@effect-auth/core 0.1.0-alpha.15 → 0.1.0-alpha.18

package/migrations/delegated-access/0001_auth_delegated_access.sql

@@ -0,0 +1,152 @@
+create table if not exists auth_invitation (
+  id text primary key,
+  kind text not null,
+  target_type text not null,
+  target_id text not null,
+  intent_type text not null,
+  intent_version integer not null,
+  intent_payload text not null,
+  recipient_type text,
+  recipient_reference text,
+  issued_by_type text,
+  issued_by_id text,
+  created_at integer not null,
+  expires_at integer not null,
+  token_hash text not null,
+  accepted_at integer,
+  accepted_by_type text,
+  accepted_by_id text,
+  revoked_at integer,
+  superseded_at integer,
+  superseded_by_id text,
+  metadata text,
+  check (length(id) = 22 and id not glob '*[^A-Za-z0-9_-]*'),
+  check (length(kind) > 0),
+  check (length(target_type) > 0 and length(target_id) > 0),
+  check (length(intent_type) > 0),
+  check (typeof(intent_version) = 'integer' and intent_version >= 1),
+  check (
+    case
+      when json_valid(intent_payload) then json_type(intent_payload) = 'object'
+      else 0
+    end
+  ),
+  check ((recipient_type is null) = (recipient_reference is null)),
+  check (recipient_type is null or (length(recipient_type) > 0 and length(recipient_reference) > 0)),
+  check ((issued_by_type is null) = (issued_by_id is null)),
+  check (issued_by_type is null or (length(issued_by_type) > 0 and length(issued_by_id) > 0)),
+  check (typeof(created_at) = 'integer' and created_at >= 0),
+  check (typeof(expires_at) = 'integer' and expires_at > created_at),
+  check (length(token_hash) > 7 and substr(token_hash, 1, 7) = 'sha256:'),
+  check ((accepted_at is null) = (accepted_by_type is null)),
+  check ((accepted_by_type is null) = (accepted_by_id is null)),
+  check (accepted_by_type is null or (length(accepted_by_type) > 0 and length(accepted_by_id) > 0)),
+  check ((superseded_at is null) = (superseded_by_id is null)),
+  check (
+    superseded_by_id is null or
+      (length(superseded_by_id) = 22 and superseded_by_id not glob '*[^A-Za-z0-9_-]*')
+  ),
+  check (
+    (accepted_at is not null) +
+      (revoked_at is not null) +
+      (superseded_at is not null) <= 1
+  ),
+  check (accepted_at is null or (typeof(accepted_at) = 'integer' and accepted_at >= created_at)),
+  check (revoked_at is null or (typeof(revoked_at) = 'integer' and revoked_at >= created_at)),
+  check (superseded_at is null or (typeof(superseded_at) = 'integer' and superseded_at >= created_at)),
+  check (
+    metadata is null or
+      case
+        when json_valid(metadata) then json_type(metadata) = 'object'
+        else 0
+      end
+  )
+);
+
+create index if not exists auth_invitation_created_at_idx
+  on auth_invitation (created_at, id);
+create index if not exists auth_invitation_kind_created_at_idx
+  on auth_invitation (kind, created_at, id);
+create index if not exists auth_invitation_target_created_at_idx
+  on auth_invitation (target_type, target_id, created_at, id);
+create index if not exists auth_invitation_recipient_created_at_idx
+  on auth_invitation (recipient_type, recipient_reference, created_at, id);
+create index if not exists auth_invitation_issued_by_created_at_idx
+  on auth_invitation (issued_by_type, issued_by_id, created_at, id);
+create index if not exists auth_invitation_pending_expires_at_idx
+  on auth_invitation (expires_at, created_at, id)
+  where accepted_at is null and revoked_at is null and superseded_at is null;
+
+create table if not exists auth_access_grant (
+  id text primary key,
+  target_type text not null,
+  target_id text not null,
+  capabilities text not null,
+  binding_type text not null,
+  binding_subject_type text,
+  binding_subject_id text,
+  issuer_type text,
+  issuer_id text,
+  created_at integer not null,
+  expires_at integer,
+  token_hash text,
+  revoked_at integer,
+  superseded_at integer,
+  superseded_by_id text,
+  metadata text,
+  check (length(id) = 22 and id not glob '*[^A-Za-z0-9_-]*'),
+  check (length(target_type) > 0 and length(target_id) > 0),
+  check (
+    case
+      when json_valid(capabilities) then
+        json_type(capabilities) = 'array' and json_array_length(capabilities) > 0
+      else 0
+    end
+  ),
+  check (binding_type in ('bearer', 'subject', 'subject-and-bearer')),
+  check ((binding_subject_type is null) = (binding_subject_id is null)),
+  check (binding_subject_type is null or (length(binding_subject_type) > 0 and length(binding_subject_id) > 0)),
+  check (
+    (binding_type = 'bearer' and binding_subject_type is null) or
+      (binding_type in ('subject', 'subject-and-bearer') and binding_subject_type is not null)
+  ),
+  check ((issuer_type is null) = (issuer_id is null)),
+  check (issuer_type is null or (length(issuer_type) > 0 and length(issuer_id) > 0)),
+  check (typeof(created_at) = 'integer' and created_at >= 0),
+  check (
+    expires_at is null or
+      (typeof(expires_at) = 'integer' and expires_at > created_at)
+  ),
+  check ((binding_type = 'subject') = (token_hash is null)),
+  check (
+    token_hash is null or
+      (length(token_hash) > 7 and substr(token_hash, 1, 7) = 'sha256:')
+  ),
+  check ((superseded_at is null) = (superseded_by_id is null)),
+  check (
+    superseded_by_id is null or
+      (length(superseded_by_id) = 22 and superseded_by_id not glob '*[^A-Za-z0-9_-]*')
+  ),
+  check ((revoked_at is not null) + (superseded_at is not null) <= 1),
+  check (revoked_at is null or (typeof(revoked_at) = 'integer' and revoked_at >= created_at)),
+  check (superseded_at is null or (typeof(superseded_at) = 'integer' and superseded_at >= created_at)),
+  check (
+    metadata is null or
+      case
+        when json_valid(metadata) then json_type(metadata) = 'object'
+        else 0
+      end
+  )
+);
+
+create index if not exists auth_access_grant_created_at_idx
+  on auth_access_grant (created_at, id);
+create index if not exists auth_access_grant_target_created_at_idx
+  on auth_access_grant (target_type, target_id, created_at, id);
+create index if not exists auth_access_grant_issuer_created_at_idx
+  on auth_access_grant (issuer_type, issuer_id, created_at, id);
+create index if not exists auth_access_grant_subject_created_at_idx
+  on auth_access_grant (binding_subject_type, binding_subject_id, created_at, id);
+create index if not exists auth_access_grant_active_expires_at_idx
+  on auth_access_grant (expires_at, created_at, id)
+  where revoked_at is null and superseded_at is null;

