tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/key_rotation_policy/_table.py

@@ -0,0 +1,38 @@
+"""Durable key rotation policy versions."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, Boolean, Integer, Mapped, S, String, TZDateTime, Timestamped, acol
+
+
+
+class KeyRotationPolicy(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "key_rotation_policies"
+    __table_args__ = ({"schema": "authn"},)
+
+    policy_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    version_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    key_class: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    key_use: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    algorithm: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    cadence_days: Mapped[int] = acol(storage=S(Integer, nullable=False))
+    max_key_age_days: Mapped[int] = acol(storage=S(Integer, nullable=False))
+    overlap_seconds: Mapped[int] = acol(storage=S(Integer, nullable=False))
+    retirement_seconds: Mapped[int] = acol(storage=S(Integer, nullable=False))
+    approval_required: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False))
+    jwks_publish_required: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True))
+    created_by: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    reason: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="draft", index=True))
+    approved_by: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    approved_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True))
+    published_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True))
+    supersedes: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+
+
+__all__ = ["KeyRotationPolicy"]

tba_storage_core/tables/logout_state/__init__.py

@@ -0,0 +1,10 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+__all__ = list(_table.__all__)

tba_storage_core/tables/logout_state/_table.py

@@ -0,0 +1,67 @@
+"""Durable logout-propagation state schema."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+
+from tba_storage_core.framework import (
+    Boolean,
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class LogoutState(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "logout_state"
+    __table_args__ = ({"schema": "authn"},)
+
+    session_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.sessions.id"),
+            nullable=True,
+            index=True,
+        )
+    )
+    sid: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="pending")
+    )
+    initiated_by: Mapped[str | None] = acol(
+        storage=S(String(64), nullable=True)
+    )
+    reason: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    frontchannel_required: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=False)
+    )
+    backchannel_required: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=False)
+    )
+    frontchannel_completed_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True)
+    )
+    backchannel_completed_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True)
+    )
+    propagated_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True)
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    logout_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["LogoutState"]

tba_storage_core/tables/machine_identity/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/machine_identity/_table.py

@@ -0,0 +1,49 @@
+"""Durable machine identity records."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import (
+    ColumnSpec,
+    F,
+    GUIDPk,
+    IO,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+
+class MachineIdentity(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "machine_identities"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    principal_id: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(255), nullable=False, unique=True, index=True),
+            field=F(constraints={"max_length": 255}, required_in=("create",)),
+            io=IO(in_verbs=("create", "update", "replace"), out_verbs=("read", "list"), filter_ops=("eq",)),
+        )
+    )
+    machine_subject: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(1000), nullable=False, unique=True, index=True),
+            field=F(constraints={"max_length": 1000}, required_in=("create",)),
+            io=IO(in_verbs=("create", "update", "replace"), out_verbs=("read", "list"), filter_ops=("eq", "ilike")),
+        )
+    )
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    realm_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    hardware_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    attestation_type: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    trust_anchor: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    machine_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["MachineIdentity"]

tba_storage_core/tables/operator_activity/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/operator_activity/_table.py

@@ -0,0 +1,29 @@
+"""Table-owned operator activity log."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    Integer,
+    Mapped,
+    S,
+    String,
+    acol,
+)
+
+
+class OperatorActivity(RestOltpTable):
+    __tablename__ = "operator_activity"
+
+    id: Mapped[int] = acol(
+        storage=S(Integer, primary_key=True, autoincrement=True, nullable=False)
+    )
+    ts: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    kind: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    resource: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    record_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    status: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    transaction_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+
+__all__ = ["OperatorActivity"]

tba_storage_core/tables/operator_audit_event/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/operator_audit_event/_table.py

@@ -0,0 +1,29 @@
+"""Table-owned operator audit log."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import RestOltpTable, Mapped, S, String, acol
+
+
+class OperatorAuditEvent(RestOltpTable):
+    __tablename__ = "operator_audit_events"
+
+    id: Mapped[str] = acol(storage=S(String(255), primary_key=True, nullable=False))
+    tenant_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    actor_user_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    actor_client_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    session_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    event_type: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    target_type: Mapped[str] = acol(storage=S(String(128), nullable=False))
+    target_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    outcome: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    request_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    occurred_at: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    details_json: Mapped[str] = acol(
+        storage=S(String(20000), nullable=False, default="{}")
+    )
+
+
+__all__ = ["OperatorAuditEvent"]

tba_storage_core/tables/operator_metadata/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/operator_metadata/_table.py

