@effect-auth/core 0.1.0-alpha.16 → 0.1.0-alpha.19

package/migrations/postgres/0001_auth_core.sql

@@ -0,0 +1,77 @@
+create table auth_user (
+  id text constraint auth_user_pkey primary key,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  metadata jsonb
+);
+
+create table auth_user_identity (
+  id text constraint auth_user_identity_pkey primary key,
+  user_id text not null,
+  scope_type text not null,
+  scope_id text not null,
+  kind text not null,
+  value text not null,
+  normalized_value text not null,
+  verified_at bigint,
+  is_primary_login boolean not null default false,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  replaced_by_id text,
+  metadata jsonb
+);
+create unique index auth_user_identity_active_value_idx
+  on auth_user_identity (scope_type, scope_id, kind, normalized_value)
+  where revoked_at is null;
+create unique index auth_user_identity_active_primary_idx
+  on auth_user_identity (user_id) where revoked_at is null and is_primary_login;
+create index auth_user_identity_user_id_idx on auth_user_identity (user_id);
+create index auth_user_identity_replaced_by_id_idx on auth_user_identity (replaced_by_id);
+
+create table auth_credential (
+  id text constraint auth_credential_pkey primary key,
+  user_id text not null,
+  type text not null,
+  password_hash text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_credential_user_type_key unique (user_id, type)
+);
+create index auth_credential_user_id_idx on auth_credential (user_id);
+
+create table auth_session (
+  id text constraint auth_session_pkey primary key,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  auth_time bigint not null,
+  authentication_events jsonb not null,
+  aal text not null,
+  amr jsonb not null,
+  claims jsonb,
+  mfa_verified_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  last_seen_at bigint,
+  rotated_at bigint
+);
+create index auth_session_user_id_idx on auth_session (user_id);
+create index auth_session_expires_at_idx on auth_session (expires_at);
+
+create table auth_verification (
+  id text constraint auth_verification_pkey primary key,
+  type text not null,
+  subject text not null,
+  secret_hash text,
+  created_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  consumed_at bigint
+);
+create index auth_verification_type_subject_idx on auth_verification (type, subject);
+create index auth_verification_expires_at_idx on auth_verification (expires_at);

package/migrations/postgres/0002_auth_security_oauth.sql

@@ -0,0 +1,65 @@
+create table auth_totp_factor (
+  id text constraint auth_totp_factor_pkey primary key,
+  user_id text not null,
+  secret text not null,
+  algorithm text not null,
+  digits integer not null,
+  period integer not null,
+  created_at bigint not null,
+  confirmed_at bigint,
+  last_used_at bigint,
+  last_accepted_counter bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_totp_factor_user_id_idx on auth_totp_factor (user_id);
+create index auth_totp_factor_active_idx on auth_totp_factor (user_id, created_at, id)
+  where revoked_at is null and confirmed_at is not null;
+
+create table auth_recovery_code (
+  id text constraint auth_recovery_code_pkey primary key,
+  user_id text not null,
+  code_hash text not null,
+  created_at bigint not null,
+  used_at bigint,
+  revoked_at bigint,
+  metadata jsonb
+);
+create index auth_recovery_code_user_id_idx on auth_recovery_code (user_id);
+create index auth_recovery_code_active_idx on auth_recovery_code (user_id, created_at, id)
+  where used_at is null and revoked_at is null;
+
+create table auth_refresh_token (
+  id text constraint auth_refresh_token_pkey primary key,
+  family_id text not null,
+  user_id text not null,
+  secret_hash text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  last_used_at bigint,
+  rotated_at bigint,
+  replaced_by_id text,
+  revoked_at bigint,
+  reuse_detected_at bigint,
+  metadata jsonb,
+  constraint auth_refresh_token_secret_hash_key unique (secret_hash)
+);
+create index auth_refresh_token_family_id_idx on auth_refresh_token (family_id, created_at, id);
+create index auth_refresh_token_user_id_idx on auth_refresh_token (user_id, created_at, id);
+create index auth_refresh_token_expires_at_idx on auth_refresh_token (expires_at);
+
+create table auth_oauth_account (
+  id text constraint auth_oauth_account_pkey primary key,
+  provider_id text not null,
+  provider_account_id text not null,
+  user_id text not null,
+  email text,
+  email_verified boolean,
+  created_at bigint not null,
+  updated_at bigint not null,
+  unlinked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_account_provider_account_key unique (provider_id, provider_account_id)
+);
+create index auth_oauth_account_user_id_idx on auth_oauth_account (user_id, created_at, id);
+create index auth_oauth_account_unlinked_at_idx on auth_oauth_account (unlinked_at);

