@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.18

package/migrations/postgres/0002_auth_security_oauth.sql

@@ -0,0 +1,65 @@
+create table auth_totp_factor (
+  id text constraint auth_totp_factor_pkey primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at bigint not null,
+  confirmed_at bigint,
+  last_used_at bigint,
+  last_accepted_counter bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index auth_totp_factor_active_idx on auth_totp_factor (user_id, created_at, id)
+  where revoked_at is null and confirmed_at is not null;
+
+create table auth_recovery_code (
+  id text constraint auth_recovery_code_pkey primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at bigint not null,
+  used_at bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index auth_recovery_code_active_idx on auth_recovery_code (user_id, created_at, id)
+  where used_at is null and revoked_at is null;
+
+create table auth_refresh_token (
+  id text constraint auth_refresh_token_pkey primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  last_used_at bigint,
+  rotated_at bigint,
+  replaced_by_id text,
+  revoked_at bigint,
+  reuse_detected_at bigint,
+  metadata jsonb,
+  constraint auth_refresh_token_secret_hash_key unique (secret_hash)
+);
+create index auth_refresh_token_family_id_idx on auth_refresh_token (family_id, created_at, id);
+create index auth_refresh_token_user_id_idx on auth_refresh_token (user_id, created_at, id);
+create index auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+
+create table auth_oauth_account (
+  id text constraint auth_oauth_account_pkey primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified boolean,
+  created_at bigint not null,
+  updated_at bigint not null,
+  unlinked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_account_provider_account_key unique (provider_id, provider_account_id)
+);
+create index auth_oauth_account_user_id_idx on auth_oauth_account (user_id, created_at, id);
+create index auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);

package/migrations/postgres/0003_auth_credentials_tokens.sql

@@ -0,0 +1,43 @@
+create table auth_passkey_credential (
+  id text constraint auth_passkey_credential_pkey primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count bigint not null,
+  transports jsonb,
+  backed_up boolean,
+  created_at bigint not null,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_passkey_credential_credential_id_key unique (credential_id)
+);
+create index auth_passkey_credential_user_id_idx
+  on auth_passkey_credential (user_id, created_at, id);
+create index auth_passkey_credential_revoked_at_idx
+  on auth_passkey_credential (revoked_at);
+
+create table auth_api_key (
+  id text constraint auth_api_key_pkey primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_api_key_prefix_key unique (prefix)
+);
+create index auth_api_key_user_id_idx on auth_api_key (user_id, created_at, id);
+create index auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index auth_api_key_revoked_at_idx on auth_api_key (revoked_at);
+
+create table auth_jwt_revocation (
+  jwt_id text constraint auth_jwt_revocation_pkey primary key,
+  revoked_at bigint not null,
+  expires_at bigint,
+  reason text
+);
+create index auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);

