@tempoxyz/id 0.0.0-pr-187.sha-eed04d3

package/src/app/crons/cleanup.ts

@@ -0,0 +1,42 @@
+/**
+ * Deletes expired rows, which every read already ignores, so the tables stay small. Void reads
+ * {@link cron} from the file's text, so it stays a literal.
+ * @module
+ */
+import { lt } from 'drizzle-orm'
+import { defineScheduled } from 'void'
+import { db } from 'void/db'
+import * as Log from '../../internal/Log.js'
+import * as Schema from '../db/schema.js'
+
+/** The schedule, hourly. */
+export const cron = '0 * * * *'
+
+/**
+ * Deletes expired sign-in codes, device codes and their requests, and pending key authorizations. A failure logs, then fails the invocation, which
+ * Cron Events record. The next run deletes the rows this one left.
+ */
+export default defineScheduled(async (controller) => {
+  const now = new Date()
+  try {
+    await db
+      .delete(Schema.verification)
+      .where(lt(Schema.verification.expiresAt, now))
+    await db
+      .delete(Schema.deviceCode)
+      .where(lt(Schema.deviceCode.expiresAt, now))
+    await db
+      .delete(Schema.deviceRequests)
+      .where(lt(Schema.deviceRequests.expiresAt, now))
+    await db
+      .delete(Schema.pendingKeys)
+      .where(lt(Schema.pendingKeys.expiresAt, now))
+  } catch (error) {
+    Log.error({
+      error,
+      fields: { cron: controller.cron },
+      message: 'The cleanup cron failed.',
+    })
+    throw error
+  }
+})

package/src/app/db/auth.ts

@@ -0,0 +1,416 @@
+/**
+ * The Better Auth tables, as Drizzle declares them. `pnpm db:schema` writes this file from the
+ * options in `src/internal/Auth.ts`, so edit those options instead.
+ * @module
+ */
+import { relations } from 'drizzle-orm'
+import {
+  boolean,
+  index,
+  integer,
+  jsonb,
+  pgTable,
+  text,
+  timestamp,
+  uniqueIndex,
+} from 'drizzle-orm/pg-core'
+
+export const account = pgTable(
+  'account',
+  {
+    accessToken: text('access_token'),
+    accessTokenExpiresAt: timestamp('access_token_expires_at'),
+    accountId: text('account_id').notNull(),
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    id: text('id').primaryKey(),
+    idToken: text('id_token'),
+    password: text('password'),
+    providerId: text('provider_id').notNull(),
+    refreshToken: text('refresh_token'),
+    refreshTokenExpiresAt: timestamp('refresh_token_expires_at'),
+    scope: text('scope'),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [index('account_userId_idx').on(table.userId)],
+)
+
+export const accountRelations = relations(account, ({ one }) => ({
+  user: one(user, {
+    fields: [account.userId],
+    references: [user.id],
+  }),
+}))
+
+export const deviceCode = pgTable(
+  'device_code',
+  {
+    clientId: text('client_id'),
+    deviceCode: text('device_code').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    lastPolledAt: timestamp('last_polled_at'),
+    oauthClientId: text('oauth_client_id'),
+    pollingInterval: integer('polling_interval'),
+    resources: text('resources').array(),
+    scope: text('scope'),
+    status: text('status').notNull(),
+    userCode: text('user_code').notNull(),
+    userId: text('user_id'),
+  },
+  (table) => [
+    uniqueIndex('deviceCode_deviceCode_uidx').on(table.deviceCode),
+    uniqueIndex('deviceCode_userCode_uidx').on(table.userCode),
+  ],
+)
+
+export const jwks = pgTable('jwks', {
+  alg: text('alg'),
+  createdAt: timestamp('created_at').notNull(),
+  crv: text('crv'),
+  expiresAt: timestamp('expires_at'),
+  id: text('id').primaryKey(),
+  privateKey: text('private_key').notNull(),
+  publicKey: text('public_key').notNull(),
+})
+
+export const oauthAccessToken = pgTable(
+  'oauth_access_token',
+  {
+    authorizationCodeId: text('authorization_code_id'),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    confirmation: jsonb('confirmation'),
