@bajustone/fortress 1.0.0-rc.1

package/examples/policy/fortress.policy.json

@@ -0,0 +1,47 @@
+{
+  "$comment": "Example Fortress policy-as-code document. Place at the root of your repo as fortress.policy.json (optionally fortress.policy.<env>.json).",
+  "resources": [
+    {
+      "name": "article",
+      "actions": ["create", "read", "update", "delete", "publish"],
+      "description": "Blog articles"
+    },
+    {
+      "name": "audit-log",
+      "actions": ["read", "export"],
+      "description": "Audit-log entries"
+    }
+  ],
+  "roles": [
+    {
+      "name": "editor",
+      "description": "Can author and publish articles",
+      "permissions": [
+        { "resource": "article", "action": "create" },
+        { "resource": "article", "action": "read" },
+        { "resource": "article", "action": "update" },
+        { "resource": "article", "action": "publish" }
+      ]
+    },
+    {
+      "name": "compliance-reviewer",
+      "description": "Read-only access to audit logs",
+      "permissions": [
+        { "resource": "audit-log", "action": "read" }
+      ]
+    }
+  ],
+  "groups": [
+    { "name": "engineering", "description": "Engineering team" },
+    { "name": "compliance", "description": "Compliance / risk team" }
+  ],
+  "serviceAccounts": [
+    {
+      "name": "ci-bot",
+      "displayName": "CI Bot",
+      "description": "GitHub Actions service account",
+      "isActive": true,
+      "roles": ["editor"]
+    }
+  ]
+}