package/migrations/postgres/0003_auth_credentials_tokens.sql

@@ -0,0 +1,43 @@
+create table auth_passkey_credential (
+  id text constraint auth_passkey_credential_pkey primary key,
+  user_id text not null,
+  credential_id text not null,
+  public_key text not null,
+  sign_count bigint not null,
+  transports jsonb,
+  backed_up boolean,
+  created_at bigint not null,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_passkey_credential_credential_id_key unique (credential_id)
+);
+create index auth_passkey_credential_user_id_idx
+  on auth_passkey_credential (user_id, created_at, id);
+create index auth_passkey_credential_revoked_at_idx
+  on auth_passkey_credential (revoked_at);
+
+create table auth_api_key (
+  id text constraint auth_api_key_pkey primary key,
+  user_id text not null,
+  prefix text not null,
+  secret_hash text not null,
+  scopes jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_api_key_prefix_key unique (prefix)
+);
+create index auth_api_key_user_id_idx on auth_api_key (user_id, created_at, id);
+create index auth_api_key_expires_at_idx on auth_api_key (expires_at);
+create index auth_api_key_revoked_at_idx on auth_api_key (revoked_at);
+
+create table auth_jwt_revocation (
+  jwt_id text constraint auth_jwt_revocation_pkey primary key,
+  revoked_at bigint not null,
+  expires_at bigint,
+  reason text
+);
+create index auth_jwt_revocation_expires_at_idx on auth_jwt_revocation (expires_at);

package/migrations/postgres/0004_auth_security_history.sql

@@ -0,0 +1,103 @@
+create table auth_audit_log (
+  storage_id bigint generated always as identity constraint auth_audit_log_pkey primary key,
+  id text,
+  type text not null,
+  user_id text,
+  actor_user_id text,
+  occurred_at bigint not null,
+  request_ip_hash text,
+  request_user_agent_hash text,
+  event jsonb not null,
+  created_at bigint not null
+);
+create index auth_audit_log_id_idx on auth_audit_log (id);
+create index auth_audit_log_user_occurred_at_idx
+  on auth_audit_log (user_id, occurred_at, id);
+create index auth_audit_log_actor_user_occurred_at_idx
+  on auth_audit_log (actor_user_id, occurred_at, id);
+create index auth_audit_log_type_occurred_at_idx
+  on auth_audit_log (type, occurred_at, id);
+create index auth_audit_log_occurred_at_idx
+  on auth_audit_log (occurred_at, id);
+
+create table auth_login_approval_review (
+  approval_challenge_id text constraint auth_login_approval_review_pkey primary key,
+  flow_id text not null,
+  user_id text not null,
+  channel text not null,
+  reason text not null,
+  session_binding text not null,
+  same_device_required boolean not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  reviewed_at bigint,
+  reviewed_by text,
+  denied_reason text,
+  risk jsonb,
+  metadata jsonb,
+  review_metadata jsonb,
+  constraint auth_login_approval_review_session_binding_check
+    check (session_binding in ('originating-device', 'approval-device', 'none')),
+  constraint auth_login_approval_review_status_check
+    check (status in ('pending', 'approved', 'denied'))
+);
+create index auth_login_approval_review_flow_id_idx
+  on auth_login_approval_review (flow_id);
+create index auth_login_approval_review_user_id_idx
+  on auth_login_approval_review (user_id);
+create index auth_login_approval_review_status_expires_at_idx
+  on auth_login_approval_review (status, expires_at);
+
+create table auth_login_risk_history (
+  id text constraint auth_login_risk_history_pkey primary key,
+  user_id text not null,
+  occurred_at bigint not null,
+  outcome text not null,
+  method text not null,
+  amr jsonb not null,
+  aal text not null,
+  device_status text not null,
+  device_key text,
+  location_key text,
+  country text,
+  region text,
+  latitude_micro bigint,
+  longitude_micro bigint,
+  risk_level text,
+  created_at bigint not null,
+  constraint auth_login_risk_history_outcome_check
+    check (outcome in ('success', 'failure')),
+  constraint auth_login_risk_history_aal_check
+    check (aal in ('aal1', 'aal2', 'aal3')),
+  constraint auth_login_risk_history_device_status_check
+    check (device_status in ('known', 'new', 'unknown')),
+  constraint auth_login_risk_history_risk_level_check
+    check (risk_level is null or risk_level in ('unknown', 'low', 'medium', 'high', 'critical')),
+  constraint auth_login_risk_history_latitude_check
+    check (latitude_micro is null or latitude_micro between -90000000 and 90000000),
+  constraint auth_login_risk_history_longitude_check
+    check (longitude_micro is null or longitude_micro between -180000000 and 180000000)
+);
+create index auth_login_risk_history_user_occurred_at_idx
+  on auth_login_risk_history (user_id, occurred_at, id);
+create index auth_login_risk_history_user_device_key_idx
+  on auth_login_risk_history (user_id, device_key);
+create index auth_login_risk_history_user_location_key_idx
+  on auth_login_risk_history (user_id, location_key);
+create index auth_login_risk_history_occurred_at_idx
+  on auth_login_risk_history (occurred_at, id);
+
+create table auth_trusted_device (
+  user_id text not null,
+  token_hash text not null,
+  created_at bigint not null,
+  last_seen_at bigint not null,
+  expires_at bigint not null,
+  metadata jsonb,
+  constraint auth_trusted_device_pkey primary key (user_id, token_hash)
+);
+create index auth_trusted_device_user_id_idx
+  on auth_trusted_device (user_id, last_seen_at, token_hash);
+create index auth_trusted_device_expires_at_idx
+  on auth_trusted_device (expires_at);

