@logto/schemas 1.41.0 → 1.43.0

package/alterations/1.42.0-1783916980-add-domain-verification-files.ts

@@ -0,0 +1,20 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table domains
+        add column verification_files jsonb not null default '[]'::jsonb;
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table domains
+        drop column verification_files;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.42.0-1784619793-add-service-logs-created-at-index.ts

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Support the age-based `service_logs` retention prune's global oldest-first scan
+    // (`where created_at < ? order by created_at asc limit ?`). The existing
+    // `(tenant_id, type, created_at)` index leads with `tenant_id`, so it can't drive a
+    // tenant-agnostic time-range scan. `concurrently` keeps the write path unlocked — this
+    // unbounded table is written on every send.
+    //
+    // No `if not exists`: fail loud if the index already exists (e.g. a leftover invalid build from a
+    // prior failed concurrent creation) instead of silently skipping.
+    await pool.query(sql`
+      create index concurrently service_logs__created_at
+        on service_logs (created_at);
+    `);
+  },
+  up: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists service_logs__created_at;
+    `);
+  },
+  down: async () => {
+    /** `concurrently` cannot be used inside a transaction. */
+  },
+};
+
+export default alteration;

package/alterations/1.42.0-1784620000-add-saml-sso-connector-signing-keys-table.ts

@@ -0,0 +1,38 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table saml_sso_connector_signing_keys (
+        id varchar(21) not null,
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        sso_connector_id varchar(128) not null
+          references sso_connectors (id) on update cascade on delete cascade,
+        private_key text not null,
+        certificate text not null,
+        created_at timestamptz not null default now(),
+        expires_at timestamptz not null,
+        active boolean not null,
+        primary key (tenant_id, sso_connector_id, id)
+      );
+
+      create unique index saml_sso_connector_signing_keys__unique_active
+        on saml_sso_connector_signing_keys (tenant_id, sso_connector_id, active)
+        where active;
+    `);
+    await applyTableRls(pool, 'saml_sso_connector_signing_keys');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'saml_sso_connector_signing_keys');
+    await pool.query(sql`
+      drop table saml_sso_connector_signing_keys;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785393731-add-oidc-model-instances-account-id-partial-index.ts

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Add index to optimize revoking access tokens and refresh tokens by accountId.
+    // See the index comment in tables/oidc_model_instances.sql for the predicate rationale.
+    await pool.query(sql`
+      create index concurrently oidc_model_instances__model_name_payload_account_id_partial
+        on oidc_model_instances (tenant_id, model_name, (payload->>'accountId'))
+        where payload ? 'accountId';
+    `);
+
+    // Collect expression statistics right away instead of waiting for autovacuum.
+    await pool.query(sql`
+      analyze oidc_model_instances;
+    `);
+  },
+  up: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently oidc_model_instances__model_name_payload_account_id_partial;
+    `);
+  },
+  down: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785481546-add-tenant-aware-scope-indexes.ts

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      create unique index concurrently scopes__tenant_id_id
+        on scopes (tenant_id, id);
+    `);
+
+    await pool.query(sql`
+      create unique index concurrently organization_scopes__tenant_id_id
+        on organization_scopes (tenant_id, id);
+    `);
+  },
+  up: async () => {
+    // The indexes must be created outside of a transaction.
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently if exists organization_scopes__tenant_id_id;
+    `);
+    await pool.query(sql`
+      drop index concurrently if exists scopes__tenant_id_id;
+    `);
+  },
+  down: async () => {
+    // The indexes must be dropped outside of a transaction.
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785488115-add-cimd-permission-ceiling-tables.ts

