@seams/wallet-server 0.8.0 → 0.9.0

package/migrations/d1-signer/0052_wallet_relocation_session_fences.sql

@@ -0,0 +1,91 @@
+CREATE TABLE wallet_relocation_session_fences (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL CHECK (source_generation > 0 AND source_generation < 9007199254740991),
+  retired_at_ms INTEGER NOT NULL CHECK (retired_at_ms > 0),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id),
+  CHECK (length(move_id) = 49 AND substr(move_id, 1, 6) = 'wmove_' AND substr(move_id, 7) NOT GLOB '*[^A-Za-z0-9_-]*'),
+  CHECK (length(request_digest_hex) = 64 AND request_digest_hex NOT GLOB '*[^a-f0-9]*')
+);
+
+CREATE TRIGGER wallet_relocation_session_fences_immutable
+BEFORE UPDATE ON wallet_relocation_session_fences
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex
+  OR NEW.source_generation IS NOT OLD.source_generation OR NEW.retired_at_ms IS NOT OLD.retired_at_ms
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_fence_immutable');
+END;
+
+CREATE TRIGGER wallet_relocation_session_fences_retain
+BEFORE DELETE ON wallet_relocation_session_fences
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_fence_retained');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_relocation_insert_guard
+BEFORE INSERT ON wallet_session_authorizations_v2
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_relocation_update_guard
+BEFORE UPDATE ON wallet_session_authorizations_v2
+WHEN (NEW.retired_at_ms IS NULL) AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id) OR (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_relocation_insert_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_relocation_update_guard
+BEFORE UPDATE ON wallet_session_hosted_credentials_v2
+WHEN (NEW.lifecycle_kind = 'active') AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id) OR (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_relocation_insert_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_relocation_update_guard
+BEFORE UPDATE ON wallet_session_hosted_exchange_codes_v2
+WHEN (NEW.lifecycle_kind IN ('issued', 'consumed')) AND EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS fence
+  WHERE (fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id AND fence.wallet_id = OLD.wallet_id) OR (fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id AND fence.wallet_id = NEW.wallet_id)
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_relocation_session_admission_closed');
+END;

package/migrations/d1-signer/0053_wallet_hosted_history_import.sql

@@ -0,0 +1,164 @@
+CREATE TABLE wallet_relocation_hosted_imports (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL CHECK (source_generation > 0 AND source_generation < 9007199254740991),
+  state TEXT NOT NULL CHECK (state IN ('importing', 'closed', 'activated')),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE TABLE wallet_relocation_hosted_import_context (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('credential', 'exchange')),
+  tenant_id TEXT NOT NULL, record_id TEXT NOT NULL,
+  record_digest TEXT NOT NULL CHECK (length(record_digest) = 64 AND record_digest NOT GLOB '*[^a-f0-9]*'),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, kind, tenant_id, record_id)
+);
+
+CREATE TABLE wallet_relocation_hosted_import_receipts (
+  namespace TEXT NOT NULL, org_id TEXT NOT NULL, project_id TEXT NOT NULL, env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL, move_id TEXT NOT NULL, request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  kind TEXT NOT NULL CHECK (kind IN ('credential', 'exchange')),
+  tenant_id TEXT NOT NULL, record_id TEXT NOT NULL,
+  record_digest TEXT NOT NULL CHECK (length(record_digest) = 64 AND record_digest NOT GLOB '*[^a-f0-9]*'),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id, move_id, kind, tenant_id, record_id)
+);
+
+CREATE TRIGGER wallet_relocation_hosted_import_identity_guard
+BEFORE UPDATE ON wallet_relocation_hosted_imports
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex OR NEW.source_generation IS NOT OLD.source_generation
+  OR (OLD.state = 'closed' AND NEW.state = 'importing')
+  OR (OLD.state = 'activated' AND NEW.state != 'activated')
+  OR (OLD.state = 'importing' AND NEW.state = 'activated')
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_import_transition_rejected'); END;
+
+CREATE TRIGGER wallet_relocation_hosted_import_retain
+BEFORE DELETE ON wallet_relocation_hosted_imports
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_import_retained'); END;
+
+CREATE TRIGGER wallet_relocation_hosted_receipt_immutable
+BEFORE UPDATE ON wallet_relocation_hosted_import_receipts
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_receipt_immutable'); END;
+
+CREATE TRIGGER wallet_relocation_hosted_receipt_retain
+BEFORE DELETE ON wallet_relocation_hosted_import_receipts
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_receipt_retained'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_import_insert_guard
+BEFORE INSERT ON wallet_session_authorizations_v2
+WHEN NEW.retired_at_ms IS NULL AND EXISTS (
+  SELECT 1 FROM wallet_relocation_hosted_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_destination_inactive'); END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_import_update_guard
+BEFORE UPDATE ON wallet_session_authorizations_v2
+WHEN NEW.retired_at_ms IS NULL AND EXISTS (