package/examples/sveltekit-app/README.md

@@ -0,0 +1,125 @@
+# Fortress + SvelteKit Example
+
+A reference for wiring `@bajustone/fortress` into a SvelteKit project.
+
+This directory holds the **Fortress-relevant** files. Drop them into a real
+SvelteKit project (`npm create svelte@latest`) and they work as-is once you
+adjust the imports to use SvelteKit's `$lib` / `$app` aliases.
+
+## Files
+
+| File | Purpose |
+|---|---|
+| `src/lib/server/fortress.ts` | Singleton Fortress instance (server-only). |
+| `src/hooks.server.ts` | Handle hook — primary integration point. |
+| `src/app.d.ts` | Augments `App.Locals` so `event.locals.fortress` is typed. |
+| `src/routes/login/+page.server.ts` | Form-action login. Honors `?flow=<id>` to land back on consent. |
+| `src/routes/dashboard/+page.server.ts` | Protected route reading `getUserId`. |
+| `src/routes/oauth/consent/+page.server.ts` | OAuth consent flow — fetches flow metadata, posts approve/deny. |
+| `src/routes/oauth/consent/+page.svelte` | Branded consent UI rendered in your app, not Fortress. |
+| `src/routes/api/fortress/[...path]/+server.ts` | **Optional** catch-all escape hatch. |
+
+## OAuth consent flow (Pattern B)
+
+`src/lib/server/fortress.ts` registers the `oauth` plugin with
+`enableAuthorizeEndpoint`/`enableConsentApi` on, and seeds a demo user
+(`alice@example.com` / `hunter2`) plus a demo OAuth client at startup.
+The seeded `client_id` / `client_secret` are logged to the server console.
+
+To try the flow end-to-end:
+
+1. Start the example (`npm run dev`).
+2. Copy the seeded `client_id` from the server log.
+3. Hit `http://localhost:5173/api/oauth/authorize?client_id=<id>&redirect_uri=http%3A%2F%2Flocalhost%3A5173%2Foauth%2Fcallback-demo&response_type=code&state=xyz&scope=read:posts`.
+4. Fortress 302s to `/login?flow=<id>` (no session). Log in as alice.
+5. The login action redirects to `/oauth/consent?flow=<id>`. The page
+   loads flow metadata, you click Allow, and the action redirects the
+   browser to the OAuth client's `redirect_uri` with `?code=...&state=xyz`.
+6. The client exchanges the code for an access token via
+   `POST /api/oauth/token` (Basic auth with `client_id:client_secret`).
+
+No HTML ever leaves Fortress — the consent screen is `+page.svelte`,
+styled however you like.
+
+## Two ways to mount Fortress
+
+### 1. Handle hook (recommended)
+
+```ts
+// src/hooks.server.ts
+import { sequence } from '@sveltejs/kit/hooks';
+import { createSvelteKitHandle } from '@bajustone/fortress/sveltekit';
+import { fortress } from '$lib/server/fortress';
+
+export const handle = sequence(
+  createSvelteKitHandle(fortress, { basePath: '/api' }),
+);
+```
+
+This single hook:
+
+- Intercepts `/api/auth/*`, `/api/iam/*`, plugin paths and delegates to
+  `fortress.handleRequest`. The Response (with `Set-Cookie`) is returned
+  directly, **bypassing SvelteKit's `csrf.checkOrigin`**.
+- For user routes, populates `event.locals.fortress` from the access cookie
+  (or `Authorization: Bearer` fallback). Auto-refreshes when expired.
+- Runs plugin middleware at `before-auth` / `after-auth` / `after-rbac`.
+- Auto-skips during `vite build` prerender via `building`.
+
+Zero route files. No `+server.ts` for `/auth/login` etc.
+
+### 2. Catch-all `+server.ts` (escape hatch)
+
+```ts
+// src/routes/api/fortress/[...path]/+server.ts
+import { toSvelteKitHandler } from '@bajustone/fortress/sveltekit';
+import { fortress } from '$lib/server/fortress';
+
+export const { GET, POST, PUT, DELETE, PATCH } = toSvelteKitHandler(fortress);
+```
+
+Use this when you want Fortress routes colocated under your normal routes
+tree. Works alongside the handle hook — there is no conflict because the
+handle hook intercepts paths the file handler would have served anyway.
+
+## Cookie defaults
+
+In production (`NODE_ENV === 'production'`):
+
+```
+Set-Cookie: __Host-fortress_access=...; HttpOnly; Secure; SameSite=Lax; Path=/
+Set-Cookie: __Host-fortress_refresh=...; HttpOnly; Secure; SameSite=Lax; Path=/
+```
+
+In development:
+
+```
+Set-Cookie: fortress_access=...; HttpOnly; SameSite=Lax; Path=/
+Set-Cookie: fortress_refresh=...; HttpOnly; SameSite=Lax; Path=/
+```
+
+(`__Host-` prefix requires `Secure`, which breaks localhost over HTTP.)
+
+Override via `FortressConfig.cookies` if you need different names, a
+`Domain`, or `SameSite=strict`.
+
+## CSRF posture
+
+- **Fortress-managed routes** (`/api/auth/*`, etc.) are intercepted *before*
+  `resolve()` runs, so SvelteKit's built-in `csrf.checkOrigin` does NOT
+  apply. They rely on `SameSite=Lax` cookies and (for OAuth) PKCE.
+- **Form actions** (`?/login`) DO go through `resolve()` and ARE subject to
+  SvelteKit's CSRF check. This is good — the check is the right default
+  for form-based logins.
+
+## Auto-refresh during SSR
+
+When a user opens a protected page with an expired access cookie but a
+valid refresh cookie, the handle hook silently refreshes both tokens and
+sets the new cookies before `resolve(event)`. The render proceeds as if
+the access token was never expired.
+
+**Caveat**: opening N tabs simultaneously triggers N parallel refresh
+attempts. Fortress's refresh-token family rotation will succeed for one and
+fail (with `TOKEN_REUSE`) for the rest. This is a known JWT+rotation
+trade-off — out of scope for this adapter.