package/migrations/postgres/0005_auth_webhooks.sql

@@ -0,0 +1,29 @@
+create table auth_webhook_outbox (
+  id text constraint auth_webhook_outbox_pkey primary key,
+  endpoint_key text not null,
+  event jsonb not null,
+  status text not null,
+  attempts integer not null,
+  next_attempt_at bigint not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  delivered_at bigint,
+  last_error text,
+  constraint auth_webhook_outbox_status_check
+    check (status in ('pending', 'failed', 'delivered', 'dead_lettered')),
+  constraint auth_webhook_outbox_attempts_check check (attempts >= 0)
+);
+create index auth_webhook_outbox_due_idx
+  on auth_webhook_outbox (next_attempt_at, status);
+create index auth_webhook_outbox_endpoint_due_idx
+  on auth_webhook_outbox (endpoint_key, next_attempt_at);
+create index auth_webhook_outbox_status_idx
+  on auth_webhook_outbox (status);
+
+create table auth_webhook_replay (
+  id text constraint auth_webhook_replay_pkey primary key,
+  expires_at bigint not null,
+  created_at bigint not null
+);
+create index auth_webhook_replay_expires_at_idx
+  on auth_webhook_replay (expires_at);

package/migrations/postgres/0006_auth_domain_timeline.sql

@@ -0,0 +1,50 @@
+create table auth_domain_verification (
+  id text constraint auth_domain_verification_pkey primary key,
+  owner_id text not null,
+  domain text not null,
+  proof_method text not null,
+  proof_token text not null,
+  status text not null,
+  created_at bigint not null,
+  expires_at bigint not null,
+  verified_at bigint,
+  revoked_at bigint,
+  last_checked_at bigint,
+  metadata jsonb,
+  constraint auth_domain_verification_owner_domain_key unique (owner_id, domain),
+  constraint auth_domain_verification_proof_method_check
+    check (proof_method in ('dns-txt', 'http-file', 'meta-tag')),
+  constraint auth_domain_verification_status_check
+    check (status in ('pending', 'verified', 'revoked'))
+);
+create index auth_domain_verification_domain_idx
+  on auth_domain_verification (domain);
+create index auth_domain_verification_status_expires_at_idx
+  on auth_domain_verification (status, expires_at);
+create index auth_domain_verification_owner_created_at_idx
+  on auth_domain_verification (owner_id, created_at, id collate "C");
+
+create table auth_security_timeline (
+  id text constraint auth_security_timeline_pkey primary key,
+  user_id text not null,
+  type text not null,
+  category text not null,
+  severity text not null,
+  occurred_at bigint not null,
+  summary text not null,
+  actor jsonb,
+  request jsonb,
+  metadata jsonb,
+  constraint auth_security_timeline_category_check
+    check (category in ('api_key', 'auth', 'authorization', 'incident', 'identity', 'jwt', 'mfa', 'oauth', 'policy', 'refresh_token', 'risk', 'session')),
+  constraint auth_security_timeline_severity_check
+    check (severity in ('info', 'warning', 'critical'))
+);
+create index auth_security_timeline_user_occurred_at_idx
+  on auth_security_timeline (user_id, occurred_at, id collate "C");
+create index auth_security_timeline_occurred_at_idx
+  on auth_security_timeline (occurred_at, id collate "C");
+create index auth_security_timeline_user_type_idx
+  on auth_security_timeline (user_id, type, occurred_at, id collate "C");
+create index auth_security_timeline_user_category_idx
+  on auth_security_timeline (user_id, category, occurred_at, id collate "C");