+    createdAt: timestamp('created_at').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    referenceId: text('reference_id'),
+    refreshId: text('refresh_id').references(() => oauthRefreshToken.id, {
+      onDelete: 'cascade',
+    }),
+    requestedUserInfoClaims: text('requested_user_info_claims').array(),
+    resources: text('resources').array(),
+    revoked: timestamp('revoked'),
+    scopes: text('scopes').array().notNull(),
+    sessionId: text('session_id').references(() => session.id, {
+      onDelete: 'set null',
+    }),
+    token: text('token').notNull().unique(),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthAccessToken_authorizationCodeId_idx').on(
+      table.authorizationCodeId,
+    ),
+    index('oauthAccessToken_clientId_idx').on(table.clientId),
+    index('oauthAccessToken_refreshId_idx').on(table.refreshId),
+    index('oauthAccessToken_sessionId_idx').on(table.sessionId),
+    index('oauthAccessToken_userId_idx').on(table.userId),
+  ],
+)
+
+export const oauthAccessTokenRelations = relations(
+  oauthAccessToken,
+  ({ one }) => ({
+    oauthClient: one(oauthClient, {
+      fields: [oauthAccessToken.clientId],
+      references: [oauthClient.clientId],
+    }),
+    oauthRefreshToken: one(oauthRefreshToken, {
+      fields: [oauthAccessToken.refreshId],
+      references: [oauthRefreshToken.id],
+    }),
+    session: one(session, {
+      fields: [oauthAccessToken.sessionId],
+      references: [session.id],
+    }),
+    user: one(user, {
+      fields: [oauthAccessToken.userId],
+      references: [user.id],
+    }),
+  }),
+)
+
+export const oauthClient = pgTable(
+  'oauth_client',
+  {
+    applicationType: text('application_type'),
+    backchannelLogoutSessionRequired: boolean(
+      'backchannel_logout_session_required',
+    ),
+    backchannelLogoutUri: text('backchannel_logout_uri'),
+    clientCredentialsScopes: text('client_credentials_scopes')
+      .array()
+      .default([]),
+    clientDiscoveryId: text('client_discovery_id'),
+    clientId: text('client_id').notNull().unique(),
+    clientSecret: text('client_secret'),
+    contacts: text('contacts').array(),
+    createdAt: timestamp('created_at'),
+    disabled: boolean('disabled').default(false),
+    dpopBoundAccessTokens: boolean('dpop_bound_access_tokens').default(false),
+    enableEndSession: boolean('enable_end_session'),
+    grantTypes: text('grant_types').array(),
+    icon: text('icon'),
+    id: text('id').primaryKey(),
+    jwks: text('jwks'),
+    jwksUri: text('jwks_uri'),
+    metadata: jsonb('metadata'),
+    name: text('name'),
+    policy: text('policy'),
+    postLogoutRedirectUris: text('post_logout_redirect_uris').array(),
+    redirectUris: text('redirect_uris').array().notNull(),
+    referenceId: text('reference_id'),
+    requirePKCE: boolean('require_pkce'),
+    responseTypes: text('response_types').array(),
+    scopes: text('scopes').array(),
+    skipConsent: boolean('skip_consent'),
+    softwareId: text('software_id'),
+    softwareStatement: text('software_statement'),
+    softwareVersion: text('software_version'),
+    subjectType: text('subject_type'),
+    tokenEndpointAuthMethod: text('token_endpoint_auth_method'),
+    tos: text('tos'),
+    updatedAt: timestamp('updated_at'),
+    uri: text('uri'),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [index('oauthClient_userId_idx').on(table.userId)],
+)
+
+export const oauthClientAssertion = pgTable('oauth_client_assertion', {
+  expiresAt: timestamp('expires_at').notNull(),
+  id: text('id').primaryKey(),
+})
+
+export const oauthClientRelations = relations(oauthClient, ({ many, one }) => ({
+  oauthAccessTokens: many(oauthAccessToken),
+  oauthClientResources: many(oauthClientResource),
+  oauthConsents: many(oauthConsent),
+  oauthRefreshTokens: many(oauthRefreshToken),
+  user: one(user, {
+    fields: [oauthClient.userId],
+    references: [user.id],