@@ -0,0 +1,77 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Add the tenant-level permission ceiling tables for client ID metadata document (CIMD) clients.
+ * The ceiling is tenant-wide because CIMD clients are unregistered and have no per-client record
+ * to attach configuration to. The tables reference the tenant and scope tables directly (not the
+ * CIMD config row), so disabling CIMD does not wipe the permission settings.
+ * Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not
+ * expressible.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table cimd_user_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        user_scope varchar(64) not null,
+        primary key (tenant_id, user_scope)
+      );
+    `);
+    await applyTableRls(pool, 'cimd_user_scopes');
+
+    await pool.query(sql`
+      create table cimd_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_resource_scopes');
+
+    await pool.query(sql`
+      create table cimd_organization_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        organization_scope_id varchar(21) not null,
+        primary key (tenant_id, organization_scope_id),
+        foreign key (tenant_id, organization_scope_id)
+          references organization_scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_organization_scopes');
+
+    await pool.query(sql`
+      create table cimd_organization_resource_scopes (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        scope_id varchar(21) not null,
+        primary key (tenant_id, scope_id),
+        foreign key (tenant_id, scope_id)
+          references scopes (tenant_id, id) on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_organization_resource_scopes');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'cimd_organization_resource_scopes');
+    await dropTableRls(pool, 'cimd_organization_scopes');
+    await dropTableRls(pool, 'cimd_resource_scopes');
+    await dropTableRls(pool, 'cimd_user_scopes');
+    await pool.query(sql`
+      drop table cimd_organization_resource_scopes;
+      drop table cimd_organization_scopes;
+      drop table cimd_resource_scopes;
+      drop table cimd_user_scopes;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785722831-add-oidc-session-extensions-account-id-index.ts

@@ -0,0 +1,27 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    // Add index to optimize deleting session extensions by accountId, including the
+    // cascades from the users table. See the index comment in tables/oidc_session_extensions.sql.
+    await pool.query(sql`
+      create index concurrently oidc_session_extensions__account_id
+        on oidc_session_extensions (account_id);
+    `);
+  },
+  up: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently oidc_session_extensions__account_id;
+    `);
+  },
+  down: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1785835991-add-cimd-client-identifier-columns.ts

@@ -0,0 +1,31 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Registered application IDs (21 chars, referencing `applications`) and CIMD (client ID metadata
+ * document) client identifier URLs are different value spaces, so each gets its own column instead
+ * of sharing one.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table users
+        add column cimd_client_id varchar(2048);
+
+      alter table oidc_session_extensions
+        add column cimd_client_id varchar(2048);
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table users
+        drop column cimd_client_id;
+
+      alter table oidc_session_extensions
+        drop column cimd_client_id;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786325989-add-cimd-grant-organizations-table.ts

@@ -0,0 +1,54 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Add the grant-scoped organization authorization table for client ID metadata document (CIMD)
+ * clients. CIMD clients are unregistered URL identities with no deletion lifecycle and
+ * transferable ownership, so organization access follows the single authorization instead of a
+ * long-lived cross-grant relation: rows cascade away with the Grant row (revocation hard-deletes
+ * it) and with the user's organization membership.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table cimd_grant_organizations (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        organization_id varchar(21) not null,
+        user_id varchar(21) not null,
+        primary key (tenant_id, grant_id, organization_id),
+        constraint cimd_grant_organizations__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade,
+        foreign key (tenant_id, organization_id, user_id)
+          references organization_user_relations (tenant_id, organization_id, user_id)
+          on update cascade on delete cascade
+      );
+    `);
+    /**
+     * Backs the membership FK's cascade lookup; the PK leaves `organization_id` outside its
+     * usable prefix. The table is created empty in this transaction, so a plain (non-concurrent)
+     * index build is free.
+     */
+    await pool.query(sql`
+      create index cimd_grant_organizations__organization_id_user_id
+        on cimd_grant_organizations (tenant_id, organization_id, user_id);
+    `);
+    await applyTableRls(pool, 'cimd_grant_organizations');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'cimd_grant_organizations');
+    await pool.query(sql`
+      drop table cimd_grant_organizations;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786333495-add-trusted-devices.ts

@@ -0,0 +1,57 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table trusted_devices (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        id varchar(21) not null,
+        user_id varchar(12) not null
+          references users (id) on update cascade on delete cascade,
+        secret_hash bytea not null,
+        user_agent text,
+        ip text,
+        country varchar(16),
+        city text,
+        created_at timestamptz not null default(now()),
+        last_used_at timestamptz not null default(now()),
+        expires_at timestamptz not null,
+        primary key (id)
+      );
+
+      create index trusted_devices__tenant_user_expires_at
+        on trusted_devices (tenant_id, user_id, expires_at);
+
+      create index trusted_devices__tenant_expires_at
+        on trusted_devices (tenant_id, expires_at);
+
+      alter table sign_in_experiences
+        add column trusted_device jsonb not null default '{}'::jsonb;
+
+      alter table organizations
+        add column is_trusted_device_allowed boolean not null default true;
+    `);
+
+    await applyTableRls(pool, 'trusted_devices');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'trusted_devices');
+
+    await pool.query(sql`
+      drop table trusted_devices;
+
+      alter table sign_in_experiences
+        drop column trusted_device;
+
+      alter table organizations
+        drop column is_trusted_device_allowed;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786373004-tighten-cimd-grant-organizations-pkey.ts

