@logto/schemas 1.40.0 → 1.41.0

package/alterations/1.41.0-1779864280-add-password-expiration-policy.ts

@@ -0,0 +1,23 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table users
+        add column password_updated_at timestamptz;
+
+      alter table sign_in_experiences
+        add column password_expiration jsonb not null default '{}'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table users drop column password_updated_at;
+      alter table sign_in_experiences drop column password_expiration;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1779864281-add-is-password-expired-to-users.ts

@@ -0,0 +1,18 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table users add column is_password_expired boolean not null default false;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table users drop column is_password_expired;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1780358400-drop-oidc-model-instances-legacy-grant-id-index.ts

@@ -0,0 +1,25 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists oidc_model_instances__model_name_payload_grant_id;
+    `);
+  },
+  up: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      create index concurrently if not exists oidc_model_instances__model_name_payload_grant_id
+        on oidc_model_instances (tenant_id, model_name, (payload->>'grantId'));
+    `);
+  },
+  down: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1780381219-add-username-policy.ts

@@ -0,0 +1,41 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  // `create index concurrently` cannot run in a transaction; the runner wraps up/down in one.
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      create index concurrently users__tenant_lower_username
+        on users (tenant_id, lower(username))
+        where username is not null;
+    `);
+  },
+  up: async (pool) => {
+    // The default must be inlined: DDL cannot use bound parameters.
+    await pool.query(sql`
+      alter table sign_in_experiences
+        add column username_policy jsonb not null default '{
+          "caseSensitive": true,
+          "minLength": 1,
+          "maxLength": 128,
+          "allowedChars": {
+            "lowercase": true,
+            "uppercase": true,
+            "numbers": true,
+            "underscore": true
+          }
+        }'::jsonb;
+    `);
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`drop index concurrently users__tenant_lower_username;`);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences drop column username_policy;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1780643665-set-sign-up-profile-fields-default.ts

@@ -0,0 +1,20 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        alter column sign_up_profile_fields set default '[]'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        alter column sign_up_profile_fields drop default;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1780906060-add-verification-code-policy.ts

@@ -0,0 +1,19 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences
+        add column if not exists verification_code_policy jsonb not null default '{}'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table sign_in_experiences drop column if exists verification_code_policy;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1781689400-add-sentinel-activities-created-at-index.ts

@@ -0,0 +1,25 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      create index concurrently if not exists sentinel_activities__created_at
+        on sentinel_activities (created_at);
+    `);
+  },
+  up: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists sentinel_activities__created_at;
+    `);
+  },
+  down: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1782354362-set-admin-account-center-profile-fields.ts

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const adminTenantId = 'admin';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      update account_centers
+      set profile_fields = '[{"name": "name"}, {"name": "avatar"}]'::jsonb
+      where tenant_id = ${adminTenantId}
+        and id = 'default'
+        and profile_fields is null
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      update account_centers
+      set profile_fields = null
+      where tenant_id = ${adminTenantId}
+        and id = 'default'
+        and profile_fields = '[{"name": "name"}, {"name": "avatar"}]'::jsonb
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.41.0-1782375106-cover-service-logs-tenant-type-index-with-created-at.ts

@@ -0,0 +1,36 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Cover the windowed hosted-email usage count (`where tenant_id=? and type=? and created_at>=?`) by
+    // adding `created_at` to the existing `(tenant_id, type)` index, then drop the now-redundant
+    // 2-column index (a left-prefix subset of the new one). `concurrently` keeps the write path
+    // unlocked — this unbounded table is written on every send.
+    await pool.query(sql`
+      create index concurrently if not exists service_logs__tenant_id__type__created_at
+        on service_logs (tenant_id, type, created_at);
+    `);
+    await pool.query(sql`
+      drop index concurrently if exists service_logs__tenant_id__type;
+    `);
+  },
+  up: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      create index concurrently if not exists service_logs__tenant_id__type
+        on service_logs (tenant_id, type);
+    `);
+    await pool.query(sql`
+      drop index concurrently if exists service_logs__tenant_id__type__created_at;
+    `);
+  },
+  down: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+};
+
+export default alteration;

package/alterations-js/1.41.0-1779864280-add-password-expiration-policy.js

@@ -0,0 +1,19 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table users
+        add column password_updated_at timestamptz;
+
+      alter table sign_in_experiences
+        add column password_expiration jsonb not null default '{}'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table users drop column password_updated_at;
+      alter table sign_in_experiences drop column password_expiration;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1779864281-add-is-password-expired-to-users.js

