@wtfalch/authz-store 0.1.0

package/migrations/0001_baseline.sql

@@ -0,0 +1,571 @@
+-- The store's baseline: every table @wtfalch/authz-store defines, as manage's
+-- live schema has it on 2026-09-22 (manage drizzle/0000-0015 plus scripts/authz-v2).
+-- Left to each app: the offered-permission CHECKs on tenants (they list that
+-- app's catalogue) and break_glass_sessions.operator_id -> profiles (a table the
+-- app owns). authz_events_action_check lists @wtfalch/authz's core events.
+-- Generated once from pg_dump. Never edit it: a change is a new numbered file.
+CREATE OR REPLACE FUNCTION access_team_tree_guard()
+ RETURNS trigger
+ LANGUAGE plpgsql
+AS $function$
+DECLARE current_id uuid; next_id uuid; depth integer := 0; subtree_depth integer := 0;
+BEGIN
+  IF TG_OP = 'UPDATE' AND NEW.tenant_id <> OLD.tenant_id THEN
+    RAISE EXCEPTION 'a team cannot move between organisations';
+  END IF;
+  PERFORM 1 FROM tenants WHERE id = NEW.tenant_id FOR UPDATE;
+  current_id := NEW.parent_id;
+  WHILE current_id IS NOT NULL LOOP
+    IF current_id = NEW.id OR depth >= 63 THEN RAISE EXCEPTION 'invalid team hierarchy'; END IF;
+    SELECT parent_id INTO next_id FROM access_teams WHERE tenant_id = NEW.tenant_id AND id = current_id;
+    IF NOT FOUND THEN RAISE EXCEPTION 'unknown team parent'; END IF;
+    current_id := next_id;
+    depth := depth + 1;
+  END LOOP;
+  IF TG_OP = 'UPDATE' AND NEW.parent_id IS DISTINCT FROM OLD.parent_id THEN
+    WITH RECURSIVE children AS (
+      SELECT id, 0 AS level FROM access_teams WHERE id = NEW.id AND tenant_id = NEW.tenant_id
+      UNION ALL
+      SELECT t.id, c.level + 1 FROM access_teams t JOIN children c ON t.parent_id = c.id
+        WHERE t.tenant_id = NEW.tenant_id AND c.level < 64
+    ) SELECT coalesce(max(level), 0) INTO subtree_depth FROM children;
+    IF depth + subtree_depth >= 64 THEN RAISE EXCEPTION 'invalid team hierarchy'; END IF;
+  END IF;
+  RETURN NEW;
+END $function$;
+--> statement-breakpoint
+CREATE OR REPLACE FUNCTION authz_event_resource_guard()
+ RETURNS trigger
+ LANGUAGE plpgsql
+AS $function$
+BEGIN
+  IF NEW.team_id IS DISTINCT FROM OLD.team_id OR NEW.subject_id IS DISTINCT FROM OLD.subject_id
+     OR NEW.subject_class IS DISTINCT FROM OLD.subject_class THEN
+    RAISE EXCEPTION 'audit resource metadata is immutable';
+  END IF;
+  RETURN NEW;
+END $function$;
+--> statement-breakpoint
+CREATE OR REPLACE FUNCTION authz_events_guard()
+ RETURNS trigger
+ LANGUAGE plpgsql
+AS $function$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    RAISE EXCEPTION 'authz_events is append-only: delete refused';
+  ELSIF TG_OP = 'TRUNCATE' THEN
+    RAISE EXCEPTION 'authz_events is append-only: truncate refused';
+  ELSIF TG_OP = 'UPDATE' THEN
+    IF NEW."id" IS DISTINCT FROM OLD."id"
+      OR NEW."occurred_at" IS DISTINCT FROM OLD."occurred_at"
+      OR NEW."tenant_id" IS DISTINCT FROM OLD."tenant_id"
+      OR NEW."actor_class" IS DISTINCT FROM OLD."actor_class"
+      OR NEW."actor_id" IS DISTINCT FROM OLD."actor_id"
+      OR NEW."action" IS DISTINCT FROM OLD."action"
+      OR NEW."target_type" IS DISTINCT FROM OLD."target_type"
+      OR NEW."target_id" IS DISTINCT FROM OLD."target_id"
+      OR NEW."outcome" IS DISTINCT FROM OLD."outcome"
+      OR NEW."context" IS DISTINCT FROM OLD."context"
+      OR NEW."session_id" IS DISTINCT FROM OLD."session_id"
+      OR NEW."reason" IS DISTINCT FROM OLD."reason"
+      OR NEW."reference" IS DISTINCT FROM OLD."reference"
+      OR NEW."request_id" IS DISTINCT FROM OLD."request_id"
+      OR NEW."ip" IS DISTINCT FROM OLD."ip"
+      OR NEW."user_agent" IS DISTINCT FROM OLD."user_agent"
+      OR NEW."tenant_visible" IS DISTINCT FROM OLD."tenant_visible"
+      OR NEW."schema_version" IS DISTINCT FROM OLD."schema_version"
+    THEN
+      RAISE EXCEPTION 'authz_events is append-only: only actor_display, before, after and erased_at may change';