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+/**
+ * Tighten the `cimd_grant_organizations` primary key to `(tenant_id, grant_id)` so the schema
+ * itself enforces the at-most-one-organization-per-grant invariant that token issuance relies on,
+ * instead of leaving it to the consent flow's composition. The table is dev-feature-gated and
+ * empty in every environment, so swapping the constraint needs no data migration.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id);
+    `);
+  },
+  down: async (pool) => {
+    await pool.query(sql`
+      alter table cimd_grant_organizations
+        drop constraint cimd_grant_organizations_pkey,
+        add primary key (tenant_id, grant_id, organization_id);
+    `);
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786414712-add-service-logs-email-indexes.ts

@@ -0,0 +1,34 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+const alteration: AlterationScript = {
+  beforeUp: async (pool) => {
+    await pool.query(sql`
+      create index concurrently service_logs__email__tenant_id__created_at__id
+        on service_logs (tenant_id, created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+    await pool.query(sql`
+      create index concurrently service_logs__email__tenant_id__recipient__created_at__id
+        on service_logs (tenant_id, lower(payload->'data'->>'to'), created_at desc, id desc)
+        where type in ('sendEmail', 'sendEmailFailed');
+    `);
+  },
+  up: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+  },
+  beforeDown: async (pool) => {
+    await pool.query(sql`
+      drop index concurrently service_logs__email__tenant_id__recipient__created_at__id;
+    `);
+    await pool.query(sql`
+      drop index concurrently service_logs__email__tenant_id__created_at__id;
+    `);
+  },
+  down: async () => {
+    /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+  },
+};
+
+export default alteration;

package/alterations/1.43.0-1786431364-add-cimd-grant-client-snapshots-table.ts

@@ -0,0 +1,43 @@
+import { sql } from '@silverhand/slonik';
+
+import type { AlterationScript } from '../lib/types/alteration.js';
+
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+
+/**
+ * Add the per-grant client display snapshot table for client ID metadata document (CIMD) clients.
+ * CIMD clients are unregistered URL identities without an `applications` row, and an unvetted
+ * client can rewrite its hosted document at any time — so the grant list renders the snapshot
+ * captured at consent instead of refetching the document. Rows cascade away with the Grant row.
+ */
+const alteration: AlterationScript = {
+  up: async (pool) => {
+    await pool.query(sql`
+      create table cimd_grant_client_snapshots (
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        grant_id varchar(128) not null,
+        grant_model_name varchar(64) not null default 'Grant',
+        client_id varchar(2048) not null,
+        name varchar(256),
+        logo_uri varchar(2048),
+        created_at timestamptz not null default(now()),
+        primary key (tenant_id, grant_id),
+        constraint cimd_grant_client_snapshots__grant_model_name
+          check (grant_model_name = 'Grant'),
+        foreign key (tenant_id, grant_model_name, grant_id)
+          references oidc_model_instances (tenant_id, model_name, id)
+          on update cascade on delete cascade
+      );
+    `);
+    await applyTableRls(pool, 'cimd_grant_client_snapshots');
+  },
+  down: async (pool) => {
+    await dropTableRls(pool, 'cimd_grant_client_snapshots');
+    await pool.query(sql`
+      drop table cimd_grant_client_snapshots;
+    `);
+  },
+};
+
+export default alteration;

package/alterations/utils/1704934999-tables.ts

@@ -2,12 +2,33 @@ import { type CommonQueryMethods, sql } from '@silverhand/slonik';
 
 const getId = (value: string) => sql.identifier([value]);
 
+/**
+ * Returns the suffix used in the base Logto role name for the current database
+ * (`logto_tenant_<suffix>`).
+ *
+ * Historically the suffix was the raw database name (which may contain hyphens). A later
+ * convention normalised it by replacing hyphens with underscores. To remain compatible with
+ * both conventions we probe `pg_roles` for the normalised name first and fall back to the
+ * raw database name for legacy installations.
+ */
 const getDatabaseName = async (pool: CommonQueryMethods) => {
   const { currentDatabase } = await pool.one<{ currentDatabase: string }>(sql`
     select current_database();
   `);
 