+  SELECT 1 FROM wallet_relocation_hosted_imports AS destination
+  WHERE destination.namespace = NEW.namespace AND destination.org_id = NEW.org_id
+    AND destination.project_id = NEW.project_id AND destination.env_id = NEW.env_id
+    AND destination.wallet_id = NEW.wallet_id AND destination.state != 'activated'
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_hosted_history_destination_inactive'); END;
+
+DROP TRIGGER wallet_session_hosted_credentials_v2_insert_lifecycle_guard;
+CREATE TRIGGER wallet_session_hosted_credentials_v2_insert_lifecycle_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN (NEW.lifecycle_kind != 'active' OR NEW.retired_at_ms IS NOT NULL) AND NOT (NEW.lifecycle_kind = 'retired' AND NEW.retired_at_ms IS NOT NULL AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'credential' AND context.record_id = NEW.hosted_credential_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_credential_initial_state_rejected'); END;
+
+DROP TRIGGER wallet_session_hosted_credentials_v2_parent_guard;
+CREATE TRIGGER wallet_session_hosted_credentials_v2_parent_guard
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.tenant_id = NEW.tenant_id AND session.authorization_id = NEW.authorization_id
+    AND session.wallet_session_id = NEW.wallet_session_id AND session.quota_id = NEW.quota_id
+    AND session.principal_id = NEW.principal_id AND session.wallet_id = NEW.wallet_id
+    AND session.authority_id = NEW.authority_id AND session.wallet_auth_method_id = NEW.wallet_auth_method_id
+    AND session.operation_credential_hash IS NOT NULL AND session.expires_at_ms >= NEW.expires_at_ms
+    AND (session.retired_at_ms IS NULL OR (NEW.lifecycle_kind = 'retired' AND NEW.retired_at_ms IS NOT NULL AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'credential' AND context.record_id = NEW.hosted_credential_id)))
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_credential_parent_rejected'); END;
+
+DROP TRIGGER wallet_session_hosted_exchange_codes_v2_insert_lifecycle_guard;
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_insert_lifecycle_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN (NEW.lifecycle_kind != 'issued' OR NEW.hosted_credential_id IS NOT NULL OR NEW.consumed_at_ms IS NOT NULL) AND NOT ((NEW.lifecycle_kind = 'issued' OR (NEW.lifecycle_kind = 'consumed' AND EXISTS (
+      SELECT 1 FROM wallet_session_hosted_credentials_v2 AS child
+      WHERE child.namespace = NEW.namespace AND child.org_id = NEW.org_id
+        AND child.project_id = NEW.project_id AND child.env_id = NEW.env_id
+        AND child.tenant_id = NEW.tenant_id AND child.hosted_credential_id = NEW.hosted_credential_id
+        AND child.wallet_id = NEW.wallet_id AND child.lifecycle_kind = 'retired'))) AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'exchange' AND context.record_id = NEW.exchange_code_id))
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_exchange_initial_state_rejected'); END;
+
+DROP TRIGGER wallet_session_hosted_exchange_codes_v2_parent_guard;
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_parent_guard
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN NOT EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.tenant_id = NEW.tenant_id AND session.authorization_id = NEW.authorization_id
+    AND session.wallet_session_id = NEW.wallet_session_id AND session.quota_id = NEW.quota_id
+    AND session.principal_id = NEW.principal_id AND session.wallet_id = NEW.wallet_id
+    AND session.authority_id = NEW.authority_id AND session.wallet_auth_method_id = NEW.wallet_auth_method_id
+    AND session.operation_credential_hash IS NOT NULL AND session.expires_at_ms >= NEW.expires_at_ms
+    AND (session.retired_at_ms IS NULL OR ((NEW.lifecycle_kind = 'issued' OR (NEW.lifecycle_kind = 'consumed' AND EXISTS (
+      SELECT 1 FROM wallet_session_hosted_credentials_v2 AS child
+      WHERE child.namespace = NEW.namespace AND child.org_id = NEW.org_id
+        AND child.project_id = NEW.project_id AND child.env_id = NEW.env_id
+        AND child.tenant_id = NEW.tenant_id AND child.hosted_credential_id = NEW.hosted_credential_id
+        AND child.wallet_id = NEW.wallet_id AND child.lifecycle_kind = 'retired'))) AND EXISTS (SELECT 1 FROM wallet_relocation_hosted_import_context AS context
+    JOIN wallet_relocation_hosted_imports AS destination
+      ON destination.namespace = context.namespace AND destination.org_id = context.org_id
+      AND destination.project_id = context.project_id AND destination.env_id = context.env_id
+      AND destination.wallet_id = context.wallet_id AND destination.move_id = context.move_id
+      AND destination.request_digest_hex = context.request_digest_hex
+      AND destination.source_generation = context.source_generation AND destination.state = 'importing'
+    WHERE context.namespace = NEW.namespace AND context.org_id = NEW.org_id
+      AND context.project_id = NEW.project_id AND context.env_id = NEW.env_id
+      AND context.wallet_id = NEW.wallet_id AND context.tenant_id = NEW.tenant_id
+      AND context.kind = 'exchange' AND context.record_id = NEW.exchange_code_id)))
+)
+BEGIN SELECT RAISE(ABORT, 'wallet_session_hosted_exchange_parent_rejected'); END;

package/migrations/d1-signer/0054_wallet_authorization_freeze.sql

@@ -0,0 +1,318 @@
+-- Freeze authorization history only after wallet-wide session retirement.
