tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/__init__.py

@@ -0,0 +1,25 @@
+"""Storage adapters and Tigrbl/SQLAlchemy tables for the TBA identity package suite."""
+
+from __future__ import annotations
+
+from .migrations.contract import (
+    MigrationContract,
+    MigrationRevision,
+    build_migration_contract,
+    collect_migration_revisions,
+)
+
+
+def ensure_identity_storage_importable() -> None:
+    """Compatibility hook for callers that previously used facade path setup."""
+
+    return None
+
+
+__all__ = [
+    "ensure_identity_storage_importable",
+    "MigrationContract",
+    "MigrationRevision",
+    "build_migration_contract",
+    "collect_migration_revisions",
+]

tba_storage_core/components.py

@@ -0,0 +1,35 @@
+"""Explicit full identity-storage composition used by the compatibility facade."""
+
+from __future__ import annotations
+
+from importlib.resources import files
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - Python 3.10
+    import tomli as tomllib
+
+from tigrbl_migrations import (
+    StorageComposition,
+    discover_components,
+)
+from tigrbl_migrations.version import require_supported_manifest_version
+
+
+def _load_import_roots() -> tuple[str, ...]:
+    profile = tomllib.loads(
+        files(__package__).joinpath("storage.toml").read_text(encoding="utf-8")
+    )
+    require_supported_manifest_version(profile["manifest_version"])
+    return tuple(profile["components"])
+
+
+COMPONENT_IMPORT_ROOTS = _load_import_roots()
+
+
+def load_full_composition():
+    manifests, migrations = discover_components(COMPONENT_IMPORT_ROOTS)
+    return StorageComposition.from_manifests(*manifests), migrations
+
+
+__all__ = ["COMPONENT_IMPORT_ROOTS", "load_full_composition"]

tba_storage_core/framework.py

@@ -0,0 +1,3 @@
+"""Compatibility projection of the standalone identity storage framework."""
+
+from tba_primitives_identity.orm import *  # noqa: F401,F403

tba_storage_core/migrations/__init__.py

@@ -0,0 +1,15 @@
+"""Repository-owned migration contracts and durable version helpers."""
+
+from tba_storage_core.migrations.contract import (
+    MigrationContract,
+    MigrationRevision,
+    build_migration_contract,
+    collect_migration_revisions,
+)
+
+__all__ = [
+    "MigrationContract",
+    "MigrationRevision",
+    "build_migration_contract",
+    "collect_migration_revisions",
+]

tba_storage_core/migrations/contract.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable
+
+
+REVISION_PATTERN = re.compile(r"^revision\s*=\s*[\"']([^\"']+)[\"']", re.MULTILINE)
+
+
+@dataclass(frozen=True, slots=True)
+class MigrationRevision:
+    revision: str
+    path: str
+    ordinal: int
+
+
+@dataclass(frozen=True, slots=True)
+class MigrationContract:
+    revisions: tuple[MigrationRevision, ...]
+    required_collections: tuple[str, ...]
+
+    @property
+    def is_ordered(self) -> bool:
+        return tuple(item.ordinal for item in self.revisions) == tuple(sorted(item.ordinal for item in self.revisions))
+
+    @property
+    def latest_revision(self) -> str | None:
+        return self.revisions[-1].revision if self.revisions else None
+
+    def assert_complete(self) -> None:
+        if not self.revisions:
+            raise ValueError("migration contract requires at least one revision")
+        if not self.is_ordered:
+            raise ValueError("migration revisions must be ordered")
+        if len({item.revision for item in self.revisions}) != len(self.revisions):
+            raise ValueError("migration revisions must be unique")
+
+
+def collect_migration_revisions(versions_dir: Path) -> tuple[MigrationRevision, ...]:
+    revisions: list[MigrationRevision] = []
+    for path in sorted(versions_dir.glob("*.py")):
+        if path.name == "__init__.py":
+            continue
+        text = path.read_text(encoding="utf-8")
+        match = REVISION_PATTERN.search(text)
+        if match is None:
+            continue
+        ordinal_text = path.name.split("_", 1)[0]
+        ordinal = int(ordinal_text) if ordinal_text.isdigit() else len(revisions) + 1
+        revisions.append(MigrationRevision(revision=match.group(1), path=path.as_posix(), ordinal=ordinal))
+    return tuple(revisions)
+
+
+def build_migration_contract(
+    *,
+    versions_dir: Path,
+    required_collections: Iterable[str],
+) -> MigrationContract:
+    contract = MigrationContract(
+        revisions=collect_migration_revisions(versions_dir),
+        required_collections=tuple(sorted(set(required_collections))),
+    )
+    contract.assert_complete()
+    return contract
+
+
+__all__ = [
+    "MigrationContract",
+    "MigrationRevision",
+    "build_migration_contract",
+    "collect_migration_revisions",
+]