package/examples/sveltekit-app/src/app.d.ts

@@ -0,0 +1,16 @@
+/**
+ * SvelteKit `app.d.ts` — augments `App.Locals` so server load functions
+ * see `event.locals.fortress` as a typed object instead of `unknown`.
+ *
+ * In a real project this lives at `src/app.d.ts`.
+ */
+
+import type { FortressLocals } from '../../../src/sveltekit';
+
+declare global {
+  namespace App {
+    interface Locals extends FortressLocals {}
+  }
+}
+
+export {};

package/examples/sveltekit-app/src/hooks.server.ts

@@ -0,0 +1,23 @@
+/**
+ * SvelteKit `hooks.server.ts` — wires Fortress into the request pipeline.
+ *
+ * In a real project this is `src/hooks.server.ts` and uses `sequence` from
+ * `@sveltejs/kit/hooks` to compose multiple handles. This example imports
+ * via relative paths so it type-checks against the workspace fortress
+ * source — adapt to `$lib/server/fortress` and `@sveltejs/kit/hooks` in
+ * your own project.
+ */
+
+import { createSvelteKitHandle } from '../../../src/sveltekit';
+import { fortress } from './lib/server/fortress';
+
+// In a real SvelteKit project:
+//   import { sequence } from '@sveltejs/kit/hooks';
+//   export const handle = sequence(createSvelteKitHandle(fortress, { basePath: '/api' }));
+export const handle = createSvelteKitHandle(fortress, {
+  basePath: '/api',
+  routeMap: {
+    'GET /api/users': { resource: 'user', action: 'list' },
+  },
+  skipPaths: ['/api/health'],
+});

package/examples/sveltekit-app/src/lib/server/fortress.ts

@@ -0,0 +1,81 @@
+/**
+ * Server-only Fortress instance.
+ *
+ * In a real SvelteKit project this lives at `src/lib/server/fortress.ts`
+ * and is imported as `$lib/server/fortress`. The `lib/server/*` convention
+ * guarantees the file never ends up in client bundles.
+ */
+
+import { createFortress } from '../../../../../src';
+import { oauth } from '../../../../../src/plugins/oauth';
+import { createTestAdapter } from '../../../../../src/testing';
+
+export const fortress = createFortress({
+  jwt: {
+    key: process.env.JWT_SECRET ?? 'dev-secret-minimum-32-bytes-long!!',
+    accessTokenExpirySeconds: 900,
+    refreshTokenExpirySeconds: 60 * 60 * 24 * 7,
+  },
+  // In a real project, swap this for createDrizzleAdapter(...).
+  database: createTestAdapter(),
+  plugins: [
+    oauth({
+      issuerUrl: 'http://localhost:5173',
+      // Pattern B (SPA-friendly) consent flow. The consent UI lives in
+      // SvelteKit; Fortress just owns the state machine.
+      enableAuthorizeEndpoint: true,
+      enableConsentApi: true,
+      // Where Fortress 302s the browser to. These are SvelteKit page paths
+      // — host-relative because the API and the web app share an origin
+      // in this example. For a cross-origin setup, use absolute URLs.
+      loginUrl: '/login',
+      consentUrl: '/oauth/consent',
+      scopePermissionMap: {
+        'read:posts': { resource: 'post', action: 'read' },
+        'write:posts': { resource: 'post', action: 'create' },
+      },
+    }),
+  ],
+});
+
+/**
+ * Seed a demo user + OAuth client on startup so the example actually works
+ * end-to-end against the in-memory adapter (which loses state on reload).
+ *
+ * Don't do this in production — register clients via your admin tooling and
+ * persist them in your real database.
+ */
+export const demoSeedPromise: Promise<{ clientId: string; clientSecret: string }> = (async () => {
+  // Demo user: alice@example.com / hunter2.
+  // The in-memory adapter is wiped on each process boot, so we always
+  // try to create — swallow conflicts if the module is re-evaluated.
+  await fortress.auth
+    .createUser({
+      email: 'alice@example.com',
+      name: 'Alice',
+      password: 'hunter2',
+    })
+    .catch(() => undefined);
+
+  // Demo OAuth client. clientId/clientSecret are returned only here, so we
+  // log them so the README/CLI can use them.
+  const client = await fortress.plugins.oauth.createClient({
+    name: 'Example OAuth Client',
+    redirectUris: ['http://localhost:5173/oauth/callback-demo'],
+    grantTypes: ['authorization_code'],
+  });
+  if (!client.clientSecret)
+    throw new Error('Demo OAuth client must be confidential');
+
+  console.warn(
+    `\n[fortress example] OAuth client seeded:\n  client_id=${client.clientId}\n  client_secret=${client.clientSecret}\n  redirect_uri=http://localhost:5173/oauth/callback-demo\n  Try: http://localhost:5173/api/oauth/authorize?client_id=${client.clientId}&redirect_uri=${encodeURIComponent('http://localhost:5173/oauth/callback-demo')}&response_type=code&state=xyz&scope=read:posts\n`,
+  );
+
+  return { clientId: client.clientId, clientSecret: client.clientSecret };
+})();
+
+// Surface seed errors loudly during dev startup instead of silently leaving
+// the promise rejected (which would break the first OAuth flow attempt).
+demoSeedPromise.catch((err: unknown) => {
+  console.error('[fortress example] demo seed failed:', err);
+});