+CREATE TABLE wallet_relocation_authorization_fences (
+  namespace TEXT NOT NULL,
+  org_id TEXT NOT NULL,
+  project_id TEXT NOT NULL,
+  env_id TEXT NOT NULL,
+  wallet_id TEXT NOT NULL,
+  move_id TEXT NOT NULL,
+  request_digest_hex TEXT NOT NULL,
+  source_generation INTEGER NOT NULL,
+  frozen_at_ms INTEGER NOT NULL CHECK (frozen_at_ms > 0),
+  PRIMARY KEY (namespace, org_id, project_id, env_id, wallet_id)
+);
+
+CREATE TRIGGER wallet_relocation_authorization_fences_retired
+BEFORE INSERT ON wallet_relocation_authorization_fences
+WHEN EXISTS (
+  SELECT 1 FROM wallet_relocation_authorization_fences AS existing
+  WHERE existing.namespace = NEW.namespace AND existing.org_id = NEW.org_id
+    AND existing.project_id = NEW.project_id AND existing.env_id = NEW.env_id
+    AND existing.wallet_id = NEW.wallet_id
+) OR NOT EXISTS (
+  SELECT 1 FROM wallet_relocation_session_fences AS retired
+  WHERE retired.namespace = NEW.namespace AND retired.org_id = NEW.org_id
+    AND retired.project_id = NEW.project_id AND retired.env_id = NEW.env_id
+    AND retired.wallet_id = NEW.wallet_id AND retired.move_id = NEW.move_id
+    AND retired.request_digest_hex = NEW.request_digest_hex
+    AND retired.source_generation = NEW.source_generation
+    AND retired.retired_at_ms <= NEW.frozen_at_ms
+) OR EXISTS (
+  SELECT 1 FROM wallet_session_authorizations_v2 AS session
+  WHERE session.namespace = NEW.namespace AND session.org_id = NEW.org_id
+    AND session.project_id = NEW.project_id AND session.env_id = NEW.env_id
+    AND session.wallet_id = NEW.wallet_id AND session.retired_at_ms IS NULL
+) OR EXISTS (
+  SELECT 1 FROM wallet_session_hosted_credentials_v2 AS credential
+  WHERE credential.namespace = NEW.namespace AND credential.org_id = NEW.org_id
+    AND credential.project_id = NEW.project_id AND credential.env_id = NEW.env_id
+    AND credential.wallet_id = NEW.wallet_id AND credential.lifecycle_kind = 'active'
+)
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_freeze_requires_retirement');
+END;
+
+CREATE TRIGGER wallet_relocation_authorization_fences_immutable
+BEFORE UPDATE ON wallet_relocation_authorization_fences
+WHEN NEW.namespace IS NOT OLD.namespace OR NEW.org_id IS NOT OLD.org_id
+  OR NEW.project_id IS NOT OLD.project_id OR NEW.env_id IS NOT OLD.env_id
+  OR NEW.wallet_id IS NOT OLD.wallet_id OR NEW.move_id IS NOT OLD.move_id
+  OR NEW.request_digest_hex IS NOT OLD.request_digest_hex
+  OR NEW.source_generation IS NOT OLD.source_generation OR NEW.frozen_at_ms IS NOT OLD.frozen_at_ms
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_fence_immutable');
+END;
+
+CREATE TRIGGER wallet_relocation_authorization_fences_retain
+BEFORE DELETE ON wallet_relocation_authorization_fences
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_fence_retained');
+END;
+
+CREATE TRIGGER wallet_authorities_frozen_insert
+BEFORE INSERT ON wallet_authorities
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_authorities_frozen_update
+BEFORE UPDATE ON wallet_authorities
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  ) OR EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_authorities_frozen_delete
+BEFORE DELETE ON wallet_authorities
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_auth_methods_frozen_insert
+BEFORE INSERT ON wallet_auth_methods
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_auth_methods_frozen_update
+BEFORE UPDATE ON wallet_auth_methods
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  ) OR EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_auth_methods_frozen_delete
+BEFORE DELETE ON wallet_auth_methods
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_frozen_insert
+BEFORE INSERT ON wallet_session_authorizations_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_frozen_update
+BEFORE UPDATE ON wallet_session_authorizations_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  ) OR EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_authorizations_v2_frozen_delete