package/migrations/postgres/0001_auth_core.sql

@@ -0,0 +1,77 @@
+create table auth_user (
+  id text constraint auth_user_pkey primary key,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  metadata jsonb
+);
+
+create table auth_user_identity (
+  id text constraint auth_user_identity_pkey primary key,
+  user_id text not null,
+  scope_type text not null,
+  scope_id text not null,
+  kind text not null,
+  value text not null,
+  normalized_value text not null,
+  verified_at bigint,
+  is_primary_login boolean not null default false,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  replaced_by_id text,
+  metadata jsonb
+);
+create unique index auth_user_identity_active_value_idx
+  on auth_user_identity (scope_type, scope_id, kind, normalized_value)
+  where revoked_at is null;
+create unique index auth_user_identity_active_primary_idx
+  on auth_user_identity (user_id) where revoked_at is null and is_primary_login;
+create index auth_user_identity_user_id_idx on auth_user_identity (user_id);
+create index auth_user_identity_replaced_by_id_idx on auth_user_identity (replaced_by_id);
+
+create table auth_credential (
+  id text constraint auth_credential_pkey primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_credential_user_type_key unique (user_id, type)
+);
+create index auth_credential_user_id_idx on auth_credential (user_id);
+
+create table auth_session (
+  id text constraint auth_session_pkey primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  auth_time bigint not null,
+  authentication_events jsonb not null,
+  aal text not null,
+  amr jsonb not null,
+  claims jsonb,
+  mfa_verified_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  last_seen_at bigint,
+  rotated_at bigint
+);
+create index auth_session_user_id_idx on auth_session (user_id);
+create index auth_session_expires_at_idx on auth_session (expires_at);
+
+create table auth_verification (
+  id text constraint auth_verification_pkey primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  consumed_at bigint
+);
+create index auth_verification_type_subject_idx on auth_verification (type, subject);
+create index auth_verification_expires_at_idx on auth_verification (expires_at);