+    END IF;
+  END IF;
+  RETURN NEW;
+END
+$function$;
+--> statement-breakpoint
+CREATE TABLE access_team_members (
+    tenant_id uuid NOT NULL,
+    team_id uuid NOT NULL,
+    principal_id text NOT NULL,
+    principal_class text DEFAULT 'human'::text NOT NULL,
+    CONSTRAINT access_team_members_principal_class_check CHECK ((principal_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text])))
+);
+--> statement-breakpoint
+CREATE TABLE access_teams (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    parent_id uuid,
+    name text NOT NULL,
+    archived_at timestamp with time zone,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT access_teams_check CHECK ((parent_id IS DISTINCT FROM id)),
+    CONSTRAINT access_teams_name_check CHECK (((length(btrim(name)) >= 1) AND (length(btrim(name)) <= 100)))
+);
+--> statement-breakpoint
+CREATE TABLE attach_proposals (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    parent_id uuid NOT NULL,
+    child_id uuid NOT NULL,
+    status text DEFAULT 'pending'::text NOT NULL,
+    reason text NOT NULL,
+    reference text NOT NULL,
+    proposed_by text NOT NULL,
+    parent_accepted_by text,
+    parent_accepted_at timestamp with time zone,
+    decided_by text,
+    decided_at timestamp with time zone,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT attach_proposals_decided_check CHECK (((status = ANY (ARRAY['pending_parent'::text, 'pending'::text])) = (decided_at IS NULL))),
+    CONSTRAINT attach_proposals_not_self_check CHECK ((parent_id <> child_id)),
+    CONSTRAINT attach_proposals_parent_accepted_check CHECK (((status <> 'pending_parent'::text) OR (parent_accepted_at IS NULL))),
+    CONSTRAINT attach_proposals_reason_check CHECK (((length(reason) >= 1) AND (length(reason) <= 512))),
+    CONSTRAINT attach_proposals_reference_check CHECK (((length(reference) >= 1) AND (length(reference) <= 512))),
+    CONSTRAINT attach_proposals_status_check CHECK ((status = ANY (ARRAY['pending_parent'::text, 'pending'::text, 'accepted'::text, 'declined'::text])))
+);
+--> statement-breakpoint
+CREATE TABLE authz_assignments (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    application_id text NOT NULL,
+    platform_id text NOT NULL,
+    role_id uuid NOT NULL,
+    principal_id text,
+    principal_class text,
+    team_id uuid,
+    recipient_descendants boolean DEFAULT false NOT NULL,
+    boundary jsonb NOT NULL,
+    scope jsonb NOT NULL,
+    source text DEFAULT 'direct'::text NOT NULL,
+    via_tenant_id uuid,
+    primary_assignment boolean DEFAULT false NOT NULL,
+    expires_at timestamp with time zone,
+    created_by text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT authz_assignments_boundary_check CHECK (((jsonb_typeof(boundary) = 'object'::text) AND ((boundary ->> 'kind'::text) = ANY (ARRAY['organisation'::text, 'organisations'::text, 'platform'::text])))),
+    CONSTRAINT authz_assignments_check CHECK (((principal_id IS NOT NULL) = (principal_class IS NOT NULL))),
+    CONSTRAINT authz_assignments_check1 CHECK (((((principal_id IS NOT NULL))::integer + ((team_id IS NOT NULL))::integer) = 1)),
+    CONSTRAINT authz_assignments_check2 CHECK (((NOT recipient_descendants) OR (team_id IS NOT NULL))),
+    CONSTRAINT authz_assignments_check3 CHECK (((NOT primary_assignment) OR (principal_id IS NOT NULL))),
+    CONSTRAINT authz_assignments_check4 CHECK (((source = 'inherited'::text) = (via_tenant_id IS NOT NULL))),
+    CONSTRAINT authz_assignments_principal_class_check CHECK ((principal_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT authz_assignments_scope_check CHECK (((jsonb_typeof(scope) = 'object'::text) AND ((scope ->> 'kind'::text) = ANY (ARRAY['organisation'::text, 'team'::text, 'own_teams'::text, 'resource'::text])))),
+    CONSTRAINT authz_assignments_source_check CHECK ((source = ANY (ARRAY['direct'::text, 'inherited'::text, 'activation'::text])))
+);
