@logto/schemas 1.39.0 → 1.40.0

package/alterations/1.40.0-1776516232-add-account-center-profile-fields.ts

@@ -0,0 +1,20 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table account_centers
+        add column profile_fields jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table account_centers
+        drop column profile_fields;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.40.0-1778318116-add-custom-ui-csp-to-sie.ts

@@ -0,0 +1,20 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        add column custom_ui_csp jsonb not null default '{}'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        drop column custom_ui_csp;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.40.0-1778500000-add-organization-user-relations-user-id-index.ts

@@ -0,0 +1,41 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    /**
+     * Secondary index for `user_id` lookups; the PK `(tenant_id, organization_id, user_id)`
+     * cannot serve queries that filter by `tenant_id` and `user_id` alone.
+     *
+     * Built `concurrently` to avoid the write-blocking `SHARE` lock that a plain
+     * `create index` holds on the table for the duration of the build. The table is hot
+     * on every sign-in, so a multi-second lock on a large tenant translates directly
+     * into request stalls. `if not exists` keeps the migration idempotent if a later
+     * step in the transaction fails and the alteration needs to be re-run.
+     */
+    await pool.query(sql`
+      create index concurrently if not exists organization_user_relations__tenant_id_user_id
+        on organization_user_relations (tenant_id, user_id);
+    `);
+  },
+  up: async () => {
+    /**
+     * The index must be created outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+     */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists organization_user_relations__tenant_id_user_id;
+    `);
+  },
+  down: async () => {
+    /**
+     * The index must be dropped outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+     */
+  },
+};
+
+export default alteration;

package/alterations/1.40.0-1778500001-add-organization-role-user-relations-org-user-index.ts

@@ -0,0 +1,43 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    /**
+     * Secondary index for `(organization_id, user_id)` lookups; the PK
+     * `(tenant_id, organization_id, organization_role_id, user_id)` cannot serve
+     * queries that skip `organization_role_id`.
+     *
+     * Built `concurrently` to avoid the write-blocking `SHARE` lock that a plain
+     * `create index` holds on the table for the duration of the build. The table is
+     * hot on every authorization decision through `getUserScopes`, so a multi-second
+     * lock on a large tenant translates directly into request stalls. `if not exists`
+     * keeps the migration idempotent if a later step in the transaction fails and the
+     * alteration needs to be re-run.
+     */
+    await pool.query(sql`
+      create index concurrently if not exists organization_role_user_relations__tenant_id_org_id_user_id
+        on organization_role_user_relations (tenant_id, organization_id, user_id);
+    `);
+  },
+  up: async () => {
+    /**
+     * The index must be created outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+     */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists organization_role_user_relations__tenant_id_org_id_user_id;
+    `);
+  },
+  down: async () => {
+    /**
+     * The index must be dropped outside of a transaction to avoid table locks.
+     * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+     */
+  },
+};
+
+export default alteration;

package/alterations/1.40.0-1779421396-add-application-access-control-schema.ts

@@ -0,0 +1,90 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const accessControlRelationTables = Object.freeze([
+  'application_access_control_user_relations',
+  'application_access_control_user_role_relations',
+  'application_access_control_organization_relations',
+  'application_access_control_org_role_relations',
+]);
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table applications
+        add column app_level_access_control_enabled boolean not null default false;
+
+      create table application_access_control_user_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        user_id varchar(21) not null
+          references users (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, user_id)
+      );
+
+      create table application_access_control_user_role_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        role_id varchar(21) not null
+          references roles (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, role_id),
+        constraint application_access_control_user_role_relations__role_type
+          check (public.check_role_type(role_id, 'User'))
+      );
+
+      create table application_access_control_organization_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, organization_id)
+      );
+
+      create table application_access_control_org_role_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        organization_role_id varchar(21) not null
+          references organization_roles (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, organization_id, organization_role_id),
+        constraint application_access_control_org_role_relations__role_type
+          check (check_organization_role_type(organization_role_id, 'User'))
+      );
+    `);
+
+    for (const table of accessControlRelationTables) {
+      // eslint-disable-next-line no-await-in-loop
+      await applyTableRls(pool, table);
+    }
+  },
+  down: async (pool) => {
+    for (const table of accessControlRelationTables) {
+      // eslint-disable-next-line no-await-in-loop
+      await dropTableRls(pool, table);
+    }
+
+    await pool.query(sql`
+      drop table application_access_control_org_role_relations;
+      drop table application_access_control_organization_relations;
+      drop table application_access_control_user_role_relations;
+      drop table application_access_control_user_relations;
+
+      alter table applications
+        drop column app_level_access_control_enabled;
+    `);
+  },
+};
+
+export default alteration;

package/alterations-js/1.40.0-1776516232-add-account-center-profile-fields.js

@@ -0,0 +1,16 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table account_centers
+        add column profile_fields jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table account_centers
+        drop column profile_fields;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.40.0-1778318116-add-custom-ui-csp-to-sie.js

