tba-storage-authorization-policy 0.4.0.dev2__tar.gz

tba_storage_authorization_policy-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,22 @@
+Metadata-Version: 2.4
+Name: tba-storage-authorization-policy
+Version: 0.4.0.dev2
+Summary: Owned authorization-policy identity database tables and migrations.
+License: Apache-2.0
+Requires-Python: >=3.10,<3.15
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Requires-Dist: tba-primitives-identity[storage] (>=0.4.0.dev2)
+Requires-Dist: tigrbl (>=0.4.4.dev1,<0.5)
+Requires-Dist: tigrbl-migrations (>=0.4.5.dev4)
+Description-Content-Type: text/markdown
+
+# tba-storage-authorization-policy
+
+Owns the `tigrbl.identity.storage.authorization-policy` schema component.
+

tba_storage_authorization_policy-0.4.0.dev2/README.md

@@ -0,0 +1,3 @@
+# tba-storage-authorization-policy
+
+Owns the `tigrbl.identity.storage.authorization-policy` schema component.

tba_storage_authorization_policy-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,20 @@
+[project]
+name = "tba-storage-authorization-policy"
+version = "0.4.0.dev2"
+description = "Owned authorization-policy identity database tables and migrations."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = { text = "Apache-2.0" }
+dependencies = [
+    "tigrbl>=0.4.4.dev1,<0.5",
+    "tigrbl-migrations>=0.4.5.dev4",
+    "tba-primitives-identity[storage]>=0.4.0.dev2",
+]
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_storage_authorization_policy", from = "src" }]
+include = ["src/tba_storage_authorization_policy/component.toml"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/__init__.py

@@ -0,0 +1,7 @@
+"""Standalone identity storage component."""
+
+from .manifest import MANIFEST, load_manifest
+from .tables import *  # noqa: F401,F403
+from .tables import TABLE_MODEL_BY_NAME, TABLE_MODEL_BY_TABLENAME, TABLE_MODELS
+
+__all__ = ["MANIFEST", "load_manifest", "TABLE_MODELS", "TABLE_MODEL_BY_NAME", "TABLE_MODEL_BY_TABLENAME"] + [model.__name__ for model in TABLE_MODELS]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/component.toml