package/examples/sveltekit-app/src/routes/api/echo/[id]/+server.ts

@@ -0,0 +1,32 @@
+/**
+ * Demonstrates the SvelteKit `vBody`/`vParam`/`vQuery` helpers.
+ *
+ * - GET  /api/echo/42?greeting=hi   → 200 { id: '42', greeting: 'hi' }
+ * - GET  /api/echo/42               → 422 VALIDATION_ERROR (missing greeting)
+ * - POST /api/echo/42 { name }      → 200 { id: '42', name }
+ * - POST /api/echo/42 {}            → 422 VALIDATION_ERROR (missing name)
+ *
+ * Validation failures throw `FortressError('VALIDATION_ERROR', 422)` — the
+ * same shape every fortress-managed endpoint produces. SvelteKit's default
+ * error handling reports the thrown `FortressError` to the client.
+ */
+
+import { json } from '@sveltejs/kit';
+import { obj, str } from '../../../../../../../src';
+import { vBody, vParam, vQuery } from '../../../../../../../src/sveltekit';
+
+const Param = obj({ id: str('Echo ID') }, 'id');
+const Query = obj({ greeting: str('Greeting') }, 'greeting');
+const Body = obj({ name: str('Name') }, 'name');
+
+export async function GET(event: any): Promise<Response> {
+  const { id } = await vParam(event, Param);
+  const { greeting } = await vQuery(event, Query);
+  return json({ id, greeting });
+}
+
+export async function POST(event: any): Promise<Response> {
+  const { id } = await vParam(event, Param);
+  const { name } = await vBody(event, Body);
+  return json({ id, name });
+}

package/examples/sveltekit-app/src/routes/api/fortress/[...path]/+server.ts

@@ -0,0 +1,15 @@
+/**
+ * Optional catch-all `+server.ts` mounting. Useful when you want Fortress
+ * routes colocated under your normal routes tree instead of intercepted in
+ * `hooks.server.ts`. The handle hook approach in `hooks.server.ts` already
+ * handles these paths — this file is here to demonstrate the escape hatch.
+ *
+ * Drop this file (and only this file) into a real SvelteKit project at
+ * `src/routes/api/fortress/[...path]/+server.ts` to expose all Fortress
+ * routes under `/api/fortress/...` without touching `hooks.server.ts`.
+ */
+
+import { toSvelteKitHandler } from '../../../../../../../src/sveltekit';
+import { fortress } from '../../../../lib/server/fortress';
+
+export const { GET, POST, PUT, DELETE, PATCH } = toSvelteKitHandler(fortress);