@@ -0,0 +1,16 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        add column custom_ui_csp jsonb not null default '{}'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        drop column custom_ui_csp;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.40.0-1778500000-add-organization-user-relations-user-id-index.js

@@ -0,0 +1,37 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        /**
+         * Secondary index for `user_id` lookups; the PK `(tenant_id, organization_id, user_id)`
+         * cannot serve queries that filter by `tenant_id` and `user_id` alone.
+         *
+         * Built `concurrently` to avoid the write-blocking `SHARE` lock that a plain
+         * `create index` holds on the table for the duration of the build. The table is hot
+         * on every sign-in, so a multi-second lock on a large tenant translates directly
+         * into request stalls. `if not exists` keeps the migration idempotent if a later
+         * step in the transaction fails and the alteration needs to be re-run.
+         */
+        await pool.query(sql `
+      create index concurrently if not exists organization_user_relations__tenant_id_user_id
+        on organization_user_relations (tenant_id, user_id);
+    `);
+    },
+    up: async () => {
+        /**
+         * The index must be created outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+         */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists organization_user_relations__tenant_id_user_id;
+    `);
+    },
+    down: async () => {
+        /**
+         * The index must be dropped outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+         */
+    },
+};
+export default alteration;

package/alterations-js/1.40.0-1778500001-add-organization-role-user-relations-org-user-index.js

@@ -0,0 +1,39 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        /**
+         * Secondary index for `(organization_id, user_id)` lookups; the PK
+         * `(tenant_id, organization_id, organization_role_id, user_id)` cannot serve
+         * queries that skip `organization_role_id`.
+         *
+         * Built `concurrently` to avoid the write-blocking `SHARE` lock that a plain
+         * `create index` holds on the table for the duration of the build. The table is
+         * hot on every authorization decision through `getUserScopes`, so a multi-second
+         * lock on a large tenant translates directly into request stalls. `if not exists`
+         * keeps the migration idempotent if a later step in the transaction fails and the
+         * alteration needs to be re-run.
+         */
+        await pool.query(sql `
+      create index concurrently if not exists organization_role_user_relations__tenant_id_org_id_user_id
+        on organization_role_user_relations (tenant_id, organization_id, user_id);
+    `);
+    },
+    up: async () => {
+        /**
+         * The index must be created outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty.
+         */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists organization_role_user_relations__tenant_id_org_id_user_id;
+    `);
+    },
+    down: async () => {
+        /**
+         * The index must be dropped outside of a transaction to avoid table locks.
+         * 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty.
+         */
+    },
+};
+export default alteration;

package/alterations-js/1.40.0-1779421396-add-application-access-control-schema.js

@@ -0,0 +1,82 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const accessControlRelationTables = Object.freeze([
+    'application_access_control_user_relations',
+    'application_access_control_user_role_relations',
+    'application_access_control_organization_relations',
+    'application_access_control_org_role_relations',
+]);
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table applications
+        add column app_level_access_control_enabled boolean not null default false;
+
+      create table application_access_control_user_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        user_id varchar(21) not null
+          references users (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, user_id)
+      );
+
+      create table application_access_control_user_role_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        role_id varchar(21) not null
+          references roles (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, role_id),
+        constraint application_access_control_user_role_relations__role_type
+          check (public.check_role_type(role_id, 'User'))
+      );
+
+      create table application_access_control_organization_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, organization_id)
+      );
+
+      create table application_access_control_org_role_relations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        application_id varchar(21) not null
+          references applications (id) on update cascade on delete cascade,
+        organization_id varchar(21) not null
+          references organizations (id) on update cascade on delete cascade,
+        organization_role_id varchar(21) not null
+          references organization_roles (id) on update cascade on delete cascade,
+        primary key (tenant_id, application_id, organization_id, organization_role_id),
+        constraint application_access_control_org_role_relations__role_type
+          check (check_organization_role_type(organization_role_id, 'User'))
+      );
+    `);
+        for (const table of accessControlRelationTables) {
+            // eslint-disable-next-line no-await-in-loop
+            await applyTableRls(pool, table);
+        }
+    },
+    down: async (pool) => {
+        for (const table of accessControlRelationTables) {
+            // eslint-disable-next-line no-await-in-loop
+            await dropTableRls(pool, table);
+        }
+        await pool.query(sql `
+      drop table application_access_control_org_role_relations;
+      drop table application_access_control_organization_relations;
+      drop table application_access_control_user_role_relations;
+      drop table application_access_control_user_relations;
+
+      alter table applications
+        drop column app_level_access_control_enabled;
+    `);
+    },
+};
+export default alteration;