@@ -0,0 +1,137 @@
+manifest_version = "1.1.0"
+
+[component]
+id = "tigrbl.identity.storage.authorization-policy"
+distribution = "tba-storage-authorization-policy"
+import_root = "tba_storage_authorization_policy"
+
+[schema]
+contract = "1.1.0"
+migration_head = "5b573a6c-8268-5af3-a505-ea2c8a7c9dcc"
+migrations_package = "tba_storage_authorization_policy.migrations.versions"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:tenant_memberships"
+kind = "table"
+physical_name = "authn.tenant_memberships"
+model = "tba_storage_authorization_policy.tables:TenantMembership"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:roles"
+kind = "table"
+physical_name = "authn.roles"
+model = "tba_storage_authorization_policy.tables:Role"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:attribute_policies"
+kind = "table"
+physical_name = "authn.attribute_policies"
+model = "tba_storage_authorization_policy.tables:AttributePolicy"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_conditions"
+kind = "table"
+physical_name = "authn.policy_conditions"
+model = "tba_storage_authorization_policy.tables:PolicyCondition"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policies"
+kind = "table"
+physical_name = "authn.policies"
+model = "tba_storage_authorization_policy.tables:Policy"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_versions"
+kind = "table"
+physical_name = "authn.policy_versions"
+model = "tba_storage_authorization_policy.tables:PolicyVersion"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_sets"
+kind = "table"
+physical_name = "authn.policy_sets"
+model = "tba_storage_authorization_policy.tables:PolicySet"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_set_members"
+kind = "table"
+physical_name = "authn.policy_set_members"
+model = "tba_storage_authorization_policy.tables:PolicySetMember"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_targets"
+kind = "table"
+physical_name = "authn.policy_targets"
+model = "tba_storage_authorization_policy.tables:PolicyTarget"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:delegated_admin_scopes"
+kind = "table"
+physical_name = "authn.delegated_admin_scopes"
+model = "tba_storage_authorization_policy.tables:DelegatedAdminScope"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:authorization_invariants"
+kind = "table"
+physical_name = "authn.authorization_invariants"
+model = "tba_storage_authorization_policy.tables:AuthorizationInvariant"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:invariant_evaluations"
+kind = "table"
+physical_name = "authn.invariant_evaluations"
+model = "tba_storage_authorization_policy.tables:InvariantEvaluation"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:invariant_violations"
+kind = "table"
+physical_name = "authn.invariant_violations"
+model = "tba_storage_authorization_policy.tables:InvariantViolation"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:authorization_resource_types"
+kind = "table"
+physical_name = "authn.authorization_resource_types"
+model = "tba_storage_authorization_policy.tables:AuthorizationResourceType"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:authorization_actions"
+kind = "table"
+physical_name = "authn.authorization_actions"
+model = "tba_storage_authorization_policy.tables:AuthorizationAction"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:authorization_groups"
+kind = "table"
+physical_name = "authn.authorization_groups"
+model = "tba_storage_authorization_policy.tables:AuthorizationGroup"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:authorization_group_memberships"
+kind = "table"
+physical_name = "authn.authorization_group_memberships"
+model = "tba_storage_authorization_policy.tables:AuthorizationGroupMembership"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:role_permissions"
+kind = "table"
+physical_name = "authn.role_permissions"
+model = "tba_storage_authorization_policy.tables:RolePermission"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:role_grants"
+kind = "table"
+physical_name = "authn.role_grants"
+model = "tba_storage_authorization_policy.tables:RoleGrant"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_approvals"
+kind = "table"
+physical_name = "authn.policy_approvals"
+model = "tba_storage_authorization_policy.tables:PolicyApproval"
+
+[[schema.objects]]
+id = "tigrbl.identity.storage.authorization-policy:table:policy_publications"
+kind = "table"
+physical_name = "authn.policy_publications"
+model = "tba_storage_authorization_policy.tables:PolicyPublication"

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/manifest.py

@@ -0,0 +1,9 @@
+"""Installed component manifest access."""
+from importlib.resources import as_file, files
+from tigrbl_migrations import StorageManifest
+
+def load_manifest() -> StorageManifest:
+    with as_file(files(__package__).joinpath("component.toml")) as path:
+        return StorageManifest.from_toml(path)
+
+MANIFEST = load_manifest()

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/migrations/versions/0ef0b038_e979_5ba7_b874_d36093292702_initial_schema.py

@@ -0,0 +1,23 @@
+"""Initial owned schema for tigrbl.identity.storage.authorization-policy."""
+from tigrbl_migrations import Migration
+from tba_storage_authorization_policy.tables import TABLE_MODELS
+
+REVISION = "0ef0b038-e979-5ba7-b874-d36093292702"
+
+def upgrade(connection):
+    for model in TABLE_MODELS:
+        model.__table__.create(bind=connection, checkfirst=True)
+
+def downgrade(connection):
+    for model in reversed(TABLE_MODELS):
+        model.__table__.drop(bind=connection, checkfirst=True)
+
+MIGRATION = Migration(
+    component="tigrbl.identity.storage.authorization-policy",
+    revision=REVISION,
+    parents=(),
+    kind="standard",
+    reversible=True,
+    upgrade=upgrade,
+    downgrade=downgrade,
+)

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/migrations/versions/5b573a6c_8268_5af3_a505_ea2c8a7c9dcc_normalized_platform_iam.py

