@logto/schemas 1.38.0 → 1.40.0

package/lib/types/user-sessions.js

@@ -35,6 +35,27 @@ export const getUserSessionsResponseGuard = z.object({
     sessions: z.array(userExtendedSessionGuard),
 });
 export const getUserSessionResponseGuard = userExtendedSessionGuard;
+/**
+ * Account-API-specific extension of `userExtendedSessionGuard`.
+ *
+ * Adds `isCurrent` so a caller that has its own OIDC session uid (i.e. the Account API)
+ * can mark which entry in the list is the session backing the request. Kept separate
+ * from `userExtendedSessionGuard` because the management/admin endpoints have no
+ * "current session" concept and shouldn't surface this field in their contracts.
+ */
+export const accountUserExtendedSessionGuard = userExtendedSessionGuard.extend({
+    /**
+     * `true` for the entry whose `payload.uid` matches the calling session, `false` for
+     * the others. At most one entry is `true` per response. Zero entries are tagged when
+     * the calling access token has no matching session uid — for example, the caller has
+     * revoked its own session but the token has not yet expired, or the token was issued
+     * from a non-session-backed grant.
+     */
+    isCurrent: z.boolean(),
+});
+export const getAccountUserSessionsResponseGuard = z.object({
+    sessions: z.array(accountUserExtendedSessionGuard),
+});
 export const userApplicationGrantPayloadGuard = z
     .object({
     /** Expiration time of the grant in seconds since the epoch */

package/lib/utils/index.d.ts

@@ -2,3 +2,4 @@ export * from './application.js';
 export * from './role.js';
 export * from './management-api.js';
 export * from './domain.js';
+export * from './oidc-private-key.js';

package/lib/utils/index.js

@@ -2,3 +2,4 @@ export * from './application.js';
 export * from './role.js';
 export * from './management-api.js';
 export * from './domain.js';
+export * from './oidc-private-key.js';

