@bajustone/fortress 1.0.0-rc.1

package/migrations/pg/0002_initial_schema.sql

@@ -0,0 +1,376 @@
+-- Fortress migration 0002: initial Fortress schema (PostgreSQL)
+
+CREATE TABLE IF NOT EXISTS fortress_user (
+  id SERIAL PRIMARY KEY,
+  email VARCHAR(255) NOT NULL UNIQUE,
+  name VARCHAR(255) NOT NULL,
+  password_hash TEXT,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  email_verified BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_login_identifier (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  type VARCHAR(20) NOT NULL,
+  value VARCHAR(255) NOT NULL UNIQUE
+);
+
+CREATE TABLE IF NOT EXISTS fortress_refresh_token (
+  id BIGSERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash VARCHAR(64) NOT NULL UNIQUE,
+  token_family VARCHAR(64) NOT NULL,
+  is_revoked BOOLEAN NOT NULL DEFAULT false,
+  expires_at TIMESTAMP NOT NULL,
+  ip_address VARCHAR(45),
+  user_agent TEXT,
+  device_name TEXT,
+  last_active_at TIMESTAMP,
+  fingerprint_hash VARCHAR(64),
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL UNIQUE,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_group_user (
+  group_id INTEGER NOT NULL REFERENCES fortress_group(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  PRIMARY KEY (group_id, user_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_service_account (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL UNIQUE,
+  display_name VARCHAR(255),
+  description TEXT,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_resource (
+  name VARCHAR(100) PRIMARY KEY,
+  description TEXT
+);
+
+CREATE TABLE IF NOT EXISTS fortress_permission (
+  id SERIAL PRIMARY KEY,
+  resource VARCHAR(100) NOT NULL REFERENCES fortress_resource(name) ON DELETE CASCADE,
+  action VARCHAR(100) NOT NULL,
+  effect VARCHAR(10) NOT NULL DEFAULT 'ALLOW',
+  conditions JSONB,
+  description TEXT
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_no_conditions
+  ON fortress_permission (resource, action, effect)
+  WHERE conditions IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_permission_with_conditions
+  ON fortress_permission (resource, action, effect, conditions)
+  WHERE conditions IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_role (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(100) NOT NULL UNIQUE,
+  description TEXT,
+  is_system BOOLEAN NOT NULL DEFAULT false
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_permission (
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  PRIMARY KEY (role_id, permission_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_role_binding (
+  id SERIAL PRIMARY KEY,
+  role_id INTEGER NOT NULL REFERENCES fortress_role(id) ON DELETE CASCADE,
+  subject_type VARCHAR(20) NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id VARCHAR(100),
+  UNIQUE (role_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_global
+  ON fortress_role_binding (role_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_role_binding_tenant
+  ON fortress_role_binding (role_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_direct_permission_binding (
+  id SERIAL PRIMARY KEY,
+  permission_id INTEGER NOT NULL REFERENCES fortress_permission(id) ON DELETE CASCADE,
+  subject_type VARCHAR(20) NOT NULL,
+  subject_id INTEGER NOT NULL,
+  tenant_id VARCHAR(100),
+  UNIQUE (permission_id, subject_type, subject_id, tenant_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_global
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id)
+  WHERE tenant_id IS NULL;
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_direct_permission_binding_tenant
+  ON fortress_direct_permission_binding (permission_id, subject_type, subject_id, tenant_id)
+  WHERE tenant_id IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_email_verification_token (
+  id BIGSERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token TEXT NOT NULL,
+  email VARCHAR(255) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_magic_link_token (
+  id BIGSERIAL PRIMARY KEY,
+  email VARCHAR(255) NOT NULL,
+  token VARCHAR(64) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_api_key (
+  id SERIAL PRIMARY KEY,
+  subject_type VARCHAR(20) NOT NULL,
+  subject_id INTEGER NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  key_hash VARCHAR(64) NOT NULL UNIQUE,
+  key_prefix VARCHAR(20) NOT NULL,
+  scopes TEXT,
+  expires_at TIMESTAMP,
+  last_used_at TIMESTAMP,
+  is_revoked BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+CREATE INDEX IF NOT EXISTS api_key_subject_idx ON fortress_api_key (subject_type, subject_id);
+
+CREATE TABLE IF NOT EXISTS fortress_two_factor_secret (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL UNIQUE REFERENCES fortress_user(id) ON DELETE CASCADE,
+  secret TEXT NOT NULL,
+  is_enabled BOOLEAN NOT NULL DEFAULT false,
+  last_used_counter INTEGER,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_backup_code (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  code_hash TEXT NOT NULL,
+  is_used BOOLEAN NOT NULL DEFAULT false,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_trusted_device (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  device_hash VARCHAR(64) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  last_used_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_social_account (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  provider VARCHAR(50) NOT NULL,
