@logto/schemas 1.41.0 → 1.42.0

package/tables/saml_sso_connector_signing_keys.sql

@@ -0,0 +1,21 @@
+/* init_order = 2 */
+
+create table saml_sso_connector_signing_keys (
+  id varchar(21) not null,
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  sso_connector_id varchar(128) not null
+    references sso_connectors (id) on update cascade on delete cascade,
+  /** The SP private key (plaintext PEM) used to sign the SAML AuthnRequest. Tenant-isolated by RLS and never returned by the API. */
+  private_key text not null,
+  /** The PEM-encoded self-signed SP certificate matching the private key. Public and safe to expose. */
+  certificate text not null,
+  created_at timestamptz not null default now(),
+  expires_at timestamptz not null,
+  active boolean not null,
+  primary key (tenant_id, sso_connector_id, id)
+);
+
+create unique index saml_sso_connector_signing_keys__unique_active
+  on saml_sso_connector_signing_keys (tenant_id, sso_connector_id, active)
+  where active;

package/tables/service_logs.sql

@@ -13,4 +13,9 @@ create index service_logs__id
 create index service_logs__tenant_id__type__created_at
   on service_logs (tenant_id, type, created_at);
 
+/* Global oldest-first scan for the age-based retention prune (the composite index above leads with
+   `tenant_id`, so it can't drive a tenant-agnostic `created_at` range scan). */
+create index service_logs__created_at
+  on service_logs (created_at);
+
 /* no_after_each */

package/lib/types/logto-config/inline-hook.d.ts

@@ -1,76 +0,0 @@
-import { z } from 'zod';
-import type { Json } from '../../foundations/index.js';
-import type { InteractionEvent, InteractionIdentifier } from '../interactions.js';
-import type { UserInfo } from '../user.js';
-export declare enum LogtoInlineHookKey {
-    PostFirstFactorVerification = "inlineHook.postFirstFactorVerification",
-    PostSignIn = "inlineHook.postSignIn"
-}
-export declare const inlineHookExecutionErrorPolicies: readonly ["block", "allow"];
-export type InlineHookExecutionErrorPolicy = (typeof inlineHookExecutionErrorPolicies)[number];
-export type InlineHook = {
-    script: string;
-    environmentVariables?: Record<string, string>;
-    contextSample?: Json;
-    enabled?: boolean;
-    onExecutionError?: InlineHookExecutionErrorPolicy;
-};
-export declare const inlineHookGuard: z.ZodObject<{
-    script: z.ZodString;
-    environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-    contextSample: z.ZodOptional<z.ZodType<Json, z.ZodTypeDef, Json>>;
-    enabled: z.ZodOptional<z.ZodBoolean>;
-    onExecutionError: z.ZodOptional<z.ZodEnum<["block", "allow"]>>;
-}, "strict", z.ZodTypeAny, {
-    script: string;
-    enabled?: boolean | undefined;
-    environmentVariables?: Record<string, string> | undefined;
-    contextSample?: Json | undefined;
-    onExecutionError?: "block" | "allow" | undefined;
-}, {
-    script: string;
-    enabled?: boolean | undefined;
-    environmentVariables?: Record<string, string> | undefined;
-    contextSample?: Json | undefined;
-    onExecutionError?: "block" | "allow" | undefined;
-}>;
-export declare const inlineHookTestRequestBodyGuard: z.ZodObject<{
-    script: z.ZodString;
-    hookType: z.ZodNativeEnum<typeof LogtoInlineHookKey>;
-    event: z.ZodType<Json, z.ZodTypeDef, Json>;
-    environmentVariables: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
-}, "strict", z.ZodTypeAny, {
-    event: Json;
-    script: string;
-    hookType: LogtoInlineHookKey;
-    environmentVariables?: Record<string, string> | undefined;
-}, {
-    event: Json;
-    script: string;
-    hookType: LogtoInlineHookKey;
-    environmentVariables?: Record<string, string> | undefined;
-}>;
-export type InlineHookTestRequestBody = z.infer<typeof inlineHookTestRequestBodyGuard>;
-export type HookUser = Pick<UserInfo, 'id' | 'username' | 'primaryEmail' | 'primaryPhone' | 'name' | 'avatar' | 'customData' | 'profile' | 'applicationId' | 'isSuspended'>;
-export type HookUserPatch = Partial<Omit<HookUser, 'id'>>;
-export type PostFirstFactorVerificationEvent = {
-    key: LogtoInlineHookKey.PostFirstFactorVerification;
-    interactionEvent: InteractionEvent.SignIn;
-    identifier: InteractionIdentifier;
-    /** Sensitive credential provided for inline hook controlled password verification. */
-    password: string;
-};
-export type PostSignInEvent = {
-    key: LogtoInlineHookKey.PostSignIn;
-    interactionEvent: InteractionEvent.SignIn;
-    user: HookUser;
-};
-export type PostFirstFactorVerificationResult = {
-    action: 'createUser' | 'updateUser';
-    user: HookUserPatch;
-    passwordVerified: true;
-};
-export type PostSignInResult = {
-    action: 'updateUser';
-    user?: HookUserPatch;
-};

package/lib/types/logto-config/inline-hook.js

@@ -1,25 +0,0 @@
-import { jsonGuard } from '@logto/connector-kit';
-import { z } from 'zod';
-export var LogtoInlineHookKey;
-(function (LogtoInlineHookKey) {
-    LogtoInlineHookKey["PostFirstFactorVerification"] = "inlineHook.postFirstFactorVerification";
-    LogtoInlineHookKey["PostSignIn"] = "inlineHook.postSignIn";
-})(LogtoInlineHookKey || (LogtoInlineHookKey = {}));
-export const inlineHookExecutionErrorPolicies = Object.freeze(['block', 'allow']);
-export const inlineHookGuard = z
-    .object({
-    script: z.string(),
-    environmentVariables: z.record(z.string()).optional(),
-    contextSample: jsonGuard.optional(),
-    enabled: z.boolean().optional(),
-    onExecutionError: z.enum(inlineHookExecutionErrorPolicies).optional(),
-})
-    .strict();
-export const inlineHookTestRequestBodyGuard = z
-    .object({
-    script: z.string(),
-    hookType: z.nativeEnum(LogtoInlineHookKey),
-    event: jsonGuard,
-    environmentVariables: z.record(z.string()).optional(),
-})
-    .strict();