package/lib/utils/oidc-private-key.d.ts

@@ -0,0 +1,88 @@
+import type { LogtoOidcConfigType, OidcPrivateKey, SigningKeyRotationState } from '../types/index.js';
+import { OidcSigningKeyStatus } from '../types/index.js';
+export type NormalizedOidcPrivateKey = OidcPrivateKey & {
+    status: OidcSigningKeyStatus;
+};
+/**
+ * Normalize OIDC private signing keys into an explicit status-based model.
+ *
+ * Legacy keys without `status` are interpreted by index order:
+ * the first key becomes `Current` and the second key becomes `Previous`.
+ * The helper also validates that the key set contains exactly one `Current`
+ * and at most one `Next` and `Previous`.
+ */
+export declare const normalizeOidcPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"]) => NormalizedOidcPrivateKey[];
+/**
+ * Return private keys in canonical business order: `Next`, then `Current`, then `Previous`.
+ *
+ * This order is useful when the caller wants a stable persisted view of key lifecycle state.
+ */
+export declare const getCanonicalOidcPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"]) => OidcPrivateKey[];
+/**
+ * Return the currently active signing key from a private-key set.
+ *
+ * This helper reads explicit key status rather than relying on array index.
+ */
+export declare const getCurrentOidcPrivateKey: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"]) => OidcPrivateKey;
+/**
+ * Return private keys in the order expected by `oidc-provider` for signing and JWKS exposure.
+ *
+ * The active `Current` key comes first, followed by `Next`, then `Previous`.
+ */
+export declare const getOidcProviderPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"]) => OidcPrivateKey[];
+/**
+ * Normalize seeded private keys into the explicit status model used by core and CLI.
+ *
+ * Seeding only supports the legacy one-key or two-key layout, so the helper rejects
+ * larger key arrays instead of trying to infer a more complex state machine.
+ */
+export declare const getSeededOidcPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"]) => OidcPrivateKey[];
+/**
+ * Build the persisted private-key state for immediate rotation.
+ *
+ * The new key becomes `Current`, the previous `Current` key becomes `Previous`,
+ * and any older `Previous` key is dropped.
+ */
+export declare const getImmediatelyRotatedOidcPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"], newPrivateKey: OidcPrivateKey) => OidcPrivateKey[];
+/**
+ * Build the persisted private-key state for staged rotation.
+ *
+ * The new key becomes `Next`, the existing `Current` key stays `Current`,
+ * and the existing `Previous` key is preserved when present.
+ */
+export declare const getStagedRotatedOidcPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"], newPrivateKey: OidcPrivateKey) => OidcPrivateKey[];
+/**
+ * Promote a staged `Next` key into `Current` and demote the previous `Current` key into `Previous`.
+ *
+ * If no staged rotation is pending, the helper returns the original key array when it already
+ * uses explicit statuses, or the normalized array when the input is still in legacy form.
+ */
+export declare const rotateOidcPrivateKeyStatuses: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"]) => OidcPrivateKey[];
+/**
+ * Remove a single private key from the canonical key set after delete validation has already passed.
+ *
+ * The helper keeps the remaining keys in canonical status order and does not attempt to infer
+ * new lifecycle transitions beyond dropping the deleted key.
+ */
+export declare const getOidcPrivateKeysAfterDeletion: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"], deletedKeyId: string) => OidcPrivateKey[];
+/**
+ * Trim one or more `Previous` private keys from the end of the normalized key set.
+ *
+ * Only `Previous` keys are trim-able; attempting to trim past the available `Previous`
+ * keys indicates an invalid operation.
+ */
+export declare const getTrimmedOidcPrivateKeys: (privateKeys: LogtoOidcConfigType["oidc.privateKeys"], length: number) => OidcPrivateKey[];
+/**
+ * Build rotation state for immediate tenant cache invalidation.
+ *
+ * This records when a tenant instance should be considered stale so the next reload
+ * can pick up newly written signing key data.
+ */
+export declare const getRotationStateForCacheInvalidation: (currentRotationState: SigningKeyRotationState | undefined, now?: number) => SigningKeyRotationState;
+/**
+ * Build rotation state for staged private-key rotation.
+ *
+ * In addition to immediate tenant invalidation, this records the future activation time
+ * when the staged `Next` key should be promoted to `Current`.
+ */
+export declare const getRotationStateForStagedRotation: (currentRotationState: SigningKeyRotationState | undefined, rotationGracePeriod: number, now?: number) => SigningKeyRotationState;

