@logto/schemas 1.43.0 → 1.44.0

package/lib/types/verification-records/code-verification.d.ts

@@ -17,11 +17,17 @@ export type CodeVerificationRecordData<T extends CodeVerificationType = CodeVeri
     identifier: VerificationCodeIdentifierOf<T>;
     templateType: TemplateType;
     verified: boolean;
+    /**
+     * The user the identifier was resolved from, when the record was created for the subject the
+     * interaction carries rather than from a client-supplied identifier.
+     */
+    userId?: string;
 };
 export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.EmailVerificationCode>;
     identifier: z.ZodObject<{
@@ -43,6 +49,7 @@ export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.EmailVerificationCode;
     id: string;
@@ -52,11 +59,13 @@ export declare const emailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.PhoneVerificationCode>;
     identifier: z.ZodObject<{
@@ -78,6 +87,7 @@ export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.PhoneVerificationCode;
     id: string;
@@ -87,11 +97,13 @@ export declare const phoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export declare const mfaEmailCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.MfaEmailVerificationCode>;
     identifier: z.ZodObject<{
@@ -113,6 +125,7 @@ export declare const mfaEmailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.MfaEmailVerificationCode;
     id: string;
@@ -122,11 +135,13 @@ export declare const mfaEmailCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export declare const mfaPhoneCodeVerificationRecordDataGuard: z.ZodObject<{
     id: z.ZodString;
     templateType: z.ZodNativeEnum<typeof TemplateType>;
     verified: z.ZodBoolean;
+    userId: z.ZodOptional<z.ZodString>;
 } & {
     type: z.ZodLiteral<VerificationType.MfaPhoneVerificationCode>;
     identifier: z.ZodObject<{
@@ -148,6 +163,7 @@ export declare const mfaPhoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }, {
     type: VerificationType.MfaPhoneVerificationCode;
     id: string;
@@ -157,5 +173,6 @@ export declare const mfaPhoneCodeVerificationRecordDataGuard: z.ZodObject<{
     };
     templateType: TemplateType;
     verified: boolean;
+    userId?: string | undefined;
 }>;
 export {};

package/lib/types/verification-records/code-verification.js

@@ -5,6 +5,7 @@ const basicCodeVerificationRecordDataGuard = z.object({
     id: z.string(),
     templateType: z.nativeEnum(TemplateType),
     verified: z.boolean(),
+    userId: z.string().optional(),
 });
 export const emailCodeVerificationRecordDataGuard = basicCodeVerificationRecordDataGuard.extend({
     type: z.literal(VerificationType.EmailVerificationCode),

package/lib/utils/oidc-private-key.test.js

@@ -14,6 +14,17 @@ describe('OIDC private key helpers', () => {
             createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
         ]);
     });
+    it('preserves explicit statuses without reordering the input array', () => {
+        expect(normalizeOidcPrivateKeys([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ])).toEqual([
+            createPrivateKey('previous', 3, OidcSigningKeyStatus.Previous),
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('next', 1, OidcSigningKeyStatus.Next),
+        ]);
+    });
     it('throws for malformed status configurations', () => {
         expect(() => normalizeOidcPrivateKeys([
             createPrivateKey('current-a', 1, OidcSigningKeyStatus.Current),
@@ -81,6 +92,17 @@ describe('OIDC private key helpers', () => {
             createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
         ]);
     });
+    it('replaces any existing Next key instead of accumulating a fourth private key', () => {
+        expect(getStagedRotatedOidcPrivateKeys([
+            createPrivateKey('next', 4, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 3, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
+        ], createPrivateKey('replacement', 5))).toEqual([
+            createPrivateKey('replacement', 5, OidcSigningKeyStatus.Next),
+            createPrivateKey('current', 3, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 2, OidcSigningKeyStatus.Previous),
+        ]);
+    });
     it('promotes Next to Current during activation', () => {
         expect(rotateOidcPrivateKeyStatuses([
             createPrivateKey('next', 3, OidcSigningKeyStatus.Next),
@@ -91,6 +113,28 @@ describe('OIDC private key helpers', () => {
             createPrivateKey('current', 2, OidcSigningKeyStatus.Previous),
         ]);
     });
+    it('returns the original keys when explicit-status keys have no staged Next key', () => {
+        const privateKeys = [
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ];
+        expect(rotateOidcPrivateKeyStatuses(privateKeys)).toBe(privateKeys);
+    });
+    it('returns normalized keys when legacy keys have no staged Next key', () => {
+        const privateKeys = [createPrivateKey('current', 2), createPrivateKey('previous', 1)];
+        const result = rotateOidcPrivateKeyStatuses(privateKeys);
+        expect(result).not.toBe(privateKeys);
+        expect(result).toEqual([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ]);
+    });
+    it('keeps only Current when deleting Previous from a two-key set', () => {
+        expect(getOidcPrivateKeysAfterDeletion([
+            createPrivateKey('current', 2, OidcSigningKeyStatus.Current),
+            createPrivateKey('previous', 1, OidcSigningKeyStatus.Previous),
+        ], 'previous')).toEqual([createPrivateKey('current', 2, OidcSigningKeyStatus.Current)]);
+    });
     it('preserves status order when deleting Previous', () => {
         expect(getOidcPrivateKeysAfterDeletion([
             createPrivateKey('next', 3, OidcSigningKeyStatus.Next),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@logto/schemas",
-  "version": "1.43.0",
+  "version": "1.44.0",
   "author": "Silverhand Inc. <contact@silverhand.io>",
   "license": "MPL-2.0",
   "type": "module",
@@ -31,7 +31,7 @@
     "@types/inquirer": "^9.0.0",
     "@types/node": "^22.14.0",
     "@types/pluralize": "^0.0.33",
-    "@vitest/coverage-v8": "^4.1.8",
+    "@vitest/coverage-v8": "^4.1.11",
     "camelcase": "^8.0.0",
     "chalk": "^5.3.0",
     "eslint": "^8.56.0",
@@ -40,7 +40,7 @@
     "prettier": "^3.5.3",
     "roarr": "^7.11.0",
     "typescript": "^5.5.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.11"
   },
   "eslintConfig": {
     "extends": "@silverhand",
@@ -65,12 +65,12 @@
   "dependencies": {
     "@withtyped/server": "^0.14.0",
     "nanoid": "^5.0.9",
-    "@logto/core-kit": "^2.13.0",
-    "@logto/connector-kit": "^5.1.1",
+    "@logto/connector-kit": "^5.1.2",
+    "@logto/phrases": "^1.32.0",
     "@logto/language-kit": "^1.4.0",
-    "@logto/phrases": "^1.31.0",
     "@logto/phrases-experience": "^1.15.0",
-    "@logto/shared": "^3.4.3"
+    "@logto/shared": "^3.4.3",
+    "@logto/core-kit": "^2.13.0"
   },
   "peerDependencies": {
     "zod": "3.24.3"