package/migrations/postgres/0004_auth_security_history.sql

@@ -0,0 +1,103 @@
+create table auth_audit_log (
+  storage_id bigint generated always as identity constraint auth_audit_log_pkey primary key,
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at bigint not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event jsonb not null,
+  created_at bigint not null
+);
+create index auth_audit_log_id_idx on auth_audit_log (id);
+create index auth_audit_log_user_occurred_at_idx
+  on auth_audit_log (user_id, occurred_at, id);
+create index auth_audit_log_actor_user_occurred_at_idx
+  on auth_audit_log (actor_user_id, occurred_at, id);
+create index auth_audit_log_type_occurred_at_idx
+  on auth_audit_log (type, occurred_at, id);
+create index auth_audit_log_occurred_at_idx
+  on auth_audit_log (occurred_at, id);
+
+create table auth_login_approval_review (
+  approval_challenge_id text constraint auth_login_approval_review_pkey primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required boolean not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  reviewed_at bigint,
+  reviewed_by text,
+  denied_reason text,
+  risk jsonb,
+  metadata jsonb,
+  review_metadata jsonb,
+  constraint auth_login_approval_review_session_binding_check
+    check (session_binding in ('originating-device', 'approval-device', 'none')),
+  constraint auth_login_approval_review_status_check
+    check (status in ('pending', 'approved', 'denied'))
+);
+create index auth_login_approval_review_flow_id_idx
+  on auth_login_approval_review (flow_id);
+create index auth_login_approval_review_user_id_idx
+  on auth_login_approval_review (user_id);
+create index auth_login_approval_review_status_expires_at_idx
+  on auth_login_approval_review (status, expires_at);
+
+create table auth_login_risk_history (
+  id text constraint auth_login_risk_history_pkey primary key,
+  user_id text not null,
+  occurred_at bigint not null,
+  outcome text not null,
+  method text not null,
+  amr jsonb not null,
+  aal text not null,
+  device_status text not null,
+  device_key text,
+  location_key text,
+  country text,
+  region text,
+  latitude_micro bigint,
+  longitude_micro bigint,
+  risk_level text,
+  created_at bigint not null,
+  constraint auth_login_risk_history_outcome_check
+    check (outcome in ('success', 'failure')),
+  constraint auth_login_risk_history_aal_check
+    check (aal in ('aal1', 'aal2', 'aal3')),
+  constraint auth_login_risk_history_device_status_check
+    check (device_status in ('known', 'new', 'unknown')),
+  constraint auth_login_risk_history_risk_level_check
+    check (risk_level is null or risk_level in ('unknown', 'low', 'medium', 'high', 'critical')),
+  constraint auth_login_risk_history_latitude_check
+    check (latitude_micro is null or latitude_micro between -90000000 and 90000000),
+  constraint auth_login_risk_history_longitude_check
+    check (longitude_micro is null or longitude_micro between -180000000 and 180000000)
+);
+create index auth_login_risk_history_user_occurred_at_idx
+  on auth_login_risk_history (user_id, occurred_at, id);
+create index auth_login_risk_history_user_device_key_idx
+  on auth_login_risk_history (user_id, device_key);
+create index auth_login_risk_history_user_location_key_idx
+  on auth_login_risk_history (user_id, location_key);
+create index auth_login_risk_history_occurred_at_idx
+  on auth_login_risk_history (occurred_at, id);
+
+create table auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at bigint not null,
+  last_seen_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  constraint auth_trusted_device_pkey primary key (user_id, token_hash)
+);
+create index auth_trusted_device_user_id_idx
+  on auth_trusted_device (user_id, last_seen_at, token_hash);
+create index auth_trusted_device_expires_at_idx
+  on auth_trusted_device (expires_at);

package/migrations/postgres/0005_auth_webhooks.sql

@@ -0,0 +1,29 @@
+create table auth_webhook_outbox (
+  id text constraint auth_webhook_outbox_pkey primary key,
+  endpoint_key text not null,
+  event jsonb not null,
+  status text not null,
+  attempts integer not null,
+  next_attempt_at bigint not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  delivered_at bigint,
+  last_error text,
+  constraint auth_webhook_outbox_status_check
+    check (status in ('pending', 'failed', 'delivered', 'dead_lettered')),
+  constraint auth_webhook_outbox_attempts_check check (attempts >= 0)
+);
+create index auth_webhook_outbox_due_idx
+  on auth_webhook_outbox (next_attempt_at, status);
+create index auth_webhook_outbox_endpoint_due_idx
+  on auth_webhook_outbox (endpoint_key, next_attempt_at);
+create index auth_webhook_outbox_status_idx
+  on auth_webhook_outbox (status);
+
+create table auth_webhook_replay (
+  id text constraint auth_webhook_replay_pkey primary key,
+  expires_at bigint not null,
+  created_at bigint not null
+);
+create index auth_webhook_replay_expires_at_idx
+  on auth_webhook_replay (expires_at);

