@logto/schemas 1.17.0 → 1.18.0

package/alterations/1.18.0-1717567857-social-sign-in-linking.ts

@@ -0,0 +1,18 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences add column social_sign_in jsonb not null default '{}'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences drop column social_sign_in;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1717597875-add-organization-email-domains-table.ts

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table organization_email_domains (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        /** The ID of the organization. */
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        /** The email domain that will be automatically provisioned. */
+        email_domain varchar(128) not null,
+        primary key (tenant_id, organization_id, email_domain)
+      );
+    `);
+    await applyTableRls(pool, 'organization_email_domains');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'organization_email_domains');
+    await pool.query(sql`
+      drop table organization_email_domains
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1717818597-organization-mfa-requirement.ts

@@ -0,0 +1,18 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table organizations add column is_mfa_required boolean not null default false;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table organizations drop column is_mfa_required;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1718340884-rename-org-email-domains-and-add-jit-roles-table.ts

@@ -0,0 +1,56 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table organization_email_domains rename to organization_jit_email_domains;
+      alter table organization_jit_email_domains
+        rename constraint organization_email_domains_organization_id_fkey to organization_jit_email_domains_organization_id_fkey;
+      alter table organization_jit_email_domains
+        rename constraint organization_email_domains_pkey to organization_jit_email_domains_pkey;
+      alter table organization_jit_email_domains
+        rename constraint organization_email_domains_tenant_id_fkey to organization_jit_email_domains_tenant_id_fkey;
+      alter policy organization_email_domains_modification
+        on organization_jit_email_domains rename to organization_jit_email_domains_modification;
+      alter policy organization_email_domains_tenant_id
+        on organization_jit_email_domains rename to organization_jit_email_domains_tenant_id;
+      create table organization_jit_roles (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        /** The ID of the organization. */
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        /** The organization role ID that will be automatically provisioned. */
+        organization_role_id varchar(21) not null
+          references organization_roles (id) on update cascade on delete cascade,
+        primary key (tenant_id, organization_id, organization_role_id)
+      );
+    `);
+    await applyTableRls(pool, 'organization_jit_roles');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'organization_jit_roles');
+    await pool.query(sql`
+      drop table organization_jit_roles
+    `);
+    await pool.query(sql`
+      alter table organization_jit_email_domains rename to organization_email_domains;
+      alter table organization_email_domains
+        rename constraint organization_jit_email_domains_organization_id_fkey to organization_email_domains_organization_id_fkey;
+      alter table organization_email_domains
+        rename constraint organization_jit_email_domains_pkey to organization_email_domains_pkey;
+      alter table organization_email_domains
+        rename constraint organization_jit_email_domains_tenant_id_fkey to organization_email_domains_tenant_id_fkey;
+      alter policy organization_jit_email_domains_modification 
+        on organization_email_domains rename to organization_email_domains_modification;
+      alter policy organization_jit_email_domains_tenant_id
+        on organization_email_domains rename to organization_email_domains_tenant_id;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1718594164-add-agree-to-terms-policy.ts

@@ -0,0 +1,40 @@
+import { yes } from '@silverhand/essentials';
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const isCi = yes(process.env.CI);
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    // Create type
+    await pool.query(sql`
+      create type agree_to_terms_policy as enum ('Automatic', 'ManualRegistrationOnly', 'Manual');
+    `);
+
+    if (isCi) {
+      // Direct set default to 'Automatic' to align with the sql table definition when running CI
+      await pool.query(sql`
+        alter table sign_in_experiences add column agree_to_terms_policy agree_to_terms_policy not null default 'Automatic';
+      `);
+    } else {
+      // For compatibility with existing data, default to 'ManualRegistrationOnly'
+      await pool.query(sql`
+        alter table sign_in_experiences add column agree_to_terms_policy agree_to_terms_policy not null default 'ManualRegistrationOnly';
+      `);
+
+      // For new data, default to 'Automatic'
+      await pool.query(sql`
+        alter table sign_in_experiences alter column agree_to_terms_policy set default 'Automatic';
+      `);
+    }
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences drop column agree_to_terms_policy;
+      drop type agree_to_terms_policy;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1718785576-organization-application-relations.ts

@@ -0,0 +1,37 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create function check_application_type(application_id varchar(21), target_type application_type) returns boolean as
+      $$ begin
+        return (select type from applications where id = application_id) = target_type;
+      end; $$ language plpgsql;
+      create table organization_application_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        primary key (tenant_id, organization_id, application_id),
+        constraint application_type
+          check (check_application_type(application_id, 'MachineToMachine'))
+      );
+    `);
+    await applyTableRls(pool, 'organization_application_relations');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'organization_application_relations');
+    await pool.query(sql`
+      drop table organization_application_relations;
+      drop function check_application_type;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1718786576-organization-jit-sso-connectors.ts

