@nathapp/nestjs-oauth-prisma 1.0.0

package/prisma/migrations/20260724_oauth_client_advanced_auth_fields/migration.mysql.sql

@@ -0,0 +1,10 @@
+-- MySQL equivalent of migration.sql.
+ALTER TABLE `oauth_clients`
+  ADD COLUMN `token_endpoint_auth_method` VARCHAR(191) NULL,
+  ADD COLUMN `jwks` JSON NULL,
+  ADD COLUMN `jwks_uri` TEXT NULL,
+  ADD COLUMN `tls_client_auth_subject_dn` TEXT NULL,
+  ADD COLUMN `tls_client_auth_san_dns` JSON NULL,
+  ADD COLUMN `tls_client_auth_self_signed_thumbprint` VARCHAR(191) NULL,
+  ADD COLUMN `client_secret_hash_previous` VARCHAR(191) NULL,
+  ADD COLUMN `previous_secret_expires_at` DATETIME(6) NULL;

package/prisma/migrations/20260724_oauth_client_advanced_auth_fields/migration.sql

@@ -0,0 +1,9 @@
+ALTER TABLE "oauth_clients"
+  ADD COLUMN "token_endpoint_auth_method" TEXT,
+  ADD COLUMN "jwks" JSONB,
+  ADD COLUMN "jwks_uri" TEXT,
+  ADD COLUMN "tls_client_auth_subject_dn" TEXT,
+  ADD COLUMN "tls_client_auth_san_dns" JSONB,
+  ADD COLUMN "tls_client_auth_self_signed_thumbprint" TEXT,
+  ADD COLUMN "client_secret_hash_previous" TEXT,
+  ADD COLUMN "previous_secret_expires_at" TIMESTAMPTZ(6);

package/prisma/migrations/20260725_oauth_resource_indicator/migration.mysql.sql

@@ -0,0 +1,10 @@
+-- MySQL equivalent of migration.sql. MySQL 8 accepts a JSON default only as an
+-- expression, hence the parenthesised (JSON_ARRAY()).
+ALTER TABLE `oauth_clients`
+  ADD COLUMN `allowed_resources` JSON NOT NULL DEFAULT (JSON_ARRAY()),
+  ADD COLUMN `require_resource` BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE `oauth_authorization_codes` ADD COLUMN `resource` TEXT NULL;
+ALTER TABLE `oauth_pushed_requests` ADD COLUMN `resource` TEXT NULL;
+ALTER TABLE `oauth_access_tokens` ADD COLUMN `resource` TEXT NULL;
+ALTER TABLE `oauth_refresh_tokens` ADD COLUMN `resource` TEXT NULL;

package/prisma/migrations/20260725_oauth_resource_indicator/migration.sql

@@ -0,0 +1,15 @@
+ALTER TABLE "oauth_clients"
+  ADD COLUMN "allowed_resources" JSONB NOT NULL DEFAULT '[]',
+  ADD COLUMN "require_resource" BOOLEAN NOT NULL DEFAULT FALSE;
+
+ALTER TABLE "oauth_authorization_codes"
+  ADD COLUMN "resource" TEXT;
+
+ALTER TABLE "oauth_pushed_requests"
+  ADD COLUMN "resource" TEXT;
+
+ALTER TABLE "oauth_access_tokens"
+  ADD COLUMN "resource" TEXT;
+
+ALTER TABLE "oauth_refresh_tokens"
+  ADD COLUMN "resource" TEXT;

package/prisma/migrations/20260725_oauth_token_exchange_actor/migration.mysql.sql

@@ -0,0 +1,2 @@
+-- MySQL equivalent of migration.sql.
+ALTER TABLE `oauth_access_tokens` ADD COLUMN `actor_client_id` VARCHAR(191) NULL;

package/prisma/migrations/20260725_oauth_token_exchange_actor/migration.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "oauth_access_tokens"
+  ADD COLUMN "actor_client_id" TEXT;

package/prisma/migrations/20261003_oauth_access_token_mtls_binding/migration.mysql.sql

@@ -0,0 +1,2 @@
+-- MySQL equivalent of migration.sql.
+ALTER TABLE `oauth_access_tokens` ADD COLUMN `cnf_x5t_s256` VARCHAR(191) NULL;

package/prisma/migrations/20261003_oauth_access_token_mtls_binding/migration.sql

@@ -0,0 +1,2 @@
+ALTER TABLE "oauth_access_tokens"
+  ADD COLUMN "cnf_x5t_s256" TEXT;

package/prisma/migrations/20261004_oauth_signing_keys_one_active_per_tenant/migration.mysql.sql