@@ -0,0 +1,47 @@
+"""Add normalized RBAC and immutable policy publication records."""
+
+from tigrbl_migrations import Migration
+from tba_storage_authorization_policy.tables import (
+    AuthorizationAction,
+    AuthorizationGroup,
+    AuthorizationGroupMembership,
+    AuthorizationResourceType,
+    PolicyApproval,
+    PolicyPublication,
+    RoleGrant,
+    RolePermission,
+)
+
+REVISION = "5b573a6c-8268-5af3-a505-ea2c8a7c9dcc"
+PARENT = "0ef0b038-e979-5ba7-b874-d36093292702"
+MODELS = (
+    AuthorizationResourceType,
+    AuthorizationAction,
+    AuthorizationGroup,
+    AuthorizationGroupMembership,
+    RolePermission,
+    RoleGrant,
+    PolicyApproval,
+    PolicyPublication,
+)
+
+
+def upgrade(connection):
+    for model in MODELS:
+        model.__table__.create(bind=connection, checkfirst=True)
+
+
+def downgrade(connection):
+    for model in reversed(MODELS):
+        model.__table__.drop(bind=connection, checkfirst=True)
+
+
+MIGRATION = Migration(
+    component="tigrbl.identity.storage.authorization-policy",
+    revision=REVISION,
+    parents=(PARENT,),
+    kind="standard",
+    reversible=True,
+    upgrade=upgrade,
+    downgrade=downgrade,
+)

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/__init__.py

@@ -0,0 +1,45 @@
+"""Owned mapped-table inventory."""
+
+from .attribute_policy import AttributePolicy
+from .authorization_invariant import AuthorizationInvariant
+from .delegated_admin_scope import DelegatedAdminScope
+from .invariant_evaluation import InvariantEvaluation
+from .invariant_violation import InvariantViolation
+from .policy import Policy
+from .policy_condition import PolicyCondition
+from .policy_set import PolicySet
+from .policy_set_member import PolicySetMember
+from .policy_target import PolicyTarget
+from .policy_version import PolicyVersion
+from .role import Role
+from .tenant_membership import TenantMembership
+from .normalized import AuthorizationAction, AuthorizationGroup, AuthorizationGroupMembership, AuthorizationResourceType, PolicyApproval, PolicyPublication, RoleGrant, RolePermission
+
+TABLE_MODELS = (
+    TenantMembership,
+    Role,
+    AttributePolicy,
+    PolicyCondition,
+    Policy,
+    PolicyVersion,
+    PolicySet,
+    PolicySetMember,
+    PolicyTarget,
+    DelegatedAdminScope,
+    AuthorizationInvariant,
+    InvariantEvaluation,
+    InvariantViolation,
+    AuthorizationResourceType,
+    AuthorizationAction,
+    AuthorizationGroup,
+    AuthorizationGroupMembership,
+    RolePermission,
+    RoleGrant,
+    PolicyApproval,
+    PolicyPublication,
+)
+TABLE_MODEL_BY_NAME = {model.__name__: model for model in TABLE_MODELS}
+TABLE_MODEL_BY_TABLENAME = {model.__tablename__: model for model in TABLE_MODELS}
+__all__ = [model.__name__ for model in TABLE_MODELS] + [
+    "TABLE_MODELS", "TABLE_MODEL_BY_NAME", "TABLE_MODEL_BY_TABLENAME",
+]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/attribute_policy/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/attribute_policy/_table.py

@@ -0,0 +1,40 @@
+"""Durable ABAC policy definitions."""
+
+from __future__ import annotations
+
+
+from tba_primitives_identity.orm import (
+    RestOltpTable,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class AttributePolicy(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attribute_policies"
+    __table_args__ = ({"schema": "authn"},)
+
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    client_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    permission: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    effect: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="allow", index=True)
+    )
+    required_attributes: Mapped[dict] = acol(
+        storage=S(JSON, nullable=False, default=dict)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+__all__ = ["AttributePolicy"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/authorization_invariant/__init__.py

@@ -0,0 +1,5 @@
+"""Authorization invariant table export."""
+
+from ._table import AuthorizationInvariant
+
+__all__ = ["AuthorizationInvariant"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/authorization_invariant/_table.py