package/lib/utils/oidc-private-key.js

@@ -0,0 +1,163 @@
+import { OidcSigningKeyStatus } from '../types/index.js';
+const oidcPrivateKeyStatusOrder = {
+    [OidcSigningKeyStatus.Next]: 0,
+    [OidcSigningKeyStatus.Current]: 1,
+    [OidcSigningKeyStatus.Previous]: 2,
+};
+const oidcProviderPrivateKeyOrder = {
+    [OidcSigningKeyStatus.Current]: 0,
+    [OidcSigningKeyStatus.Next]: 1,
+    [OidcSigningKeyStatus.Previous]: 2,
+};
+const sortOidcPrivateKeys = (privateKeys, order) => privateKeys.toSorted((leftKey, rightKey) => order[leftKey.status] - order[rightKey.status]);
+/**
+ * Normalize OIDC private signing keys into an explicit status-based model.
+ *
+ * Legacy keys without `status` are interpreted by index order:
+ * the first key becomes `Current` and the second key becomes `Previous`.
+ * The helper also validates that the key set contains exactly one `Current`
+ * and at most one `Next` and `Previous`.
+ */
+export const normalizeOidcPrivateKeys = (privateKeys) => {
+    const normalizedPrivateKeys = privateKeys.map((privateKey, index) => ({
+        ...privateKey,
+        status: privateKey.status ??
+            (index === 0 ? OidcSigningKeyStatus.Current : OidcSigningKeyStatus.Previous),
+    }));
+    const currentKeys = normalizedPrivateKeys.filter(({ status }) => status === OidcSigningKeyStatus.Current);
+    const nextKeys = normalizedPrivateKeys.filter(({ status }) => status === OidcSigningKeyStatus.Next);
+    const previousKeys = normalizedPrivateKeys.filter(({ status }) => status === OidcSigningKeyStatus.Previous);
+    if (currentKeys.length !== 1 || nextKeys.length > 1 || previousKeys.length > 1) {
+        throw new Error('Malformed OIDC private key status configuration: expected exactly one Current key and at most one Next and Previous key.');
+    }
+    return normalizedPrivateKeys;
+};
+/**
+ * Return private keys in canonical business order: `Next`, then `Current`, then `Previous`.
+ *
+ * This order is useful when the caller wants a stable persisted view of key lifecycle state.
+ */
+export const getCanonicalOidcPrivateKeys = (privateKeys) => sortOidcPrivateKeys(normalizeOidcPrivateKeys(privateKeys), oidcPrivateKeyStatusOrder);
+/**
+ * Return the currently active signing key from a private-key set.
+ *
+ * This helper reads explicit key status rather than relying on array index.
+ */
+export const getCurrentOidcPrivateKey = (privateKeys) => {
+    const currentKey = normalizeOidcPrivateKeys(privateKeys).find(({ status }) => status === OidcSigningKeyStatus.Current);
+    if (!currentKey) {
+        throw new Error('Malformed OIDC private key status configuration: missing Current key.');
+    }
+    return currentKey;
+};
+/**
+ * Return private keys in the order expected by `oidc-provider` for signing and JWKS exposure.
+ *
+ * The active `Current` key comes first, followed by `Next`, then `Previous`.
+ */
+export const getOidcProviderPrivateKeys = (privateKeys) => sortOidcPrivateKeys(normalizeOidcPrivateKeys(privateKeys), oidcProviderPrivateKeyOrder);
+/**
+ * Normalize seeded private keys into the explicit status model used by core and CLI.
+ *
+ * Seeding only supports the legacy one-key or two-key layout, so the helper rejects
+ * larger key arrays instead of trying to infer a more complex state machine.
+ */
+export const getSeededOidcPrivateKeys = (privateKeys) => {
+    if (privateKeys.length > 2) {
+        throw new TypeError('CLI seed supports at most 2 OIDC private keys');
+    }
+    return normalizeOidcPrivateKeys(privateKeys);
+};
+/**
+ * Build the persisted private-key state for immediate rotation.
+ *
+ * The new key becomes `Current`, the previous `Current` key becomes `Previous`,
+ * and any older `Previous` key is dropped.
+ */
+export const getImmediatelyRotatedOidcPrivateKeys = (privateKeys, newPrivateKey) => {
+    const normalizedPrivateKeys = normalizeOidcPrivateKeys(privateKeys);
+    if (normalizedPrivateKeys.some(({ status }) => status === OidcSigningKeyStatus.Next)) {