+BEFORE DELETE ON wallet_session_authorizations_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_frozen_insert
+BEFORE INSERT ON wallet_session_hosted_credentials_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_frozen_update
+BEFORE UPDATE ON wallet_session_hosted_credentials_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  ) OR EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_hosted_credentials_v2_frozen_delete
+BEFORE DELETE ON wallet_session_hosted_credentials_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_frozen_insert
+BEFORE INSERT ON wallet_session_hosted_exchange_codes_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_frozen_update
+BEFORE UPDATE ON wallet_session_hosted_exchange_codes_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  ) OR EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = NEW.namespace AND fence.org_id = NEW.org_id
+      AND fence.project_id = NEW.project_id AND fence.env_id = NEW.env_id
+      AND fence.wallet_id = NEW.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER wallet_session_hosted_exchange_codes_v2_frozen_delete
+BEFORE DELETE ON wallet_session_hosted_exchange_codes_v2
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    WHERE fence.namespace = OLD.namespace AND fence.org_id = OLD.org_id
+      AND fence.project_id = OLD.project_id AND fence.env_id = OLD.env_id
+      AND fence.wallet_id = OLD.wallet_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER authorization_wallet_session_quotas_frozen_insert
+BEFORE INSERT ON authorization_wallet_session_quotas
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    JOIN wallet_session_authorizations_v2 AS session
+      ON session.namespace = fence.namespace AND session.org_id = fence.org_id
+      AND session.project_id = fence.project_id AND session.env_id = fence.env_id
+      AND session.wallet_id = fence.wallet_id
+    WHERE session.namespace = NEW.namespace AND session.tenant_id = NEW.tenant_id
+      AND session.quota_id = NEW.quota_id AND session.wallet_session_id = NEW.wallet_session_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER authorization_wallet_session_quotas_frozen_update
+BEFORE UPDATE ON authorization_wallet_session_quotas
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    JOIN wallet_session_authorizations_v2 AS session
+      ON session.namespace = fence.namespace AND session.org_id = fence.org_id
+      AND session.project_id = fence.project_id AND session.env_id = fence.env_id
+      AND session.wallet_id = fence.wallet_id
+    WHERE session.namespace = OLD.namespace AND session.tenant_id = OLD.tenant_id
+      AND session.quota_id = OLD.quota_id AND session.wallet_session_id = OLD.wallet_session_id
+  ) OR EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    JOIN wallet_session_authorizations_v2 AS session
+      ON session.namespace = fence.namespace AND session.org_id = fence.org_id
+      AND session.project_id = fence.project_id AND session.env_id = fence.env_id
+      AND session.wallet_id = fence.wallet_id
+    WHERE session.namespace = NEW.namespace AND session.tenant_id = NEW.tenant_id
+      AND session.quota_id = NEW.quota_id AND session.wallet_session_id = NEW.wallet_session_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;
+
+CREATE TRIGGER authorization_wallet_session_quotas_frozen_delete
+BEFORE DELETE ON authorization_wallet_session_quotas
+WHEN EXISTS (
+    SELECT 1 FROM wallet_relocation_authorization_fences AS fence
+    JOIN wallet_session_authorizations_v2 AS session
+      ON session.namespace = fence.namespace AND session.org_id = fence.org_id
+      AND session.project_id = fence.project_id AND session.env_id = fence.env_id
+      AND session.wallet_id = fence.wallet_id
+    WHERE session.namespace = OLD.namespace AND session.tenant_id = OLD.tenant_id
+      AND session.quota_id = OLD.quota_id AND session.wallet_session_id = OLD.wallet_session_id
+  )
+BEGIN
+  SELECT RAISE(ABORT, 'wallet_authorization_history_frozen');
+END;