+--> statement-breakpoint
+CREATE TABLE authz_events (
+    id bigint NOT NULL,
+    occurred_at timestamp with time zone DEFAULT now() NOT NULL,
+    tenant_id uuid,
+    actor_class text NOT NULL,
+    actor_id text NOT NULL,
+    actor_display text NOT NULL,
+    action text NOT NULL,
+    target_type text NOT NULL,
+    target_id text NOT NULL,
+    outcome text NOT NULL,
+    context text NOT NULL,
+    session_id text,
+    reason text,
+    reference text,
+    request_id text,
+    ip text,
+    user_agent text,
+    tenant_visible boolean NOT NULL,
+    before jsonb,
+    after jsonb,
+    erased_at timestamp with time zone,
+    schema_version smallint DEFAULT 1 NOT NULL,
+    team_id uuid,
+    subject_id text,
+    subject_class text,
+    CONSTRAINT authz_events_actor_class_check CHECK ((actor_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT authz_events_actor_display_check CHECK (((length(actor_display) >= 1) AND (length(actor_display) <= 256))),
+    CONSTRAINT authz_events_actor_id_check CHECK (((length(actor_id) >= 1) AND (length(actor_id) <= 256))),
+    CONSTRAINT authz_events_after_check CHECK (((after IS NULL) OR (octet_length((after)::text) <= 65536))),
+    CONSTRAINT authz_events_before_check CHECK (((before IS NULL) OR (octet_length((before)::text) <= 65536))),
+    CONSTRAINT authz_events_break_glass_check CHECK (((context <> 'break_glass'::text) OR ((session_id IS NOT NULL) AND (reason IS NOT NULL) AND (reference IS NOT NULL) AND (reason = ANY (ARRAY['customer_support'::text, 'incident'::text, 'review'::text, 'migration'::text, 'other'::text]))))),
+    CONSTRAINT authz_events_context_check CHECK ((context = ANY (ARRAY['standard'::text, 'operator'::text, 'break_glass'::text]))),
+    CONSTRAINT authz_events_ip_check CHECK (((ip IS NULL) OR (length(ip) <= 64))),
+    CONSTRAINT authz_events_outcome_check CHECK ((outcome = ANY (ARRAY['success'::text, 'denied'::text, 'error'::text]))),
+    CONSTRAINT authz_events_reason_check CHECK (((reason IS NULL) OR (length(reason) <= 512))),
+    CONSTRAINT authz_events_reference_check CHECK (((reference IS NULL) OR (length(reference) <= 512))),
+    CONSTRAINT authz_events_request_id_check CHECK (((request_id IS NULL) OR (length(request_id) <= 128))),
+    CONSTRAINT authz_events_session_id_check CHECK (((session_id IS NULL) OR (length(session_id) <= 256))),
+    CONSTRAINT authz_events_subject_class_check CHECK ((subject_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT authz_events_subject_pair_check CHECK (((subject_id IS NULL) = (subject_class IS NULL))),
+    CONSTRAINT authz_events_target_id_check CHECK (((length(target_id) >= 1) AND (length(target_id) <= 256))),
+    CONSTRAINT authz_events_target_type_check CHECK (((length(target_type) >= 1) AND (length(target_type) <= 64))),
+    CONSTRAINT authz_events_team_requires_tenant_check CHECK (((team_id IS NULL) OR (tenant_id IS NOT NULL))),
+    CONSTRAINT authz_events_user_agent_check CHECK (((user_agent IS NULL) OR (length(user_agent) <= 1024)))
+);
+--> statement-breakpoint
+ALTER TABLE authz_events ALTER COLUMN id ADD GENERATED ALWAYS AS IDENTITY (
+    SEQUENCE NAME authz_events_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1
+);
+--> statement-breakpoint
+CREATE TABLE authz_policy_version (
+    id integer NOT NULL,
+    version integer NOT NULL,
+    application_id text NOT NULL,
+    platform_id text NOT NULL,
+    mapping_revision text NOT NULL,
+    source_digest text NOT NULL,
+    migrated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT authz_policy_version_id_check CHECK ((id = 1)),
+    CONSTRAINT authz_policy_version_version_check CHECK ((version = 2))
+);
+--> statement-breakpoint
+CREATE TABLE authz_roles (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    application_id text NOT NULL,
+    platform_id text NOT NULL,
+    key text NOT NULL,
+    name text NOT NULL,
+    description text DEFAULT ''::text NOT NULL,
