@logto/schemas 1.42.0 → 1.43.0

package/tables/cimd_grant_client_snapshots.sql

@@ -0,0 +1,27 @@
+/* init_order = 2 */
+
+/**
+  The client identity a user approved at consent time for a client ID metadata document (CIMD)
+  client, captured per Grant. CIMD clients are unregistered URL identities without an
+  `applications` row, and an unvetted client can rewrite its hosted document at any time — so the
+  grant list renders this snapshot instead of refetching the document.
+*/
+create table cimd_grant_client_snapshots (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The ID of the Grant row in `oidc_model_instances`. */
+  grant_id varchar(128) not null,
+  /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+  grant_model_name varchar(64) not null default 'Grant',
+  client_id varchar(2048) not null,
+  name varchar(256),
+  logo_uri varchar(2048),
+  created_at timestamptz not null default(now()),
+  primary key (tenant_id, grant_id),
+  constraint cimd_grant_client_snapshots__grant_model_name
+    check (grant_model_name = 'Grant'),
+  /** Revoking the grant hard-deletes the Grant row, which erases the snapshot with it. */
+  foreign key (tenant_id, grant_model_name, grant_id)
+    references oidc_model_instances (tenant_id, model_name, id)
+    on update cascade on delete cascade
+);

package/tables/cimd_grant_organizations.sql

@@ -0,0 +1,38 @@
+/* init_order = 3 */
+
+/**
+  The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client.
+  CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership,
+  so organization access follows the single authorization instead of a long-lived cross-grant
+  relation: rows cascade away with the Grant row and with the user's organization membership.
+*/
+create table cimd_grant_organizations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The ID of the Grant row in `oidc_model_instances`. */
+  grant_id varchar(128) not null,
+  /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+  grant_model_name varchar(64) not null default 'Grant',
+  organization_id varchar(21) not null,
+  /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+  user_id varchar(21) not null,
+  primary key (tenant_id, grant_id),
+  constraint cimd_grant_organizations__grant_model_name
+    check (grant_model_name = 'Grant'),
+  /** Revoking the grant hard-deletes the Grant row, which erases the organization authorization with it. */
+  foreign key (tenant_id, grant_model_name, grant_id)
+    references oidc_model_instances (tenant_id, model_name, id)
+    on update cascade on delete cascade,
+  /** Leaving the organization revokes the authorization. */
+  foreign key (tenant_id, organization_id, user_id)
+    references organization_user_relations (tenant_id, organization_id, user_id)
+    on update cascade on delete cascade
+);
+
+/**
+  Backs the membership FK's cascade lookup: rows live as long as the Grant row (not the grant's
+  validity), so membership deletions would otherwise scan the tenant's whole row set per deleted
+  membership, amplified by member count on organization deletion.
+*/
+create index cimd_grant_organizations__organization_id_user_id
+  on cimd_grant_organizations (tenant_id, organization_id, user_id);

package/tables/cimd_organization_resource_scopes.sql

@@ -0,0 +1,16 @@
+/* init_order = 3 */
+
+/**
+  The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of
+  the tenant can request. The scopes are granted to users through organization roles.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_organization_resource_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the API resource scope. */
+  scope_id varchar(21) not null,
+  primary key (tenant_id, scope_id),
+  foreign key (tenant_id, scope_id)
+    references scopes (tenant_id, id) on update cascade on delete cascade
+);

package/tables/cimd_organization_scopes.sql

@@ -0,0 +1,15 @@
+/* init_order = 2 */
+
+/**
+  The organization scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_organization_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the organization scope. */
+  organization_scope_id varchar(21) not null,
+  primary key (tenant_id, organization_scope_id),
+  foreign key (tenant_id, organization_scope_id)
+    references organization_scopes (tenant_id, id) on update cascade on delete cascade
+);

package/tables/cimd_resource_scopes.sql

@@ -0,0 +1,15 @@
+/* init_order = 3 */
+
+/**
+  The API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_resource_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the API resource scope. */
+  scope_id varchar(21) not null,
+  primary key (tenant_id, scope_id),
+  foreign key (tenant_id, scope_id)
+    references scopes (tenant_id, id) on update cascade on delete cascade
+);

package/tables/cimd_user_scopes.sql

@@ -0,0 +1,13 @@
+/* init_order = 2 */
+
+/**
+  The user scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_user_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The unique UserScope enum value @see (@logto/core-kit/open-id.js) for more details */
+  user_scope varchar(64) not null,
+  primary key (tenant_id, user_scope)
+);

package/tables/oidc_model_instances.sql

@@ -42,6 +42,11 @@ create index oidc_model_instances__grant_payload_account_id_expires_at
   on oidc_model_instances (tenant_id, (payload->>'accountId'), expires_at)
   WHERE model_name = 'Grant';
 
