@logto/schemas 1.42.0 → 1.44.0

package/lib/types/user-sessions.js

@@ -1,5 +1,4 @@
 import { z } from 'zod';
-import { Applications } from '../db-entries/index.js';
 import { oidcSessionInstancePayloadGuard } from '../foundations/index.js';
 import { jwtCustomizerUserInteractionContextGuard } from './logto-config/jwt-customizer.js';
 export const userSessionSignInContextGuard = z
@@ -73,9 +72,15 @@ export const userApplicationGrantGuard = z.object({
     id: z.string(),
     payload: userApplicationGrantPayloadGuard,
     expiresAt: z.number(),
-    application: Applications.guard.pick({
-        id: true,
-        name: true,
+    /**
+     * A CIMD (client ID metadata document) grant fills this slot with a URL identity that has no
+     * `applications` row: the identifier URL lands in `id` and `name` comes from the consent-time
+     * snapshot, so neither field can keep the applications table varchar bounds. Consumers tell
+     * the kinds apart by the id shape.
+     */
+    application: z.object({
+        id: z.string(),
+        name: z.string(),
     }),
 });
 export const getUserApplicationGrantsResponseGuard = z.object({

package/lib/types/user.d.ts

@@ -1,7 +1,7 @@
 import { z } from 'zod';
 import { type User } from '../db-entries/index.js';
 import { MfaFactor } from '../foundations/index.js';
-export declare const userInfoSelectFields: readonly ("name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended")[];
+export declare const userInfoSelectFields: readonly ("name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended")[];
 export declare const userInfoGuard: z.ZodObject<Pick<{
     tenantId: z.ZodType<string, z.ZodTypeDef, string>;
     id: z.ZodType<string, z.ZodTypeDef, string>;
@@ -54,6 +54,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -126,10 +127,11 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
     passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended">, "strip", z.ZodTypeAny, {
+}, "name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended">, "strip", z.ZodTypeAny, {
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -145,6 +147,7 @@ export declare const userInfoGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -210,6 +213,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;
@@ -282,7 +286,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     passwordUpdatedAt: z.ZodType<number | null, z.ZodTypeDef, number | null>;
     createdAt: z.ZodType<number, z.ZodTypeDef, number>;
     updatedAt: z.ZodType<number, z.ZodTypeDef, number>;
-}, "name" | "id" | "applicationId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
+}, "name" | "id" | "applicationId" | "cimdClientId" | "username" | "createdAt" | "profile" | "avatar" | "customData" | "identities" | "updatedAt" | "lastSignInAt" | "primaryEmail" | "primaryPhone" | "isSuspended"> & {
     hasPassword: z.ZodOptional<z.ZodBoolean>;
     hasSecurityVerificationMethod: z.ZodOptional<z.ZodBoolean>;
     ssoIdentities: z.ZodOptional<z.ZodArray<import("../foundations/schemas.js").Guard<import("../db-entries/user-sso-identity.js").UserSsoIdentity>, "many">>;
@@ -290,6 +294,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -308,6 +313,7 @@ export declare const userProfileResponseGuard: z.ZodObject<Pick<{
     name: string | null;
     id: string;
     applicationId: string | null;
+    cimdClientId: string | null;
     username: string | null;
     createdAt: number;
     profile: import("../foundations/index.js").UserProfile;
@@ -430,6 +436,7 @@ export declare const featuredUserGuard: z.ZodObject<Pick<{
         }>;
     }>>;
     applicationId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
+    cimdClientId: z.ZodType<string | null, z.ZodTypeDef, string | null>;
     identities: z.ZodType<Record<string, {
         userId: string;
         details?: Record<string, import("@withtyped/server/lib/types.js").Json> | undefined;

package/lib/types/user.js

@@ -16,6 +16,7 @@ export const userInfoSelectFields = Object.freeze([
     'updatedAt',
     'profile',
     'applicationId',
+    'cimdClientId',
     'isSuspended',
 ]);
 export const userInfoGuard = Users.guard.pick(