package/migrations/postgres/0002_auth_security_oauth.sql

@@ -0,0 +1,65 @@
+create table auth_totp_factor (
+  id text constraint auth_totp_factor_pkey primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at bigint not null,
+  confirmed_at bigint,
+  last_used_at bigint,
+  last_accepted_counter bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index auth_totp_factor_active_idx on auth_totp_factor (user_id, created_at, id)
+  where revoked_at is null and confirmed_at is not null;
+
+create table auth_recovery_code (
+  id text constraint auth_recovery_code_pkey primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at bigint not null,
+  used_at bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index auth_recovery_code_active_idx on auth_recovery_code (user_id, created_at, id)
+  where used_at is null and revoked_at is null;
+
+create table auth_refresh_token (
+  id text constraint auth_refresh_token_pkey primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  last_used_at bigint,
+  rotated_at bigint,
+  replaced_by_id text,
+  revoked_at bigint,
+  reuse_detected_at bigint,
+  metadata jsonb,
+  constraint auth_refresh_token_secret_hash_key unique (secret_hash)
+);
+create index auth_refresh_token_family_id_idx on auth_refresh_token (family_id, created_at, id);
+create index auth_refresh_token_user_id_idx on auth_refresh_token (user_id, created_at, id);
+create index auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+
+create table auth_oauth_account (
+  id text constraint auth_oauth_account_pkey primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified boolean,
+  created_at bigint not null,
+  updated_at bigint not null,
+  unlinked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_account_provider_account_key unique (provider_id, provider_account_id)
+);
+create index auth_oauth_account_user_id_idx on auth_oauth_account (user_id, created_at, id);
+create index auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);

package/migrations/postgres/0003_auth_credentials_tokens.sql

@@ -0,0 +1,43 @@
+create table auth_passkey_credential (
+  id text constraint auth_passkey_credential_pkey primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count bigint not null,
+  transports jsonb,
+  backed_up boolean,
+  created_at bigint not null,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_passkey_credential_credential_id_key unique (credential_id)
+);
+create index auth_passkey_credential_user_id_idx
+  on auth_passkey_credential (user_id, created_at, id);
+create index auth_passkey_credential_revoked_at_idx
+  on auth_passkey_credential (revoked_at);
+
+create table auth_api_key (
+  id text constraint auth_api_key_pkey primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_api_key_prefix_key unique (prefix)
+);
+create index auth_api_key_user_id_idx on auth_api_key (user_id, created_at, id);
+create index auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index auth_api_key_revoked_at_idx on auth_api_key (revoked_at);
+
+create table auth_jwt_revocation (
+  jwt_id text constraint auth_jwt_revocation_pkey primary key,
+  revoked_at bigint not null,
+  expires_at bigint,
+  reason text
+);
+create index auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);