@@ -0,0 +1,14 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table users add column is_password_expired boolean not null default false;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table users drop column is_password_expired;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1780358400-drop-oidc-model-instances-legacy-grant-id-index.js

@@ -0,0 +1,21 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists oidc_model_instances__model_name_payload_grant_id;
+    `);
+    },
+    up: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      create index concurrently if not exists oidc_model_instances__model_name_payload_grant_id
+        on oidc_model_instances (tenant_id, model_name, (payload->>'grantId'));
+    `);
+    },
+    down: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1780381219-add-username-policy.js

@@ -0,0 +1,37 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    // `create index concurrently` cannot run in a transaction; the runner wraps up/down in one.
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      create index concurrently users__tenant_lower_username
+        on users (tenant_id, lower(username))
+        where username is not null;
+    `);
+    },
+    up: async (pool) => {
+        // The default must be inlined: DDL cannot use bound parameters.
+        await pool.query(sql `
+      alter table sign_in_experiences
+        add column username_policy jsonb not null default '{
+          "caseSensitive": true,
+          "minLength": 1,
+          "maxLength": 128,
+          "allowedChars": {
+            "lowercase": true,
+            "uppercase": true,
+            "numbers": true,
+            "underscore": true
+          }
+        }'::jsonb;
+    `);
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `drop index concurrently users__tenant_lower_username;`);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences drop column username_policy;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1780643665-set-sign-up-profile-fields-default.js

@@ -0,0 +1,16 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        alter column sign_up_profile_fields set default '[]'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        alter column sign_up_profile_fields drop default;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1780906060-add-verification-code-policy.js

@@ -0,0 +1,15 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences
+        add column if not exists verification_code_policy jsonb not null default '{}'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table sign_in_experiences drop column if exists verification_code_policy;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1781689400-add-sentinel-activities-created-at-index.js

@@ -0,0 +1,21 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        await pool.query(sql `
+      create index concurrently if not exists sentinel_activities__created_at
+        on sentinel_activities (created_at);
+    `);
+    },
+    up: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists sentinel_activities__created_at;
+    `);
+    },
+    down: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1782354362-set-admin-account-center-profile-fields.js

@@ -0,0 +1,23 @@
+import { sql } from '@silverhand/slonik';
+const adminTenantId = 'admin';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      update account_centers
+      set profile_fields = '[{"name": "name"}, {"name": "avatar"}]'::jsonb
+      where tenant_id = ${adminTenantId}
+        and id = 'default'
+        and profile_fields is null
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      update account_centers
+      set profile_fields = null
+      where tenant_id = ${adminTenantId}
+        and id = 'default'
+        and profile_fields = '[{"name": "name"}, {"name": "avatar"}]'::jsonb
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.41.0-1782375106-cover-service-logs-tenant-type-index-with-created-at.js

@@ -0,0 +1,32 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Cover the windowed hosted-email usage count (`where tenant_id=? and type=? and created_at>=?`) by
+        // adding `created_at` to the existing `(tenant_id, type)` index, then drop the now-redundant
+        // 2-column index (a left-prefix subset of the new one). `concurrently` keeps the write path
+        // unlocked — this unbounded table is written on every send.
+        await pool.query(sql `
+      create index concurrently if not exists service_logs__tenant_id__type__created_at
+        on service_logs (tenant_id, type, created_at);
+    `);
+        await pool.query(sql `
+      drop index concurrently if exists service_logs__tenant_id__type;
+    `);
+    },
+    up: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      create index concurrently if not exists service_logs__tenant_id__type
+        on service_logs (tenant_id, type);
+    `);
+        await pool.query(sql `
+      drop index concurrently if exists service_logs__tenant_id__type__created_at;
+    `);
+    },
+    down: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+};
+export default alteration;