+  }),
+}))
+
+export const oauthClientResource = pgTable(
+  'oauth_client_resource',
+  {
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at'),
+    id: text('id').primaryKey(),
+    metadata: jsonb('metadata'),
+    resourceId: text('resource_id')
+      .notNull()
+      .references(() => oauthResource.identifier, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthClientResource_clientId_idx').on(table.clientId),
+    uniqueIndex('oauthClientResource_clientId_resourceId_uidx').on(
+      table.clientId,
+      table.resourceId,
+    ),
+    index('oauthClientResource_resourceId_idx').on(table.resourceId),
+  ],
+)
+
+export const oauthClientResourceRelations = relations(
+  oauthClientResource,
+  ({ one }) => ({
+    oauthClient: one(oauthClient, {
+      fields: [oauthClientResource.clientId],
+      references: [oauthClient.clientId],
+    }),
+    oauthResource: one(oauthResource, {
+      fields: [oauthClientResource.resourceId],
+      references: [oauthResource.identifier],
+    }),
+  }),
+)
+
+export const oauthConsent = pgTable(
+  'oauth_consent',
+  {
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    createdAt: timestamp('created_at').notNull(),
+    id: text('id').primaryKey(),
+    referenceId: text('reference_id'),
+    requestedUserInfoClaims: text('requested_user_info_claims').array(),
+    resources: text('resources').array(),
+    scopes: text('scopes').array().notNull(),
+    updatedAt: timestamp('updated_at').notNull(),
+    userId: text('user_id').references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthConsent_clientId_idx').on(table.clientId),
+    index('oauthConsent_userId_idx').on(table.userId),
+  ],
+)
+
+export const oauthConsentRelations = relations(oauthConsent, ({ one }) => ({
+  oauthClient: one(oauthClient, {
+    fields: [oauthConsent.clientId],
+    references: [oauthClient.clientId],
+  }),
+  user: one(user, {
+    fields: [oauthConsent.userId],
+    references: [user.id],
+  }),
+}))
+
+export const oauthRefreshToken = pgTable(
+  'oauth_refresh_token',
+  {
+    authorizationCodeId: text('authorization_code_id'),
+    authTime: timestamp('auth_time'),
+    clientId: text('client_id')
+      .notNull()
+      .references(() => oauthClient.clientId, { onDelete: 'cascade' }),
+    confirmation: jsonb('confirmation'),
+    createdAt: timestamp('created_at').notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    referenceId: text('reference_id'),
+    requestedUserInfoClaims: text('requested_user_info_claims').array(),
+    resources: text('resources').array(),
+    revoked: timestamp('revoked'),
+    rotatedAt: timestamp('rotated_at'),
+    rotationReplayExpiresAt: timestamp('rotation_replay_expires_at'),
+    rotationReplayResponse: text('rotation_replay_response'),
+    scopes: text('scopes').array().notNull(),
+    sessionId: text('session_id').references(() => session.id, {
+      onDelete: 'set null',
+    }),
+    token: text('token').notNull().unique(),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [
+    index('oauthRefreshToken_authorizationCodeId_idx').on(
+      table.authorizationCodeId,
+    ),
+    index('oauthRefreshToken_clientId_idx').on(table.clientId),
+    index('oauthRefreshToken_sessionId_idx').on(table.sessionId),
+    index('oauthRefreshToken_userId_idx').on(table.userId),
+  ],
+)
+
+export const oauthRefreshTokenRelations = relations(
+  oauthRefreshToken,
+  ({ many, one }) => ({
+    oauthAccessTokens: many(oauthAccessToken),
+    oauthClient: one(oauthClient, {
+      fields: [oauthRefreshToken.clientId],
+      references: [oauthClient.clientId],
+    }),
+    session: one(session, {
+      fields: [oauthRefreshToken.sessionId],
+      references: [session.id],
+    }),
+    user: one(user, {
+      fields: [oauthRefreshToken.userId],
+      references: [user.id],
+    }),
+  }),
+)
+
+export const oauthResource = pgTable('oauth_resource', {