+    built_in boolean DEFAULT false NOT NULL,
+    revision integer DEFAULT 1 NOT NULL,
+    entries jsonb NOT NULL,
+    guards text[] DEFAULT '{}'::text[] NOT NULL,
+    created_by text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_by text,
+    CONSTRAINT authz_roles_entries_check CHECK (((jsonb_typeof(entries) = 'array'::text) AND (jsonb_array_length(entries) <= 1000))),
+    CONSTRAINT authz_roles_key_check CHECK ((key ~ '^[a-z][a-z0-9_-]{0,63}$'::text)),
+    CONSTRAINT authz_roles_name_check CHECK (((length(btrim(name)) >= 1) AND (length(btrim(name)) <= 100))),
+    CONSTRAINT authz_roles_revision_check CHECK ((revision > 0))
+);
+--> statement-breakpoint
+CREATE TABLE break_glass_sessions (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    operator_id text NOT NULL,
+    tenant_id uuid NOT NULL,
+    read_only boolean DEFAULT true NOT NULL,
+    reason_code text NOT NULL,
+    reference text NOT NULL,
+    started_at timestamp with time zone DEFAULT now() NOT NULL,
+    expires_at timestamp with time zone NOT NULL,
+    ended_at timestamp with time zone,
+    ended_by text,
+    role_id uuid NOT NULL,
+    CONSTRAINT bg_ended_check CHECK (((ended_at IS NULL) OR (ended_at >= started_at))),
+    CONSTRAINT bg_reason_check CHECK ((reason_code = ANY (ARRAY['customer_support'::text, 'incident'::text, 'review'::text, 'migration'::text, 'other'::text]))),
+    CONSTRAINT bg_reference_check CHECK (((length(reference) >= 1) AND (length(reference) <= 512))),
+    CONSTRAINT bg_ttl_check CHECK (((expires_at > started_at) AND (expires_at <= (started_at + '01:00:00'::interval))))
+);
+--> statement-breakpoint
+CREATE TABLE credentials (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    kind text NOT NULL,
+    name text NOT NULL,
+    secret_hash text NOT NULL,
+    created_by text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    expires_at timestamp with time zone,
+    revoked_at timestamp with time zone,
+    last_used_at timestamp with time zone,
+    secret_prefix text,
+    issuer_id text NOT NULL,
+    issuer_class text NOT NULL,
+    CONSTRAINT credentials_expiry_check CHECK (((expires_at IS NULL) OR (expires_at > created_at))),
+    CONSTRAINT credentials_issuer_class_check CHECK ((issuer_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT credentials_kind_check CHECK ((kind = ANY (ARRAY['api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT credentials_name_check CHECK (((length(name) >= 1) AND (length(name) <= 120))),
+    CONSTRAINT credentials_secret_prefix_check CHECK (((secret_prefix IS NULL) OR ((length(secret_prefix) >= 1) AND (length(secret_prefix) <= 16))))
+);
+--> statement-breakpoint
+CREATE TABLE invitations (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    tenant_id uuid NOT NULL,
+    email text NOT NULL,
+    token_hash text NOT NULL,
+    status text DEFAULT 'pending'::text NOT NULL,
+    mail_state text DEFAULT 'pending'::text NOT NULL,
+    invited_by text,
+    expires_at timestamp with time zone NOT NULL,
+    accepted_by text,
+    accepted_at timestamp with time zone,
+    revoked_by text,
+    revoked_at timestamp with time zone,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    attach_parent_id uuid,
+    mail_state_at timestamp with time zone,
+    role_id uuid NOT NULL,
+    invited_by_class text,
+    CONSTRAINT invitations_accepted_check CHECK (((status = 'accepted'::text) = (accepted_at IS NOT NULL))),
+    CONSTRAINT invitations_email_lower_check CHECK ((email = lower(email))),
+    CONSTRAINT invitations_expiry_check CHECK ((expires_at > created_at)),
+    CONSTRAINT invitations_invited_by_class_check CHECK ((invited_by_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT invitations_mail_state_check CHECK ((mail_state = ANY (ARRAY['pending'::text, 'sent'::text, 'failed'::text]))),
+    CONSTRAINT invitations_revoked_check CHECK (((status = 'revoked'::text) = (revoked_at IS NOT NULL))),