package/lib/consts/experience.d.ts

@@ -12,3 +12,5 @@ export declare const experience: Readonly<{
         readonly oneTimeToken: "one-time-token";
     }>;
 }>;
+/** `postMessage` sender tag from admin Console sign-in experience live preview. */
+export declare const signInExperiencePreviewMessageSender = "ac_preview";

package/lib/consts/experience.js

@@ -13,3 +13,5 @@ const routes = Object.freeze({
 export const experience = Object.freeze({
     routes,
 });
+/** `postMessage` sender tag from admin Console sign-in experience live preview. */
+export const signInExperiencePreviewMessageSender = 'ac_preview';

package/lib/consts/index.d.ts

@@ -6,5 +6,7 @@ export * from './tenant.js';
 export * from './subscriptions.js';
 export * from './experience.js';
 export * from './sentinel.js';
+export * from './message-rate-limit.js';
+export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';

package/lib/consts/index.js

@@ -6,5 +6,7 @@ export * from './tenant.js';
 export * from './subscriptions.js';
 export * from './experience.js';
 export * from './sentinel.js';
+export * from './message-rate-limit.js';
+export * from './verification-code.js';
 export * from './product-event.js';
 export * from './application.js';

package/lib/consts/message-rate-limit.d.ts

@@ -0,0 +1,65 @@
+import { z } from 'zod';
+/**
+ * System-level rate-limit policy for outbound messages (verification codes and
+ * other notifications) over email/SMS.
+ *
+ * This is intentionally separate from `SentinelPolicy`: the sentinel throttles
+ * *failed verification attempts* and is tenant-configurable (a paid security
+ * feature), whereas this throttles *successful sends* and is mandatory and
+ * system-level — it is not exposed for tenant editing.
+ *
+ * Note: a per-send cooldown is intentionally omitted here. The experience app
+ * already enforces a client-side resend cooldown, and the windowed per-recipient
+ * cap below bounds abuse for non-UI callers without risking a server/client
+ * cooldown mismatch that could reject a legitimate resend.
+ */
+export type MessageRateLimitPolicy = {
+    /** Rolling window, in seconds, over which the per-recipient cap is counted. */
+    sendWindow: number;
+    /** Maximum number of sends to the same recipient within `sendWindow`. */
+    maxSendsPerRecipient: number;
+};
+export declare const messageRateLimitPolicyGuard: z.ZodObject<{
+    sendWindow: z.ZodNumber;
+    maxSendsPerRecipient: z.ZodNumber;
+}, "strip", z.ZodTypeAny, {
+    sendWindow: number;
+    maxSendsPerRecipient: number;
+}, {
+    sendWindow: number;
+    maxSendsPerRecipient: number;
+}>;
+/**
+ * The default message rate limit policy. Applied to every tenant and not
+ * tenant-configurable.
+ *
+ * - `sendWindow`: 600 seconds (10 minutes)
+ * - `maxSendsPerRecipient`: 10 per window
+ *
+ * The window is short and rolling on purpose: a falsely-throttled recipient
+ * regains capacity within ~10 minutes rather than being unable to receive a
+ * message for up to an hour.
+ */
+export declare const defaultMessageRateLimitPolicy: Readonly<{
+    sendWindow: number;
+    maxSendsPerRecipient: number;
+}>;
+/**
+ * Internal, ops-only per-tenant override of {@link defaultMessageRateLimitPolicy}. Stored under the
+ * `messageRateLimitOverride` key in `logto_configs` and not exposed by any API — it exists solely
+ * as a relief valve for a legitimately high-volume tenant that trips the system cap.
+ *
+ * Every field is optional: the effective policy is resolved per field as `override ?? system
+ * default`, so a partial override only changes the fields it sets.
+ */
+export declare const messageRateLimitOverrideGuard: z.ZodObject<{
+    sendWindow: z.ZodOptional<z.ZodNumber>;
+    maxSendsPerRecipient: z.ZodOptional<z.ZodNumber>;
+}, "strip", z.ZodTypeAny, {
+    sendWindow?: number | undefined;
+    maxSendsPerRecipient?: number | undefined;
+}, {
+    sendWindow?: number | undefined;
+    maxSendsPerRecipient?: number | undefined;
+}>;
+export type MessageRateLimitOverride = z.infer<typeof messageRateLimitOverrideGuard>;