tba_storage_core/migrations/env.py

@@ -0,0 +1,7 @@
+"""Migration environment metadata exports."""
+
+from tba_storage_core.tables import RestOltpTable
+
+TARGET_METADATA = RestOltpTable.metadata
+
+__all__ = ["TARGET_METADATA"]

tba_storage_core/migrations/helpers.py

@@ -0,0 +1,219 @@
+"""DDL helpers for executable repository-owned migrations."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Protocol
+
+from sqlalchemy import Column, ForeignKey, MetaData, Table, inspect, text
+from sqlalchemy.exc import NoSuchTableError, SQLAlchemyError
+
+
+class SupportsTable(Protocol):
+    __table__: object
+
+
+AUTHN_SCHEMA = "authn"
+MIGRATION_TABLE = "schema_migrations"
+
+
+def ensure_schema(conn) -> None:
+    if conn.dialect.name != "sqlite":
+        conn.exec_driver_sql(f"CREATE SCHEMA IF NOT EXISTS {AUTHN_SCHEMA}")
+
+
+def ensure_migration_table(conn) -> None:
+    ensure_schema(conn)
+    if conn.dialect.name == "sqlite":
+        conn.exec_driver_sql(
+            f"CREATE TABLE IF NOT EXISTS {MIGRATION_TABLE} (revision VARCHAR(128) PRIMARY KEY, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)"
+        )
+        return
+    conn.exec_driver_sql(
+        f"CREATE TABLE IF NOT EXISTS {AUTHN_SCHEMA}.{MIGRATION_TABLE} (revision VARCHAR(128) PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW())"
+    )
+
+
+def applied_revisions(conn) -> set[str]:
+    ensure_migration_table(conn)
+    if conn.dialect.name == "sqlite":
+        rows = conn.exec_driver_sql(f"SELECT revision FROM {MIGRATION_TABLE}").fetchall()
+    else:
+        rows = conn.exec_driver_sql(f"SELECT revision FROM {AUTHN_SCHEMA}.{MIGRATION_TABLE}").fetchall()
+    return {str(row[0]) for row in rows}
+
+
+def mark_revision(conn, revision: str) -> None:
+    ensure_migration_table(conn)
+    table = MIGRATION_TABLE if conn.dialect.name == "sqlite" else f"{AUTHN_SCHEMA}.{MIGRATION_TABLE}"
+    conn.execute(text(f"INSERT INTO {table} (revision) VALUES (:revision)"), {"revision": revision})
+
+
+def unmark_revision(conn, revision: str) -> None:
+    ensure_migration_table(conn)
+    table = MIGRATION_TABLE if conn.dialect.name == "sqlite" else f"{AUTHN_SCHEMA}.{MIGRATION_TABLE}"
+    conn.execute(text(f"DELETE FROM {table} WHERE revision = :revision"), {"revision": revision})
+
+
+def _ddl_tables(conn, *models: SupportsTable) -> list[Table]:
+    return [model.__table__ for model in models]
+
+
+def create_tables(conn, *models: SupportsTable) -> None:
+    ensure_schema(conn)
+    for table in _ddl_tables(conn, *models):
+        table.create(bind=conn, checkfirst=True)
+
+
+def drop_tables(conn, *models: SupportsTable) -> None:
+    for table in reversed(_ddl_tables(conn, *models)):
+        table.drop(bind=conn, checkfirst=True)
+
+
+def table_names(conn) -> set[str]:
+    inspector = inspect(conn)
+    if conn.dialect.name == "sqlite":
+        return set(inspector.get_table_names(schema=AUTHN_SCHEMA))
+    return set(inspector.get_table_names(schema=AUTHN_SCHEMA))
+
+
+def column_names(conn, table: str) -> set[str]:
+    inspector = inspect(conn)
+    try:
+        cols = inspector.get_columns(
+            table,
+            schema=AUTHN_SCHEMA if conn.dialect.name == "sqlite" else AUTHN_SCHEMA,
+        )
+    except NoSuchTableError:
+        return set()
+    return {str(col["name"]) for col in cols}
+
+
+def _table_name(conn, table: str) -> str:
+    return f'"{AUTHN_SCHEMA}"."{table}"'
+
+
+def _index_name(conn, index: str) -> str:
+    if conn.dialect.name == "sqlite":
+        return f'"{AUTHN_SCHEMA}"."{index}"'
+    return f'"{index}"'
+
+
+def _copy_sqlalchemy_column(column, *, preserve_foreign_keys: bool = True) -> Column:
+    args = [column.type]
+    if preserve_foreign_keys:
+        for fk in column.foreign_keys:
+            target = fk.target_fullname
+            if target.startswith(f"{AUTHN_SCHEMA}."):
+                target = target[len(AUTHN_SCHEMA) + 1 :]
+            args.append(
+                ForeignKey(
+                    target,
+                    onupdate=fk.onupdate,