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table organization_jit_sso_connectors (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        /** The ID of the organization. */
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        sso_connector_id varchar(128) not null
+          references sso_connectors (id) on update cascade on delete cascade,
+        primary key (tenant_id, organization_id, sso_connector_id)
+      );
+    `);
+    await applyTableRls(pool, 'organization_jit_sso_connectors');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'organization_jit_sso_connectors');
+    await pool.query(sql`
+      drop table organization_jit_sso_connectors;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1718807616-organization-role-application-relations.ts

@@ -0,0 +1,34 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table organization_role_application_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null,
+        organization_role_id varchar(21) not null
+          references organization_roles (id) on update cascade on delete cascade,
+        application_id varchar(21) not null,
+        primary key (tenant_id, organization_id, organization_role_id, application_id),
+        /** Application's roles in an organization should be synchronized with the application's membership in the organization. */
+        foreign key (tenant_id, organization_id, application_id)
+          references organization_application_relations (tenant_id, organization_id, application_id)
+          on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'organization_role_application_relations');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'organization_role_application_relations');
+    await pool.query(sql`
+      drop table organization_role_application_relations;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1718865814-add-subject-tokens.ts

@@ -0,0 +1,36 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table subject_tokens (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        id varchar(25) not null,
+        context jsonb /* @use JsonObject */ not null default '{}'::jsonb,
+        expires_at timestamptz not null,
+        consumed_at timestamptz,
+        user_id varchar(21) not null
+          references users (id) on update cascade on delete cascade,
+        created_at timestamptz not null default(now()),
+        creator_id varchar(32) not null, /* It is intented to not reference to user or application table */
+        primary key (id)
+      );
+
+      create index subject_token__id on subject_tokens (tenant_id, id);
+    `);
+    await applyTableRls(pool, 'subject_tokens');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'subject_tokens');
+    await pool.query(sql`
+      drop table subject_tokens
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1719014832-organization-role-types.ts

@@ -0,0 +1,35 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table organization_roles
+        add column type role_type not null default 'User';
+      create function check_organization_role_type(role_id varchar(21), target_type role_type) returns boolean as
+        $$ begin
+          return (select type from organization_roles where id = role_id) = target_type;
+        end; $$ language plpgsql;
+      alter table organization_role_user_relations
+        add constraint organization_role_user_relations__role_type
+          check (check_organization_role_type(organization_role_id, 'User'));
+      alter table organization_role_application_relations
+        add constraint organization_role_application_relations__role_type
+          check (check_organization_role_type(organization_role_id, 'MachineToMachine'));
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table organization_role_application_relations
+        drop constraint organization_role_application_relations__role_type;
+      alter table organization_role_user_relations
+        drop constraint organization_role_user_relations__role_type;
+      alter table organization_roles
+        drop column type;
+      drop function check_organization_role_type;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1719221205-fix-functions.ts

@@ -0,0 +1,25 @@
+/**
+ * In Logto Cloud, we have multiple schemas and the default search behavior will be problematic.
+ * This alteration script will fix it by setting the search path to public for the functions.
+ */
+
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter function check_application_type set search_path = public;
+      alter function check_organization_role_type set search_path = public;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter function check_application_type reset search_path;
+      alter function check_organization_role_type reset search_path;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.18.0-1719312694-custom-ui-assets.ts

@@ -0,0 +1,18 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences add column custom_ui_asset_id varchar(21);
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences drop column custom_ui_asset_id;
+    `);
+  },
+};
+
+export default alteration;

package/alterations-js/1.18.0-1717567857-social-sign-in-linking.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1717567857-social-sign-in-linking.js

@@ -0,0 +1,14 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences add column social_sign_in jsonb not null default '{}'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences drop column social_sign_in;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1717597875-add-organization-email-domains-table.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1717597875-add-organization-email-domains-table.js

@@ -0,0 +1,26 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table organization_email_domains (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        /** The ID of the organization. */
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        /** The email domain that will be automatically provisioned. */
+        email_domain varchar(128) not null,
+        primary key (tenant_id, organization_id, email_domain)
+      );
+    `);
+        await applyTableRls(pool, 'organization_email_domains');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'organization_email_domains');
+        await pool.query(sql `
+      drop table organization_email_domains
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1717818597-organization-mfa-requirement.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1717818597-organization-mfa-requirement.js

@@ -0,0 +1,14 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table organizations add column is_mfa_required boolean not null default false;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table organizations drop column is_mfa_required;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1718340884-rename-org-email-domains-and-add-jit-roles-table.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1718340884-rename-org-email-domains-and-add-jit-roles-table.js

