@logto/schemas 1.39.0 → 1.40.0

package/lib/types/user-sessions.js

@@ -35,6 +35,27 @@ export const getUserSessionsResponseGuard = z.object({
     sessions: z.array(userExtendedSessionGuard),
 });
 export const getUserSessionResponseGuard = userExtendedSessionGuard;
+/**
+ * Account-API-specific extension of `userExtendedSessionGuard`.
+ *
+ * Adds `isCurrent` so a caller that has its own OIDC session uid (i.e. the Account API)
+ * can mark which entry in the list is the session backing the request. Kept separate
+ * from `userExtendedSessionGuard` because the management/admin endpoints have no
+ * "current session" concept and shouldn't surface this field in their contracts.
+ */
+export const accountUserExtendedSessionGuard = userExtendedSessionGuard.extend({
+    /**
+     * `true` for the entry whose `payload.uid` matches the calling session, `false` for
+     * the others. At most one entry is `true` per response. Zero entries are tagged when
+     * the calling access token has no matching session uid — for example, the caller has
+     * revoked its own session but the token has not yet expired, or the token was issued
+     * from a non-session-backed grant.
+     */
+    isCurrent: z.boolean(),
+});
+export const getAccountUserSessionsResponseGuard = z.object({
+    sessions: z.array(accountUserExtendedSessionGuard),
+});
 export const userApplicationGrantPayloadGuard = z
     .object({
     /** Expiration time of the grant in seconds since the epoch */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.39.0",
+  "version": "1.40.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -65,11 +65,11 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
+    "@logto/connector-kit": "^5.0.1",
+    "@logto/language-kit": "^1.3.0",
     "@logto/core-kit": "^2.9.0",
-    "@logto/connector-kit": "^5.0.0",
+    "@logto/phrases-experience": "^1.13.2",
     "@logto/phrases": "^1.28.0",
-    "@logto/language-kit": "^1.3.0",
-    "@logto/phrases-experience": "^1.13.1",
     "@logto/shared": "^3.4.0"
   },
   "peerDependencies": {

package/tables/account_centers.sql

@@ -11,5 +11,7 @@ create table account_centers (
   delete_account_url varchar(2048),
   /** User-defined custom CSS for the account center */
   custom_css text,
+  /** Ordered list of custom profile fields to show in the prebuilt account center */
+  profile_fields jsonb /* @use AccountCenterProfileFields */,
   primary key (tenant_id, id)
 );

package/tables/application_access_control_org_role_relations.sql

@@ -0,0 +1,16 @@
+/* init_order = 2 */
+
+/** The organization role allow relations for application-level access control. */
+create table application_access_control_org_role_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  organization_id varchar(21) not null
+    references organizations (id) on update cascade on delete cascade,
+  organization_role_id varchar(21) not null
+    references organization_roles (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, organization_id, organization_role_id),
+  constraint application_access_control_org_role_relations__role_type
+    check (check_organization_role_type(organization_role_id, 'User'))
+);

package/tables/application_access_control_organization_relations.sql

@@ -0,0 +1,12 @@
+/* init_order = 2 */
+
+/** The organization membership allow relations for application-level access control. */
+create table application_access_control_organization_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  organization_id varchar(21) not null
+    references organizations (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, organization_id)
+);

package/tables/application_access_control_user_relations.sql

@@ -0,0 +1,12 @@
+/* init_order = 2 */
+
+/** The direct user allow relations for application-level access control. */
+create table application_access_control_user_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  user_id varchar(21) not null
+    references users (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, user_id)
+);

package/tables/application_access_control_user_role_relations.sql

@@ -0,0 +1,14 @@
+/* init_order = 2 */
+
+/** The user role allow relations for application-level access control. */
+create table application_access_control_user_role_relations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  application_id varchar(21) not null
+    references applications (id) on update cascade on delete cascade,
+  role_id varchar(21) not null
+    references roles (id) on update cascade on delete cascade,
+  primary key (tenant_id, application_id, role_id),
+  constraint application_access_control_user_role_relations__role_type
+    check (public.check_role_type(role_id, 'User'))
+);

package/tables/applications.sql

@@ -16,6 +16,7 @@ create table applications (
   protected_app_metadata jsonb /* @use ProtectedAppMetadata */,
   custom_data jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   is_third_party boolean not null default false,
+  app_level_access_control_enabled boolean not null default false,
   created_at timestamptz not null default(now()),
   primary key (id)
 );

package/tables/organization_role_user_relations.sql

@@ -16,3 +16,6 @@ create table organization_role_user_relations (
   constraint organization_role_user_relations__role_type
     check (check_organization_role_type(organization_role_id, 'User'))
 );
+
+create index organization_role_user_relations__tenant_id_org_id_user_id
+  on organization_role_user_relations (tenant_id, organization_id, user_id);

package/tables/organization_user_relations.sql

@@ -13,3 +13,6 @@ create table organization_user_relations (
     foreign key (tenant_id, user_id)
       references users (tenant_id, id) on update cascade on delete cascade
 );
+
+create index organization_user_relations__tenant_id_user_id
+  on organization_user_relations (tenant_id, user_id);

package/tables/sign_in_experiences.sql

@@ -21,6 +21,7 @@ create table sign_in_experiences (
   custom_css text,
   custom_content jsonb /* @use CustomContent */ not null default '{}'::jsonb,
   custom_ui_assets jsonb /* @use CustomUiAssets */,
+  custom_ui_csp jsonb /* @use CustomUiCsp */ not null default '{}'::jsonb,
   password_policy jsonb /* @use PartialPasswordPolicy */ not null default '{}'::jsonb,
   mfa jsonb /* @use Mfa */ not null default '{}'::jsonb,
   adaptive_mfa jsonb /* @use AdaptiveMfa */ not null default '{}'::jsonb,