@logto/schemas 1.40.1 → 1.42.0

package/lib/types/user-sessions.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { Applications } from '../db-entries/index.js';
 import { oidcSessionInstancePayloadGuard } from '../foundations/index.js';
 import { jwtCustomizerUserInteractionContextGuard } from './logto-config/jwt-customizer.js';
 export const userSessionSignInContextGuard = z
@@ -72,6 +73,10 @@ export const userApplicationGrantGuard = z.object({
     id: z.string(),
     payload: userApplicationGrantPayloadGuard,
     expiresAt: z.number(),
+    application: Applications.guard.pick({
+        id: true,
+        name: true,
+    }),
 });
 export const getUserApplicationGrantsResponseGuard = z.object({
     grants: z.array(userApplicationGrantGuard),

package/lib/types/user.d.ts

@@ -68,6 +68,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -95,6 +96,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -119,7 +121,9 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended">, "strip", z.ZodTypeAny, {
@@ -220,6 +224,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -247,6 +252,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -271,11 +277,14 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
     hasPassword: z.ZodOptional<z.ZodBoolean>;
+    hasSecurityVerificationMethod: z.ZodOptional<z.ZodBoolean>;
     ssoIdentities: z.ZodOptional<z.ZodArray<import("../foundations/schemas.js").Guard<import("../db-entries/user-sso-identity.js").UserSsoIdentity>, "many">>;
 }, "strip", z.ZodTypeAny, {
     name: string | null;
@@ -293,6 +302,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     primaryPhone: string | null;
     isSuspended: boolean;
     hasPassword?: boolean | undefined;
+    hasSecurityVerificationMethod?: boolean | undefined;
     ssoIdentities?: import("../db-entries/user-sso-identity.js").UserSsoIdentity[] | undefined;
 }, {
     name: string | null;
@@ -310,6 +320,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     primaryPhone: string | null;
     isSuspended: boolean;
     hasPassword?: boolean | undefined;
+    hasSecurityVerificationMethod?: boolean | undefined;
     ssoIdentities?: import("../db-entries/user-sso-identity.js").UserSsoIdentity[] | undefined;
 }>;
 export type UserProfileResponse = z.infer<typeof userProfileResponseGuard>;
@@ -433,6 +444,7 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -460,6 +472,7 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         id: string;
         key: string;
         createdAt: string;
+        lastUsedTimeStep?: number | undefined;
         lastUsedAt?: string | undefined;
     } | {
         type: MfaFactor.WebAuthn;
@@ -484,7 +497,9 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         lastUsedAt?: string | undefined;
     })[]>;
     isSuspended: z.ZodType<boolean, z.ZodTypeDef, boolean>;
+    isPasswordExpired: z.ZodType<boolean, z.ZodTypeDef, boolean>;
     lastSignInAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
+    passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
 }, "name" | "id" | "avatar">, "strip", z.ZodTypeAny, {

package/lib/types/user.js

@@ -23,6 +23,7 @@ export const userInfoGuard = Users.guard.pick(
 Object.fromEntries(userInfoSelectFields.map((field) => [field, true])));
 export const userProfileResponseGuard = userInfoGuard.extend({
     hasPassword: z.boolean().optional(),
+    hasSecurityVerificationMethod: z.boolean().optional(),
     ssoIdentities: z.array(UserSsoIdentities.guard).optional(),
 });
 export const userMfaVerificationResponseGuard = z