package/migrations/postgres/0006_auth_domain_timeline.sql

@@ -0,0 +1,50 @@
+create table auth_domain_verification (
+  id text constraint auth_domain_verification_pkey primary key,
+  owner_id text not null,
+  domain text not null,
+  proof_method text not null,
+  proof_token text not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  verified_at bigint,
+  revoked_at bigint,
+  last_checked_at bigint,
+  metadata jsonb,
+  constraint auth_domain_verification_owner_domain_key unique (owner_id, domain),
+  constraint auth_domain_verification_proof_method_check
+    check (proof_method in ('dns-txt', 'http-file', 'meta-tag')),
+  constraint auth_domain_verification_status_check
+    check (status in ('pending', 'verified', 'revoked'))
+);
+create index auth_domain_verification_domain_idx
+  on auth_domain_verification (domain);
+create index auth_domain_verification_status_expires_at_idx
+  on auth_domain_verification (status, expires_at);
+create index auth_domain_verification_owner_created_at_idx
+  on auth_domain_verification (owner_id, created_at, id collate "C");
+
+create table auth_security_timeline (
+  id text constraint auth_security_timeline_pkey primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at bigint not null,
+  summary text not null,
+  actor jsonb,
+  request jsonb,
+  metadata jsonb,
+  constraint auth_security_timeline_category_check
+    check (category in ('api_key', 'auth', 'authorization', 'incident', 'identity', 'jwt', 'mfa', 'oauth', 'policy', 'refresh_token', 'risk', 'session')),
+  constraint auth_security_timeline_severity_check
+    check (severity in ('info', 'warning', 'critical'))
+);
+create index auth_security_timeline_user_occurred_at_idx
+  on auth_security_timeline (user_id, occurred_at, id collate "C");
+create index auth_security_timeline_occurred_at_idx
+  on auth_security_timeline (occurred_at, id collate "C");
+create index auth_security_timeline_user_type_idx
+  on auth_security_timeline (user_id, type, occurred_at, id collate "C");
+create index auth_security_timeline_user_category_idx
+  on auth_security_timeline (user_id, category, occurred_at, id collate "C");

package/migrations/postgres/0007_auth_oauth_clients.sql

@@ -0,0 +1,85 @@
+create table auth_oauth_client (
+  id text constraint auth_oauth_client_pkey primary key,
+  type text not null,
+  status text not null,
+  name text,
+  redirect_uris jsonb not null,
+  allowed_grant_types jsonb not null,
+  allowed_response_types jsonb not null,
+  allowed_scopes jsonb,
+  created_at bigint,
+  updated_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_type_check
+    check (type in ('public', 'confidential')),
+  constraint auth_oauth_client_status_check
+    check (status in ('active', 'disabled')),
+  constraint auth_oauth_client_redirect_uris_check
+    check (jsonb_typeof(redirect_uris) = 'array' and not jsonb_path_exists(redirect_uris, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_client_allowed_grant_types_check
+    check (jsonb_typeof(allowed_grant_types) = 'array' and not jsonb_path_exists(allowed_grant_types, '$[*] ? (@.type() != "string" || (@ != "authorization_code" && @ != "refresh_token" && @ != "client_credentials"))')),
+  constraint auth_oauth_client_allowed_response_types_check
+    check (jsonb_typeof(allowed_response_types) = 'array' and not jsonb_path_exists(allowed_response_types, '$[*] ? (@.type() != "string" || @ != "code")')),
+  constraint auth_oauth_client_allowed_scopes_check
+    check (allowed_scopes is null or (jsonb_typeof(allowed_scopes) = 'array' and not jsonb_path_exists(allowed_scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_client_status_idx
+  on auth_oauth_client (status, id collate "C");
+
+create table auth_oauth_consent (
+  user_id text not null,
+  client_id text not null,
+  scopes jsonb not null,
+  granted_at bigint not null,
+  expires_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_consent_user_client_key unique (user_id, client_id),
+  constraint auth_oauth_consent_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")'))
+);
+create index auth_oauth_consent_user_id_idx
+  on auth_oauth_consent (user_id, granted_at, client_id collate "C");
+create index auth_oauth_consent_expires_at_idx
+  on auth_oauth_consent (expires_at);
+create index auth_oauth_consent_revoked_at_idx
+  on auth_oauth_consent (revoked_at);
+
+create table auth_oauth_authorization_code (
+  code_hash text constraint auth_oauth_authorization_code_pkey primary key,
+  client_id text not null,
+  subject text not null,
+  redirect_uri text not null,
+  scopes jsonb not null,
+  code_challenge text,
+  code_challenge_method text,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  consumed_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_authorization_code_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_authorization_code_challenge_method_check
+    check (code_challenge_method is null or code_challenge_method = 'S256')
+);
+create index auth_oauth_authorization_code_client_expires_at_idx
+  on auth_oauth_authorization_code (client_id, expires_at);
+create index auth_oauth_authorization_code_expires_at_idx
+  on auth_oauth_authorization_code (expires_at);
+create index auth_oauth_authorization_code_consumed_at_idx
+  on auth_oauth_authorization_code (consumed_at);
+
+create table auth_oauth_client_secret (
+  prefix text collate "C" not null,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_secret_pkey primary key (client_id, prefix),
+  constraint auth_oauth_client_secret_authentication_methods_check
+    check (jsonb_typeof(authentication_methods) = 'array' and not jsonb_path_exists(authentication_methods, '$[*] ? (@.type() != "string" || (@ != "client_secret_basic" && @ != "client_secret_post"))'))
+);