package/migrations/postgres/0004_auth_security_history.sql

@@ -0,0 +1,103 @@
+create table auth_audit_log (
+  storage_id bigint generated always as identity constraint auth_audit_log_pkey primary key,
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at bigint not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event jsonb not null,
+  created_at bigint not null
+);
+create index auth_audit_log_id_idx on auth_audit_log (id);
+create index auth_audit_log_user_occurred_at_idx
+  on auth_audit_log (user_id, occurred_at, id);
+create index auth_audit_log_actor_user_occurred_at_idx
+  on auth_audit_log (actor_user_id, occurred_at, id);
+create index auth_audit_log_type_occurred_at_idx
+  on auth_audit_log (type, occurred_at, id);
+create index auth_audit_log_occurred_at_idx
+  on auth_audit_log (occurred_at, id);
+
+create table auth_login_approval_review (
+  approval_challenge_id text constraint auth_login_approval_review_pkey primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required boolean not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  reviewed_at bigint,
+  reviewed_by text,
+  denied_reason text,
+  risk jsonb,
+  metadata jsonb,
+  review_metadata jsonb,
+  constraint auth_login_approval_review_session_binding_check
+    check (session_binding in ('originating-device', 'approval-device', 'none')),
+  constraint auth_login_approval_review_status_check
+    check (status in ('pending', 'approved', 'denied'))
+);
+create index auth_login_approval_review_flow_id_idx
+  on auth_login_approval_review (flow_id);
+create index auth_login_approval_review_user_id_idx
+  on auth_login_approval_review (user_id);
+create index auth_login_approval_review_status_expires_at_idx
+  on auth_login_approval_review (status, expires_at);
+
+create table auth_login_risk_history (
+  id text constraint auth_login_risk_history_pkey primary key,
+  user_id text not null,
+  occurred_at bigint not null,
+  outcome text not null,
+  method text not null,
+  amr jsonb not null,
+  aal text not null,
+  device_status text not null,
+  device_key text,
+  location_key text,
+  country text,
+  region text,
+  latitude_micro bigint,
+  longitude_micro bigint,
+  risk_level text,
+  created_at bigint not null,
+  constraint auth_login_risk_history_outcome_check
+    check (outcome in ('success', 'failure')),
+  constraint auth_login_risk_history_aal_check
+    check (aal in ('aal1', 'aal2', 'aal3')),
+  constraint auth_login_risk_history_device_status_check
+    check (device_status in ('known', 'new', 'unknown')),
+  constraint auth_login_risk_history_risk_level_check
+    check (risk_level is null or risk_level in ('unknown', 'low', 'medium', 'high', 'critical')),
+  constraint auth_login_risk_history_latitude_check
+    check (latitude_micro is null or latitude_micro between -90000000 and 90000000),
+  constraint auth_login_risk_history_longitude_check
+    check (longitude_micro is null or longitude_micro between -180000000 and 180000000)
+);
+create index auth_login_risk_history_user_occurred_at_idx
+  on auth_login_risk_history (user_id, occurred_at, id);
+create index auth_login_risk_history_user_device_key_idx
+  on auth_login_risk_history (user_id, device_key);
+create index auth_login_risk_history_user_location_key_idx
+  on auth_login_risk_history (user_id, location_key);
+create index auth_login_risk_history_occurred_at_idx
+  on auth_login_risk_history (occurred_at, id);
+
+create table auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at bigint not null,
+  last_seen_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  constraint auth_trusted_device_pkey primary key (user_id, token_hash)
+);
+create index auth_trusted_device_user_id_idx
+  on auth_trusted_device (user_id, last_seen_at, token_hash);
+create index auth_trusted_device_expires_at_idx
+  on auth_trusted_device (expires_at);

package/migrations/postgres/0005_auth_webhooks.sql

@@ -0,0 +1,29 @@
+create table auth_webhook_outbox (
+  id text constraint auth_webhook_outbox_pkey primary key,
+  endpoint_key text not null,
+  event jsonb not null,
+  status text not null,
+  attempts integer not null,
+  next_attempt_at bigint not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  delivered_at bigint,
+  last_error text,
+  constraint auth_webhook_outbox_status_check
+    check (status in ('pending', 'failed', 'delivered', 'dead_lettered')),
+  constraint auth_webhook_outbox_attempts_check check (attempts >= 0)
+);
+create index auth_webhook_outbox_due_idx
+  on auth_webhook_outbox (next_attempt_at, status);
+create index auth_webhook_outbox_endpoint_due_idx
+  on auth_webhook_outbox (endpoint_key, next_attempt_at);
+create index auth_webhook_outbox_status_idx
+  on auth_webhook_outbox (status);
+
+create table auth_webhook_replay (
+  id text constraint auth_webhook_replay_pkey primary key,
+  expires_at bigint not null,
+  created_at bigint not null
+);
+create index auth_webhook_replay_expires_at_idx
+  on auth_webhook_replay (expires_at);