@@ -0,0 +1,34 @@
+"""Durable authorization invariant definitions."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class AuthorizationInvariant(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_invariants"
+    __table_args__ = ({"schema": "authn"},)
+
+    invariant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    title: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    property_family: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    statement: Mapped[str] = acol(storage=S(String(2000), nullable=False))
+    verification_method: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    severity: Mapped[str] = acol(storage=S(String(64), nullable=False, default="error", index=True))
+    enabled: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+    feature_ids: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    spec_ids: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    tags: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["AuthorizationInvariant"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/delegated_admin_scope/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/delegated_admin_scope/_table.py

@@ -0,0 +1,34 @@
+"""Durable delegated administration scopes."""
+
+from __future__ import annotations
+
+
+from tba_primitives_identity.orm import (
+    RestOltpTable,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class DelegatedAdminScope(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegated_admin_scopes"
+    __table_args__ = ({"schema": "authn"},)
+
+    subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_ids: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    permissions: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    visible_client_fields: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    mutable_client_fields: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    service_identity_permissions: Mapped[list | None] = acol(
+        storage=S(JSON, nullable=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+__all__ = ["DelegatedAdminScope"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/invariant_evaluation/__init__.py

@@ -0,0 +1,5 @@
+"""Invariant evaluation table export."""
+
+from ._table import InvariantEvaluation
+
+__all__ = ["InvariantEvaluation"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/invariant_evaluation/_table.py

@@ -0,0 +1,29 @@
+"""Durable authorization invariant evaluation records."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class InvariantEvaluation(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "invariant_evaluations"
+    __table_args__ = ({"schema": "authn"},)
+
+    invariant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    passed: Mapped[bool] = acol(storage=S(Boolean, nullable=False, index=True))
+    message: Mapped[str] = acol(storage=S(String(2000), nullable=False))
+    evaluated_at: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    evidence: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["InvariantEvaluation"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/invariant_violation/__init__.py

@@ -0,0 +1,5 @@
+"""Invariant violation table export."""
+
+from ._table import InvariantViolation
+
+__all__ = ["InvariantViolation"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/invariant_violation/_table.py

@@ -0,0 +1,27 @@
+"""Durable authorization invariant violation records."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class InvariantViolation(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "invariant_violations"
+    __table_args__ = ({"schema": "authn"},)
+
+    invariant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    severity: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    message: Mapped[str] = acol(storage=S(String(2000), nullable=False))
+    evidence: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["InvariantViolation"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/normalized.py

@@ -0,0 +1,83 @@
+"""Normalized RBAC, publication, and access-governance storage models."""
+
+from tba_primitives_identity.orm import Boolean, GUIDPk, JSON, Mapped, RestOltpTable, S, String, Timestamped, acol
+
+
+class AuthorizationResourceType(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_resource_types"
+    __table_args__ = ({"schema": "authn"},)
+    key: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+
+class AuthorizationAction(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_actions"
+    __table_args__ = ({"schema": "authn"},)
+    key: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    resource_type: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    required_acr: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+class AuthorizationGroup(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_groups"
+    __table_args__ = ({"schema": "authn"},)
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+class AuthorizationGroupMembership(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_group_memberships"
+    __table_args__ = ({"schema": "authn"},)
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    group_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+class RolePermission(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "role_permissions"
+    __table_args__ = ({"schema": "authn"},)
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    role_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    action_key: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    effect: Mapped[str] = acol(storage=S(String(16), nullable=False, default="allow", index=True))
+
+class RoleGrant(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "role_grants"
+    __table_args__ = ({"schema": "authn"},)
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_type: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    role_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    resource_type: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    resource_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    valid_from: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    expires_at: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    revoked_at: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    conditions: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+class PolicyApproval(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_approvals"
+    __table_args__ = ({"schema": "authn"},)
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    policy_version_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    approver_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    decision: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    reason: Mapped[str | None] = acol(storage=S(String(2000), nullable=True))
+
+class PolicyPublication(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_publications"
+    __table_args__ = ({"schema": "authn"},)
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    policy_version_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    manifest_hash: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    active: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+    supersedes_publication_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+__all__ = [
+    "AuthorizationResourceType",
+    "AuthorizationAction",
+    "AuthorizationGroup",
+    "AuthorizationGroupMembership",
+    "RolePermission",
+    "RoleGrant",
+    "PolicyApproval",
+    "PolicyPublication",
+]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy/__init__.py