@@ -0,0 +1,13 @@
+-- MySQL equivalent of migration.sql: one active signing key per tenant (NULL
+-- tenant_id = the global key), replacing 20260608's global index. A functional
+-- unique index (MySQL 8.0.13+) over an expression that is NULL for every
+-- non-active row; NULLs never collide.
+--
+-- Preflight: resolve any rows this returns before creating the index:
+--   SELECT tenant_id, COUNT(*) FROM oauth_signing_keys WHERE status = 'active'
+--   GROUP BY tenant_id HAVING COUNT(*) > 1;
+CREATE UNIQUE INDEX oauth_signing_keys_one_active_per_tenant
+  ON oauth_signing_keys ((CASE WHEN status = 'active' THEN COALESCE(tenant_id, '') ELSE NULL END));
+
+-- Only if 20260608_oauth_signing_keys_one_active was applied:
+DROP INDEX oauth_signing_keys_one_active ON oauth_signing_keys;

package/prisma/migrations/20261004_oauth_signing_keys_one_active_per_tenant/migration.sql

@@ -0,0 +1,14 @@
+-- One active signing key per tenant (NULL tenant_id = the global key), replacing
+-- 20260608's global index. Signing keys became tenant-scoped after that index was
+-- written, so the global index lets only one tenant hold an active key: on a
+-- multi-tenant database every other tenant's first key insert fails.
+--
+-- Preflight: resolve any rows this returns (retire all but one active key per
+-- tenant) before creating the index:
+--   SELECT tenant_id, COUNT(*) FROM oauth_signing_keys WHERE status = 'active'
+--   GROUP BY tenant_id HAVING COUNT(*) > 1;
+CREATE UNIQUE INDEX IF NOT EXISTS oauth_signing_keys_one_active_per_tenant
+ON oauth_signing_keys ((COALESCE(tenant_id, '')))
+WHERE status = 'active';
+
+DROP INDEX IF EXISTS oauth_signing_keys_one_active;