package/migrations/postgres/0006_auth_domain_timeline.sql

@@ -0,0 +1,50 @@
+create table auth_domain_verification (
+  id text constraint auth_domain_verification_pkey primary key,
+  owner_id text not null,
+  domain text not null,
+  proof_method text not null,
+  proof_token text not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  verified_at bigint,
+  revoked_at bigint,
+  last_checked_at bigint,
+  metadata jsonb,
+  constraint auth_domain_verification_owner_domain_key unique (owner_id, domain),
+  constraint auth_domain_verification_proof_method_check
+    check (proof_method in ('dns-txt', 'http-file', 'meta-tag')),
+  constraint auth_domain_verification_status_check
+    check (status in ('pending', 'verified', 'revoked'))
+);
+create index auth_domain_verification_domain_idx
+  on auth_domain_verification (domain);
+create index auth_domain_verification_status_expires_at_idx
+  on auth_domain_verification (status, expires_at);
+create index auth_domain_verification_owner_created_at_idx
+  on auth_domain_verification (owner_id, created_at, id collate "C");
+
+create table auth_security_timeline (
+  id text constraint auth_security_timeline_pkey primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at bigint not null,
+  summary text not null,
+  actor jsonb,
+  request jsonb,
+  metadata jsonb,
+  constraint auth_security_timeline_category_check
+    check (category in ('api_key', 'auth', 'authorization', 'incident', 'identity', 'jwt', 'mfa', 'oauth', 'policy', 'refresh_token', 'risk', 'session')),
+  constraint auth_security_timeline_severity_check
+    check (severity in ('info', 'warning', 'critical'))
+);
+create index auth_security_timeline_user_occurred_at_idx
+  on auth_security_timeline (user_id, occurred_at, id collate "C");
+create index auth_security_timeline_occurred_at_idx
+  on auth_security_timeline (occurred_at, id collate "C");
+create index auth_security_timeline_user_type_idx
+  on auth_security_timeline (user_id, type, occurred_at, id collate "C");
+create index auth_security_timeline_user_category_idx
+  on auth_security_timeline (user_id, category, occurred_at, id collate "C");

package/migrations/postgres/0007_auth_oauth_clients.sql

@@ -0,0 +1,85 @@
+create table auth_oauth_client (
+  id text constraint auth_oauth_client_pkey primary key,
+  type text not null,
+  status text not null,
+  name text,
+  redirect_uris jsonb not null,
+  allowed_grant_types jsonb not null,
+  allowed_response_types jsonb not null,
+  allowed_scopes jsonb,
+  created_at bigint,
+  updated_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_type_check
+    check (type in ('public', 'confidential')),
+  constraint auth_oauth_client_status_check
+    check (status in ('active', 'disabled')),
+  constraint auth_oauth_client_redirect_uris_check
+    check (jsonb_typeof(redirect_uris) = 'array' and not jsonb_path_exists(redirect_uris, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_client_allowed_grant_types_check
+    check (jsonb_typeof(allowed_grant_types) = 'array' and not jsonb_path_exists(allowed_grant_types, '$[*] ? (@.type() != "string" || (@ != "authorization_code" && @ != "refresh_token" && @ != "client_credentials"))')),
+  constraint auth_oauth_client_allowed_response_types_check
+    check (jsonb_typeof(allowed_response_types) = 'array' and not jsonb_path_exists(allowed_response_types, '$[*] ? (@.type() != "string" || @ != "code")')),
+  constraint auth_oauth_client_allowed_scopes_check
+    check (allowed_scopes is null or (jsonb_typeof(allowed_scopes) = 'array' and not jsonb_path_exists(allowed_scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_client_status_idx
+  on auth_oauth_client (status, id collate "C");
+
+create table auth_oauth_consent (
+  user_id text not null,
+  client_id text not null,
+  scopes jsonb not null,
+  granted_at bigint not null,
+  expires_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_consent_user_client_key unique (user_id, client_id),
+  constraint auth_oauth_consent_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")'))
+);
+create index auth_oauth_consent_user_id_idx
+  on auth_oauth_consent (user_id, granted_at, client_id collate "C");
+create index auth_oauth_consent_expires_at_idx
+  on auth_oauth_consent (expires_at);
+create index auth_oauth_consent_revoked_at_idx
+  on auth_oauth_consent (revoked_at);
+
+create table auth_oauth_authorization_code (
+  code_hash text constraint auth_oauth_authorization_code_pkey primary key,
+  client_id text not null,
+  subject text not null,
+  redirect_uri text not null,
+  scopes jsonb not null,
+  code_challenge text,
+  code_challenge_method text,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  consumed_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_authorization_code_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_authorization_code_challenge_method_check
+    check (code_challenge_method is null or code_challenge_method = 'S256')
+);
+create index auth_oauth_authorization_code_client_expires_at_idx
+  on auth_oauth_authorization_code (client_id, expires_at);
+create index auth_oauth_authorization_code_expires_at_idx
+  on auth_oauth_authorization_code (expires_at);
+create index auth_oauth_authorization_code_consumed_at_idx
+  on auth_oauth_authorization_code (consumed_at);
+
+create table auth_oauth_client_secret (
+  prefix text collate "C" not null,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_secret_pkey primary key (client_id, prefix),
+  constraint auth_oauth_client_secret_authentication_methods_check
+    check (jsonb_typeof(authentication_methods) = 'array' and not jsonb_path_exists(authentication_methods, '$[*] ? (@.type() != "string" || (@ != "client_secret_basic" && @ != "client_secret_post"))'))
+);