package/lib/consts/message-rate-limit.js

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+export const messageRateLimitPolicyGuard = z.object({
+    sendWindow: z.number().int().positive(),
+    maxSendsPerRecipient: z.number().int().positive(),
+});
+/**
+ * The default message rate limit policy. Applied to every tenant and not
+ * tenant-configurable.
+ *
+ * - `sendWindow`: 600 seconds (10 minutes)
+ * - `maxSendsPerRecipient`: 10 per window
+ *
+ * The window is short and rolling on purpose: a falsely-throttled recipient
+ * regains capacity within ~10 minutes rather than being unable to receive a
+ * message for up to an hour.
+ */
+export const defaultMessageRateLimitPolicy = Object.freeze({
+    sendWindow: 600,
+    maxSendsPerRecipient: 10,
+});
+/**
+ * Internal, ops-only per-tenant override of {@link defaultMessageRateLimitPolicy}. Stored under the
+ * `messageRateLimitOverride` key in `logto_configs` and not exposed by any API — it exists solely
+ * as a relief valve for a legitimately high-volume tenant that trips the system cap.
+ *
+ * Every field is optional: the effective policy is resolved per field as `override ?? system
+ * default`, so a partial override only changes the fields it sets.
+ */
+export const messageRateLimitOverrideGuard = messageRateLimitPolicyGuard.partial();

package/lib/consts/message-rate-limit.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/consts/message-rate-limit.test.js

@@ -0,0 +1,20 @@
+import { describe, expect, it } from 'vitest';
+import { defaultMessageRateLimitPolicy, messageRateLimitPolicyGuard, } from './message-rate-limit.js';
+describe('messageRateLimitPolicyGuard', () => {
+    it('parses a valid policy', () => {
+        expect(messageRateLimitPolicyGuard.parse({ sendWindow: 3600, maxSendsPerRecipient: 5 })).toEqual({ sendWindow: 3600, maxSendsPerRecipient: 5 });
+    });
+    it('rejects a non-numeric value', () => {
+        expect(messageRateLimitPolicyGuard.safeParse({ sendWindow: '3600', maxSendsPerRecipient: 5 }).success).toBe(false);
+    });
+    it.each([
+        { sendWindow: 0, maxSendsPerRecipient: 5 },
+        { sendWindow: 3600, maxSendsPerRecipient: 0 },
+        { sendWindow: 3600.5, maxSendsPerRecipient: 5 },
+    ])('rejects out-of-range or fractional values %o', (policy) => {
+        expect(messageRateLimitPolicyGuard.safeParse(policy).success).toBe(false);
+    });
+    it('accepts the default policy', () => {
+        expect(messageRateLimitPolicyGuard.parse(defaultMessageRateLimitPolicy)).toEqual(defaultMessageRateLimitPolicy);
+    });
+});

package/lib/consts/verification-code.d.ts

@@ -0,0 +1,10 @@
+/**
+ * The default verification code policy.
+ *
+ * - `expirationDuration`: 600 seconds (10 minutes)
+ * - `maxRetryAttempts`: 10
+ */
+export declare const defaultVerificationCodePolicy: Readonly<{
+    expirationDuration: number;
+    maxRetryAttempts: number;
+}>;

package/lib/consts/verification-code.js

@@ -0,0 +1,10 @@
+/**
+ * The default verification code policy.
+ *
+ * - `expirationDuration`: 600 seconds (10 minutes)
+ * - `maxRetryAttempts`: 10
+ */
+export const defaultVerificationCodePolicy = Object.freeze({
+    expirationDuration: 600,
+    maxRetryAttempts: 10,
+});