+  accessTokenTtl: integer('access_token_ttl'),
+  allowedScopes: text('allowed_scopes').array(),
+  createdAt: timestamp('created_at'),
+  customClaims: jsonb('custom_claims'),
+  disabled: boolean('disabled').default(false),
+  dpopBoundAccessTokensRequired: boolean(
+    'dpop_bound_access_tokens_required',
+  ).default(false),
+  id: text('id').primaryKey(),
+  identifier: text('identifier').notNull().unique(),
+  metadata: jsonb('metadata'),
+  name: text('name').notNull(),
+  policyVersion: integer('policy_version').default(1),
+  refreshTokenTtl: integer('refresh_token_ttl'),
+  signingAlgorithm: text('signing_algorithm'),
+  signingKeyId: text('signing_key_id'),
+  updatedAt: timestamp('updated_at'),
+})
+
+export const oauthResourceRelations = relations(oauthResource, ({ many }) => ({
+  oauthClientResources: many(oauthClientResource),
+}))
+
+export const session = pgTable(
+  'session',
+  {
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    ipAddress: text('ip_address'),
+    token: text('token').notNull().unique(),
+    updatedAt: timestamp('updated_at')
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    userAgent: text('user_agent'),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id, { onDelete: 'cascade' }),
+  },
+  (table) => [index('session_userId_idx').on(table.userId)],
+)
+
+export const sessionRelations = relations(session, ({ many, one }) => ({
+  oauthAccessTokens: many(oauthAccessToken),
+  oauthRefreshTokens: many(oauthRefreshToken),
+  user: one(user, {
+    fields: [session.userId],
+    references: [user.id],
+  }),
+}))
+
+export const user = pgTable('user', {
+  createdAt: timestamp('created_at').defaultNow().notNull(),
+  email: text('email').notNull().unique(),
+  emailVerified: boolean('email_verified').default(false).notNull(),
+  id: text('id').primaryKey(),
+  image: text('image'),
+  name: text('name').notNull(),
+  updatedAt: timestamp('updated_at')
+    .defaultNow()
+    .$onUpdate(() => /* @__PURE__ */ new Date())
+    .notNull(),
+})
+
+export const userRelations = relations(user, ({ many }) => ({
+  accounts: many(account),
+  oauthAccessTokens: many(oauthAccessToken),
+  oauthClients: many(oauthClient),
+  oauthConsents: many(oauthConsent),
+  oauthRefreshTokens: many(oauthRefreshToken),
+  sessions: many(session),
+}))
+
+export const verification = pgTable(
+  'verification',
+  {
+    createdAt: timestamp('created_at').defaultNow().notNull(),
+    expiresAt: timestamp('expires_at').notNull(),
+    id: text('id').primaryKey(),
+    identifier: text('identifier').notNull(),
+    updatedAt: timestamp('updated_at')
+      .defaultNow()
+      .$onUpdate(() => /* @__PURE__ */ new Date())
+      .notNull(),
+    value: text('value').notNull(),
+  },
+  (table) => [index('verification_identifier_idx').on(table.identifier)],
+)

package/src/app/db/migrations/0000_better_auth.sql

@@ -0,0 +1,53 @@
+CREATE TABLE "account" (
+	"id" text PRIMARY KEY NOT NULL,
+	"account_id" text NOT NULL,
+	"provider_id" text NOT NULL,
+	"user_id" text NOT NULL,
+	"access_token" text,
+	"refresh_token" text,
+	"id_token" text,
+	"access_token_expires_at" timestamp,
+	"refresh_token_expires_at" timestamp,
+	"scope" text,
+	"password" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "session" (
+	"id" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"token" text NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp NOT NULL,
+	"ip_address" text,
+	"user_agent" text,
+	"user_id" text NOT NULL,
+	CONSTRAINT "session_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "user" (
+	"id" text PRIMARY KEY NOT NULL,
+	"name" text NOT NULL,
+	"email" text NOT NULL,
+	"email_verified" boolean DEFAULT false NOT NULL,
+	"image" text,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL,
+	CONSTRAINT "user_email_unique" UNIQUE("email")
+);
+--> statement-breakpoint