+    CONSTRAINT invitations_status_check CHECK ((status = ANY (ARRAY['pending'::text, 'accepted'::text, 'revoked'::text, 'expired'::text]))),
+    CONSTRAINT invitations_typed_inviter CHECK (((status <> 'pending'::text) OR (invited_by IS NULL) OR (invited_by_class IS NOT NULL)))
+);
+--> statement-breakpoint
+CREATE TABLE memberships (
+    tenant_id uuid NOT NULL,
+    principal_id text NOT NULL,
+    principal_class text NOT NULL,
+    source text DEFAULT 'direct'::text NOT NULL,
+    via_tenant_id uuid,
+    tenant_name text NOT NULL,
+    granted_by text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    CONSTRAINT memberships_principal_class_check CHECK ((principal_class = ANY (ARRAY['human'::text, 'api_key'::text, 'agent'::text, 'service'::text]))),
+    CONSTRAINT memberships_source_check CHECK ((source = ANY (ARRAY['direct'::text, 'inherited'::text]))),
+    CONSTRAINT memberships_source_via_check CHECK (((source = 'inherited'::text) = (via_tenant_id IS NOT NULL)))
+);
+--> statement-breakpoint
+CREATE TABLE tenants (
+    id uuid DEFAULT gen_random_uuid() NOT NULL,
+    kind text DEFAULT 'customer'::text NOT NULL,
+    slug text NOT NULL,
+    name text NOT NULL,
+    state text DEFAULT 'active'::text NOT NULL,
+    parent_id uuid,
+    ceiling text[] NOT NULL,
+    self_denied text[] DEFAULT '{}'::text[] NOT NULL,
+    created_by text,
+    created_at timestamp with time zone DEFAULT now() NOT NULL,
+    updated_at timestamp with time zone DEFAULT now() NOT NULL,
+    frozen boolean DEFAULT false NOT NULL,
+    CONSTRAINT tenants_frozen_operator_check CHECK (((kind = 'operator'::text) OR (NOT frozen))),
+    CONSTRAINT tenants_kind_check CHECK ((kind = ANY (ARRAY['customer'::text, 'operator'::text]))),
+    CONSTRAINT tenants_name_check CHECK (((length(name) >= 1) AND (length(name) <= 120))),
+    CONSTRAINT tenants_operator_active_check CHECK (((kind <> 'operator'::text) OR (state = 'active'::text))),
+    CONSTRAINT tenants_operator_no_parent_check CHECK (((kind <> 'operator'::text) OR (parent_id IS NULL))),
+    CONSTRAINT tenants_parent_not_self_check CHECK (((parent_id IS NULL) OR (parent_id <> id))),
+    CONSTRAINT tenants_slug_check CHECK ((slug ~ '^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$'::text)),
+    CONSTRAINT tenants_state_check CHECK ((state = ANY (ARRAY['active'::text, 'read_only'::text, 'suspended'::text, 'archived'::text])))
+);
+--> statement-breakpoint
+ALTER TABLE ONLY access_team_members
+    ADD CONSTRAINT access_team_members_pkey PRIMARY KEY (team_id, principal_class, principal_id);
+--> statement-breakpoint
+ALTER TABLE ONLY access_teams
+    ADD CONSTRAINT access_teams_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY access_teams
+    ADD CONSTRAINT access_teams_tenant_id_id_key UNIQUE (tenant_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY attach_proposals
+    ADD CONSTRAINT attach_proposals_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_assignments
+    ADD CONSTRAINT authz_assignments_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_events
+    ADD CONSTRAINT authz_events_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_policy_version
+    ADD CONSTRAINT authz_policy_version_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_roles
+    ADD CONSTRAINT authz_roles_boundary_id UNIQUE (tenant_id, application_id, platform_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_roles
+    ADD CONSTRAINT authz_roles_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_roles
+    ADD CONSTRAINT authz_roles_tenant_app_key UNIQUE (tenant_id, application_id, key);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_roles
+    ADD CONSTRAINT authz_roles_tenant_id_id_key UNIQUE (tenant_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY break_glass_sessions
+    ADD CONSTRAINT break_glass_sessions_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY credentials