package/prisma/oauth.prisma

@@ -0,0 +1,287 @@
+// === @nathapp/nestjs-oauth schema fragment ===
+// Append these models to your application's schema.prisma.
+//
+// TZ NOTE: All DateTime fields use @db.Timestamptz(6) (timestamptz in PostgreSQL).
+// When migrating an existing database, use:
+//   ALTER TABLE t ALTER COLUMN col TYPE TIMESTAMPTZ(6) USING col AT TIME ZONE 'UTC';
+// The USING clause treats existing values as UTC — safe if your DB was UTC-configured.
+// Verify your DB timezone (SHOW timezone;) before running migrations on production data.
+
+model OAuthClient {
+  id                     String   @id @default(uuid())
+  tenantId               String?  @map("tenant_id")
+  clientId               String   @unique @map("client_id")
+  clientSecretHash       String?  @map("client_secret_hash")
+  name                   String
+  description            String? @db.Text
+  clientType             String   @default("confidential") @map("client_type")
+  redirectUris           Json     @default("[]") @map("redirect_uris")
+  postLogoutRedirectUris Json?    @default("[]") @map("post_logout_redirect_uris")
+  grantTypes             Json     @default("[\"authorization_code\",\"refresh_token\"]") @map("grant_types")
+  responseTypes          Json     @default("[\"code\"]") @map("response_types")
+  accessTokenTtl         Int      @default(3600) @map("access_token_ttl")
+  refreshTokenTtl        Int      @default(604800) @map("refresh_token_ttl")
+  authCodeTtl            Int      @default(600) @map("auth_code_ttl")
+  pkceRequired                    String   @default("required") @map("pkce_required")
+  requireConsent                  Boolean  @default(true) @map("require_consent")
+  dpopBoundAccessTokens           Boolean  @default(false) @map("dpop_bound_access_tokens")
+  backchannelLogoutUri            String? @db.Text @map("backchannel_logout_uri")
+  backchannelLogoutSessionRequired Boolean? @map("backchannel_logout_session_required")
+  frontchannelLogoutUri           String? @db.Text @map("frontchannel_logout_uri")
+  frontchannelLogoutSessionRequired Boolean? @map("frontchannel_logout_session_required")
+  tokenEndpointAuthMethod          String?  @map("token_endpoint_auth_method")
+  allowedResources           Json     @default("[]") @map("allowed_resources")
+  requireResource            Boolean  @default(false) @map("require_resource")
+  jwks                             Json?    @map("jwks")
+  jwksUri                          String? @db.Text @map("jwks_uri")
+  tlsClientAuthSubjectDn           String? @db.Text @map("tls_client_auth_subject_dn")
+  tlsClientAuthSanDns              Json?    @map("tls_client_auth_san_dns")
+  tlsClientAuthSelfSignedThumbprint String? @map("tls_client_auth_self_signed_thumbprint")
+  clientSecretHashPrevious         String?  @map("client_secret_hash_previous")
+  previousSecretExpiresAt          DateTime? @db.Timestamptz(6) @map("previous_secret_expires_at")
+  status                          Int      @default(1)
+  createdAt              DateTime @db.Timestamptz(6) @default(now()) @map("created_at")
+  updatedAt              DateTime @db.Timestamptz(6) @updatedAt      @map("updated_at")
+
+  scopes             OAuthClientScope[]
+  authorizationCodes OAuthAuthorizationCode[]
+  accessTokens       OAuthAccessToken[]
+  refreshTokens      OAuthRefreshToken[]
+  consents           OAuthConsent[]
+  deviceCodes        OAuthDeviceCode[]
+  pushedRequests     OAuthPushedRequest[]
+
+  @@index([tenantId])
+  @@map("oauth_clients")
+}
+
+model OAuthScope {
+  id          String   @id @default(uuid())
+  code        String   @unique
+  name        String
+  description String?
+  claims      Json     @default("[]")
+  isSystem    Boolean  @default(false) @map("is_system")
+  status      Int      @default(1)
+  createdAt   DateTime @db.Timestamptz(6) @default(now()) @map("created_at")
+  updatedAt   DateTime @db.Timestamptz(6) @updatedAt      @map("updated_at")
+
+  clients            OAuthClientScope[]
+  authorizationCodes OAuthAuthorizationCodeScope[]
+  accessTokens       OAuthAccessTokenScope[]
+  consents           OAuthConsentScope[]
+
+  @@map("oauth_scopes")
+}
+
+model OAuthClientScope {
+  clientId  String  @map("client_id")
+  scopeId   String  @map("scope_id")
+  isDefault Boolean @default(false) @map("is_default")
+
+  client OAuthClient @relation(fields: [clientId], references: [id], onDelete: Cascade)
+  scope  OAuthScope  @relation(fields: [scopeId], references: [id])
+
+  @@id([clientId, scopeId])
+  @@map("oauth_client_scopes")
+}
+
+model OAuthAuthorizationCode {
+  id                  String    @id @default(uuid())
+  tenantId            String?   @map("tenant_id")
+  code                String    @unique
+  clientId            String    @map("client_id")
+  userId              String    @map("user_id")
+  codeChallenge       String?   @map("code_challenge")
+  codeChallengeMethod String?   @map("code_challenge_method")
+  redirectUri         String @db.Text @map("redirect_uri")
+  state               String? @db.Text
+  nonce               String? @db.Text
+  sid                 String?   @map("sid")
+  expiresAt           DateTime  @db.Timestamptz(6) @map("expires_at")
+  usedAt              DateTime? @db.Timestamptz(6) @map("used_at")
+  authTime            DateTime? @db.Timestamptz(6) @map("auth_time")
+  resource            String? @db.Text @map("resource")
+  createdAt           DateTime  @db.Timestamptz(6) @default(now()) @map("created_at")
+
+  client OAuthClient                   @relation(fields: [clientId], references: [id])
+  scopes OAuthAuthorizationCodeScope[]
+
+  @@index([tenantId])
+  @@index([clientId])
+  @@index([userId])
+  @@index([expiresAt])
+  @@map("oauth_authorization_codes")
+}
+
+model OAuthAuthorizationCodeScope {
+  authCodeId String @map("auth_code_id")
+  scopeId    String @map("scope_id")
+
+  authCode OAuthAuthorizationCode @relation(fields: [authCodeId], references: [id], onDelete: Cascade)
+  scope    OAuthScope             @relation(fields: [scopeId], references: [id])
+
+  @@id([authCodeId, scopeId])
+  @@map("oauth_authorization_code_scopes")
+}
+
+model OAuthAccessToken {