package/tables/aggregated_daily_active_users.sql

@@ -2,7 +2,7 @@
 create table aggregated_daily_active_users (
   tenant_id varchar(21) not null,
   activity_date date not null,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   activity_count integer not null,
   primary key (tenant_id, activity_date, user_id)
 );

package/tables/application_access_control_user_relations.sql

@@ -6,7 +6,7 @@ create table application_access_control_user_relations (
     references tenants (id) on update cascade on delete cascade,
   application_id varchar(21) not null
     references applications (id) on update cascade on delete cascade,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   primary key (tenant_id, application_id, user_id)
 );

package/tables/application_user_consent_organizations.sql

@@ -7,7 +7,7 @@ create table application_user_consent_organizations (
   application_id varchar(21) not null
     references applications (id) on update cascade on delete cascade,
   organization_id varchar(21) not null,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   primary key (tenant_id, application_id, organization_id, user_id),
   /** User's consent to an application should be synchronized with the user's membership in the organization. */
   foreign key (tenant_id, organization_id, user_id)

package/tables/cimd_grant_organizations.sql

@@ -15,7 +15,7 @@ create table cimd_grant_organizations (
   grant_model_name varchar(64) not null default 'Grant',
   organization_id varchar(21) not null,
   /** The user the grant was issued to and the membership FK's target. Must match the Grant payload's `accountId` (unreachable by FK) — the consent write enforces the pairing. */
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   primary key (tenant_id, grant_id),
   constraint cimd_grant_organizations__grant_model_name
     check (grant_model_name = 'Grant'),

package/tables/daily_active_users.sql

@@ -1,7 +1,7 @@
 create table daily_active_users (
   id varchar(21) not null,
   tenant_id varchar(21) not null,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   date timestamptz not null default (now()),
   primary key (id),
   constraint daily_active_users__user_id_date

package/tables/oidc_session_extensions.sql

@@ -4,7 +4,7 @@ create table oidc_session_extensions (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   session_uid varchar(128) not null,
-  account_id varchar(12) not null
+  account_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   last_submission jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   client_id varchar(21) null,

package/tables/organization_invitations.sql

@@ -9,12 +9,12 @@ create table organization_invitations (
   /** The unique identifier of the invitation. */
   id varchar(21) not null,
   /** The user ID who sent the invitation. */
-  inviter_id varchar(21)
+  inviter_id varchar(128)
     references users (id) on update cascade on delete cascade,
   /** The email address or other identifier of the invitee. */
   invitee varchar(256) not null,
   /** The user ID of who accepted the invitation. */
-  accepted_user_id varchar(21)
+  accepted_user_id varchar(128)
     references users (id) on update cascade on delete cascade,
   /** The ID of the organization to which the invitee is invited. */
   organization_id varchar(21) not null