package/lib/types/verification-records/one-time-token-verification.d.ts

@@ -25,10 +25,13 @@ export declare const oneTimeTokenVerificationRecordDataGuard: z.ZodObject<{
     }>;
     oneTimeTokenContext: z.ZodOptional<z.ZodObject<{
         jitOrganizationIds: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        interactionEvent: z.ZodOptional<z.ZodNativeEnum<typeof import("../interaction-event.js").InteractionEvent>>;
     }, "strip", z.ZodTypeAny, {
         jitOrganizationIds?: string[] | undefined;
+        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
     }, {
         jitOrganizationIds?: string[] | undefined;
+        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
     }>>;
 }, "strip", z.ZodTypeAny, {
     type: VerificationType.OneTimeToken;
@@ -40,6 +43,7 @@ export declare const oneTimeTokenVerificationRecordDataGuard: z.ZodObject<{
     verified: boolean;
     oneTimeTokenContext?: {
         jitOrganizationIds?: string[] | undefined;
+        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
     } | undefined;
 }, {
     type: VerificationType.OneTimeToken;
@@ -51,5 +55,6 @@ export declare const oneTimeTokenVerificationRecordDataGuard: z.ZodObject<{
     verified: boolean;
     oneTimeTokenContext?: {
         jitOrganizationIds?: string[] | undefined;
+        interactionEvent?: import("../interaction-event.js").InteractionEvent | undefined;
     } | undefined;
 }>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.40.1",
+  "version": "1.42.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -31,7 +31,7 @@
     "@types/inquirer": "^9.0.0",
     "@types/node": "^22.14.0",
     "@types/pluralize": "^0.0.33",
-    "@vitest/coverage-v8": "^3.1.1",
+    "@vitest/coverage-v8": "^4.1.8",
     "camelcase": "^8.0.0",
     "chalk": "^5.3.0",
     "eslint": "^8.56.0",
@@ -40,7 +40,7 @@
     "prettier": "^3.5.3",
     "roarr": "^7.11.0",
     "typescript": "^5.5.3",
-    "vitest": "^3.1.1"
+    "vitest": "^4.1.8"
   },
   "eslintConfig": {
     "extends": "@silverhand",
@@ -65,12 +65,12 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
-    "@logto/connector-kit": "^5.0.1",
-    "@logto/core-kit": "^2.10.0",
-    "@logto/phrases": "^1.28.0",
+    "@logto/connector-kit": "^5.1.0",
     "@logto/language-kit": "^1.3.0",
-    "@logto/shared": "^3.4.0",
-    "@logto/phrases-experience": "^1.13.3"
+    "@logto/phrases": "^1.30.0",
+    "@logto/core-kit": "^2.12.0",
+    "@logto/shared": "^3.4.2",
+    "@logto/phrases-experience": "^1.14.1"
   },
   "peerDependencies": {
     "zod": "3.24.3"

package/tables/domains.sql

@@ -6,6 +6,7 @@ create table domains (
   status varchar(32) /* @use DomainStatus */ not null default('PendingVerification'),
   error_message varchar(1024),
   dns_records jsonb /* @use DomainDnsRecords */ not null default '[]'::jsonb,
+  verification_files jsonb /* @use DomainVerificationFiles */ not null default '[]'::jsonb,
   cloudflare_data jsonb /* @use CloudflareData */,
   updated_at timestamptz not null default(now()),
   created_at timestamptz not null default(now()),

package/tables/oidc_model_instances.sql

@@ -27,14 +27,6 @@ create index oidc_model_instances__model_name_payload_uid
     (payload->>'uid')
   );
 
-/* TODO: Consider dropping this full data index if the partial index proves to be effective and safe. */
-create index oidc_model_instances__model_name_payload_grant_id
-  on oidc_model_instances (
-    tenant_id,
-    model_name,
-    (payload->>'grantId')
-  );
-
 create index oidc_model_instances__model_name_payload_grant_id_partial
   on oidc_model_instances (tenant_id, model_name, (payload->>'grantId'))
   where payload ? 'grantId';

package/tables/saml_sso_connector_signing_keys.sql

@@ -0,0 +1,21 @@
+/* init_order = 2 */
+
+create table saml_sso_connector_signing_keys (
+  id varchar(21) not null,
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  sso_connector_id varchar(128) not null
+    references sso_connectors (id) on update cascade on delete cascade,
+  /** The SP private key (plaintext PEM) used to sign the SAML AuthnRequest. Tenant-isolated by RLS and never returned by the API. */
+  private_key text not null,
+  /** The PEM-encoded self-signed SP certificate matching the private key. Public and safe to expose. */
+  certificate text not null,
+  created_at timestamptz not null default now(),
+  expires_at timestamptz not null,
+  active boolean not null,
+  primary key (tenant_id, sso_connector_id, id)
+);
+
+create unique index saml_sso_connector_signing_keys__unique_active
+  on saml_sso_connector_signing_keys (tenant_id, sso_connector_id, active)
+  where active;