+  id        String    @id @default(uuid())
+  tenantId  String?   @map("tenant_id")
+  tokenHash String    @unique @map("token_hash")
+  clientId  String    @map("client_id")
+  userId    String?   @map("user_id")
+  tokenType String    @default("Bearer") @map("token_type")
+  expiresAt DateTime  @db.Timestamptz(6) @map("expires_at")
+  revokedAt DateTime? @db.Timestamptz(6) @map("revoked_at")
+  cnfJkt    String?   @map("cnf_jkt")
+  cnfX5tS256 String?  @map("cnf_x5t_s256")
+  createdAt DateTime  @db.Timestamptz(6) @default(now()) @map("created_at")
+
+  refreshTokenId String? @map("refresh_token_id")
+  resource        String? @db.Text @map("resource")
+  actorClientId   String? @map("actor_client_id")
+
+  client OAuthClient            @relation(fields: [clientId], references: [id])
+  scopes OAuthAccessTokenScope[]
+
+  @@index([tenantId])
+  @@index([clientId])
+  @@index([userId])
+  @@index([expiresAt])
+  @@index([refreshTokenId])
+  @@map("oauth_access_tokens")
+}
+
+model OAuthAccessTokenScope {
+  accessTokenId String @map("access_token_id")
+  scopeId       String @map("scope_id")
+
+  accessToken OAuthAccessToken @relation(fields: [accessTokenId], references: [id], onDelete: Cascade)
+  scope       OAuthScope       @relation(fields: [scopeId], references: [id])
+
+  @@id([accessTokenId, scopeId])
+  @@map("oauth_access_token_scopes")
+}
+
+model OAuthRefreshToken {
+  id                String    @id @default(uuid())
+  tenantId          String?   @map("tenant_id")
+  tokenHash         String    @unique @map("token_hash")
+  clientId          String    @map("client_id")
+  userId            String    @map("user_id")
+  scope             String? @db.Text
+  previousTokenHash String?   @map("previous_token_hash")
+  expiresAt         DateTime  @db.Timestamptz(6) @map("expires_at")
+  revokedAt         DateTime? @db.Timestamptz(6) @map("revoked_at")
+  cnfJkt            String?   @map("cnf_jkt")
+  lastUsedAt        DateTime? @db.Timestamptz(6) @map("last_used_at")
+  resource          String? @db.Text @map("resource")
+  createdAt         DateTime  @db.Timestamptz(6) @default(now()) @map("created_at")
+
+  client OAuthClient @relation(fields: [clientId], references: [id])
+
+  @@index([tenantId])
+  @@index([clientId])
+  @@index([userId])
+  @@index([expiresAt])
+  @@map("oauth_refresh_tokens")
+}
+
+model OAuthConsent {
+  id        String    @id @default(uuid())
+  tenantId  String?   @map("tenant_id")
+  clientId  String    @map("client_id")
+  userId    String    @map("user_id")
+  grantedAt DateTime  @db.Timestamptz(6) @default(now()) @map("granted_at")
+  revokedAt DateTime? @db.Timestamptz(6) @map("revoked_at")
+
+  client OAuthClient        @relation(fields: [clientId], references: [id])
+  scopes OAuthConsentScope[]
+
+  @@unique([clientId, userId])
+  @@index([tenantId])
+  @@index([userId])
+  @@map("oauth_consents")
+}
+
+model OAuthConsentScope {
+  consentId String @map("consent_id")
+  scopeId   String @map("scope_id")
+
+  consent OAuthConsent @relation(fields: [consentId], references: [id], onDelete: Cascade)
+  scope   OAuthScope   @relation(fields: [scopeId], references: [id])
+
+  @@id([consentId, scopeId])
+  @@map("oauth_consent_scopes")
+}
+
+// Application invariant: at most one key may have status = 'active' at any time.
+// Enforced via the raw SQL migration in prisma/migrations/*_oauth_signing_keys_one_active/.
+model OAuthSigningKey {
+  id            String    @id @default(uuid())
+  tenantId      String?   @map("tenant_id")
+  kid           String    @unique
+  alg           String    @default("RS256")
+  privateKeyPem String @db.Text @map("private_key_pem")
+  publicKeyPem  String @db.Text @map("public_key_pem")
+  status        String    @default("active")
+  createdAt     DateTime  @db.Timestamptz(6) @default(now()) @map("created_at")
+  expiresAt     DateTime? @db.Timestamptz(6) @map("expires_at")
+
+  @@index([status])
+  @@index([tenantId, status])
+  @@map("oauth_signing_keys")
+}
+
+model OAuthDeviceCode {
+  id             String    @id @default(uuid())
+  tenantId       String?   @map("tenant_id")
+  deviceCodeHash String    @unique @map("device_code_hash")
+  userCodeHash   String    @unique @map("user_code_hash")
+  clientId       String    @map("client_id")
+  scope          String? @db.Text
+  status         String    @default("pending")
+  userId         String?   @map("user_id")
+  authTime       DateTime? @db.Timestamptz(6) @map("auth_time")
+  interval       Int       @default(5)
+  lastPolledAt   DateTime? @db.Timestamptz(6) @map("last_polled_at")
+  approvedAt     DateTime? @db.Timestamptz(6) @map("approved_at")
+  consumedAt     DateTime? @db.Timestamptz(6) @map("consumed_at")
+  expiresAt      DateTime  @db.Timestamptz(6) @map("expires_at")
+  createdAt      DateTime  @db.Timestamptz(6) @default(now()) @map("created_at")
+
+  client OAuthClient @relation(fields: [clientId], references: [id])
+
+  @@index([tenantId])
+  @@index([clientId])
+  @@index([expiresAt])
+  @@map("oauth_device_codes")
+}
+
+model OAuthPushedRequest {
+  id                  String    @id @default(uuid())
+  tenantId            String?   @map("tenant_id")
+  requestUriHash      String    @unique @map("request_uri_hash")
+  clientId            String    @map("client_id")
+  responseType        String    @map("response_type")
+  redirectUri         String @db.Text @map("redirect_uri")
+  scope               String? @db.Text
+  state               String? @db.Text
+  codeChallenge       String?   @map("code_challenge")
+  codeChallengeMethod String?   @map("code_challenge_method")
+  nonce               String? @db.Text
+  prompt              String?
+  maxAge              String?   @map("max_age")
+  consumedAt          DateTime? @db.Timestamptz(6) @map("consumed_at")
+  resource            String? @db.Text @map("resource")
+  expiresAt           DateTime  @db.Timestamptz(6) @map("expires_at")
+  createdAt           DateTime  @db.Timestamptz(6) @default(now()) @map("created_at")
+
+  client OAuthClient @relation(fields: [clientId], references: [id])
+
+  @@index([tenantId])
+  @@index([clientId])
+  @@index([expiresAt])
+  @@map("oauth_pushed_requests")
+}