+        throw new TypeError('Immediate OIDC private key rotation is not allowed when a Next key exists');
+    }
+    const currentKey = getCurrentOidcPrivateKey(normalizedPrivateKeys);
+    return [
+        { ...newPrivateKey, status: OidcSigningKeyStatus.Current },
+        { ...currentKey, status: OidcSigningKeyStatus.Previous },
+    ];
+};
+/**
+ * Build the persisted private-key state for staged rotation.
+ *
+ * The new key becomes `Next`, the existing `Current` key stays `Current`,
+ * and the existing `Previous` key is preserved when present.
+ */
+export const getStagedRotatedOidcPrivateKeys = (privateKeys, newPrivateKey) => {
+    const normalizedPrivateKeys = normalizeOidcPrivateKeys(privateKeys);
+    const currentKey = getCurrentOidcPrivateKey(normalizedPrivateKeys);
+    const previousKey = normalizedPrivateKeys.find(({ status }) => status === OidcSigningKeyStatus.Previous);
+    return [
+        { ...newPrivateKey, status: OidcSigningKeyStatus.Next },
+        { ...currentKey, status: OidcSigningKeyStatus.Current },
+        ...(previousKey ? [{ ...previousKey, status: OidcSigningKeyStatus.Previous }] : []),
+    ];
+};
+/**
+ * Promote a staged `Next` key into `Current` and demote the previous `Current` key into `Previous`.
+ *
+ * If no staged rotation is pending, the helper returns the original key array when it already
+ * uses explicit statuses, or the normalized array when the input is still in legacy form.
+ */
+export const rotateOidcPrivateKeyStatuses = (privateKeys) => {
+    const normalizedPrivateKeys = normalizeOidcPrivateKeys(privateKeys);
+    const nextKey = normalizedPrivateKeys.find(({ status }) => status === OidcSigningKeyStatus.Next);
+    if (!nextKey) {
+        return privateKeys.every(({ status }) => status) ? privateKeys : normalizedPrivateKeys;
+    }
+    const currentKey = getCurrentOidcPrivateKey(normalizedPrivateKeys);
+    return [
+        { ...nextKey, status: OidcSigningKeyStatus.Current },
+        { ...currentKey, status: OidcSigningKeyStatus.Previous },
+    ];
+};
+/**
+ * Remove a single private key from the canonical key set after delete validation has already passed.
+ *
+ * The helper keeps the remaining keys in canonical status order and does not attempt to infer
+ * new lifecycle transitions beyond dropping the deleted key.
+ */
+export const getOidcPrivateKeysAfterDeletion = (privateKeys, deletedKeyId) => getCanonicalOidcPrivateKeys(privateKeys).filter(({ id }) => id !== deletedKeyId);
+/**
+ * Trim one or more `Previous` private keys from the end of the normalized key set.
+ *
+ * Only `Previous` keys are trim-able; attempting to trim past the available `Previous`
+ * keys indicates an invalid operation.
+ */
+export const getTrimmedOidcPrivateKeys = (privateKeys, length) => {
+    const normalizedPrivateKeys = normalizeOidcPrivateKeys(privateKeys);
+    const previousKeys = normalizedPrivateKeys.filter(({ status }) => status === OidcSigningKeyStatus.Previous);
+    if (length > previousKeys.length) {
+        throw new TypeError('Only Previous OIDC private keys can be trimmed');
+    }
+    return getCanonicalOidcPrivateKeys(normalizedPrivateKeys).slice(0, -length);
+};
+/**
+ * Build rotation state for immediate tenant cache invalidation.
+ *
+ * This records when a tenant instance should be considered stale so the next reload
+ * can pick up newly written signing key data.
+ */
+export const getRotationStateForCacheInvalidation = (currentRotationState, now = Date.now()) => ({
+    ...currentRotationState,
+    tenantCacheExpiresAt: now,
+});
+/**
+ * Build rotation state for staged private-key rotation.
+ *
+ * In addition to immediate tenant invalidation, this records the future activation time
+ * when the staged `Next` key should be promoted to `Current`.
+ */
+export const getRotationStateForStagedRotation = (currentRotationState, rotationGracePeriod, now = Date.now()) => ({
+    ...currentRotationState,
+    tenantCacheExpiresAt: now,
+    signingKeyRotationAt: now + rotationGracePeriod * 1000,
+});