+CREATE TABLE "verification" (
+	"id" text PRIMARY KEY NOT NULL,
+	"identifier" text NOT NULL,
+	"value" text NOT NULL,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp DEFAULT now() NOT NULL,
+	"updated_at" timestamp DEFAULT now() NOT NULL
+);
+--> statement-breakpoint
+ALTER TABLE "account" ADD CONSTRAINT "account_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "session" ADD CONSTRAINT "session_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "account_userId_idx" ON "account" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "session_userId_idx" ON "session" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "verification_identifier_idx" ON "verification" USING btree ("identifier");

package/src/app/db/migrations/0001_oauth_provider.sql

@@ -0,0 +1,162 @@
+CREATE TABLE "jwks" (
+	"id" text PRIMARY KEY NOT NULL,
+	"public_key" text NOT NULL,
+	"private_key" text NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"expires_at" timestamp,
+	"alg" text,
+	"crv" text
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_access_token" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token" text NOT NULL,
+	"client_id" text NOT NULL,
+	"session_id" text,
+	"user_id" text,
+	"reference_id" text,
+	"authorization_code_id" text,
+	"resources" text[],
+	"requested_user_info_claims" text[],
+	"refresh_id" text,
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"revoked" timestamp,
+	"confirmation" jsonb,
+	"scopes" text[] NOT NULL,
+	CONSTRAINT "oauth_access_token_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_client" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"client_secret" text,
+	"client_discovery_id" text,
+	"disabled" boolean DEFAULT false,
+	"skip_consent" boolean,
+	"enable_end_session" boolean,
+	"subject_type" text,
+	"scopes" text[],
+	"client_credentials_scopes" text[] DEFAULT '{}',
+	"user_id" text,
+	"created_at" timestamp,
+	"updated_at" timestamp,
+	"name" text,
+	"uri" text,
+	"icon" text,
+	"contacts" text[],
+	"tos" text,
+	"policy" text,
+	"software_id" text,
+	"software_version" text,
+	"software_statement" text,
+	"redirect_uris" text[] NOT NULL,
+	"post_logout_redirect_uris" text[],
+	"backchannel_logout_uri" text,
+	"backchannel_logout_session_required" boolean,
+	"token_endpoint_auth_method" text,
+	"application_type" text,
+	"jwks" text,
+	"jwks_uri" text,
+	"grant_types" text[],
+	"response_types" text[],
+	"require_pkce" boolean,
+	"dpop_bound_access_tokens" boolean DEFAULT false,
+	"reference_id" text,
+	"metadata" jsonb,
+	CONSTRAINT "oauth_client_client_id_unique" UNIQUE("client_id")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_client_assertion" (
+	"id" text PRIMARY KEY NOT NULL,
+	"expires_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_client_resource" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"resource_id" text NOT NULL,
+	"metadata" jsonb,
+	"created_at" timestamp
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_consent" (
+	"id" text PRIMARY KEY NOT NULL,
+	"client_id" text NOT NULL,
+	"user_id" text,
+	"reference_id" text,
+	"resources" text[],
+	"requested_user_info_claims" text[],
+	"scopes" text[] NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"updated_at" timestamp NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_refresh_token" (
+	"id" text PRIMARY KEY NOT NULL,
+	"token" text NOT NULL,
+	"client_id" text NOT NULL,
+	"session_id" text,
+	"user_id" text NOT NULL,
+	"reference_id" text,
+	"authorization_code_id" text,
+	"resources" text[],
+	"requested_user_info_claims" text[],
+	"expires_at" timestamp NOT NULL,
+	"created_at" timestamp NOT NULL,
+	"revoked" timestamp,
+	"rotated_at" timestamp,
+	"rotation_replay_response" text,
+	"rotation_replay_expires_at" timestamp,
+	"auth_time" timestamp,
+	"confirmation" jsonb,
+	"scopes" text[] NOT NULL,
+	CONSTRAINT "oauth_refresh_token_token_unique" UNIQUE("token")
+);
