TEXT NOT NULL DEFAULT 'active'
+                               CHECK (status IN ('active', 'disabled', 'locked')),
+    email_verified_at      TEXT,
+    auth_version           INTEGER NOT NULL DEFAULT 0,
+    failed_login_attempts  INTEGER NOT NULL DEFAULT 0,
+    locked_until           TEXT,
+    two_factor_enabled     INTEGER NOT NULL DEFAULT 0,
+    created_at             TEXT NOT NULL,
+    updated_at             TEXT NOT NULL
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS identity_users_email_key
+    ON identity_users (email COLLATE NOCASE);
+
+CREATE TABLE IF NOT EXISTS identity_credentials (
+    user_id       TEXT PRIMARY KEY REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    password_hash TEXT NOT NULL,
+    updated_at    TEXT NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS identity_sessions (
+    session_id         TEXT PRIMARY KEY,
+    user_id            TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    refresh_token_hash TEXT NOT NULL,
+    created_at         TEXT NOT NULL,
+    expires_at         TEXT NOT NULL,
+    revoked_at         TEXT
+);
+
+CREATE INDEX IF NOT EXISTS identity_sessions_user_idx ON identity_sessions (user_id);
+
+CREATE TABLE IF NOT EXISTS identity_roles (
+    role_id     TEXT PRIMARY KEY,
+    name        TEXT NOT NULL UNIQUE,
+    description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS identity_user_roles (
+    user_id TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    role_id TEXT NOT NULL REFERENCES identity_roles (role_id) ON DELETE CASCADE,
+    PRIMARY KEY (user_id, role_id)
+);
+
+CREATE TABLE IF NOT EXISTS identity_role_permissions (
+    role_id    TEXT NOT NULL REFERENCES identity_roles (role_id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,
+    PRIMARY KEY (role_id, permission)
+);
+
+CREATE TABLE IF NOT EXISTS identity_user_permissions (
+    user_id    TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    permission TEXT NOT NULL,
+    PRIMARY KEY (user_id, permission)
+);
+
+CREATE TABLE IF NOT EXISTS identity_oauth_linked_accounts (
+    user_id          TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    provider         TEXT NOT NULL,
+    provider_user_id TEXT NOT NULL,
+    email            TEXT,
+    display_name     TEXT,
+    linked_at        TEXT NOT NULL,
+    PRIMARY KEY (provider, provider_user_id)
+);
+
+CREATE INDEX IF NOT EXISTS identity_oauth_user_idx
+    ON identity_oauth_linked_accounts (user_id);
+
+CREATE TABLE IF NOT EXISTS identity_verification_tokens (
+    token_hash TEXT PRIMARY KEY,
+    user_id    TEXT NOT NULL REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    type       TEXT NOT NULL CHECK (type IN ('email_verification', 'password_reset')),
+    expires_at TEXT NOT NULL,
+    used_at    TEXT
+);
+
+CREATE INDEX IF NOT EXISTS identity_vtokens_user_idx
+    ON identity_verification_tokens (user_id);
+
+CREATE TABLE IF NOT EXISTS identity_totp_secrets (
+    user_id       TEXT PRIMARY KEY REFERENCES identity_users (user_id) ON DELETE CASCADE,
+    secret_base32 TEXT NOT NULL,
+    enabled_at    TEXT,
+    created_at    TEXT NOT NULL
+);