package/lib/utils/oidc-private-key.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/utils/oidc-private-key.test.js

@@ -0,0 +1,128 @@
+import { describe, expect, it } from 'vitest';
+import { OidcSigningKeyStatus } from '../types/index.js';
+import { getCanonicalOidcPrivateKeys, getCurrentOidcPrivateKey, getImmediatelyRotatedOidcPrivateKeys, getOidcPrivateKeysAfterDeletion, getOidcProviderPrivateKeys, getRotationStateForCacheInvalidation, getRotationStateForStagedRotation, getSeededOidcPrivateKeys, getStagedRotatedOidcPrivateKeys, getTrimmedOidcPrivateKeys, normalizeOidcPrivateKeys, rotateOidcPrivateKeyStatuses, } from './oidc-private-key.js';
+const createPrivateKey = (id, createdAt, status) => ({
+    id,
+    value: `private-key-${id}`,
+    createdAt,
+    status,
+});
+describe('OIDC private key helpers', () => {
+    it('normalizes legacy private keys without status into Current and Previous', () => {
+        expect(normalizeOidcPrivateKeys([createPrivateKey('current', 1), createPrivateKey('previous', 2)])).toEqual([
+            createPrivateKey('current', 1, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('throws for malformed status configurations', () => {
+        expect(() => normalizeOidcPrivateKeys([
+            createPrivateKey('current-a', 1, OidcSigningKeyStatus.Current),
+            createPrivateKey('current-b', 2, OidcSigningKeyStatus.Current),
+        ])).toThrow('Malformed OIDC private key status configuration');
+    });
+    it('orders private keys in canonical business order', () => {
+        expect(getCanonicalOidcPrivateKeys([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ])).toEqual([
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('orders private keys for oidc-provider consumption', () => {
+        expect(getOidcProviderPrivateKeys([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ])).toEqual([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('finds the current signing key by status', () => {
+        expect(getCurrentOidcPrivateKey([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ])).toEqual(createPrivateKey('current', 2, OidcSigningKeyStatus.Current));
+    });
+    it('assigns statuses to seeded keys', () => {
+        expect(getSeededOidcPrivateKeys([createPrivateKey('current', 2), createPrivateKey('previous', 1)])).toEqual([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('rejects more than two seeded private keys', () => {
+        expect(() => getSeededOidcPrivateKeys([
+            createPrivateKey('current', 3),
+            createPrivateKey('previous-a', 2),
+            createPrivateKey('previous-b', 1),
+        ])).toThrow('CLI seed supports at most 2 OIDC private keys');
+    });
+    it('immediately rotates the new key into Current', () => {
+        expect(getImmediatelyRotatedOidcPrivateKeys([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ], createPrivateKey('new', 3))).toEqual([
+            createPrivateKey('new', 3, OidcSigningKeyStatus.Current),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('stages the new key as Next while preserving Current and Previous', () => {
+        expect(getStagedRotatedOidcPrivateKeys([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ], createPrivateKey('new', 3))).toEqual([
+            createPrivateKey('new', 3, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('promotes Next to Current during activation', () => {
+        expect(rotateOidcPrivateKeyStatuses([
+            createPrivateKey('next', 3, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ])).toEqual([
+            createPrivateKey('next', 3, OidcSigningKeyStatus.Current),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('preserves status order when deleting Previous', () => {
+        expect(getOidcPrivateKeysAfterDeletion([
+            createPrivateKey('next', 3, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ], 'previous')).toEqual([
+            createPrivateKey('next', 3, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+        ]);
+    });
+    it('only trims Previous keys', () => {
+        expect(getTrimmedOidcPrivateKeys([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ], 1)).toEqual([createPrivateKey('current', 2, OidcSigningKeyStatus.Current)]);
+    });
+    it('trims the Previous key even when the input order is not canonical', () => {
+        expect(getTrimmedOidcPrivateKeys([
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+        ], 1)).toEqual([createPrivateKey('current', 2, OidcSigningKeyStatus.Current)]);
+    });
+    it('creates invalidation-only state', () => {
+        expect(getRotationStateForCacheInvalidation({ signingKeyRotationAt: 456 }, 123)).toEqual({
+            tenantCacheExpiresAt: 123,
+            signingKeyRotationAt: 456,
+        });
+    });
+    it('creates staged rotation state with tenant invalidation and activation timestamps', () => {
+        expect(getRotationStateForStagedRotation({ tenantCacheExpiresAt: 1 }, 60, 123)).toEqual({
+            tenantCacheExpiresAt: 123,
+            signingKeyRotationAt: 60_123,
+        });
+    });
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.38.0",
+  "version": "1.40.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -65,12 +65,12 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
+    "@logto/connector-kit": "^5.0.1",
     "@logto/language-kit": "^1.3.0",
-    "@logto/core-kit": "^2.8.0",
-    "@logto/phrases": "^1.27.0",
-    "@logto/shared": "^3.3.1",
-    "@logto/connector-kit": "^5.0.0",
-    "@logto/phrases-experience": "^1.13.0"
+    "@logto/core-kit": "^2.9.0",
+    "@logto/phrases-experience": "^1.13.2",
+    "@logto/phrases": "^1.28.0",
+    "@logto/shared": "^3.4.0"
   },
   "peerDependencies": {
     "zod": "3.24.3"