+--> statement-breakpoint
+CREATE TABLE "oauth_resource" (
+	"id" text PRIMARY KEY NOT NULL,
+	"identifier" text NOT NULL,
+	"name" text NOT NULL,
+	"access_token_ttl" integer,
+	"refresh_token_ttl" integer,
+	"signing_algorithm" text,
+	"signing_key_id" text,
+	"allowed_scopes" text[],
+	"custom_claims" jsonb,
+	"dpop_bound_access_tokens_required" boolean DEFAULT false,
+	"disabled" boolean DEFAULT false,
+	"created_at" timestamp,
+	"updated_at" timestamp,
+	"policy_version" integer DEFAULT 1,
+	"metadata" jsonb,
+	CONSTRAINT "oauth_resource_identifier_unique" UNIQUE("identifier")
+);
+--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_session_id_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."session"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_access_token" ADD CONSTRAINT "oauth_access_token_refresh_id_oauth_refresh_token_id_fk" FOREIGN KEY ("refresh_id") REFERENCES "public"."oauth_refresh_token"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_client" ADD CONSTRAINT "oauth_client_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_client_resource" ADD CONSTRAINT "oauth_client_resource_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_client_resource" ADD CONSTRAINT "oauth_client_resource_resource_id_oauth_resource_identifier_fk" FOREIGN KEY ("resource_id") REFERENCES "public"."oauth_resource"("identifier") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_consent" ADD CONSTRAINT "oauth_consent_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_consent" ADD CONSTRAINT "oauth_consent_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_token" ADD CONSTRAINT "oauth_refresh_token_client_id_oauth_client_client_id_fk" FOREIGN KEY ("client_id") REFERENCES "public"."oauth_client"("client_id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_token" ADD CONSTRAINT "oauth_refresh_token_session_id_session_id_fk" FOREIGN KEY ("session_id") REFERENCES "public"."session"("id") ON DELETE set null ON UPDATE no action;--> statement-breakpoint
+ALTER TABLE "oauth_refresh_token" ADD CONSTRAINT "oauth_refresh_token_user_id_user_id_fk" FOREIGN KEY ("user_id") REFERENCES "public"."user"("id") ON DELETE cascade ON UPDATE no action;--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_clientId_idx" ON "oauth_access_token" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_sessionId_idx" ON "oauth_access_token" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_userId_idx" ON "oauth_access_token" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_authorizationCodeId_idx" ON "oauth_access_token" USING btree ("authorization_code_id");--> statement-breakpoint
+CREATE INDEX "oauthAccessToken_refreshId_idx" ON "oauth_access_token" USING btree ("refresh_id");--> statement-breakpoint
+CREATE INDEX "oauthClient_userId_idx" ON "oauth_client" USING btree ("user_id");--> statement-breakpoint
+CREATE UNIQUE INDEX "oauthClientResource_clientId_resourceId_uidx" ON "oauth_client_resource" USING btree ("client_id","resource_id");--> statement-breakpoint
+CREATE INDEX "oauthClientResource_clientId_idx" ON "oauth_client_resource" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthClientResource_resourceId_idx" ON "oauth_client_resource" USING btree ("resource_id");--> statement-breakpoint
+CREATE INDEX "oauthConsent_clientId_idx" ON "oauth_consent" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthConsent_userId_idx" ON "oauth_consent" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_clientId_idx" ON "oauth_refresh_token" USING btree ("client_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_sessionId_idx" ON "oauth_refresh_token" USING btree ("session_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_userId_idx" ON "oauth_refresh_token" USING btree ("user_id");--> statement-breakpoint
+CREATE INDEX "oauthRefreshToken_authorizationCodeId_idx" ON "oauth_refresh_token" USING btree ("authorization_code_id");