package/prisma/sql/long-text-columns.mysql.sql

@@ -0,0 +1,29 @@
+-- MySQL only. Widens columns whose values can exceed VARCHAR(191) (Prisma's MySQL
+-- mapping for a bare String). PostgreSQL needs nothing: String is already text there.
+-- Apply once to a MySQL database created from an earlier version of this fragment.
+ALTER TABLE `oauth_clients` MODIFY `description` TEXT NULL,
+    MODIFY `backchannel_logout_uri` TEXT NULL,
+    MODIFY `frontchannel_logout_uri` TEXT NULL,
+    MODIFY `jwks_uri` TEXT NULL,
+    MODIFY `tls_client_auth_subject_dn` TEXT NULL;
+
+ALTER TABLE `oauth_authorization_codes` MODIFY `redirect_uri` TEXT NOT NULL,
+    MODIFY `state` TEXT NULL,
+    MODIFY `nonce` TEXT NULL,
+    MODIFY `resource` TEXT NULL;
+
+ALTER TABLE `oauth_access_tokens` MODIFY `resource` TEXT NULL;
+
+ALTER TABLE `oauth_refresh_tokens` MODIFY `scope` TEXT NULL,
+    MODIFY `resource` TEXT NULL;
+
+ALTER TABLE `oauth_signing_keys` MODIFY `private_key_pem` TEXT NOT NULL,
+    MODIFY `public_key_pem` TEXT NOT NULL;
+
+ALTER TABLE `oauth_device_codes` MODIFY `scope` TEXT NULL;
+
+ALTER TABLE `oauth_pushed_requests` MODIFY `redirect_uri` TEXT NOT NULL,
+    MODIFY `scope` TEXT NULL,
+    MODIFY `state` TEXT NULL,
+    MODIFY `nonce` TEXT NULL,
+    MODIFY `resource` TEXT NULL;