package/tables/sentinel_activities.sql

@@ -33,3 +33,7 @@ create index sentinel_activities__target_type_target_hash
 
 create index sentinel_activities__target_type_target_hash_action_action_result_decision
   on sentinel_activities (tenant_id, target_type, target_hash, action, action_result, decision);
+
+/** Supports the cross-tenant retention prune of stale activity rows by age. */
+create index sentinel_activities__created_at
+  on sentinel_activities (created_at);

package/tables/service_logs.sql

@@ -10,7 +10,12 @@ create table service_logs (
 create index service_logs__id
   on service_logs (id);
 
-create index service_logs__tenant_id__type
-  on service_logs (tenant_id, type);
+create index service_logs__tenant_id__type__created_at
+  on service_logs (tenant_id, type, created_at);
+
+/* Global oldest-first scan for the age-based retention prune (the composite index above leads with
+   `tenant_id`, so it can't drive a tenant-agnostic `created_at` range scan). */
+create index service_logs__created_at
+  on service_logs (created_at);
 
 /* no_after_each */

package/tables/sign_in_experiences.sql

@@ -32,9 +32,22 @@ create table sign_in_experiences (
   captcha_policy jsonb /* @use CaptchaPolicy */ not null default '{}'::jsonb,
   sentinel_policy jsonb /* @use SentinelPolicy */ not null default '{}'::jsonb,
   email_blocklist_policy jsonb /* @use EmailBlocklistPolicy */ not null default '{}'::jsonb,
+  verification_code_policy jsonb /* @use VerificationCodePolicy */ not null default '{}'::jsonb,
   forgot_password_methods jsonb /* @use ForgotPasswordMethods */ default '[]'::jsonb,
   passkey_sign_in jsonb /* @use PasskeySignIn */ not null default '{}'::jsonb,
-  /** Nullable by design: null keeps legacy full-catalog behavior and [] collects no custom profile fields. */
-  sign_up_profile_fields jsonb /* @use SignUpProfileFields */,
+  /** Nullable by design: null keeps legacy full-catalog behavior, and new rows default to [] to collect no custom profile fields. */
+  sign_up_profile_fields jsonb /* @use SignUpProfileFields */ default '[]'::jsonb,
+  password_expiration jsonb /* @use PasswordExpirationPolicy */ not null default '{}'::jsonb,
+  username_policy jsonb /* @use UsernamePolicy */ not null default ('{
+    "caseSensitive": true,
+    "minLength": 1,
+    "maxLength": 128,
+    "allowedChars": {
+      "lowercase": true,
+      "uppercase": true,
+      "numbers": true,
+      "underscore": true
+    }
+  }'::jsonb),
   primary key (tenant_id, id)
 );

package/tables/users.sql

@@ -22,7 +22,9 @@ create table users (
   logto_config jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   mfa_verifications jsonb /* @use MfaVerifications */ not null default '[]'::jsonb,
   is_suspended boolean not null default false,
+  is_password_expired boolean not null default false,
   last_sign_in_at timestamptz,
+  password_updated_at timestamptz,
   created_at timestamptz not null default (now()),
   updated_at timestamptz not null default (now()),
   primary key (id),
@@ -44,6 +46,11 @@ create index users__name
 create index users_mfa_verifications_gin
   on users using gin (mfa_verifications jsonb_path_ops);
 
+/* Supports case-insensitive username lookups and case-flip conflict detection. */
+create index users__tenant_lower_username
+  on users (tenant_id, lower(username))
+  where username is not null;
+
 create trigger set_updated_at
   before update on users
   for each row