+    ADD CONSTRAINT credentials_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY credentials
+    ADD CONSTRAINT credentials_secret_hash_key UNIQUE (secret_hash);
+--> statement-breakpoint
+ALTER TABLE ONLY invitations
+    ADD CONSTRAINT invitations_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY invitations
+    ADD CONSTRAINT invitations_token_hash_key UNIQUE (token_hash);
+--> statement-breakpoint
+ALTER TABLE ONLY memberships
+    ADD CONSTRAINT memberships_pkey PRIMARY KEY (tenant_id, principal_class, principal_id);
+--> statement-breakpoint
+ALTER TABLE ONLY memberships
+    ADD CONSTRAINT memberships_typed_identity UNIQUE (tenant_id, principal_class, principal_id);
+--> statement-breakpoint
+ALTER TABLE ONLY tenants
+    ADD CONSTRAINT tenants_pkey PRIMARY KEY (id);
+--> statement-breakpoint
+ALTER TABLE ONLY tenants
+    ADD CONSTRAINT tenants_slug_unique UNIQUE (slug);
+--> statement-breakpoint
+CREATE INDEX access_team_members_principal_idx ON access_team_members USING btree (tenant_id, principal_id);
+--> statement-breakpoint
+CREATE INDEX access_teams_parent_idx ON access_teams USING btree (tenant_id, parent_id);
+--> statement-breakpoint
+CREATE INDEX attach_proposals_child_idx ON attach_proposals USING btree (child_id, created_at DESC);
+--> statement-breakpoint
+CREATE INDEX attach_proposals_parent_idx ON attach_proposals USING btree (parent_id, created_at DESC);
+--> statement-breakpoint
+CREATE UNIQUE INDEX attach_proposals_pending_idx ON attach_proposals USING btree (parent_id, child_id) WHERE (status = ANY (ARRAY['pending_parent'::text, 'pending'::text]));
+--> statement-breakpoint
+CREATE UNIQUE INDEX authz_assignments_primary_idx ON authz_assignments USING btree (tenant_id, application_id, principal_class, principal_id) WHERE primary_assignment;
+--> statement-breakpoint
+CREATE INDEX authz_assignments_principal_idx ON authz_assignments USING btree (tenant_id, principal_class, principal_id);
+--> statement-breakpoint
+CREATE INDEX authz_assignments_role_idx ON authz_assignments USING btree (tenant_id, role_id);
+--> statement-breakpoint
+CREATE INDEX authz_assignments_team_idx ON authz_assignments USING btree (tenant_id, team_id);
+--> statement-breakpoint
+CREATE INDEX authz_events_action_time_idx ON authz_events USING btree (action, occurred_at DESC);
+--> statement-breakpoint
+CREATE INDEX authz_events_actor_time_idx ON authz_events USING btree (actor_id, occurred_at DESC);
+--> statement-breakpoint
+CREATE INDEX authz_events_subject_time_idx ON authz_events USING btree (tenant_id, subject_class, subject_id, occurred_at DESC, id DESC);
+--> statement-breakpoint
+CREATE INDEX authz_events_team_time_idx ON authz_events USING btree (tenant_id, team_id, occurred_at DESC, id DESC);
+--> statement-breakpoint
+CREATE INDEX authz_events_tenant_time_idx ON authz_events USING btree (tenant_id, occurred_at DESC, id DESC);
+--> statement-breakpoint
+CREATE INDEX bg_active_idx ON break_glass_sessions USING btree (operator_id, tenant_id) WHERE (ended_at IS NULL);
+--> statement-breakpoint
+CREATE INDEX bg_tenant_idx ON break_glass_sessions USING btree (tenant_id, started_at DESC);
+--> statement-breakpoint
+CREATE INDEX credentials_live_idx ON credentials USING btree (tenant_id, created_at DESC) WHERE (revoked_at IS NULL);
+--> statement-breakpoint
+CREATE INDEX credentials_tenant_idx ON credentials USING btree (tenant_id);
+--> statement-breakpoint
+CREATE UNIQUE INDEX invitations_pending_idx ON invitations USING btree (tenant_id, email) WHERE (status = 'pending'::text);
+--> statement-breakpoint
+CREATE INDEX invitations_tenant_idx ON invitations USING btree (tenant_id, created_at DESC);
+--> statement-breakpoint
+CREATE INDEX memberships_principal_idx ON memberships USING btree (principal_class, principal_id, tenant_name, tenant_id);
+--> statement-breakpoint
+CREATE INDEX memberships_via_idx ON memberships USING btree (via_tenant_id);