+  provider_account_id VARCHAR(255) NOT NULL,
+  email VARCHAR(255),
+  access_token TEXT,
+  refresh_token TEXT,
+  token_expires_at TIMESTAMP,
+  profile JSONB,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now(),
+  UNIQUE (user_id, provider),
+  UNIQUE (provider, provider_account_id)
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant (
+  id SERIAL PRIMARY KEY,
+  name VARCHAR(255) NOT NULL,
+  tax_id VARCHAR(100) NOT NULL UNIQUE,
+  description TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now(),
+  updated_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_tenant_user (
+  tenant_id INTEGER NOT NULL REFERENCES fortress_tenant(id) ON DELETE CASCADE,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  is_default BOOLEAN NOT NULL DEFAULT false,
+  PRIMARY KEY (tenant_id, user_id)
+);
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id) WHERE is_default = true;
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_client (
+  id SERIAL PRIMARY KEY,
+  client_id VARCHAR(255) NOT NULL UNIQUE,
+  client_secret_hash TEXT NOT NULL,
+  name VARCHAR(255) NOT NULL,
+  redirect_uris TEXT NOT NULL,
+  grant_types TEXT NOT NULL,
+  allowed_scopes TEXT,
+  token_endpoint_auth_method TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_authorization_code (
+  id BIGSERIAL PRIMARY KEY,
+  code VARCHAR(255) NOT NULL UNIQUE,
+  client_id VARCHAR(255) NOT NULL,
+  user_id INTEGER NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  code_challenge TEXT,
+  code_challenge_method VARCHAR(10),
+  nonce TEXT,
+  auth_time INTEGER,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_access_token (
+  id BIGSERIAL PRIMARY KEY,
+  token VARCHAR(255) NOT NULL UNIQUE,
+  client_id VARCHAR(255) NOT NULL,
+  user_id INTEGER,
+  scope TEXT,
+  expires_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_refresh_token (
+  id BIGSERIAL PRIMARY KEY,
+  token VARCHAR(255) NOT NULL UNIQUE,
+  family_id VARCHAR(64) NOT NULL,
+  client_id VARCHAR(255) NOT NULL,
+  user_id INTEGER NOT NULL,
+  scope TEXT,
+  issued_at TIMESTAMP NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  used_at TIMESTAMP,
+  parent_id INTEGER,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_pending_flow (
+  id BIGSERIAL PRIMARY KEY,
+  flow_id TEXT NOT NULL UNIQUE,
+  client_id VARCHAR(255) NOT NULL,
+  redirect_uri TEXT NOT NULL,
+  scope TEXT,
+  state VARCHAR(255) NOT NULL,
+  code_challenge TEXT,
+  code_challenge_method VARCHAR(10),
+  nonce TEXT,
+  user_id INTEGER,
+  used_at TIMESTAMP,
+  expires_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_oauth_signing_key (
+  id SERIAL PRIMARY KEY,
+  kid VARCHAR(64) NOT NULL UNIQUE,
+  alg VARCHAR(16) NOT NULL,
+  public_jwk TEXT NOT NULL,
+  private_jwk TEXT NOT NULL,
+  rotated_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_user_scope_assignment (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  scope_name VARCHAR(100) NOT NULL,
+  scope_value VARCHAR(255) NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_account_lockout (
+  id SERIAL PRIMARY KEY,
+  identifier VARCHAR(255) NOT NULL UNIQUE,
+  failed_attempts INTEGER NOT NULL DEFAULT 0,
+  last_failed_at TIMESTAMP,
+  locked_until TIMESTAMP,
+  lockout_count INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_audit_log (
+  id BIGSERIAL PRIMARY KEY,
+  timestamp TIMESTAMP NOT NULL DEFAULT now(),
+  event_type VARCHAR(100) NOT NULL,
+  actor_id INTEGER,
+  actor_type VARCHAR(20) NOT NULL DEFAULT 'USER',
+  target_id INTEGER,
+  target_type VARCHAR(50),
+  ip_address VARCHAR(45),
+  user_agent TEXT,
+  outcome VARCHAR(20) NOT NULL DEFAULT 'SUCCESS',
+  metadata JSONB,
+  previous_hash TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_endpoint (
+  id SERIAL PRIMARY KEY,
+  url TEXT NOT NULL,
+  events TEXT NOT NULL,
+  secret TEXT NOT NULL,
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  deactivated_reason TEXT,
+  consecutive_failures INTEGER NOT NULL DEFAULT 0,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webhook_delivery (
+  id BIGSERIAL PRIMARY KEY,
+  endpoint_id INTEGER NOT NULL REFERENCES fortress_webhook_endpoint(id) ON DELETE CASCADE,
+  event_type VARCHAR(100) NOT NULL,
+  payload TEXT NOT NULL,
+  status VARCHAR(20) NOT NULL DEFAULT 'pending',
+  attempts INTEGER NOT NULL DEFAULT 0,
+  idempotency_key TEXT,
+  last_attempt_at TIMESTAMP,
+  next_retry_at TIMESTAMP,
+  response_status INTEGER,
+  response_body TEXT,
+  error_kind TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE UNIQUE INDEX IF NOT EXISTS uniq_webhook_delivery_idempotency
+  ON fortress_webhook_delivery (endpoint_id, idempotency_key)
+  WHERE idempotency_key IS NOT NULL;
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_credential (
+  id SERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  credential_id TEXT NOT NULL UNIQUE,
+  public_key TEXT NOT NULL,
+  counter INTEGER NOT NULL DEFAULT 0,
+  device_type VARCHAR(20) NOT NULL,
+  backed_up BOOLEAN NOT NULL DEFAULT false,
+  transports TEXT,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);
+
+CREATE TABLE IF NOT EXISTS fortress_webauthn_challenge (
+  id BIGSERIAL PRIMARY KEY,
+  challenge TEXT NOT NULL UNIQUE,
+  user_id INTEGER,
+  expires_at TIMESTAMP NOT NULL,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);