package/lib/types/verification-records/code-verification.d.ts

@@ -17,11 +17,17 @@ export type CodeVerificationRecordData<T extends CodeVerificationType = CodeVeri
     identifier: VerificationCodeIdentifierOf<T>;
     templateType: TemplateType;
     verified: boolean;
+    /**
+     * The user the identifier was resolved from, when the record was created for the subject the
+     * interaction carries rather than from a client-supplied identifier.
+     */
+    userId?: string;
 };
 export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.EmailVerificationCode>;
     identifier: z.ZodObject<{
@@ -43,6 +49,7 @@ export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.EmailVerificationCode;
     id: string;
@@ -52,11 +59,13 @@ export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.PhoneVerificationCode>;
     identifier: z.ZodObject<{
@@ -78,6 +87,7 @@ export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.PhoneVerificationCode;
     id: string;
@@ -87,11 +97,13 @@ export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export declare const mfaEmailCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.MfaEmailVerificationCode>;
     identifier: z.ZodObject<{
@@ -113,6 +125,7 @@ export declare const mfaEmailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.MfaEmailVerificationCode;
     id: string;
@@ -122,11 +135,13 @@ export declare const mfaEmailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export declare const mfaPhoneCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.MfaPhoneVerificationCode>;
     identifier: z.ZodObject<{
@@ -148,6 +163,7 @@ export declare const mfaPhoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.MfaPhoneVerificationCode;
     id: string;
@@ -157,5 +173,6 @@ export declare const mfaPhoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export {};

package/lib/types/verification-records/code-verification.js

@@ -5,6 +5,7 @@ const basicCodeVerificationRecordDataGuard = z.object({
     id: z.string(),
     templateType: z.nativeEnum(TemplateType),
     verified: z.boolean(),
+    userId: z.string().optional(),
 });
 export const emailCodeVerificationRecordDataGuard = basicCodeVerificationRecordDataGuard.extend({
     type: z.literal(VerificationType.EmailVerificationCode),

package/lib/utils/cimd.d.ts

@@ -0,0 +1,14 @@
+/**
+ * @overview The CIMD (OAuth Client ID Metadata Document) client identifier namespace predicate.
+ *
+ * Lives in `@logto/schemas` because both runtimes classify the same identifier: core wires the
+ * feature configuration and request-time matching, while the experience client recognizes a CIMD
+ * identifier carried over from the authorization request (e.g. to accept SSR settings rendered
+ * without an `appId`).
+ */
+/**
+ * Whether the identifier is in the CIMD namespace. Mirrors the scheme test of the fork's
+ * `isValidClientIdUrl` (case-insensitive); registered application ids never take the URL shape,
+ * so the shape safely routes — the resolved client stays the authority on what a client is.
+ */
+export declare const isCimdClientId: (clientId: string) => boolean;

package/lib/utils/cimd.js

@@ -0,0 +1,14 @@
+/**
+ * @overview The CIMD (OAuth Client ID Metadata Document) client identifier namespace predicate.
+ *
+ * Lives in `@logto/schemas` because both runtimes classify the same identifier: core wires the
+ * feature configuration and request-time matching, while the experience client recognizes a CIMD
+ * identifier carried over from the authorization request (e.g. to accept SSR settings rendered
+ * without an `appId`).
+ */
+/**
+ * Whether the identifier is in the CIMD namespace. Mirrors the scheme test of the fork's
+ * `isValidClientIdUrl` (case-insensitive); registered application ids never take the URL shape,
+ * so the shape safely routes — the resolved client stays the authority on what a client is.
+ */
+export const isCimdClientId = (clientId) => /^https:\/\//iu.test(clientId);

package/lib/utils/cimd.test.d.ts

@@ -0,0 +1 @@
+export {};

package/lib/utils/cimd.test.js

@@ -0,0 +1,9 @@
+import { describe, expect, it } from 'vitest';
+import { isCimdClientId } from './cimd.js';
+describe('isCimdClientId', () => {
+    it('matches the fork scheme test case-insensitively and never matches registered ids', () => {
+        expect(isCimdClientId('https://client.example.com/metadata.json')).toBe(true);
+        expect(isCimdClientId('HTTPS://client.example.com/metadata.json')).toBe(true);
+        expect(isCimdClientId('registered_client_id')).toBe(false);
+    });
+});

package/lib/utils/index.d.ts

@@ -3,3 +3,4 @@ export * from './role.js';
 export * from './management-api.js';
 export * from './domain.js';
 export * from './oidc-private-key.js';
+export * from './cimd.js';

package/lib/utils/index.js

@@ -3,3 +3,4 @@ export * from './role.js';
 export * from './management-api.js';
 export * from './domain.js';
 export * from './oidc-private-key.js';
+export * from './cimd.js';