+                    ondelete=fk.ondelete,
+                    deferrable=fk.deferrable,
+                    initially=fk.initially,
+                    name=fk.constraint.name if fk.constraint is not None else None,
+                )
+            )
+    server_default = None
+    if column.server_default is not None and getattr(column.server_default, "arg", None) is not None:
+        server_default = column.server_default.arg
+    return Column(
+        column.name,
+        *args,
+        primary_key=column.primary_key,
+        nullable=column.nullable,
+        unique=bool(column.unique),
+        autoincrement=column.autoincrement,
+        server_default=server_default,
+        comment=column.comment,
+    )
+
+
+def _sqlite_rebuild_without_columns(conn, table: str, columns_to_drop: Iterable[str]) -> None:
+    drop_set = {name for name in columns_to_drop if name in column_names(conn, table)}
+    if not drop_set:
+        return
+
+    old_meta = MetaData()
+    old_table = Table(table, old_meta, schema=AUTHN_SCHEMA, autoload_with=conn)
+    keep_columns = [column for column in old_table.columns if column.name not in drop_set]
+    if not keep_columns:
+        raise ValueError(f"cannot rebuild SQLite table '{table}' without any remaining columns")
+
+    old_indexes = inspect(conn).get_indexes(table, schema=AUTHN_SCHEMA)
+    tmp_table_name = f"__tmp__{table}"
+
+    conn.exec_driver_sql("PRAGMA foreign_keys=OFF")
+    try:
+        new_meta = MetaData()
+        new_table = Table(
+            tmp_table_name,
+            new_meta,
+            schema=AUTHN_SCHEMA,
+            *(_copy_sqlalchemy_column(column, preserve_foreign_keys=False) for column in keep_columns),
+        )
+        new_table.create(bind=conn, checkfirst=False)
+
+        keep_names = [column.name for column in keep_columns]
+        select_columns = ", ".join(f'"{name}"' for name in keep_names)
+        conn.exec_driver_sql(
+            f'INSERT INTO {_table_name(conn, tmp_table_name)} ({select_columns}) '
+            f'SELECT {select_columns} FROM {_table_name(conn, table)}'
+        )
+        conn.exec_driver_sql(f'DROP TABLE {_table_name(conn, table)}')
+        conn.exec_driver_sql(
+            f'ALTER TABLE {_table_name(conn, tmp_table_name)} RENAME TO "{table}"'
+        )
+
+        for index in old_indexes:
+            index_columns = list(index.get("column_names") or [])
+            if not index_columns or any(name in drop_set for name in index_columns):
+                continue
+            unique_sql = "UNIQUE " if bool(index.get("unique", False)) else ""
+            rendered = ", ".join(f'"{name}"' for name in index_columns)
+            conn.exec_driver_sql(
+                f"CREATE {unique_sql}INDEX IF NOT EXISTS {_index_name(conn, index['name'])} "
+                f'ON "{table}" ({rendered})'
+            )
+    finally:
+        conn.exec_driver_sql("PRAGMA foreign_keys=ON")
+
+
+def drop_columns(conn, table: str, columns_to_drop: Iterable[str]) -> None:
+    drop_list = [name for name in columns_to_drop if name in column_names(conn, table)]
+    if not drop_list:
+        return
+
+    if conn.dialect.name == "sqlite":
+        remaining = list(drop_list)
+        for name in drop_list:
+            try:
+                conn.exec_driver_sql(f'ALTER TABLE {_table_name(conn, table)} DROP COLUMN "{name}"')
+                remaining.remove(name)
+            except SQLAlchemyError:
+                continue
+        if remaining:
+            _sqlite_rebuild_without_columns(conn, table, remaining)
+        return
+
+    rendered_table = _table_name(conn, table)
+    for name in drop_list:
+        conn.exec_driver_sql(f'ALTER TABLE {rendered_table} DROP COLUMN IF EXISTS "{name}"')
+
+
+__all__ = [
+    "AUTHN_SCHEMA",
+    "MIGRATION_TABLE",
+    "applied_revisions",
+    "column_names",
+    "create_tables",
+    "drop_columns",
+    "drop_tables",
+    "ensure_migration_table",
+    "ensure_schema",
+    "mark_revision",
+    "table_names",
+    "unmark_revision",
+]