@@ -0,0 +1,51 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table organization_email_domains rename to organization_jit_email_domains;
+      alter table organization_jit_email_domains
+        rename constraint organization_email_domains_organization_id_fkey to organization_jit_email_domains_organization_id_fkey;
+      alter table organization_jit_email_domains
+        rename constraint organization_email_domains_pkey to organization_jit_email_domains_pkey;
+      alter table organization_jit_email_domains
+        rename constraint organization_email_domains_tenant_id_fkey to organization_jit_email_domains_tenant_id_fkey;
+      alter policy organization_email_domains_modification
+        on organization_jit_email_domains rename to organization_jit_email_domains_modification;
+      alter policy organization_email_domains_tenant_id
+        on organization_jit_email_domains rename to organization_jit_email_domains_tenant_id;
+      create table organization_jit_roles (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        /** The ID of the organization. */
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        /** The organization role ID that will be automatically provisioned. */
+        organization_role_id varchar(21) not null
+          references organization_roles (id) on update cascade on delete cascade,
+        primary key (tenant_id, organization_id, organization_role_id)
+      );
+    `);
+        await applyTableRls(pool, 'organization_jit_roles');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'organization_jit_roles');
+        await pool.query(sql `
+      drop table organization_jit_roles
+    `);
+        await pool.query(sql `
+      alter table organization_jit_email_domains rename to organization_email_domains;
+      alter table organization_email_domains
+        rename constraint organization_jit_email_domains_organization_id_fkey to organization_email_domains_organization_id_fkey;
+      alter table organization_email_domains
+        rename constraint organization_jit_email_domains_pkey to organization_email_domains_pkey;
+      alter table organization_email_domains
+        rename constraint organization_jit_email_domains_tenant_id_fkey to organization_email_domains_tenant_id_fkey;
+      alter policy organization_jit_email_domains_modification 
+        on organization_email_domains rename to organization_email_domains_modification;
+      alter policy organization_jit_email_domains_tenant_id
+        on organization_email_domains rename to organization_email_domains_tenant_id;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1718594164-add-agree-to-terms-policy.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1718594164-add-agree-to-terms-policy.js

@@ -0,0 +1,34 @@
+import { yes } from '@silverhand/essentials';
+import { sql } from '@silverhand/slonik';
+const isCi = yes(process.env.CI);
+const alteration = {
+    up: async (pool) => {
+        // Create type
+        await pool.query(sql `
+      create type agree_to_terms_policy as enum ('Automatic', 'ManualRegistrationOnly', 'Manual');
+    `);
+        if (isCi) {
+            // Direct set default to 'Automatic' to align with the sql table definition when running CI
+            await pool.query(sql `
+        alter table sign_in_experiences add column agree_to_terms_policy agree_to_terms_policy not null default 'Automatic';
+      `);
+        }
+        else {
+            // For compatibility with existing data, default to 'ManualRegistrationOnly'
+            await pool.query(sql `
+        alter table sign_in_experiences add column agree_to_terms_policy agree_to_terms_policy not null default 'ManualRegistrationOnly';
+      `);
+            // For new data, default to 'Automatic'
+            await pool.query(sql `
+        alter table sign_in_experiences alter column agree_to_terms_policy set default 'Automatic';
+      `);
+        }
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences drop column agree_to_terms_policy;
+      drop type agree_to_terms_policy;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1718785576-organization-application-relations.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1718785576-organization-application-relations.js

@@ -0,0 +1,32 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create function check_application_type(application_id varchar(21), target_type application_type) returns boolean as
+      $$ begin
+        return (select type from applications where id = application_id) = target_type;
+      end; $$ language plpgsql;
+      create table organization_application_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        primary key (tenant_id, organization_id, application_id),
+        constraint application_type
+          check (check_application_type(application_id, 'MachineToMachine'))
+      );
+    `);
+        await applyTableRls(pool, 'organization_application_relations');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'organization_application_relations');
+        await pool.query(sql `
+      drop table organization_application_relations;
+      drop function check_application_type;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1718786576-organization-jit-sso-connectors.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;

package/alterations-js/1.18.0-1718786576-organization-jit-sso-connectors.js

@@ -0,0 +1,26 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table organization_jit_sso_connectors (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        /** The ID of the organization. */
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        sso_connector_id varchar(128) not null
+          references sso_connectors (id) on update cascade on delete cascade,
+        primary key (tenant_id, organization_id, sso_connector_id)
+      );
+    `);
+        await applyTableRls(pool, 'organization_jit_sso_connectors');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'organization_jit_sso_connectors');
+        await pool.query(sql `
+      drop table organization_jit_sso_connectors;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.18.0-1718807616-organization-role-application-relations.d.ts

@@ -0,0 +1,3 @@
+import type { AlterationScript } from '../lib/types/alteration.js';
+declare const alteration: AlterationScript;
+export default alteration;