package/examples/sveltekit-app/src/routes/dashboard/+page.server.ts

@@ -0,0 +1,20 @@
+/**
+ * Protected route. Reads the authenticated user via `getUserId`.
+ * If the auth handle hook didn't populate `event.locals.fortress.userId`
+ * (no token, expired beyond refresh, etc.), `getUserId` throws and the
+ * caller redirects to `/login`.
+ *
+ * In a real project the load function uses SvelteKit's `error()` /
+ * `redirect()` from `@sveltejs/kit` instead of throwing fortress errors
+ * directly. This example throws to keep the dependencies minimal.
+ */
+
+import type { SvelteKitRequestEvent } from '../../../../../src/sveltekit';
+import { getUserId } from '../../../../../src/sveltekit';
+import { fortress } from '../../lib/server/fortress';
+
+export async function load(event: SvelteKitRequestEvent): Promise<{ user: { id: string; email: string } }> {
+  const userId = getUserId(event as never);
+  const user = await fortress.auth.me(userId);
+  return { user };
+}

package/examples/sveltekit-app/src/routes/login/+page.server.ts

@@ -0,0 +1,48 @@
+/**
+ * `<form method="POST">` login.
+ *
+ * Reuses `fortressActions.login` for the actual auth work, then layers a
+ * dynamic redirect on top so the same page can also be the landing pad
+ * for the OAuth consent flow:
+ *
+ *   - regular login → /dashboard
+ *   - OAuth consent flow (`?flow=<id>`) → /oauth/consent?flow=<id>
+ *
+ * The corresponding `+page.svelte`:
+ *
+ * ```svelte
+ * <script>
+ *   import { enhance } from '$app/forms';
+ *   export let form;
+ * </script>
+ *
+ * <form method="POST" use:enhance>
+ *   <input name="identifier" required />
+ *   <input name="password" type="password" required />
+ *   {#if form?.error}<p class="error">{form.error}</p>{/if}
+ *   <button>Log in</button>
+ * </form>
+ * ```
+ */
+
+import type { Actions } from '@sveltejs/kit';
+import { redirect } from '@sveltejs/kit';
+import { fortressActions } from '../../../../../src/sveltekit';
+import { fortress } from '../../lib/server/fortress';
+
+const baseLogin = fortressActions.login(fortress); // no static redirectTo
+
+export const actions: Actions = {
+  default: async (event) => {
+    const result = await baseLogin(event);
+    // Failed: bubble the form-fail object back so the page can render the error.
+    if (result && 'error' in result)
+      return result;
+
+    // Success: pick destination based on whether we're mid-OAuth.
+    const flow = event.url.searchParams.get('flow');
+    if (flow)
+      throw redirect(303, `/oauth/consent?flow=${encodeURIComponent(flow)}`);
+    throw redirect(303, '/dashboard');
+  },
+};