tba_storage_core/migrations/versions/0001_initial_identity_tables.py

@@ -0,0 +1,17 @@
+"""Executable DDL migration for 0001_initial_identity_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import Realm, Tenant, User
+
+revision = '0001_initial_identity_tables'
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, Realm, Tenant, User)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, Realm, Tenant, User)

tba_storage_core/migrations/versions/0002_client_and_service_tables.py

@@ -0,0 +1,23 @@
+"""Executable DDL migration for 0002_client_and_service_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    Client,
+    ClientRegistration,
+    CredentialApiKey,
+    CredentialServiceKey,
+    ServiceIdentity,
+)
+
+revision = '0002_client_and_service_tables'
+down_revision = '0001_initial_identity_tables'
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, Client, ClientRegistration, ServiceIdentity, CredentialServiceKey, CredentialApiKey)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, Client, ClientRegistration, ServiceIdentity, CredentialServiceKey, CredentialApiKey)

tba_storage_core/migrations/versions/0003_authorization_runtime_tables.py

@@ -0,0 +1,17 @@
+"""Executable DDL migration for 0003_authorization_runtime_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import AuthSession, AuthCode, Consent, TokenRecord
+
+revision = '0003_authorization_runtime_tables'
+down_revision = '0002_client_and_service_tables'
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, AuthSession, AuthCode, Consent, TokenRecord)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, AuthSession, AuthCode, Consent, TokenRecord)

tba_storage_core/migrations/versions/0004_device_par_revocation_tables.py

@@ -0,0 +1,17 @@
+"""Executable DDL migration for 0004_device_par_revocation_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import DeviceCode, PushedAuthorizationRequest, RevokedToken
+
+revision = '0004_device_par_revocation_tables'
+down_revision = '0003_authorization_runtime_tables'
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, DeviceCode, PushedAuthorizationRequest, RevokedToken)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, DeviceCode, PushedAuthorizationRequest, RevokedToken)