package/lib/utils/oidc-private-key.test.js

@@ -14,6 +14,17 @@ describe('OIDC private key helpers', () => {
             createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
         ]);
     });
+    it('preserves explicit statuses without reordering the input array', () => {
+        expect(normalizeOidcPrivateKeys([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ])).toEqual([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ]);
+    });
     it('throws for malformed status configurations', () => {
         expect(() => normalizeOidcPrivateKeys([
             createPrivateKey('current-a', 1, OidcSigningKeyStatus.Current),
@@ -81,6 +92,17 @@ describe('OIDC private key helpers', () => {
             createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
         ]);
     });
+    it('replaces any existing Next key instead of accumulating a fourth private key', () => {
+        expect(getStagedRotatedOidcPrivateKeys([
+            createPrivateKey('next', 4, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 3, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
+        ], createPrivateKey('replacement', 5))).toEqual([
+            createPrivateKey('replacement', 5, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 3, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
+        ]);
+    });
     it('promotes Next to Current during activation', () => {
         expect(rotateOidcPrivateKeyStatuses([
             createPrivateKey('next', 3, OidcSigningKeyStatus.Next),
@@ -91,6 +113,28 @@ describe('OIDC private key helpers', () => {
             createPrivateKey('current', 2, OidcSigningKeyStatus.Previous),
         ]);
     });
+    it('returns the original keys when explicit-status keys have no staged Next key', () => {
+        const privateKeys = [
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ];
+        expect(rotateOidcPrivateKeyStatuses(privateKeys)).toBe(privateKeys);
+    });
+    it('returns normalized keys when legacy keys have no staged Next key', () => {
+        const privateKeys = [createPrivateKey('current', 2), createPrivateKey('previous', 1)];
+        const result = rotateOidcPrivateKeyStatuses(privateKeys);
+        expect(result).not.toBe(privateKeys);
+        expect(result).toEqual([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('keeps only Current when deleting Previous from a two-key set', () => {
+        expect(getOidcPrivateKeysAfterDeletion([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ], 'previous')).toEqual([createPrivateKey('current', 2, OidcSigningKeyStatus.Current)]);
+    });
     it('preserves status order when deleting Previous', () => {
         expect(getOidcPrivateKeysAfterDeletion([
             createPrivateKey('next', 3, OidcSigningKeyStatus.Next),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.42.0",
+  "version": "1.44.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -31,7 +31,7 @@
     "@types/inquirer": "^9.0.0",
     "@types/node": "^22.14.0",
     "@types/pluralize": "^0.0.33",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.11",
     "camelcase": "^8.0.0",
     "chalk": "^5.3.0",
     "eslint": "^8.56.0",
@@ -40,7 +40,7 @@
     "prettier": "^3.5.3",
     "roarr": "^7.11.0",
     "typescript": "^5.5.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   },
   "eslintConfig": {
     "extends": "@silverhand",
@@ -65,12 +65,12 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
-    "@logto/connector-kit": "^5.1.0",
-    "@logto/language-kit": "^1.3.0",
-    "@logto/phrases": "^1.30.0",
-    "@logto/core-kit": "^2.12.0",
-    "@logto/shared": "^3.4.2",
-    "@logto/phrases-experience": "^1.14.1"
+    "@logto/connector-kit": "^5.1.2",
+    "@logto/phrases": "^1.32.0",
+    "@logto/language-kit": "^1.4.0",
+    "@logto/phrases-experience": "^1.15.0",
+    "@logto/shared": "^3.4.3",
+    "@logto/core-kit": "^2.13.0"
   },
   "peerDependencies": {
     "zod": "3.24.3"

package/tables/aggregated_daily_active_users.sql

@@ -2,7 +2,7 @@
 create table aggregated_daily_active_users (
   tenant_id varchar(21) not null,
   activity_date date not null,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   activity_count integer not null,
   primary key (tenant_id, activity_date, user_id)
 );

package/tables/application_access_control_user_relations.sql

@@ -6,7 +6,7 @@ create table application_access_control_user_relations (
     references tenants (id) on update cascade on delete cascade,
   application_id varchar(21) not null
     references applications (id) on update cascade on delete cascade,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   primary key (tenant_id, application_id, user_id)
 );

package/tables/application_user_consent_organizations.sql

@@ -7,7 +7,7 @@ create table application_user_consent_organizations (
   application_id varchar(21) not null
     references applications (id) on update cascade on delete cascade,
   organization_id varchar(21) not null,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   primary key (tenant_id, application_id, organization_id, user_id),
   /** User's consent to an application should be synchronized with the user's membership in the organization. */
   foreign key (tenant_id, organization_id, user_id)