-  return currentDatabase.replaceAll('-', '_');
+  const normalized = currentDatabase.replaceAll('-', '_');
+
+  if (normalized === currentDatabase) {
+    return currentDatabase;
+  }
+
+  const { exists } = await pool.one<{ exists: boolean }>(sql`
+    select exists(
+      select 1 from pg_roles where rolname = ${'logto_tenant_' + normalized}
+    ) as exists;
+  `);
+
+  return exists ? normalized : currentDatabase;
 };
 
 /**

package/alterations-js/1.42.0-1783916980-add-domain-verification-files.js

@@ -0,0 +1,16 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      alter table domains
+        add column verification_files jsonb not null default '[]'::jsonb;
+    `);
+    },
+    down: async (pool) => {
+        await pool.query(sql `
+      alter table domains
+        drop column verification_files;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.42.0-1784619793-add-service-logs-created-at-index.js

@@ -0,0 +1,29 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Support the age-based `service_logs` retention prune's global oldest-first scan
+        // (`where created_at < ? order by created_at asc limit ?`). The existing
+        // `(tenant_id, type, created_at)` index leads with `tenant_id`, so it can't drive a
+        // tenant-agnostic time-range scan. `concurrently` keeps the write path unlocked — this
+        // unbounded table is written on every send.
+        //
+        // No `if not exists`: fail loud if the index already exists (e.g. a leftover invalid build from a
+        // prior failed concurrent creation) instead of silently skipping.
+        await pool.query(sql `
+      create index concurrently service_logs__created_at
+        on service_logs (created_at);
+    `);
+    },
+    up: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently if exists service_logs__created_at;
+    `);
+    },
+    down: async () => {
+        /** `concurrently` cannot be used inside a transaction. */
+    },
+};
+export default alteration;

package/alterations-js/1.42.0-1784620000-add-saml-sso-connector-signing-keys-table.js

@@ -0,0 +1,33 @@
+import { sql } from '@silverhand/slonik';
+import { applyTableRls, dropTableRls } from './utils/1704934999-tables.js';
+const alteration = {
+    up: async (pool) => {
+        await pool.query(sql `
+      create table saml_sso_connector_signing_keys (
+        id varchar(21) not null,
+        tenant_id varchar(21) not null
+          references tenants (id) on update cascade on delete cascade,
+        sso_connector_id varchar(128) not null
+          references sso_connectors (id) on update cascade on delete cascade,
+        private_key text not null,
+        certificate text not null,
+        created_at timestamptz not null default now(),
+        expires_at timestamptz not null,
+        active boolean not null,
+        primary key (tenant_id, sso_connector_id, id)
+      );
+
+      create unique index saml_sso_connector_signing_keys__unique_active
+        on saml_sso_connector_signing_keys (tenant_id, sso_connector_id, active)
+        where active;
+    `);
+        await applyTableRls(pool, 'saml_sso_connector_signing_keys');
+    },
+    down: async (pool) => {
+        await dropTableRls(pool, 'saml_sso_connector_signing_keys');
+        await pool.query(sql `
+      drop table saml_sso_connector_signing_keys;
+    `);
+    },
+};
+export default alteration;

package/alterations-js/1.43.0-1785393731-add-oidc-model-instances-account-id-partial-index.js

@@ -0,0 +1,28 @@
+import { sql } from '@silverhand/slonik';
+const alteration = {
+    beforeUp: async (pool) => {
+        // Add index to optimize revoking access tokens and refresh tokens by accountId.
+        // See the index comment in tables/oidc_model_instances.sql for the predicate rationale.
+        await pool.query(sql `
+      create index concurrently oidc_model_instances__model_name_payload_account_id_partial
+        on oidc_model_instances (tenant_id, model_name, (payload->>'accountId'))
+        where payload ? 'accountId';
+    `);
+        // Collect expression statistics right away instead of waiting for autovacuum.
+        await pool.query(sql `
+      analyze oidc_model_instances;
+    `);
+    },
+    up: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this up is intentionally left empty. */
+    },
+    beforeDown: async (pool) => {
+        await pool.query(sql `
+      drop index concurrently oidc_model_instances__model_name_payload_account_id_partial;
+    `);
+    },
+    down: async () => {
+        /** 'concurrently' cannot be used inside a transaction, so this down is intentionally left empty. */
+    },
+};
+export default alteration;