package/examples/sveltekit-app/src/routes/oauth/consent/+page.server.ts

@@ -0,0 +1,69 @@
+/**
+ * OAuth consent page (Pattern B).
+ *
+ * The browser arrives here with `?flow=<id>` after `GET /api/oauth/authorize`
+ * detected an authenticated session and 302'd to the configured `consentUrl`.
+ *
+ * Server load fetches the flow metadata from Fortress (cookie-authed —
+ * `event.fetch` automatically forwards cookies to the same origin). The
+ * page then renders the client name + scopes and offers Allow / Deny.
+ *
+ * Both actions POST to the corresponding Fortress endpoint and `throw
+ * redirect` to the URL Fortress hands back (the OAuth client's
+ * `redirect_uri` with `?code=...&state=...` or `?error=access_denied&state=...`).
+ *
+ * For a cross-origin setup, swap `event.fetch('/api/...')` for an absolute
+ * URL and either (a) move the load to a `+page.ts` (browser-side) so the
+ * fetch goes out with `credentials: 'include'`, or (b) give the SvelteKit
+ * server its own session and proxy.
+ */
+
+import type { Actions, RequestEvent } from '@sveltejs/kit';
+import { error, redirect } from '@sveltejs/kit';
+
+interface FlowMetadata {
+  flowId: number;
+  client: { clientId: string; name: string };
+  redirectUri: string;
+  scopes: string[];
+  state: string;
+}
+
+export async function load(event: RequestEvent): Promise<{ flow: FlowMetadata }> {
+  const flow = event.url.searchParams.get('flow');
+  if (!flow)
+    throw error(400, 'Missing flow id');
+
+  const res = await event.fetch(`/api/oauth/flows/${encodeURIComponent(flow)}`);
+  if (res.status === 401)
+    throw redirect(303, `/login?flow=${encodeURIComponent(flow)}`);
+  if (!res.ok)
+    throw error(res.status, await res.text());
+
+  const meta = (await res.json()) as FlowMetadata;
+  return { flow: meta };
+}
+
+async function postFlowAction(
+  event: RequestEvent,
+  decision: 'approve' | 'deny',
+): Promise<never> {
+  const flow = event.url.searchParams.get('flow');
+  if (!flow)
+    throw error(400, 'Missing flow id');
+
+  const res = await event.fetch(
+    `/api/oauth/flows/${encodeURIComponent(flow)}/${decision}`,
+    { method: 'POST' },
+  );
+  if (!res.ok)
+    throw error(res.status, await res.text());
+
+  const { redirectUrl } = (await res.json()) as { redirectUrl: string };
+  throw redirect(303, redirectUrl);
+}
+
+export const actions: Actions = {
+  approve: event => postFlowAction(event, 'approve'),
+  deny: event => postFlowAction(event, 'deny'),
+};

package/examples/sveltekit-app/src/routes/oauth/consent/+page.svelte

@@ -0,0 +1,83 @@
+<!--
+  OAuth consent page. Renders the client name, redirect URI, and requested
+  scopes from the data the `+page.server.ts` load returned, then offers
+  Allow / Deny form actions.
+
+  Two separate <form>s so each button submits to its own action. SvelteKit's
+  `?/approve` / `?/deny` syntax in `formaction` keeps this single-file.
+-->
+<script lang="ts">
+  import { enhance } from '$app/forms';
+
+  let { data } = $props<{
+    data: {
+      flow: {
+        flowId: number;
+        client: { clientId: string; name: string };
+        redirectUri: string;
+        scopes: string[];
+        state: string;
+      };
+    };
+  }>();
+</script>
+
+<main class="consent">
+  <h1>Authorize {data.flow.client.name}</h1>
+  <p>
+    <strong>{data.flow.client.name}</strong> wants to access your account.
+    It will be able to:
+  </p>
+
+  {#if data.flow.scopes.length > 0}
+    <ul>
+      {#each data.flow.scopes as scope}
+        <li><code>{scope}</code></li>
+      {/each}
+    </ul>
+  {:else}
+    <p><em>No specific permissions requested.</em></p>
+  {/if}
+
+  <p class="redirect">
+    You will be redirected to:
+    <code>{data.flow.redirectUri}</code>
+  </p>
+
+  <form method="POST" use:enhance class="actions">
+    <button type="submit" formaction="?/deny" class="btn-secondary">
+      Deny
+    </button>
+    <button type="submit" formaction="?/approve" class="btn-primary">
+      Allow
+    </button>
+  </form>
+</main>
+
+<style>
+  .consent {
+    max-width: 28rem;
+    margin: 4rem auto;
+    padding: 2rem;
+    border: 1px solid #e2e8f0;
+    border-radius: 0.75rem;
+    font-family: system-ui, sans-serif;
+  }
+  h1 { margin-top: 0; }
+  ul { margin: 0.5rem 0 1.5rem; padding-left: 1.5rem; }
+  .redirect { color: #475569; font-size: 0.9rem; }
+  .actions {
+    display: flex;
+    gap: 0.75rem;
+    justify-content: flex-end;
+    margin-top: 1.5rem;
+  }
+  .btn-primary, .btn-secondary {
+    padding: 0.5rem 1rem;
+    border-radius: 0.375rem;
+    font-weight: 500;
+    cursor: pointer;
+  }
+  .btn-primary  { background: #2563eb; color: white; border: none; }
+  .btn-secondary{ background: white; color: #334155; border: 1px solid #cbd5e1; }
+</style>