package/tables/cimd_grant_client_snapshots.sql

@@ -0,0 +1,27 @@
+/* init_order = 2 */
+
+/**
+  The client identity a user approved at consent time for a client ID metadata document (CIMD)
+  client, captured per Grant. CIMD clients are unregistered URL identities without an
+  `applications` row, and an unvetted client can rewrite its hosted document at any time — so the
+  grant list renders this snapshot instead of refetching the document.
+*/
+create table cimd_grant_client_snapshots (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The ID of the Grant row in `oidc_model_instances`. */
+  grant_id varchar(128) not null,
+  /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+  grant_model_name varchar(64) not null default 'Grant',
+  client_id varchar(2048) not null,
+  name varchar(256),
+  logo_uri varchar(2048),
+  created_at timestamptz not null default(now()),
+  primary key (tenant_id, grant_id),
+  constraint cimd_grant_client_snapshots__grant_model_name
+    check (grant_model_name = 'Grant'),
+  /** Revoking the grant hard-deletes the Grant row, which erases the snapshot with it. */
+  foreign key (tenant_id, grant_model_name, grant_id)
+    references oidc_model_instances (tenant_id, model_name, id)
+    on update cascade on delete cascade
+);

package/tables/cimd_grant_organizations.sql

@@ -0,0 +1,38 @@
+/* init_order = 3 */
+
+/**
+  The organization authorized on a single OIDC Grant for a client ID metadata document (CIMD) client.
+  CIMD clients are unregistered URL identities with no deletion lifecycle and transferable ownership,
+  so organization access follows the single authorization instead of a long-lived cross-grant
+  relation: rows cascade away with the Grant row and with the user's organization membership.
+*/
+create table cimd_grant_organizations (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The ID of the Grant row in `oidc_model_instances`. */
+  grant_id varchar(128) not null,
+  /** Fixed discriminator so the composite foreign key can target Grant rows in the polymorphic `oidc_model_instances` table. */
+  grant_model_name varchar(64) not null default 'Grant',
+  organization_id varchar(21) not null,
+  /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
+  user_id varchar(128) not null,
+  primary key (tenant_id, grant_id),
+  constraint cimd_grant_organizations__grant_model_name
+    check (grant_model_name = 'Grant'),
+  /** Revoking the grant hard-deletes the Grant row, which erases the organization authorization with it. */
+  foreign key (tenant_id, grant_model_name, grant_id)
+    references oidc_model_instances (tenant_id, model_name, id)
+    on update cascade on delete cascade,
+  /** Leaving the organization revokes the authorization. */
+  foreign key (tenant_id, organization_id, user_id)
+    references organization_user_relations (tenant_id, organization_id, user_id)
+    on update cascade on delete cascade
+);
+
+/**
+  Backs the membership FK's cascade lookup: rows live as long as the Grant row (not the grant's
+  validity), so membership deletions would otherwise scan the tenant's whole row set per deleted
+  membership, amplified by member count on organization deletion.
+*/
+create index cimd_grant_organizations__organization_id_user_id
+  on cimd_grant_organizations (tenant_id, organization_id, user_id);

package/tables/cimd_organization_resource_scopes.sql

@@ -0,0 +1,16 @@
+/* init_order = 3 */
+
+/**
+  The organization API resource scopes (permissions) that client ID metadata document (CIMD) clients of
+  the tenant can request. The scopes are granted to users through organization roles.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_organization_resource_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the API resource scope. */
+  scope_id varchar(21) not null,
+  primary key (tenant_id, scope_id),
+  foreign key (tenant_id, scope_id)
+    references scopes (tenant_id, id) on update cascade on delete cascade
+);

package/tables/cimd_organization_scopes.sql

@@ -0,0 +1,15 @@
+/* init_order = 2 */
+
+/**
+  The organization scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_organization_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the organization scope. */
+  organization_scope_id varchar(21) not null,
+  primary key (tenant_id, organization_scope_id),
+  foreign key (tenant_id, organization_scope_id)
+    references organization_scopes (tenant_id, id) on update cascade on delete cascade
+);

package/tables/cimd_resource_scopes.sql

@@ -0,0 +1,15 @@
+/* init_order = 3 */
+
+/**
+  The API resource scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_resource_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The globally unique identifier of the API resource scope. */
+  scope_id varchar(21) not null,
+  primary key (tenant_id, scope_id),
+  foreign key (tenant_id, scope_id)
+    references scopes (tenant_id, id) on update cascade on delete cascade
+);