package/migrations/postgres/0007_auth_oauth_clients.sql

@@ -0,0 +1,85 @@
+create table auth_oauth_client (
+  id text constraint auth_oauth_client_pkey primary key,
+  type text not null,
+  status text not null,
+  name text,
+  redirect_uris jsonb not null,
+  allowed_grant_types jsonb not null,
+  allowed_response_types jsonb not null,
+  allowed_scopes jsonb,
+  created_at bigint,
+  updated_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_type_check
+    check (type in ('public', 'confidential')),
+  constraint auth_oauth_client_status_check
+    check (status in ('active', 'disabled')),
+  constraint auth_oauth_client_redirect_uris_check
+    check (jsonb_typeof(redirect_uris) = 'array' and not jsonb_path_exists(redirect_uris, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_client_allowed_grant_types_check
+    check (jsonb_typeof(allowed_grant_types) = 'array' and not jsonb_path_exists(allowed_grant_types, '$[*] ? (@.type() != "string" || (@ != "authorization_code" && @ != "refresh_token" && @ != "client_credentials"))')),
+  constraint auth_oauth_client_allowed_response_types_check
+    check (jsonb_typeof(allowed_response_types) = 'array' and not jsonb_path_exists(allowed_response_types, '$[*] ? (@.type() != "string" || @ != "code")')),
+  constraint auth_oauth_client_allowed_scopes_check
+    check (allowed_scopes is null or (jsonb_typeof(allowed_scopes) = 'array' and not jsonb_path_exists(allowed_scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_client_status_idx
+  on auth_oauth_client (status, id collate "C");
+
+create table auth_oauth_consent (
+  user_id text not null,
+  client_id text not null,
+  scopes jsonb not null,
+  granted_at bigint not null,
+  expires_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_consent_user_client_key unique (user_id, client_id),
+  constraint auth_oauth_consent_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")'))
+);
+create index auth_oauth_consent_user_id_idx
+  on auth_oauth_consent (user_id, granted_at, client_id collate "C");
+create index auth_oauth_consent_expires_at_idx
+  on auth_oauth_consent (expires_at);
+create index auth_oauth_consent_revoked_at_idx
+  on auth_oauth_consent (revoked_at);
+
+create table auth_oauth_authorization_code (
+  code_hash text constraint auth_oauth_authorization_code_pkey primary key,
+  client_id text not null,
+  subject text not null,
+  redirect_uri text not null,
+  scopes jsonb not null,
+  code_challenge text,
+  code_challenge_method text,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  consumed_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_authorization_code_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_authorization_code_challenge_method_check
+    check (code_challenge_method is null or code_challenge_method = 'S256')
+);
+create index auth_oauth_authorization_code_client_expires_at_idx
+  on auth_oauth_authorization_code (client_id, expires_at);
+create index auth_oauth_authorization_code_expires_at_idx
+  on auth_oauth_authorization_code (expires_at);
+create index auth_oauth_authorization_code_consumed_at_idx
+  on auth_oauth_authorization_code (consumed_at);
+
+create table auth_oauth_client_secret (
+  prefix text collate "C" not null,
+  client_id text not null,
+  secret_hash text not null,
+  authentication_methods jsonb not null,
+  created_at bigint not null,
+  expires_at bigint,
+  last_used_at bigint,
+  revoked_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_client_secret_pkey primary key (client_id, prefix),
+  constraint auth_oauth_client_secret_authentication_methods_check
+    check (jsonb_typeof(authentication_methods) = 'array' and not jsonb_path_exists(authentication_methods, '$[*] ? (@.type() != "string" || (@ != "client_secret_basic" && @ != "client_secret_post"))'))
+);

