@logto/schemas 1.21.0 → 1.23.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.21.0",
+  "version": "1.23.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -31,7 +31,7 @@
     "@types/inquirer": "^9.0.0",
     "@types/node": "^20.9.5",
     "@types/pluralize": "^0.0.33",
-    "@vitest/coverage-v8": "^2.0.0",
+    "@vitest/coverage-v8": "^2.1.8",
     "camelcase": "^8.0.0",
     "chalk": "^5.3.0",
     "eslint": "^8.56.0",
@@ -40,7 +40,7 @@
     "prettier": "^3.0.0",
     "roarr": "^7.11.0",
     "typescript": "^5.5.3",
-    "vitest": "^2.0.0"
+    "vitest": "^2.1.8"
   },
   "eslintConfig": {
     "extends": "@silverhand",
@@ -63,14 +63,14 @@
   },
   "prettier": "@silverhand/eslint-config/.prettierrc",
   "dependencies": {
-    "@logto/connector-kit": "^4.0.0",
-    "@logto/core-kit": "^2.5.0",
+    "@logto/connector-kit": "^4.1.0",
+    "@logto/core-kit": "^2.5.2",
     "@logto/language-kit": "^1.1.0",
-    "@logto/phrases": "^1.14.1",
-    "@logto/phrases-experience": "^1.8.0",
+    "@logto/phrases": "^1.16.0",
+    "@logto/phrases-experience": "^1.9.0",
     "@logto/shared": "^3.1.2",
     "@withtyped/server": "^0.14.0",
-    "nanoid": "^5.0.1"
+    "nanoid": "^5.0.9"
   },
   "peerDependencies": {
     "zod": "^3.23.8"

package/tables/account_centers.sql

@@ -0,0 +1,10 @@
+create table account_centers (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  id varchar(21) not null,
+  /** The whole feature can be disabled */
+  enabled boolean not null default false,
+  /** Control each fields */
+  fields jsonb /* @use AccountCenterFieldControl */ not null default '{}'::jsonb,
+  primary key (tenant_id, id)
+);

package/tables/applications.sql

@@ -1,6 +1,6 @@
 /* init_order = 1 */
 
-create type application_type as enum ('Native', 'SPA', 'Traditional', 'MachineToMachine', 'Protected');
+create type application_type as enum ('Native', 'SPA', 'Traditional', 'MachineToMachine', 'Protected', 'SAML');
 
 create table applications (
   tenant_id varchar(21) not null
@@ -17,7 +17,10 @@ create table applications (
   custom_data jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   is_third_party boolean not null default false,
   created_at timestamptz not null default(now()),
-  primary key (id)
+  primary key (id),
+  constraint check_saml_app_third_party_consistency check (
+    type != 'SAML' OR (type = 'SAML' AND is_third_party = true)
+  )
 );
 
 create index applications__id

package/tables/saml_application_configs.sql

@@ -0,0 +1,15 @@
+/* init_order = 2 */
+
+/** The SAML application config and SAML-type application have a one-to-one correspondence: 1. a SAML-type application can only have one SAML application config. (CANNOT use "semicolon" in comments, since it indicates the end of query.) 2. a SAML application config can only configure one SAML-type application. */
+create table saml_application_configs (
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  attribute_mapping jsonb /* @use SamlAttributeMapping */ not null default '{}'::jsonb,
+  entity_id varchar(128),
+  acs_url jsonb /* @use SamlAcsUrl */,
+  primary key (tenant_id, application_id),
+  constraint saml_application_configs__application_type
+    check (check_application_type(application_id, 'SAML'))
+);

package/tables/saml_application_secrets.sql

@@ -0,0 +1,22 @@
+/* init_order = 2 */
+
+create table saml_application_secrets (
+  id varchar(21) not null,
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  private_key text not null,
+  certificate text not null,
+  created_at timestamptz not null default now(),
+  expires_at timestamptz not null,
+  active boolean not null,
+  primary key (tenant_id, application_id, id),
+  constraint saml_application_secrets__application_type
+    check (check_application_type(application_id, 'SAML'))
+);
+
+-- Only one active secret per application
+create unique index saml_application_secrets__unique_active_secret
+  on saml_application_secrets (tenant_id, application_id, active)
+  where active;

package/tables/saml_application_sessions.sql

@@ -0,0 +1,23 @@
+/* init_order = 2 */
+
+create table saml_application_sessions (
+  tenant_id varchar(21) not null 
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the session. */
+  id varchar(32) not null,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  /** The identifier of the SAML SSO auth request ID, SAML request ID is pretty long. */
+  saml_request_id varchar(128) not null,
+  /** The identifier of the OIDC auth request state. */
+  oidc_state varchar(32),
+  /** The relay state of the SAML auth request. */
+  relay_state varchar(256),
+  /** The raw request of the SAML auth request. */
+  raw_auth_request text not null,
+  created_at timestamptz not null default(now()),
+  expires_at timestamptz not null,
+  primary key (tenant_id, id),
+  constraint saml_application_sessions__application_type 
+    check (check_application_type(application_id, 'SAML'))
+);

package/tables/sign_in_experiences.sql

@@ -23,5 +23,8 @@ create table sign_in_experiences (
   password_policy jsonb /* @use PartialPasswordPolicy */ not null default '{}'::jsonb,
   mfa jsonb /* @use Mfa */ not null default '{}'::jsonb,
   single_sign_on_enabled boolean not null default false,
+  support_email text,
+  support_website_url text,
+  unknown_session_redirect_url text,
   primary key (tenant_id, id)
 );

package/tables/sso_connector_idp_initiated_auth_configs.sql

@@ -20,5 +20,5 @@ create table sso_connector_idp_initiated_auth_configs (
   primary key (tenant_id, connector_id),
   /** Insure the application type is Traditional or SPA. */
   constraint application_type
-    check (check_application_type(default_application_id, 'Traditional', 'SPA'))
+    check (check_application_type(default_application_id, 'Traditional', 'SPA', 'SAML'))
 );