package/migrations/pg/0003_auth_continuation.down.sql

@@ -0,0 +1,6 @@
+-- Fortress migration 0003 rollback: auth continuation + refresh-session metadata (PostgreSQL)
+
+DROP TABLE IF EXISTS fortress_auth_continuation CASCADE;
+ALTER TABLE fortress_refresh_token DROP COLUMN rotated_at;
+ALTER TABLE fortress_refresh_token DROP COLUMN successor_token_hash;
+ALTER TABLE fortress_refresh_token DROP COLUMN family_created_at;

package/migrations/pg/0003_auth_continuation.sql

@@ -0,0 +1,30 @@
+-- Fortress migration 0003: auth continuation + refresh-session metadata (PostgreSQL)
+
+ALTER TABLE fortress_refresh_token
+  ADD COLUMN family_created_at TIMESTAMP;
+UPDATE fortress_refresh_token AS token
+  SET family_created_at = family.created_at
+  FROM (
+    SELECT token_family, MIN(created_at) AS created_at
+    FROM fortress_refresh_token
+    GROUP BY token_family
+  ) AS family
+  WHERE token.token_family = family.token_family;
+ALTER TABLE fortress_refresh_token
+  ALTER COLUMN family_created_at SET NOT NULL;
+ALTER TABLE fortress_refresh_token
+  ALTER COLUMN family_created_at SET DEFAULT now();
+ALTER TABLE fortress_refresh_token
+  ADD COLUMN successor_token_hash VARCHAR(64);
+ALTER TABLE fortress_refresh_token
+  ADD COLUMN rotated_at TIMESTAMP;
+
+CREATE TABLE fortress_auth_continuation (
+  id BIGSERIAL PRIMARY KEY,
+  user_id INTEGER NOT NULL REFERENCES fortress_user(id) ON DELETE CASCADE,
+  token_hash VARCHAR(64) NOT NULL UNIQUE,
+  reason VARCHAR(32) NOT NULL,
+  expires_at TIMESTAMP NOT NULL,
+  consumed_at TIMESTAMP,
+  created_at TIMESTAMP NOT NULL DEFAULT now()
+);

package/migrations/pg/0004_tenant_default_unique.down.sql

@@ -0,0 +1 @@
+DROP INDEX IF EXISTS fortress_tenant_user_one_default_idx;

package/migrations/pg/0004_tenant_default_unique.sql

@@ -0,0 +1,14 @@
+WITH ranked_defaults AS (
+  SELECT ctid, ROW_NUMBER() OVER (PARTITION BY user_id ORDER BY tenant_id) AS position
+  FROM fortress_tenant_user
+  WHERE is_default = true
+)
+UPDATE fortress_tenant_user AS membership
+SET is_default = false
+FROM ranked_defaults
+WHERE membership.ctid = ranked_defaults.ctid
+  AND ranked_defaults.position > 1;
+
+CREATE UNIQUE INDEX IF NOT EXISTS fortress_tenant_user_one_default_idx
+  ON fortress_tenant_user (user_id)
+  WHERE is_default = true;