package/migrations/postgres/0008_auth_oauth_tokens.sql

@@ -0,0 +1,63 @@
+create table auth_oauth_provider_mode_token (
+  token_hash text constraint auth_oauth_provider_mode_token_pkey primary key,
+  token_type text not null,
+  client_id text not null,
+  subject text not null,
+  scopes jsonb not null,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  issuer text,
+  audience jsonb,
+  jwt_id text,
+  revoked_at bigint,
+  revocation_reason text,
+  rotated_at bigint,
+  replaced_by_token_hash text,
+  metadata jsonb,
+  constraint auth_oauth_provider_mode_token_type_check
+    check (token_type in ('access_token', 'refresh_token')),
+  constraint auth_oauth_provider_mode_token_scopes_check
+    check (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_provider_mode_token_audience_check
+    check (audience is null or jsonb_typeof(audience) = 'string' or (jsonb_typeof(audience) = 'array' and not jsonb_path_exists(audience, '$[*] ? (@.type() != "string")'))),
+  constraint auth_oauth_provider_mode_token_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object')
+);
+create index auth_oauth_provider_mode_token_client_expires_at_idx
+  on auth_oauth_provider_mode_token (client_id, expires_at);
+create index auth_oauth_provider_mode_token_subject_idx
+  on auth_oauth_provider_mode_token (subject);
+create index auth_oauth_provider_mode_token_expires_at_idx
+  on auth_oauth_provider_mode_token (expires_at);
+create index auth_oauth_provider_mode_token_revoked_at_idx
+  on auth_oauth_provider_mode_token (revoked_at);
+create index auth_oauth_provider_mode_token_rotated_at_idx
+  on auth_oauth_provider_mode_token (rotated_at);
+create index auth_oauth_provider_mode_token_jwt_id_idx
+  on auth_oauth_provider_mode_token (jwt_id);
+
+create table auth_oauth_provider_token_vault (
+  account_id text constraint auth_oauth_provider_token_vault_pkey primary key,
+  user_id text not null,
+  provider_id text not null,
+  provider_account_id text not null,
+  access_token_ciphertext text not null,
+  refresh_token_ciphertext text,
+  id_token_ciphertext text,
+  token_type text not null,
+  scopes jsonb,
+  expires_at bigint,
+  updated_at bigint not null,
+  revoked_at bigint,
+  revocation_reason text,
+  constraint auth_oauth_provider_token_vault_scopes_check
+    check (scopes is null or (jsonb_typeof(scopes) = 'array' and not jsonb_path_exists(scopes, '$[*] ? (@.type() != "string")')))
+);
+create index auth_oauth_provider_token_vault_user_id_idx
+  on auth_oauth_provider_token_vault (user_id);
+create index auth_oauth_provider_token_vault_provider_account_idx
+  on auth_oauth_provider_token_vault (provider_id, provider_account_id);
+create index auth_oauth_provider_token_vault_expires_at_idx
+  on auth_oauth_provider_token_vault (expires_at);
+create index auth_oauth_provider_token_vault_revoked_at_idx
+  on auth_oauth_provider_token_vault (revoked_at);