package/tables/organization_role_user_relations.sql

@@ -7,7 +7,7 @@ create table organization_role_user_relations (
   organization_id varchar(21) not null,
   organization_role_id varchar(21) not null
     references organization_roles (id) on update cascade on delete cascade,
-  user_id varchar(21) not null,
+  user_id varchar(128) not null,
   primary key (tenant_id, organization_id, organization_role_id, user_id),
   /** User's roles in an organization should be synchronized with the user's membership in the organization. */
   foreign key (tenant_id, organization_id, user_id)

package/tables/organization_user_relations.sql

@@ -6,7 +6,7 @@ create table organization_user_relations (
     references tenants (id) on update cascade on delete cascade,
   organization_id varchar(21) not null
     references organizations (id) on update cascade on delete cascade,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   primary key (tenant_id, organization_id, user_id),
   constraint organization_user_relations__user_id__fk

package/tables/personal_access_tokens.sql

@@ -3,7 +3,7 @@
 create table personal_access_tokens (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   /** The name of the secret. Should be unique within the user. */
   name varchar(256) not null,

package/tables/saml_application_configs.sql

@@ -10,6 +10,7 @@ create table saml_application_configs (
   entity_id varchar(128),
   acs_url jsonb /* @use SamlAcsUrl */,
   encryption jsonb /* @use SamlEncryption */,
+  authn_request_config jsonb /* @use SamlAuthnRequestConfig */,
   name_id_format varchar(128) /* @use NameIdFormat */ not null,
   primary key (tenant_id, application_id),
   constraint saml_application_configs__application_type

package/tables/secrets.sql

@@ -3,7 +3,7 @@ create table secrets (
   tenant_id varchar(21) not null 
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null primary key,
-  user_id varchar(21) not null 
+  user_id varchar(128) not null 
     references users (id) on update cascade on delete cascade,
   type varchar(256) /* @use SecretType */ not null,
   /** Encrypted data encryption key (DEK) for the secret. */

package/tables/subject_tokens.sql

@@ -5,7 +5,7 @@ create table subject_tokens (
   context jsonb /* @use JsonObject */ not null default '{}'::jsonb,
   expires_at timestamptz not null,
   consumed_at timestamptz,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   created_at timestamptz not null default(now()),
   /* It is intented to not reference to user or application table, it can be userId or applicationId, for audit only */

package/tables/trusted_devices.sql

@@ -5,7 +5,7 @@ create table trusted_devices (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null,
-  user_id varchar(12) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   secret_hash bytea /* @use BufferLike */ not null,
   user_agent text,

package/tables/user_geo_locations.sql

@@ -4,7 +4,7 @@
 create table user_geo_locations (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
-  user_id varchar(12) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   latitude numeric(9,6),
   longitude numeric(9,6),

package/tables/user_sign_in_countries.sql

@@ -4,7 +4,7 @@
 create table user_sign_in_countries (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
-  user_id varchar(12) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   /** ISO 3166-1 alpha-2 country code (2 chars), stored up to 16 chars for robustness. */
   country varchar(16) not null,

package/tables/user_sso_identities.sql

@@ -4,7 +4,7 @@ create table user_sso_identities (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null,
-  user_id varchar(12) not null references users (id) on update cascade on delete cascade,
+  user_id varchar(128) not null references users (id) on update cascade on delete cascade,
   /** Unique provider identifier. Issuer of the OIDC connectors, entityId of the SAML providers */
   issuer varchar(256) not null,
   /** Provider user identity id*/

package/tables/users.sql

@@ -5,7 +5,7 @@ create type users_password_encryption_method as enum ('Argon2i', 'Argon2id', 'Ar
 create table users (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
-  id varchar(12) not null,
+  id varchar(128) not null,
   username varchar(128),
   primary_email varchar(128),
   primary_phone varchar(128),

package/tables/users_roles.sql

@@ -4,7 +4,7 @@ create table users_roles (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   role_id varchar(21) not null
     references roles (id) on update cascade on delete cascade,

package/tables/verification_records.sql

@@ -2,7 +2,7 @@ create table verification_records (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null,
-  user_id varchar(21)
+  user_id varchar(128)
     references users (id) on update cascade on delete cascade,
   created_at timestamptz not null default(now()),
   expires_at timestamptz not null,

package/tables/verification_statuses.sql

@@ -2,7 +2,7 @@ create table verification_statuses (
   tenant_id varchar(21) not null
     references tenants (id) on update cascade on delete cascade,
   id varchar(21) not null,
-  user_id varchar(21) not null
+  user_id varchar(128) not null
     references users (id) on update cascade on delete cascade,
   created_at timestamptz not null default(now()),
   verified_identifier varchar(255),