package/migrations/pg/0005_hot_indexes_timestamptz.down.sql

@@ -0,0 +1,71 @@
+ALTER TABLE fortress_schema_version ALTER COLUMN applied_at TYPE TIMESTAMP USING applied_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN family_created_at TYPE TIMESTAMP USING family_created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN rotated_at TYPE TIMESTAMP USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN last_active_at TYPE TIMESTAMP USING last_active_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN consumed_at TYPE TIMESTAMP USING consumed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN last_used_at TYPE TIMESTAMP USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_two_factor_secret ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_backup_code ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN last_used_at TYPE TIMESTAMP USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN token_expires_at TYPE TIMESTAMP USING token_expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN updated_at TYPE TIMESTAMP USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_client ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN issued_at TYPE TIMESTAMP USING issued_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN used_at TYPE TIMESTAMP USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN rotated_at TYPE TIMESTAMP USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user_scope_assignment ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN last_failed_at TYPE TIMESTAMP USING last_failed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN locked_until TYPE TIMESTAMP USING locked_until AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN timestamp TYPE TIMESTAMP USING timestamp AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_endpoint ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN last_attempt_at TYPE TIMESTAMP USING last_attempt_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN next_retry_at TYPE TIMESTAMP USING next_retry_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_credential ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN expires_at TYPE TIMESTAMP USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN created_at TYPE TIMESTAMP USING created_at AT TIME ZONE 'UTC';
+
+DROP INDEX IF EXISTS audit_log_timestamp_idx;
+DROP INDEX IF EXISTS webhook_delivery_retry_idx;
+DROP INDEX IF EXISTS trusted_device_user_idx;
+DROP INDEX IF EXISTS backup_code_user_idx;
+DROP INDEX IF EXISTS direct_permission_binding_subject_idx;
+DROP INDEX IF EXISTS role_binding_subject_idx;
+DROP INDEX IF EXISTS magic_link_token_token_idx;
+DROP INDEX IF EXISTS email_verification_token_token_idx;
+DROP INDEX IF EXISTS refresh_token_user_idx;
+DROP INDEX IF EXISTS refresh_token_family_idx;

package/migrations/pg/0005_hot_indexes_timestamptz.sql

@@ -0,0 +1,71 @@
+CREATE INDEX refresh_token_family_idx ON fortress_refresh_token (token_family);
+CREATE INDEX refresh_token_user_idx ON fortress_refresh_token (user_id);
+CREATE INDEX email_verification_token_token_idx ON fortress_email_verification_token (token);
+CREATE INDEX magic_link_token_token_idx ON fortress_magic_link_token (token);
+CREATE INDEX role_binding_subject_idx ON fortress_role_binding (subject_type, subject_id);
+CREATE INDEX direct_permission_binding_subject_idx ON fortress_direct_permission_binding (subject_type, subject_id);
+CREATE INDEX backup_code_user_idx ON fortress_backup_code (user_id);
+CREATE INDEX trusted_device_user_idx ON fortress_trusted_device (user_id);
+CREATE INDEX webhook_delivery_retry_idx ON fortress_webhook_delivery (status, next_retry_at);
+CREATE INDEX audit_log_timestamp_idx ON fortress_audit_log (timestamp);
+
+ALTER TABLE fortress_schema_version ALTER COLUMN applied_at TYPE TIMESTAMPTZ USING applied_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN family_created_at TYPE TIMESTAMPTZ USING family_created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN rotated_at TYPE TIMESTAMPTZ USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN last_active_at TYPE TIMESTAMPTZ USING last_active_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_refresh_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN consumed_at TYPE TIMESTAMPTZ USING consumed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_auth_continuation ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_service_account ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_email_verification_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_magic_link_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN last_used_at TYPE TIMESTAMPTZ USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_api_key ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_two_factor_secret ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_backup_code ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN last_used_at TYPE TIMESTAMPTZ USING last_used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_trusted_device ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN token_expires_at TYPE TIMESTAMPTZ USING token_expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_social_account ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_tenant ALTER COLUMN updated_at TYPE TIMESTAMPTZ USING updated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_client ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_authorization_code ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_access_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN issued_at TYPE TIMESTAMPTZ USING issued_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_refresh_token ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN used_at TYPE TIMESTAMPTZ USING used_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_pending_flow ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN rotated_at TYPE TIMESTAMPTZ USING rotated_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_oauth_signing_key ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_user_scope_assignment ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN last_failed_at TYPE TIMESTAMPTZ USING last_failed_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN locked_until TYPE TIMESTAMPTZ USING locked_until AT TIME ZONE 'UTC';
+ALTER TABLE fortress_account_lockout ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN timestamp TYPE TIMESTAMPTZ USING timestamp AT TIME ZONE 'UTC';
+ALTER TABLE fortress_audit_log ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_endpoint ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN last_attempt_at TYPE TIMESTAMPTZ USING last_attempt_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN next_retry_at TYPE TIMESTAMPTZ USING next_retry_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webhook_delivery ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_credential ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN expires_at TYPE TIMESTAMPTZ USING expires_at AT TIME ZONE 'UTC';
+ALTER TABLE fortress_webauthn_challenge ALTER COLUMN created_at TYPE TIMESTAMPTZ USING created_at AT TIME ZONE 'UTC';