package/migrations/postgres/0009_auth_permissions.sql

@@ -0,0 +1,66 @@
+create table auth_permission_definition (
+  id text collate "C" constraint auth_permission_definition_pkey primary key,
+  description text,
+  scope_type_present boolean not null,
+  scope_type text not null,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  deleted_at bigint
+);
+create index auth_permission_definition_status_idx
+  on auth_permission_definition (disabled_at, deleted_at, id);
+
+create table auth_role_definition (
+  id text constraint auth_role_definition_pkey primary key,
+  description text,
+  created_at bigint not null,
+  updated_at bigint not null,
+  disabled_at bigint,
+  deleted_at bigint
+);
+create index auth_role_definition_status_idx
+  on auth_role_definition (disabled_at, deleted_at, id collate "C");
+
+create table auth_permission_grant (
+  subject_type text not null,
+  subject_id text not null,
+  permission_id text not null,
+  scope_type text not null,
+  scope_id_present boolean not null,
+  scope_id text not null,
+  expires_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  constraint auth_permission_grant_pkey primary key
+    (subject_type, subject_id, permission_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_permission_grant_check_idx
+  on auth_permission_grant (subject_type, subject_id, permission_id, revoked_at, expires_at);
+
+create table auth_role_grant (
+  subject_type text not null,
+  subject_id text not null,
+  role_id text not null,
+  scope_type text not null,
+  scope_id_present boolean not null,
+  scope_id text not null,
+  expires_at bigint,
+  metadata jsonb,
+  revoked_at bigint,
+  constraint auth_role_grant_pkey primary key
+    (subject_type, subject_id, role_id, scope_type, scope_id_present, scope_id)
+);
+create index auth_role_grant_check_idx
+  on auth_role_grant (subject_type, subject_id, role_id, revoked_at, expires_at);
+
+create table auth_role_permission (
+  role_id text not null,
+  permission_id text not null,
+  scope_type_present boolean not null,
+  scope_type text not null,
+  constraint auth_role_permission_pkey primary key
+    (role_id, permission_id, scope_type_present, scope_type)
+);
+create index auth_role_permission_check_idx
+  on auth_role_permission (permission_id, role_id, scope_type_present, scope_type);

package/migrations/postgres/0010_auth_oauth_device_authorization.sql

@@ -0,0 +1,50 @@
+alter table auth_oauth_client
+  drop constraint auth_oauth_client_allowed_grant_types_check;
+
+alter table auth_oauth_client
+  add constraint auth_oauth_client_allowed_grant_types_check
+    check (jsonb_typeof(allowed_grant_types) = 'array' and not jsonb_path_exists(allowed_grant_types, '$[*] ? (@.type() != "string" || (@ != "authorization_code" && @ != "refresh_token" && @ != "client_credentials" && @ != "urn:ietf:params:oauth:grant-type:device_code"))'));
+
+create table auth_oauth_device_authorization (
+  id text constraint auth_oauth_device_authorization_pkey primary key,
+  device_code_hash text not null,
+  user_code_hash text not null,
+  client_id text not null,
+  requested_scopes jsonb not null,
+  granted_scopes jsonb,
+  subject text,
+  status text not null,
+  issued_at bigint not null,
+  expires_at bigint not null,
+  poll_interval_seconds integer not null,
+  next_poll_at bigint not null,
+  last_polled_at bigint,
+  approved_at bigint,
+  denied_at bigint,
+  consumed_at bigint,
+  metadata jsonb,
+  constraint auth_oauth_device_authorization_device_code_hash_key unique (device_code_hash),
+  constraint auth_oauth_device_authorization_user_code_hash_key unique (user_code_hash),
+  constraint auth_oauth_device_authorization_status_check
+    check (status in ('pending', 'approved', 'denied')),
+  constraint auth_oauth_device_authorization_requested_scopes_check
+    check (jsonb_typeof(requested_scopes) = 'array' and not jsonb_path_exists(requested_scopes, '$[*] ? (@.type() != "string")')),
+  constraint auth_oauth_device_authorization_granted_scopes_check
+    check (granted_scopes is null or (jsonb_typeof(granted_scopes) = 'array' and not jsonb_path_exists(granted_scopes, '$[*] ? (@.type() != "string")'))),
+  constraint auth_oauth_device_authorization_metadata_check
+    check (metadata is null or jsonb_typeof(metadata) = 'object'),
+  constraint auth_oauth_device_authorization_poll_interval_check
+    check (poll_interval_seconds > 0),
+  constraint auth_oauth_device_authorization_state_check
+    check (
+      (status = 'pending' and granted_scopes is null and subject is null and approved_at is null and denied_at is null and consumed_at is null)
+      or (status = 'approved' and granted_scopes is not null and subject is not null and approved_at is not null and denied_at is null)
+      or (status = 'denied' and granted_scopes is null and subject is null and approved_at is null and denied_at is not null and consumed_at is null)
+    )
+);
+create index auth_oauth_device_authorization_expires_at_idx
+  on auth_oauth_device_authorization (expires_at);
+create index auth_oauth_device_authorization_client_status_expires_at_idx
+  on auth_oauth_device_authorization (client_id, status, expires_at);
+create index auth_oauth_device_authorization_status_expires_at_idx
+  on auth_oauth_device_authorization (status, expires_at);