package/lib/consts/application.d.ts

@@ -0,0 +1 @@
+export declare const defaultApplicationSecretName = "Default secret";

package/lib/consts/application.js

@@ -0,0 +1 @@
+export const defaultApplicationSecretName = 'Default secret';

package/lib/consts/index.d.ts

@@ -7,3 +7,4 @@ export * from './subscriptions.js';
 export * from './experience.js';
 export * from './sentinel.js';
 export * from './product-event.js';
+export * from './application.js';

package/lib/consts/index.js

@@ -7,3 +7,4 @@ export * from './subscriptions.js';
 export * from './experience.js';
 export * from './sentinel.js';
 export * from './product-event.js';
+export * from './application.js';

package/lib/db-entries/account-center.d.ts

@@ -1,4 +1,4 @@
-import { AccountCenterFieldControl, WebauthnRelatedOrigins, GeneratedSchema } from './../foundations/index.js';
+import { AccountCenterFieldControl, WebauthnRelatedOrigins, AccountCenterProfileFields, GeneratedSchema } from './../foundations/index.js';
 /**
  *
  * @remarks This is a type for database creation.
@@ -16,6 +16,8 @@ export type CreateAccountCenter = {
     deleteAccountUrl?: string | null;
     /** User-defined custom CSS for the account center */
     customCss?: string | null;
+    /** Ordered list of custom profile fields to show in the prebuilt account center */
+    profileFields?: AccountCenterProfileFields | null;
 };
 export type AccountCenter = {
     tenantId: string;
@@ -29,6 +31,8 @@ export type AccountCenter = {
     deleteAccountUrl: string | null;
     /** User-defined custom CSS for the account center */
     customCss: string | null;
+    /** Ordered list of custom profile fields to show in the prebuilt account center */
+    profileFields: AccountCenterProfileFields | null;
 };
-export type AccountCenterKeys = 'tenantId' | 'id' | 'enabled' | 'fields' | 'webauthnRelatedOrigins' | 'deleteAccountUrl' | 'customCss';
+export type AccountCenterKeys = 'tenantId' | 'id' | 'enabled' | 'fields' | 'webauthnRelatedOrigins' | 'deleteAccountUrl' | 'customCss' | 'profileFields';
 export declare const AccountCenters: GeneratedSchema<AccountCenterKeys, CreateAccountCenter, AccountCenter, 'account_centers', 'account_center'>;

package/lib/db-entries/account-center.js

@@ -1,6 +1,6 @@
 // THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
 import { z } from 'zod';
-import { accountCenterFieldControlGuard, webauthnRelatedOriginsGuard } from './../foundations/index.js';
+import { accountCenterFieldControlGuard, webauthnRelatedOriginsGuard, accountCenterProfileFieldsGuard } from './../foundations/index.js';
 const createGuard = z.object({
     tenantId: z.string().max(21).optional(),
     id: z.string().min(1).max(21),
@@ -9,6 +9,7 @@ const createGuard = z.object({
     webauthnRelatedOrigins: webauthnRelatedOriginsGuard.optional(),
     deleteAccountUrl: z.string().max(2048).nullable().optional(),
     customCss: z.string().nullable().optional(),
+    profileFields: accountCenterProfileFieldsGuard.nullable().optional(),
 });
 const guard = z.object({
     tenantId: z.string().max(21),
@@ -18,6 +19,7 @@ const guard = z.object({
     webauthnRelatedOrigins: webauthnRelatedOriginsGuard,
     deleteAccountUrl: z.string().max(2048).nullable(),
     customCss: z.string().nullable(),
+    profileFields: accountCenterProfileFieldsGuard.nullable(),
 });
 export const AccountCenters = Object.freeze({
     table: 'account_centers',
@@ -30,6 +32,7 @@ export const AccountCenters = Object.freeze({
         webauthnRelatedOrigins: 'webauthn_related_origins',
         deleteAccountUrl: 'delete_account_url',
         customCss: 'custom_css',
+        profileFields: 'profile_fields',
     },
     fieldKeys: [
         'tenantId',
@@ -39,6 +42,7 @@ export const AccountCenters = Object.freeze({
         'webauthnRelatedOrigins',
         'deleteAccountUrl',
         'customCss',
+        'profileFields',
     ],
     createGuard,
     guard,