@@ -0,0 +1,5 @@
+"""Policy table export."""
+
+from ._table import Policy
+
+__all__ = ["Policy"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy/_table.py

@@ -0,0 +1,30 @@
+"""Durable policy definition records for PAP and PRP surfaces."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class Policy(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policies"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    language: Mapped[str] = acol(storage=S(String(128), nullable=False, default="tba-conditions/v1", index=True))
+    description: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="draft", index=True))
+    active_version_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    policy_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["Policy"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_condition/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_condition/_table.py

@@ -0,0 +1,21 @@
+"""Durable dynamic policy conditions."""
+
+from __future__ import annotations
+
+
+from tba_primitives_identity.orm import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class PolicyCondition(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_conditions"
+    __table_args__ = ({"schema": "authn"},)
+
+    policy_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    field_name: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    operator: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    expected: Mapped[dict | list | str | int | float | bool | None] = acol(storage=S(JSON, nullable=True))
+    condition_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicyCondition"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_set/__init__.py

@@ -0,0 +1,5 @@
+"""Policy set table export."""
+
+from ._table import PolicySet
+
+__all__ = ["PolicySet"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_set/_table.py

@@ -0,0 +1,33 @@
+"""Durable policy set records for XACML-style policy grouping."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicySet(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_sets"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    description: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    combining_algorithm: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, default="deny_overrides", index=True)
+    )
+    priority: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    policy_set_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicySet"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_set_member/__init__.py

@@ -0,0 +1,5 @@
+"""Policy set member table export."""
+
+from ._table import PolicySetMember
+
+__all__ = ["PolicySetMember"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_set_member/_table.py

@@ -0,0 +1,32 @@
+"""Durable policy set member records."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicySetMember(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_set_members"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    policy_set_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    member_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    member_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    priority: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0, index=True))
+    condition_expression: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    member_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicySetMember"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_target/__init__.py

@@ -0,0 +1,5 @@
+"""Policy target table export."""
+
+from ._table import PolicyTarget
+
+__all__ = ["PolicyTarget"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_target/_table.py

@@ -0,0 +1,36 @@
+"""Durable policy target records."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicyTarget(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_targets"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    owner_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    owner_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    subject_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    resource_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    action_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    environment_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    scope_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    condition_expression: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    priority: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    target_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicyTarget"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_version/__init__.py

@@ -0,0 +1,5 @@
+"""Policy version table export."""
+
+from ._table import PolicyVersion
+
+__all__ = ["PolicyVersion"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/policy_version/_table.py

@@ -0,0 +1,35 @@
+"""Durable policy version records for PAP and PRP surfaces."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    Boolean,
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicyVersion(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_versions"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    policy_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    version_number: Mapped[int] = acol(storage=S(Integer, nullable=False, default=1, index=True))
+    source: Mapped[str] = acol(storage=S(String(4000), nullable=False))
+    source_hash: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    relation: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    context_equals: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    promoted: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="draft", index=True))
+    version_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicyVersion"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/role/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/role/_table.py

@@ -0,0 +1,22 @@
+"""Durable RBAC role definitions."""
+
+from __future__ import annotations
+
+
+from tba_primitives_identity.orm import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class Role(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "roles"
+    __table_args__ = ({"schema": "authn"},)
+
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    permissions: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    denied_permissions: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    inherited_roles: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["Role"]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/tenant_membership/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_authorization_policy-0.4.0.dev2/src/tba_storage_authorization_policy/tables/tenant_membership/_table.py

@@ -0,0 +1,28 @@
+"""Durable principal-to-tenant memberships."""
+
+from __future__ import annotations
+
+from tba_primitives_identity.orm import (
+    RestOltpTable,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class TenantMembership(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "tenant_memberships"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    roles: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+__all__ = ["TenantMembership"]