package/migrations/postgres/0008_auth_oauth_tokens.sql

@@ -0,0 +1,63 @@
+create table auth_oauth_provider_mode_token (
+  token_hash text constraint auth_oauth_provider_mode_token_pkey primary key,
+  token_type text not null,
+  client_id text not null,
+  subject text not null,
+  scopes jsonb not null,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  issuer text,
+  audience jsonb,
+  jwt_id text,
+  revoked_at bigint,
+  revocation_reason text,
+  rotated_at bigint,
+  replaced_by_token_hash text,
+  metadata jsonb,
+  constraint auth_oauth_provider_mode_token_type_check
+    check (token_type in ('access_token', 'refresh_token')),
+  constraint auth_oauth_provider_mode_token_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_provider_mode_token_audience_check
+    check (audience is null or jsonb_typeof(audience) = 'string' or (jsonb_typeof(audience) = 'array' and not jsonb_path_exists(audience, '$[*] ? (@.type() != "string")'))),
+  constraint auth_oauth_provider_mode_token_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object')
+);
+create index auth_oauth_provider_mode_token_client_expires_at_idx
+  on auth_oauth_provider_mode_token (client_id, expires_at);
+create index auth_oauth_provider_mode_token_subject_idx
+  on auth_oauth_provider_mode_token (subject);
+create index auth_oauth_provider_mode_token_expires_at_idx
+  on auth_oauth_provider_mode_token (expires_at);
+create index auth_oauth_provider_mode_token_revoked_at_idx
+  on auth_oauth_provider_mode_token (revoked_at);
+create index auth_oauth_provider_mode_token_rotated_at_idx
+  on auth_oauth_provider_mode_token (rotated_at);
+create index auth_oauth_provider_mode_token_jwt_id_idx
+  on auth_oauth_provider_mode_token (jwt_id);
+
+create table auth_oauth_provider_token_vault (
+  account_id text constraint auth_oauth_provider_token_vault_pkey primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes jsonb,
+  expires_at bigint,
+  updated_at bigint not null,
+  revoked_at bigint,
+  revocation_reason text,
+  constraint auth_oauth_provider_token_vault_scopes_check
+    check (scopes is null or (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_provider_token_vault_user_id_idx
+  on auth_oauth_provider_token_vault (user_id);
+create index auth_oauth_provider_token_vault_provider_account_idx
+  on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index auth_oauth_provider_token_vault_expires_at_idx
+  on auth_oauth_provider_token_vault (expires_at);
+create index auth_oauth_provider_token_vault_revoked_at_idx
+  on auth_oauth_provider_token_vault (revoked_at);