tba_storage_core/migrations/versions/0005_session_logout_tables.py

@@ -0,0 +1,17 @@
+"""Executable DDL migration for 0005_session_logout_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import LogoutState
+
+revision = '0005_session_logout_tables'
+down_revision = '0004_device_par_revocation_tables'
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, LogoutState)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, LogoutState)

tba_storage_core/migrations/versions/0006_key_rotation_and_audit_tables.py

@@ -0,0 +1,17 @@
+"""Executable DDL migration for 0006_key_rotation_and_audit_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import KeyRotationEvent, AuditEvent
+
+revision = '0006_key_rotation_and_audit_tables'
+down_revision = '0005_session_logout_tables'
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, KeyRotationEvent, AuditEvent)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, KeyRotationEvent, AuditEvent)

tba_storage_core/migrations/versions/0007_browser_session_cookie_and_auth_code_linkage.py

@@ -0,0 +1,50 @@
+"""Executable DDL migration for 0007_browser_session_cookie_and_auth_code_linkage."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import column_names, drop_columns, AUTHN_SCHEMA
+
+revision = '0007_browser_session_cookie_and_auth_code_linkage'
+down_revision = '0006_key_rotation_and_audit_tables'
+branch_labels = None
+depends_on = None
+
+SESSION_COLUMNS = (
+    'session_state_salt',
+    'cookie_secret_hash',
+    'cookie_issued_at',
+    'cookie_rotated_at',
+)
+AUTH_CODE_COLUMNS = ('session_id',)
+
+
+def _table_name(conn, name: str) -> str:
+    return f"{AUTHN_SCHEMA}.{name}"
+
+
+def _add_column(conn, table: str, ddl: str) -> None:
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(conn, table)} ADD COLUMN {ddl}")
+
+
+def upgrade(conn) -> None:
+    session_cols = column_names(conn, 'sessions')
+    if 'session_state_salt' not in session_cols:
+        _add_column(conn, 'sessions', 'session_state_salt VARCHAR(128)')
+    if 'cookie_secret_hash' not in session_cols:
+        _add_column(conn, 'sessions', 'cookie_secret_hash VARCHAR(128)')
+    if 'cookie_issued_at' not in session_cols:
+        _add_column(conn, 'sessions', 'cookie_issued_at TIMESTAMP')
+    if 'cookie_rotated_at' not in session_cols:
+        _add_column(conn, 'sessions', 'cookie_rotated_at TIMESTAMP')
+
+    auth_code_cols = column_names(conn, 'auth_codes')
+    if 'session_id' not in auth_code_cols:
+        if conn.dialect.name == 'sqlite':
+            _add_column(conn, 'auth_codes', 'session_id CHAR(32)')
+        else:
+            _add_column(conn, 'auth_codes', 'session_id UUID')
+
+
+def downgrade(conn) -> None:
+    drop_columns(conn, 'auth_codes', AUTH_CODE_COLUMNS)
+    drop_columns(conn, 'sessions', SESSION_COLUMNS)

tba_storage_core/migrations/versions/0008_refresh_token_family_state.py

@@ -0,0 +1,44 @@
+"""Executable DDL migration for 0008_refresh_token_family_state."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import AUTHN_SCHEMA, column_names, drop_columns
+
+revision = "0008_refresh_token_family_state"
+down_revision = "0007_browser_session_cookie_and_auth_code_linkage"
+branch_labels = None
+depends_on = None
+
+TOKEN_RECORD_COLUMNS = (
+    "refresh_family_id",
+    "refresh_parent_hash",
+    "refresh_successor_hash",
+    "used_at",
+    "reuse_detected_at",
+)
+
+
+def _table_name(conn, name: str) -> str:
+    return f"{AUTHN_SCHEMA}.{name}"
+
+
+def _add_column(conn, table: str, ddl: str) -> None:
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(conn, table)} ADD COLUMN {ddl}")
+
+
+def upgrade(conn) -> None:
+    token_cols = column_names(conn, "token_records")
+    if "refresh_family_id" not in token_cols:
+        _add_column(conn, "token_records", "refresh_family_id VARCHAR(64)")
+    if "refresh_parent_hash" not in token_cols:
+        _add_column(conn, "token_records", "refresh_parent_hash VARCHAR(128)")
+    if "refresh_successor_hash" not in token_cols:
+        _add_column(conn, "token_records", "refresh_successor_hash VARCHAR(128)")
+    if "used_at" not in token_cols:
+        _add_column(conn, "token_records", "used_at TIMESTAMP")
+    if "reuse_detected_at" not in token_cols:
+        _add_column(conn, "token_records", "reuse_detected_at TIMESTAMP")
+
+
+def downgrade(conn) -> None:
+    drop_columns(conn, "token_records", TOKEN_RECORD_COLUMNS)