+/* Partial on payload key existence so rows without accountId (e.g. client credentials tokens) stay out of the index. The parameter-free predicate stays provable under generic query plans, but matching queries must include the payload ? 'accountId' clause. */
+create index oidc_model_instances__model_name_payload_account_id_partial
+  on oidc_model_instances (tenant_id, model_name, (payload->>'accountId'))
+  where payload ? 'accountId';
+
 alter table oidc_model_instances set (
   autovacuum_vacuum_scale_factor = 0.05,
   autovacuum_analyze_scale_factor = 0.02,

package/tables/oidc_session_extensions.sql

@@ -8,11 +8,16 @@ create table oidc_session_extensions (
     references users (id) on update cascade on delete cascade,
   last_submission jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   client_id varchar(21) null,
+  cimd_client_id varchar(2048) null,
   created_at timestamptz not null default(now()),
   updated_at timestamptz not null default(now()),
   primary key (tenant_id, session_uid)
 );
 
+/* Leads with account_id instead of tenant_id so the cascades from the users table can use it (users.id is globally unique, so a tenant_id prefix adds no selectivity). */
+create index oidc_session_extensions__account_id
+  on oidc_session_extensions (account_id);
+
 create trigger set_updated_at
   before update on oidc_session_extensions
   for each row

package/tables/organization_scopes.sql

@@ -17,3 +17,7 @@ create table organization_scopes (
 
 create index organization_scopes__id
   on organization_scopes (tenant_id, id);
+
+/** Supports tenant-aware foreign keys from tenant-owned organization scope relations. */
+create unique index organization_scopes__tenant_id_id
+  on organization_scopes (tenant_id, id);

package/tables/organizations.sql

@@ -14,6 +14,8 @@ create table organizations (
   custom_data jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   /** Whether multi-factor authentication configuration is required for the members of the organization. */
   is_mfa_required boolean not null default false,
+  /** Whether trusted devices are allowed for members of the organization. */
+  is_trusted_device_allowed boolean not null default true,
   /** The organization's branding color configuration. */
   color jsonb /* @use PartialColor */ not null default '{}'::jsonb,
   /** The organization's branding configuration. */

package/tables/scopes.sql

@@ -16,3 +16,7 @@ create table scopes (
 
 create index scopes__id
   on scopes (tenant_id, id);
+
+/** Supports tenant-aware foreign keys from tenant-owned scope relations. */
+create unique index scopes__tenant_id_id
+  on scopes (tenant_id, id);

package/tables/service_logs.sql

@@ -18,4 +18,18 @@ create index service_logs__tenant_id__type__created_at
 create index service_logs__created_at
   on service_logs (created_at);
 
+/* Cloud email-logs read path: streams a tenant's sent + failed hosted-email rows in
+   (created_at desc, id desc) keyset order (in the composite index above `type` sits between
+   `tenant_id` and `created_at`, so a read spanning both email types cannot stream in time order
+   and needs a full top-N sort) */
+create index service_logs__email__tenant_id__created_at__id
+  on service_logs (tenant_id, created_at desc, id desc)
+  where type in ('sendEmail', 'sendEmailFailed');
+
+/* Cloud email-logs recipient filter: case-insensitive exact recipient lookups in the same
+   keyset order, without inspecting every email-log payload of the tenant */
+create index service_logs__email__tenant_id__recipient__created_at__id
+  on service_logs (tenant_id, lower(payload->'data'->>'to'), created_at desc, id desc)
+  where type in ('sendEmail', 'sendEmailFailed');
+
 /* no_after_each */

package/tables/sign_in_experiences.sql

@@ -25,6 +25,7 @@ create table sign_in_experiences (
   password_policy jsonb /* @use PartialPasswordPolicy */ not null default '{}'::jsonb,
   mfa jsonb /* @use Mfa */ not null default '{}'::jsonb,
   adaptive_mfa jsonb /* @use AdaptiveMfa */ not null default '{}'::jsonb,
+  trusted_device jsonb /* @use TrustedDevicePolicy */ not null default '{}'::jsonb,
   single_sign_on_enabled boolean not null default false,
   support_email text,
   support_website_url text,

package/tables/trusted_devices.sql

@@ -0,0 +1,25 @@
+/* init_order = 2 */
+
+/** A revocable server-side credential that can fulfill sign-in MFA for a user. */
+create table trusted_devices (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  id varchar(21) not null,
+  user_id varchar(12) not null
+    references users (id) on update cascade on delete cascade,
+  secret_hash bytea /* @use BufferLike */ not null,
+  user_agent text,
+  ip text,
+  country varchar(16),
+  city text,
+  created_at timestamptz not null default(now()),
+  last_used_at timestamptz not null default(now()),
+  expires_at timestamptz not null,
+  primary key (id)
+);
+
+create index trusted_devices__tenant_user_expires_at
+  on trusted_devices (tenant_id, user_id, expires_at);
+
+create index trusted_devices__tenant_expires_at
+  on trusted_devices (tenant_id, expires_at);

package/tables/users.sql

@@ -17,6 +17,7 @@ create table users (
   /** Additional OpenID Connect standard claims that are not included in user's properties. */
   profile jsonb /* @use UserProfile */ not null default '{}'::jsonb,
   application_id varchar(21),
+  cimd_client_id varchar(2048),
   identities jsonb /* @use Identities */ not null default '{}'::jsonb,
   custom_data jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   logto_config jsonb /* @use JsonObject */ not null default '{}'::jsonb,