package/migrations/postgres/0009_auth_permissions.sql

@@ -0,0 +1,66 @@
+create table auth_permission_definition (
+  id text collate "C" constraint auth_permission_definition_pkey primary key,
+  description text,
+  scope_type_present boolean not null,
+  scope_type text not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  deleted_at bigint
+);
+create index auth_permission_definition_status_idx
+  on auth_permission_definition (disabled_at, deleted_at, id);
+
+create table auth_role_definition (
+  id text constraint auth_role_definition_pkey primary key,
+  description text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  deleted_at bigint
+);
+create index auth_role_definition_status_idx
+  on auth_role_definition (disabled_at, deleted_at, id collate "C");
+
+create table auth_permission_grant (
+  subject_type text not null,
+  subject_id text not null,
+  permission_id text not null,
+  scope_type text not null,
+  scope_id_present boolean not null,
+  scope_id text not null,
+  expires_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  constraint auth_permission_grant_pkey primary key
+    (subject_type, subject_id, permission_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_permission_grant_check_idx
+  on auth_permission_grant (subject_type, subject_id, permission_id, revoked_at, expires_at);
+
+create table auth_role_grant (
+  subject_type text not null,
+  subject_id text not null,
+  role_id text not null,
+  scope_type text not null,
+  scope_id_present boolean not null,
+  scope_id text not null,
+  expires_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  constraint auth_role_grant_pkey primary key
+    (subject_type, subject_id, role_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_role_grant_check_idx
+  on auth_role_grant (subject_type, subject_id, role_id, revoked_at, expires_at);
+
+create table auth_role_permission (
+  role_id text not null,
+  permission_id text not null,
+  scope_type_present boolean not null,
+  scope_type text not null,
+  constraint auth_role_permission_pkey primary key
+    (role_id, permission_id, scope_type_present, scope_type)
+);
+create index auth_role_permission_check_idx
+  on auth_role_permission (permission_id, role_id, scope_type_present, scope_type);