tba_storage_core/migrations/versions/0009_admin_identity_bootstrap_and_password_recovery.py

@@ -0,0 +1,48 @@
+"""Executable DDL migration for 0009_admin_identity_bootstrap_and_password_recovery."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import AUTHN_SCHEMA, column_names, drop_columns
+
+revision = "0009_admin_identity_bootstrap_and_password_recovery"
+down_revision = "0008_refresh_token_family_state"
+branch_labels = None
+depends_on = None
+
+USER_COLUMNS = (
+    "is_admin",
+    "is_superuser",
+    "must_change_password",
+    "password_reset_token_hash",
+    "password_reset_expires_at",
+)
+
+
+def _table_name(name: str) -> str:
+    return f"{AUTHN_SCHEMA}.{name}"
+
+
+def _add_column(conn, table: str, ddl: str) -> None:
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(table)} ADD COLUMN {ddl}")
+
+
+def _bool_default(conn) -> str:
+    return "0" if conn.dialect.name == "sqlite" else "FALSE"
+
+
+def upgrade(conn) -> None:
+    user_cols = column_names(conn, "users")
+    if "is_admin" not in user_cols:
+        _add_column(conn, "users", f"is_admin BOOLEAN NOT NULL DEFAULT {_bool_default(conn)}")
+    if "is_superuser" not in user_cols:
+        _add_column(conn, "users", f"is_superuser BOOLEAN NOT NULL DEFAULT {_bool_default(conn)}")
+    if "must_change_password" not in user_cols:
+        _add_column(conn, "users", f"must_change_password BOOLEAN NOT NULL DEFAULT {_bool_default(conn)}")
+    if "password_reset_token_hash" not in user_cols:
+        _add_column(conn, "users", "password_reset_token_hash VARCHAR(128)")
+    if "password_reset_expires_at" not in user_cols:
+        _add_column(conn, "users", "password_reset_expires_at TIMESTAMP")
+
+
+def downgrade(conn) -> None:
+    drop_columns(conn, "users", USER_COLUMNS)

tba_storage_core/migrations/versions/0010_realm_namespace_tables.py

@@ -0,0 +1,33 @@
+"""Executable DDL migration for 0010_realm_namespace_tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import AUTHN_SCHEMA, column_names, create_tables, drop_columns, table_names
+from tba_storage_core.tables import Realm
+
+revision = "0010_realm_namespace_tables"
+down_revision = "0009_admin_identity_bootstrap_and_password_recovery"
+branch_labels = None
+depends_on = None
+
+DEFAULT_REALM_ID = "FFFFFFFF-1000-0000-0000-000000000000"
+
+
+def _table_name(table: str) -> str:
+    return f'"{AUTHN_SCHEMA}"."{table}"'
+
+
+def _add_column(conn, table: str, ddl: str) -> None:
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(table)} ADD COLUMN {ddl}")
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, Realm)
+    if "tenants" in table_names(conn) and "realm_id" not in column_names(conn, "tenants"):
+        _add_column(conn, "tenants", "realm_id UUID")
+
+
+def downgrade(conn) -> None:
+    if "tenants" in table_names(conn):
+        drop_columns(conn, "tenants", ("realm_id",))
+    Realm.__table__.drop(bind=conn, checkfirst=True)