package/tables/cimd_user_scopes.sql

@@ -0,0 +1,13 @@
+/* init_order = 2 */
+
+/**
+  The user scopes (permissions) that client ID metadata document (CIMD) clients of the tenant can request.
+  Rows are an allowlist: an empty table allows nothing (deny-all), and an unrestricted state is not expressible.
+*/
+create table cimd_user_scopes (
+  tenant_id varchar(21) not null
+    references tenants (id) on update cascade on delete cascade,
+  /** The unique UserScope enum value @see (@logto/core-kit/open-id.js) for more details */
+  user_scope varchar(64) not null,
+  primary key (tenant_id, user_scope)
+);

package/tables/daily_active_users.sql

@@ -1,7 +1,7 @@
 create table daily_active_users (
   id varchar(21) not null,
   tenant_id varchar(21) not null,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   date timestamptz not null default (now()),
   primary key (id),
   constraint daily_active_users__user_id_date

package/tables/oidc_model_instances.sql

@@ -42,6 +42,11 @@ create index oidc_model_instances__grant_payload_account_id_expires_at
   on oidc_model_instances (tenant_id, (payload->>'accountId'), expires_at)
   WHERE model_name = 'Grant';
 
+/* Partial on payload key existence so rows without accountId (e.g. client credentials tokens) stay out of the index. The parameter-free predicate stays provable under generic query plans, but matching queries must include the payload ? 'accountId' clause. */
+create index oidc_model_instances__model_name_payload_account_id_partial
+  on oidc_model_instances (tenant_id, model_name, (payload->>'accountId'))
+  where payload ? 'accountId';
+
 alter table oidc_model_instances set (
   autovacuum_vacuum_scale_factor = 0.05,
   autovacuum_analyze_scale_factor = 0.02,

package/tables/oidc_session_extensions.sql

@@ -4,15 +4,20 @@ create table oidc_session_extensions (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   session_uid varchar(128) not null,
-  account_id varchar(12) not null
+  account_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   last_submission jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   client_id varchar(21) null,
+  cimd_client_id varchar(2048) null,
   created_at timestamptz not null default(now()),
   updated_at timestamptz not null default(now()),
   primary key (tenant_id, session_uid)
 );
 
+/* Leads with account_id instead of tenant_id so the cascades from the users table can use it (users.id is globally unique, so a tenant_id prefix adds no selectivity). */
+create index oidc_session_extensions__account_id
+  on oidc_session_extensions (account_id);
+
 create trigger set_updated_at
   before update on oidc_session_extensions
   for each row

package/tables/organization_invitations.sql

@@ -9,12 +9,12 @@ create table organization_invitations (
   /** The unique identifier of the invitation. */
   id varchar(21) not null,
   /** The user ID who sent the invitation. */
-  inviter_id varchar(21)
+  inviter_id varchar(128)
     references users (id) on update cascade on delete cascade,
   /** The email address or other identifier of the invitee. */
   invitee varchar(256) not null,
   /** The user ID of who accepted the invitation. */
-  accepted_user_id varchar(21)
+  accepted_user_id varchar(128)
     references users (id) on update cascade on delete cascade,
   /** The ID of the organization to which the invitee is invited. */
   organization_id varchar(21) not null

package/tables/organization_role_user_relations.sql

@@ -7,7 +7,7 @@ create table organization_role_user_relations (
   organization_id varchar(21) not null,
   organization_role_id varchar(21) not null
     references organization_roles (id) on update cascade on delete cascade,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   primary key (tenant_id, organization_id, organization_role_id, user_id),
   /** User's roles in an organization should be synchronized with the user's membership in the organization. */
   foreign key (tenant_id, organization_id, user_id)

package/tables/organization_scopes.sql

@@ -17,3 +17,7 @@ create table organization_scopes (
 
 create index organization_scopes__id
   on organization_scopes (tenant_id, id);
+
+/** Supports tenant-aware foreign keys from tenant-owned organization scope relations. */
+create unique index organization_scopes__tenant_id_id
+  on organization_scopes (tenant_id, id);

package/tables/organization_user_relations.sql

@@ -6,7 +6,7 @@ create table organization_user_relations (
     references tenants (id) on update cascade on delete cascade,
   organization_id varchar(21) not null
     references organizations (id) on update cascade on delete cascade,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   primary key (tenant_id, organization_id, user_id),
   constraint organization_user_relations__user_id__fk