package/migrations/postgres/delegated-access/0001_auth_delegated_access.sql

@@ -0,0 +1,112 @@
+create table auth_invitation (
+  id text collate "C" constraint auth_invitation_pkey primary key,
+  kind text not null,
+  target_type text not null,
+  target_id text not null,
+  intent_type text not null,
+  intent_version integer not null,
+  intent_payload jsonb not null,
+  recipient_type text,
+  recipient_reference text,
+  issued_by_type text,
+  issued_by_id text,
+  created_at bigint not null,
+  expires_at bigint not null,
+  token_hash text not null,
+  accepted_at bigint,
+  accepted_by_type text,
+  accepted_by_id text,
+  revoked_at bigint,
+  superseded_at bigint,
+  superseded_by_id text,
+  metadata jsonb,
+  constraint auth_invitation_id_check
+    check (id ~ '^[A-Za-z0-9_-]{22}$'),
+  constraint auth_invitation_required_text_check
+    check (length(kind) > 0 and length(target_type) > 0 and length(target_id) > 0 and length(intent_type) > 0),
+  constraint auth_invitation_intent_check
+    check (intent_version >= 1 and jsonb_typeof(intent_payload) = 'object'),
+  constraint auth_invitation_recipient_pair_check
+    check ((recipient_type is null and recipient_reference is null) or (recipient_type is not null and recipient_reference is not null and length(recipient_type) > 0 and length(recipient_reference) > 0)),
+  constraint auth_invitation_issued_by_pair_check
+    check ((issued_by_type is null and issued_by_id is null) or (issued_by_type is not null and issued_by_id is not null and length(issued_by_type) > 0 and length(issued_by_id) > 0)),
+  constraint auth_invitation_token_hash_check
+    check (token_hash ~ '^sha256:.+$'),
+  constraint auth_invitation_accepted_pair_check
+    check ((accepted_at is null and accepted_by_type is null and accepted_by_id is null) or (accepted_at is not null and accepted_by_type is not null and accepted_by_id is not null and length(accepted_by_type) > 0 and length(accepted_by_id) > 0)),
+  constraint auth_invitation_superseded_pair_check
+    check ((superseded_at is null and superseded_by_id is null) or (superseded_at is not null and superseded_by_id is not null and superseded_by_id ~ '^[A-Za-z0-9_-]{22}$')),
+  constraint auth_invitation_terminal_state_check
+    check (((accepted_at is not null)::integer + (revoked_at is not null)::integer + (superseded_at is not null)::integer) <= 1),
+  constraint auth_invitation_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object'),
+  constraint auth_invitation_timestamp_order_check
+    check (created_at >= 0 and expires_at > created_at and (accepted_at is null or accepted_at >= created_at) and (revoked_at is null or revoked_at >= created_at) and (superseded_at is null or superseded_at >= created_at))
+);
+create index auth_invitation_created_at_idx
+  on auth_invitation (created_at, id);
+create index auth_invitation_kind_created_at_idx
+  on auth_invitation (kind, created_at, id);
+create index auth_invitation_target_created_at_idx
+  on auth_invitation (target_type, target_id, created_at, id);
+create index auth_invitation_recipient_created_at_idx
+  on auth_invitation (recipient_type, recipient_reference, created_at, id);
+create index auth_invitation_issued_by_created_at_idx
+  on auth_invitation (issued_by_type, issued_by_id, created_at, id);
+create index auth_invitation_pending_expires_at_idx
+  on auth_invitation (expires_at, created_at, id)
+  where accepted_at is null and revoked_at is null and superseded_at is null;
+
+create table auth_access_grant (
+  id text collate "C" constraint auth_access_grant_pkey primary key,
+  target_type text not null,
+  target_id text not null,
+  capabilities jsonb not null,
+  binding_type text not null,
+  binding_subject_type text,
+  binding_subject_id text,
+  issuer_type text,
+  issuer_id text,
+  created_at bigint not null,
+  expires_at bigint,
+  token_hash text,
+  revoked_at bigint,
+  superseded_at bigint,
+  superseded_by_id text,
+  metadata jsonb,
+  constraint auth_access_grant_id_check
+    check (id ~ '^[A-Za-z0-9_-]{22}$'),
+  constraint auth_access_grant_target_check
+    check (length(target_type) > 0 and length(target_id) > 0),
+  constraint auth_access_grant_capabilities_check
+    check (jsonb_typeof(capabilities) = 'array' and jsonb_array_length(capabilities) > 0 and not jsonb_path_exists(capabilities, '$[*] ? (@.type() != "string" || @ == "")')),
+  constraint auth_access_grant_binding_type_check
+    check (binding_type in ('bearer', 'subject', 'subject-and-bearer')),
+  constraint auth_access_grant_binding_subject_check
+    check ((binding_type = 'bearer' and binding_subject_type is null and binding_subject_id is null) or (binding_type in ('subject', 'subject-and-bearer') and binding_subject_type is not null and binding_subject_id is not null and length(binding_subject_type) > 0 and length(binding_subject_id) > 0)),
+  constraint auth_access_grant_issuer_pair_check
+    check ((issuer_type is null and issuer_id is null) or (issuer_type is not null and issuer_id is not null and length(issuer_type) > 0 and length(issuer_id) > 0)),
+  constraint auth_access_grant_token_hash_check
+    check (token_hash is null or token_hash ~ '^sha256:.+$'),
+  constraint auth_access_grant_binding_token_hash_check
+    check ((binding_type = 'subject' and token_hash is null) or (binding_type in ('bearer', 'subject-and-bearer') and token_hash is not null)),
+  constraint auth_access_grant_superseded_pair_check
+    check ((superseded_at is null and superseded_by_id is null) or (superseded_at is not null and superseded_by_id is not null and superseded_by_id ~ '^[A-Za-z0-9_-]{22}$')),
+  constraint auth_access_grant_terminal_state_check
+    check (((revoked_at is not null)::integer + (superseded_at is not null)::integer) <= 1),
+  constraint auth_access_grant_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object'),
+  constraint auth_access_grant_timestamp_order_check
+    check (created_at >= 0 and (expires_at is null or expires_at > created_at) and (revoked_at is null or revoked_at >= created_at) and (superseded_at is null or superseded_at >= created_at))
+);
+create index auth_access_grant_created_at_idx
+  on auth_access_grant (created_at, id);
+create index auth_access_grant_target_created_at_idx
+  on auth_access_grant (target_type, target_id, created_at, id);
+create index auth_access_grant_issuer_created_at_idx
+  on auth_access_grant (issuer_type, issuer_id, created_at, id);
+create index auth_access_grant_subject_created_at_idx
+  on auth_access_grant (binding_subject_type, binding_subject_id, created_at, id);
+create index auth_access_grant_active_expires_at_idx
+  on auth_access_grant (expires_at, created_at, id)
+  where revoked_at is null and superseded_at is null;