package/migrations/postgres/0008_auth_oauth_tokens.sql

@@ -0,0 +1,63 @@
+create table auth_oauth_provider_mode_token (
+  token_hash text constraint auth_oauth_provider_mode_token_pkey primary key,
+  token_type text not null,
+  client_id text not null,
+  subject text not null,
+  scopes jsonb not null,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  issuer text,
+  audience jsonb,
+  jwt_id text,
+  revoked_at bigint,
+  revocation_reason text,
+  rotated_at bigint,
+  replaced_by_token_hash text,
+  metadata jsonb,
+  constraint auth_oauth_provider_mode_token_type_check
+    check (token_type in ('access_token', 'refresh_token')),
+  constraint auth_oauth_provider_mode_token_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_provider_mode_token_audience_check
+    check (audience is null or jsonb_typeof(audience) = 'string' or (jsonb_typeof(audience) = 'array' and not jsonb_path_exists(audience, '$[*] ? (@.type() != "string")'))),
+  constraint auth_oauth_provider_mode_token_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object')
+);
+create index auth_oauth_provider_mode_token_client_expires_at_idx
+  on auth_oauth_provider_mode_token (client_id, expires_at);
+create index auth_oauth_provider_mode_token_subject_idx
+  on auth_oauth_provider_mode_token (subject);
+create index auth_oauth_provider_mode_token_expires_at_idx
+  on auth_oauth_provider_mode_token (expires_at);
+create index auth_oauth_provider_mode_token_revoked_at_idx
+  on auth_oauth_provider_mode_token (revoked_at);
+create index auth_oauth_provider_mode_token_rotated_at_idx
+  on auth_oauth_provider_mode_token (rotated_at);
+create index auth_oauth_provider_mode_token_jwt_id_idx
+  on auth_oauth_provider_mode_token (jwt_id);
+
+create table auth_oauth_provider_token_vault (
+  account_id text constraint auth_oauth_provider_token_vault_pkey primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes jsonb,
+  expires_at bigint,
+  updated_at bigint not null,
+  revoked_at bigint,
+  revocation_reason text,
+  constraint auth_oauth_provider_token_vault_scopes_check
+    check (scopes is null or (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_provider_token_vault_user_id_idx
+  on auth_oauth_provider_token_vault (user_id);
+create index auth_oauth_provider_token_vault_provider_account_idx
+  on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index auth_oauth_provider_token_vault_expires_at_idx
+  on auth_oauth_provider_token_vault (expires_at);
+create index auth_oauth_provider_token_vault_revoked_at_idx
+  on auth_oauth_provider_token_vault (revoked_at);