package/lib/db-entries/application-access-control-org-role-relation.d.ts

@@ -0,0 +1,22 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization role allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlOrgRoleRelation} for the original type.
+ */
+export type CreateApplicationAccessControlOrgRoleRelation = {
+    tenantId?: string;
+    applicationId: string;
+    organizationId: string;
+    organizationRoleId: string;
+};
+/** The organization role allow relations for application-level access control. */
+export type ApplicationAccessControlOrgRoleRelation = {
+    tenantId: string;
+    applicationId: string;
+    organizationId: string;
+    organizationRoleId: string;
+};
+export type ApplicationAccessControlOrgRoleRelationKeys = 'tenantId' | 'applicationId' | 'organizationId' | 'organizationRoleId';
+export declare const ApplicationAccessControlOrgRoleRelations: GeneratedSchema<ApplicationAccessControlOrgRoleRelationKeys, CreateApplicationAccessControlOrgRoleRelation, ApplicationAccessControlOrgRoleRelation, 'application_access_control_org_role_relations', 'application_access_control_org_role_relation'>;

package/lib/db-entries/application-access-control-org-role-relation.js

@@ -0,0 +1,33 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+    organizationRoleId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+    organizationRoleId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlOrgRoleRelations = Object.freeze({
+    table: 'application_access_control_org_role_relations',
+    tableSingular: 'application_access_control_org_role_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        organizationId: 'organization_id',
+        organizationRoleId: 'organization_role_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'organizationId',
+        'organizationRoleId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application-access-control-organization-relation.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The organization membership allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlOrganizationRelation} for the original type.
+ */
+export type CreateApplicationAccessControlOrganizationRelation = {
+    tenantId?: string;
+    applicationId: string;
+    organizationId: string;
+};
+/** The organization membership allow relations for application-level access control. */
+export type ApplicationAccessControlOrganizationRelation = {
+    tenantId: string;
+    applicationId: string;
+    organizationId: string;
+};
+export type ApplicationAccessControlOrganizationRelationKeys = 'tenantId' | 'applicationId' | 'organizationId';
+export declare const ApplicationAccessControlOrganizationRelations: GeneratedSchema<ApplicationAccessControlOrganizationRelationKeys, CreateApplicationAccessControlOrganizationRelation, ApplicationAccessControlOrganizationRelation, 'application_access_control_organization_relations', 'application_access_control_organization_relation'>;

package/lib/db-entries/application-access-control-organization-relation.js

@@ -0,0 +1,29 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    organizationId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlOrganizationRelations = Object.freeze({
+    table: 'application_access_control_organization_relations',
+    tableSingular: 'application_access_control_organization_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        organizationId: 'organization_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'organizationId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});

package/lib/db-entries/application-access-control-user-relation.d.ts

@@ -0,0 +1,20 @@
+import { GeneratedSchema } from './../foundations/index.js';
+/**
+ * The direct user allow relations for application-level access control.
+ *
+ * @remarks This is a type for database creation.
+ * @see {@link ApplicationAccessControlUserRelation} for the original type.
+ */
+export type CreateApplicationAccessControlUserRelation = {
+    tenantId?: string;
+    applicationId: string;
+    userId: string;
+};
+/** The direct user allow relations for application-level access control. */
+export type ApplicationAccessControlUserRelation = {
+    tenantId: string;
+    applicationId: string;
+    userId: string;
+};
+export type ApplicationAccessControlUserRelationKeys = 'tenantId' | 'applicationId' | 'userId';
+export declare const ApplicationAccessControlUserRelations: GeneratedSchema<ApplicationAccessControlUserRelationKeys, CreateApplicationAccessControlUserRelation, ApplicationAccessControlUserRelation, 'application_access_control_user_relations', 'application_access_control_user_relation'>;

package/lib/db-entries/application-access-control-user-relation.js

@@ -0,0 +1,29 @@
+// THIS IS AN AUTOGENERATED FILE. DO NOT EDIT THIS FILE DIRECTLY.
+import { z } from 'zod';
+const createGuard = z.object({
+    tenantId: z.string().max(21).optional(),
+    applicationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+const guard = z.object({
+    tenantId: z.string().max(21),
+    applicationId: z.string().min(1).max(21),
+    userId: z.string().min(1).max(21),
+});
+export const ApplicationAccessControlUserRelations = Object.freeze({
+    table: 'application_access_control_user_relations',
+    tableSingular: 'application_access_control_user_relation',
+    fields: {
+        tenantId: 'tenant_id',
+        applicationId: 'application_id',
+        userId: 'user_id',
+    },
+    fieldKeys: [
+        'tenantId',
+        'applicationId',
+        'userId',
+    ],
+    createGuard,
+    guard,
+    updateGuard: guard.partial(),
+});