package/tables/account_centers.sql

@@ -7,5 +7,11 @@ create table account_centers (
   /** Control each fields */
   fields jsonb /* @use AccountCenterFieldControl */ not null default '{}'::jsonb,
   webauthn_related_origins jsonb /* @use WebauthnRelatedOrigins */ not null default '[]'::jsonb,
+  /** URL for custom account deletion endpoint */
+  delete_account_url varchar(2048),
+  /** User-defined custom CSS for the account center */
+  custom_css text,
+  /** Ordered list of custom profile fields to show in the prebuilt account center */
+  profile_fields jsonb /* @use AccountCenterProfileFields */,
   primary key (tenant_id, id)
 );

package/tables/application_access_control_org_role_relations.sql

@@ -0,0 +1,16 @@
+/* init_order = 2 */
+
+/** The organization role allow relations for application-level access control. */
+create table application_access_control_org_role_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  organization_id varchar(21) not null
+    references organizations (id) on update cascade on delete cascade,
+  organization_role_id varchar(21) not null
+    references organization_roles (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, organization_id, organization_role_id),
+  constraint application_access_control_org_role_relations__role_type
+    check (check_organization_role_type(organization_role_id, 'User'))
+);

package/tables/application_access_control_organization_relations.sql

@@ -0,0 +1,12 @@
+/* init_order = 2 */
+
+/** The organization membership allow relations for application-level access control. */
+create table application_access_control_organization_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  organization_id varchar(21) not null
+    references organizations (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, organization_id)
+);

package/tables/application_access_control_user_relations.sql

@@ -0,0 +1,12 @@
+/* init_order = 2 */
+
+/** The direct user allow relations for application-level access control. */
+create table application_access_control_user_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  user_id varchar(21) not null
+    references users (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, user_id)
+);

package/tables/application_access_control_user_role_relations.sql

@@ -0,0 +1,14 @@
+/* init_order = 2 */
+
+/** The user role allow relations for application-level access control. */
+create table application_access_control_user_role_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  role_id varchar(21) not null
+    references roles (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, role_id),
+  constraint application_access_control_user_role_relations__role_type
+    check (public.check_role_type(role_id, 'User'))
+);

package/tables/applications.sql

@@ -16,6 +16,7 @@ create table applications (
   protected_app_metadata jsonb /* @use ProtectedAppMetadata */,
   custom_data jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   is_third_party boolean not null default false,
+  app_level_access_control_enabled boolean not null default false,
   created_at timestamptz not null default(now()),
   primary key (id)
 );

package/tables/organization_role_user_relations.sql

@@ -16,3 +16,6 @@ create table organization_role_user_relations (
   constraint organization_role_user_relations__role_type
     check (check_organization_role_type(organization_role_id, 'User'))
 );
+
+create index organization_role_user_relations__tenant_id_org_id_user_id
+  on organization_role_user_relations (tenant_id, organization_id, user_id);

package/tables/organization_user_relations.sql

@@ -13,3 +13,6 @@ create table organization_user_relations (
     foreign key (tenant_id, user_id)
       references users (tenant_id, id) on update cascade on delete cascade
 );
+
+create index organization_user_relations__tenant_id_user_id
+  on organization_user_relations (tenant_id, user_id);

package/tables/sign_in_experiences.sql

@@ -21,6 +21,7 @@ create table sign_in_experiences (
   custom_css text,
   custom_content jsonb /* @use CustomContent */ not null default '{}'::jsonb,
   custom_ui_assets jsonb /* @use CustomUiAssets */,
+  custom_ui_csp jsonb /* @use CustomUiCsp */ not null default '{}'::jsonb,
   password_policy jsonb /* @use PartialPasswordPolicy */ not null default '{}'::jsonb,
   mfa jsonb /* @use Mfa */ not null default '{}'::jsonb,
   adaptive_mfa jsonb /* @use AdaptiveMfa */ not null default '{}'::jsonb,
@@ -33,5 +34,7 @@ create table sign_in_experiences (
   email_blocklist_policy jsonb /* @use EmailBlocklistPolicy */ not null default '{}'::jsonb,
   forgot_password_methods jsonb /* @use ForgotPasswordMethods */ default '[]'::jsonb,
   passkey_sign_in jsonb /* @use PasskeySignIn */ not null default '{}'::jsonb,
+  /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
+  sign_up_profile_fields jsonb /* @use SignUpProfileFields */,
   primary key (tenant_id, id)
 );