package/migrations/pg/0006_canonical_email.down.sql

@@ -0,0 +1,3 @@
+-- Canonicalization and duplicate-account quarantine are intentionally irreversible.
+DROP INDEX IF EXISTS login_identifier_email_ci_unique;
+DROP INDEX IF EXISTS user_email_ci_unique;

package/migrations/pg/0006_canonical_email.sql

@@ -0,0 +1,8 @@
+-- This sentinel is created only by the Fortress migration engine after its
+-- Unicode-aware data step. Applying this SQL directly fails closed.
+INSERT INTO fortress_email_migration_ready (id) VALUES (1);
+CREATE UNIQUE INDEX user_email_ci_unique ON fortress_user (lower(email));
+CREATE UNIQUE INDEX login_identifier_email_ci_unique
+  ON fortress_login_identifier (lower(value))
+  WHERE type = 'email';
+DROP TABLE fortress_email_migration_ready;

package/migrations/pg/0007_audit_chain_anchor.down.sql

@@ -0,0 +1 @@
+DROP TABLE IF EXISTS fortress_audit_chain_state;

package/migrations/pg/0007_audit_chain_anchor.sql

@@ -0,0 +1,8 @@
+CREATE TABLE fortress_audit_chain_state (
+  id INTEGER PRIMARY KEY CHECK (id = 1),
+  last_hash VARCHAR(64),
+  entry_count INTEGER NOT NULL CHECK (entry_count >= 0),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  CHECK ((entry_count = 0 AND last_hash IS NULL) OR (entry_count > 0 AND last_hash IS NOT NULL))
+);
+INSERT INTO fortress_audit_chain_state (id, last_hash, entry_count) VALUES (1, NULL, 0);

package/migrations/pg/0008_two_factor_hardening.down.sql

@@ -0,0 +1,8 @@
+-- Fortress migration 0008 rollback.
+DROP INDEX IF EXISTS auth_continuation_failure_idx;
+ALTER TABLE fortress_auth_continuation
+  DROP COLUMN cooldown_seconds,
+  DROP COLUMN max_attempts,
+  DROP COLUMN invalidated_at,
+  DROP COLUMN last_failed_at,
+  DROP COLUMN failed_attempts;

package/migrations/pg/0008_two_factor_hardening.sql

@@ -0,0 +1,8 @@
+-- Fortress migration 0008: bounded MFA continuation attempts.
+ALTER TABLE fortress_auth_continuation
+  ADD COLUMN failed_attempts INTEGER NOT NULL DEFAULT 0,
+  ADD COLUMN last_failed_at TIMESTAMPTZ,
+  ADD COLUMN invalidated_at TIMESTAMPTZ,
+  ADD COLUMN max_attempts INTEGER NOT NULL DEFAULT 5,
+  ADD COLUMN cooldown_seconds INTEGER NOT NULL DEFAULT 1;
+CREATE INDEX auth_continuation_failure_idx ON fortress_auth_continuation (user_id, reason, last_failed_at);

package/migrations/pg/0009_encrypt_totp_secrets.down.sql

@@ -0,0 +1,2 @@
+SELECT 1;
+-- Deleted plaintext TOTP credentials cannot be restored.

package/migrations/pg/0009_encrypt_totp_secrets.sql

@@ -0,0 +1,5 @@
+-- Existing TOTP seeds were stored in plaintext. SQL migrations cannot encrypt
+-- them with the application-held key, so fail securely by requiring re-enrolment.
+DELETE FROM fortress_backup_code;
+DELETE FROM fortress_trusted_device;
+DELETE FROM fortress_two_factor_secret;

package/migrations/pg/0010_bigint_append_only_ids.down.sql

@@ -0,0 +1,2 @@
+-- Narrowing bigint identifiers can lose data and is intentionally irreversible.
+SELECT 1;