+--> statement-breakpoint
+CREATE UNIQUE INDEX tenants_one_operator_idx ON tenants USING btree (kind) WHERE (kind = 'operator'::text);
+--> statement-breakpoint
+CREATE INDEX tenants_parent_idx ON tenants USING btree (parent_id);
+--> statement-breakpoint
+CREATE TRIGGER access_team_tree_guard BEFORE INSERT OR UPDATE ON access_teams FOR EACH ROW EXECUTE FUNCTION access_team_tree_guard();
+--> statement-breakpoint
+CREATE TRIGGER authz_event_resource_guard BEFORE UPDATE ON authz_events FOR EACH ROW EXECUTE FUNCTION authz_event_resource_guard();
+--> statement-breakpoint
+CREATE TRIGGER authz_events_guarded_update BEFORE UPDATE ON authz_events FOR EACH ROW EXECUTE FUNCTION authz_events_guard();
+--> statement-breakpoint
+CREATE TRIGGER authz_events_no_delete BEFORE DELETE ON authz_events FOR EACH ROW EXECUTE FUNCTION authz_events_guard();
+--> statement-breakpoint
+CREATE TRIGGER authz_events_no_truncate BEFORE TRUNCATE ON authz_events FOR EACH STATEMENT EXECUTE FUNCTION authz_events_guard();
+--> statement-breakpoint
+ALTER TABLE ONLY access_team_members
+    ADD CONSTRAINT access_team_members_tenant_id_principal_class_principal_id_fkey FOREIGN KEY (tenant_id, principal_class, principal_id) REFERENCES memberships(tenant_id, principal_class, principal_id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY access_team_members
+    ADD CONSTRAINT access_team_members_tenant_id_team_id_fkey FOREIGN KEY (tenant_id, team_id) REFERENCES access_teams(tenant_id, id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY access_teams
+    ADD CONSTRAINT access_teams_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY access_teams
+    ADD CONSTRAINT access_teams_tenant_id_parent_id_fkey FOREIGN KEY (tenant_id, parent_id) REFERENCES access_teams(tenant_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY attach_proposals
+    ADD CONSTRAINT attach_proposals_child_id_fkey FOREIGN KEY (child_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY attach_proposals
+    ADD CONSTRAINT attach_proposals_parent_id_fkey FOREIGN KEY (parent_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY authz_assignments
+    ADD CONSTRAINT authz_assignments_tenant_id_application_id_platform_id_rol_fkey FOREIGN KEY (tenant_id, application_id, platform_id, role_id) REFERENCES authz_roles(tenant_id, application_id, platform_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_assignments
+    ADD CONSTRAINT authz_assignments_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY authz_assignments
+    ADD CONSTRAINT authz_assignments_tenant_id_principal_class_principal_id_fkey FOREIGN KEY (tenant_id, principal_class, principal_id) REFERENCES memberships(tenant_id, principal_class, principal_id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY authz_assignments
+    ADD CONSTRAINT authz_assignments_tenant_id_team_id_fkey FOREIGN KEY (tenant_id, team_id) REFERENCES access_teams(tenant_id, id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY authz_assignments
+    ADD CONSTRAINT authz_assignments_via_tenant_id_fkey FOREIGN KEY (via_tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY authz_events
+    ADD CONSTRAINT authz_events_team_tenant_fk FOREIGN KEY (tenant_id, team_id) REFERENCES access_teams(tenant_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY authz_roles
+    ADD CONSTRAINT authz_roles_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY break_glass_sessions
+    ADD CONSTRAINT break_glass_sessions_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE RESTRICT;
+--> statement-breakpoint
+ALTER TABLE ONLY credentials
+    ADD CONSTRAINT credentials_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY invitations
+    ADD CONSTRAINT invitations_attach_parent_id_fkey FOREIGN KEY (attach_parent_id) REFERENCES tenants(id) ON DELETE SET NULL;
+--> statement-breakpoint
+ALTER TABLE ONLY invitations