package/migrations/pg/0001_schema_version.down.sql

@@ -0,0 +1,2 @@
+-- Fortress migration 0001 rollback: schema version tracking table (PostgreSQL)
+DROP TABLE IF EXISTS fortress_schema_version;

package/migrations/pg/0001_schema_version.sql

@@ -0,0 +1,8 @@
+-- Fortress migration 0001: schema version tracking table (PostgreSQL)
+-- The version row is written by the migration runner after apply; this
+-- migration only creates the checkpoint table.
+CREATE TABLE IF NOT EXISTS fortress_schema_version (
+  id integer PRIMARY KEY DEFAULT 1 CHECK (id = 1),
+  version integer NOT NULL,
+  applied_at timestamp NOT NULL DEFAULT now()
+);

package/migrations/pg/0002_initial_schema.down.sql

@@ -0,0 +1,36 @@
+-- Fortress migration 0002: initial Fortress schema (PostgreSQL) — rollback
+
+DROP TABLE IF EXISTS fortress_webauthn_challenge CASCADE;
+DROP TABLE IF EXISTS fortress_webauthn_credential CASCADE;
+DROP TABLE IF EXISTS fortress_webhook_delivery CASCADE;
+DROP TABLE IF EXISTS fortress_webhook_endpoint CASCADE;
+DROP TABLE IF EXISTS fortress_audit_log CASCADE;
+DROP TABLE IF EXISTS fortress_account_lockout CASCADE;
+DROP TABLE IF EXISTS fortress_user_scope_assignment CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_signing_key CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_pending_flow CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_refresh_token CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_access_token CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_authorization_code CASCADE;
+DROP TABLE IF EXISTS fortress_oauth_client CASCADE;
+DROP TABLE IF EXISTS fortress_tenant_user CASCADE;
+DROP TABLE IF EXISTS fortress_tenant CASCADE;
+DROP TABLE IF EXISTS fortress_social_account CASCADE;
+DROP TABLE IF EXISTS fortress_trusted_device CASCADE;
+DROP TABLE IF EXISTS fortress_backup_code CASCADE;
+DROP TABLE IF EXISTS fortress_two_factor_secret CASCADE;
+DROP TABLE IF EXISTS fortress_api_key CASCADE;
+DROP TABLE IF EXISTS fortress_magic_link_token CASCADE;
+DROP TABLE IF EXISTS fortress_email_verification_token CASCADE;
+DROP TABLE IF EXISTS fortress_direct_permission_binding CASCADE;
+DROP TABLE IF EXISTS fortress_role_binding CASCADE;
+DROP TABLE IF EXISTS fortress_role_permission CASCADE;
+DROP TABLE IF EXISTS fortress_role CASCADE;
+DROP TABLE IF EXISTS fortress_permission CASCADE;
+DROP TABLE IF EXISTS fortress_resource CASCADE;
+DROP TABLE IF EXISTS fortress_service_account CASCADE;
+DROP TABLE IF EXISTS fortress_group_user CASCADE;
+DROP TABLE IF EXISTS fortress_group CASCADE;
+DROP TABLE IF EXISTS fortress_refresh_token CASCADE;
+DROP TABLE IF EXISTS fortress_login_identifier CASCADE;
+DROP TABLE IF EXISTS fortress_user CASCADE;