+    ADD CONSTRAINT invitations_policy_role_fk FOREIGN KEY (tenant_id, role_id) REFERENCES authz_roles(tenant_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY invitations
+    ADD CONSTRAINT invitations_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY memberships
+    ADD CONSTRAINT memberships_tenant_id_fkey FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY memberships
+    ADD CONSTRAINT memberships_via_tenant_id_fkey FOREIGN KEY (via_tenant_id) REFERENCES tenants(id) ON DELETE CASCADE;
+--> statement-breakpoint
+ALTER TABLE ONLY break_glass_sessions
+    ADD CONSTRAINT support_policy_role_fk FOREIGN KEY (tenant_id, role_id) REFERENCES authz_roles(tenant_id, id);
+--> statement-breakpoint
+ALTER TABLE ONLY tenants
+    ADD CONSTRAINT tenants_parent_id_fkey FOREIGN KEY (parent_id) REFERENCES tenants(id) ON DELETE RESTRICT;
+--> statement-breakpoint
+ALTER TABLE "authz_events" ADD CONSTRAINT "authz_events_action_check" CHECK ("action" IN (
+  'activation.approved',
+  'activation.denied',
+  'activation.expired',
+  'activation.requested',
+  'activation.revoked',
+  'activation.started',
+  'audit_log.viewed',
+  'break_glass.ended',
+  'break_glass.started',
+  'break_glass.viewed',
+  'credential.minted',
+  'credential.revoked',
+  'credential.rotated',
+  'invitation.accepted',
+  'invitation.expired',
+  'invitation.revoked',
+  'invitation.sent',
+  'membership.created',
+  'membership.ended',
+  'membership.role_changed',
+  'operator.bootstrapped',
+  'owner.installed',
+  'person.erased',
+  'platform.frozen',
+  'platform.unfrozen',
+  'role.created',
+  'role.deleted',
+  'role.updated',
+  'tenant.attach_declined',
+  'tenant.attach_proposed',
+  'tenant.ceiling_changed',
+  'tenant.created',
+  'tenant.exported',
+  'tenant.parent_attached',
+  'tenant.parent_detached',
+  'tenant.settings_changed',
+  'tenant.state_changed'
+));

package/migrations/0002_grants.sql

@@ -0,0 +1,27 @@
+-- Grants to one person, stored rather than compiled from a role. Guests live
+-- here; see src/grants.ts and https://github.com/wtfalch/authz/issues/42.
+CREATE TABLE "authz_grants" (
+  "id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+  "tenant_id" uuid NOT NULL,
+  "application_id" text NOT NULL,
+  "platform_id" text NOT NULL,
+  "permission" text NOT NULL,
+  "principal_id" text NOT NULL,
+  "principal_class" text NOT NULL,
+  "boundary" jsonb NOT NULL,
+  "scope" jsonb NOT NULL,
+  "constraints" jsonb,
+  "relation" text DEFAULT 'any' NOT NULL,
+  "guest" boolean DEFAULT false NOT NULL,
+  "reason" text,
+  "expires_at" timestamp with time zone,
+  "revoked_at" timestamp with time zone,
+  "created_by" text,
+  "created_at" timestamp with time zone DEFAULT now() NOT NULL,
+  -- The engine refuses a guest grant with no end date, so the table does too.
+  CONSTRAINT "authz_grants_guest_expires" CHECK (NOT "guest" OR "expires_at" IS NOT NULL)
+);
+--> statement-breakpoint
+CREATE INDEX "authz_grants_principal_idx" ON "authz_grants" ("tenant_id", "principal_class", "principal_id");
+--> statement-breakpoint
+CREATE INDEX "authz_grants_guest_idx" ON "authz_grants" ("tenant_id", "guest");

package/package.json

@@ -0,0 +1,44 @@
+{
+  "name": "@wtfalch/authz-store",
+  "version": "0.1.0",
+  "description": "Persistence and lifecycle for @wtfalch/authz: the storage a host would otherwise write itself.",
+  "type": "module",
+  "files": [
+    "dist",
+    "migrations",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "peerDependencies": {
+    "@wtfalch/authz": "^0.12.0",
+    "drizzle-orm": "^0.39.0"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "devDependencies": {
+    "@electric-sql/pglite": "^0.5.8",
+    "@types/node": "^22",
+    "drizzle-kit": "^0.31.10",
+    "drizzle-orm": "^0.39.0",
+    "fast-check": "^4.9.0",
+    "postgres": "^3.4.5",
+    "typescript": "^5.9.0",
+    "vitest": "^4.1.6"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run"
+  }
+}