@@ -0,0 +1,19 @@
+"""Table-owned operator store metadata."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from tba_storage_core.framework import RestOltpTable, Mapped, S, String, TZDateTime, acol
+from tba_primitives_identity.clock import utc_now
+
+
+class OperatorMetadata(RestOltpTable):
+    __tablename__ = "operator_metadata"
+
+    key: Mapped[str] = acol(storage=S(String(255), primary_key=True, nullable=False))
+    value_json: Mapped[str] = acol(storage=S(String(8000), nullable=False, default="null"))
+    updated_at: Mapped[Any] = acol(storage=S(TZDateTime, nullable=False, default=utc_now))
+
+
+__all__ = ["OperatorMetadata"]

tba_storage_core/tables/operator_record/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/operator_record/_table.py

@@ -0,0 +1,44 @@
+"""Table-owned operator resource records."""
+
+from __future__ import annotations
+
+import copy
+from typing import Any, Mapping
+
+from tba_storage_core.framework import RestOltpTable, Boolean, Mapped, S, String, acol
+
+
+
+def _default_status(resource: str) -> str:
+    return "staged" if resource in {"keys"} else "active"
+
+
+class OperatorRecord(RestOltpTable):
+    __tablename__ = "operator_records"
+
+    id: Mapped[str] = acol(storage=S(String(512), primary_key=True, nullable=False))
+    resource: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    record_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(64), nullable=False, default="active", index=True))
+    enabled: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True))
+    created_at: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    updated_at: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    actor: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    profile: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    tenant: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    issuer: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    revision: Mapped[int] = acol(storage=S(nullable=False, default=1))
+    data_json: Mapped[str] = acol(storage=S(String(20000), nullable=False, default="{}"))
+
+    @staticmethod
+    def store_id(resource: str, record_id: str) -> str:
+        return f"{resource}:{record_id}"
+
+
+def _without_revision(record: Mapping[str, Any]) -> dict[str, Any]:
+    cleaned = copy.deepcopy(dict(record))
+    cleaned.pop("revision", None)
+    return cleaned
+
+
+__all__ = ["OperatorRecord"]

tba_storage_core/tables/operator_transaction/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/operator_transaction/_table.py

@@ -0,0 +1,33 @@
+"""Table-owned operator transaction log."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import RestOltpTable, Mapped, S, String, acol
+
+
+class OperatorTransaction(RestOltpTable):
+    __tablename__ = "operator_transactions"
+
+    transaction_id: Mapped[str] = acol(
+        storage=S(String(255), primary_key=True, nullable=False)
+    )
+    ts: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    command: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    resource: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    record_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    changed_ids_json: Mapped[str] = acol(
+        storage=S(String(8000), nullable=False, default="[]")
+    )
+    summary_json: Mapped[str] = acol(
+        storage=S(String(20000), nullable=False, default="{}")
+    )
+    actor: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    profile: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    tenant: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    issuer: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    before_checksum: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    after_checksum: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+
+
+__all__ = ["OperatorTransaction"]

tba_storage_core/tables/plugin_descriptor/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/plugin_descriptor/_table.py

@@ -0,0 +1,23 @@
+"""Durable plugin descriptor registry."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class PluginDescriptorRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "plugin_descriptors"
+    __table_args__ = ({"schema": "authn"},)
+
+    plugin_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    version: Mapped[str] = acol(storage=S(String(128), nullable=False))
+    isolation_mode: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    fail_behavior: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    descriptor_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="enabled", index=True))
+
+
+__all__ = ["PluginDescriptorRecord"]

tba_storage_core/tables/plugin_lifecycle_event/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/plugin_lifecycle_event/_table.py

@@ -0,0 +1,22 @@
+"""Append-only plugin lifecycle events."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class PluginLifecycleEventRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "plugin_lifecycle_events"
+    __table_args__ = ({"schema": "authn"},)
+
+    event_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    plugin_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    hook_name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    outcome: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    message: Mapped[str | None] = acol(storage=S(String(2000), nullable=True))
+    event_payload: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PluginLifecycleEventRecord"]

tba_storage_core/tables/policy/__init__.py

@@ -0,0 +1,5 @@
+"""Policy table export."""
+
+from ._table import Policy
+
+__all__ = ["Policy"]

tba_storage_core/tables/policy/_table.py

@@ -0,0 +1,30 @@
+"""Durable policy definition records for PAP and PRP surfaces."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class Policy(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policies"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    language: Mapped[str] = acol(storage=S(String(128), nullable=False, default="tba-conditions/v1", index=True))
+    description: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="draft", index=True))
+    active_version_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    policy_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["Policy"]

tba_storage_core/tables/policy_condition/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/policy_condition/_table.py

@@ -0,0 +1,21 @@
+"""Durable dynamic policy conditions."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class PolicyCondition(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_conditions"
+    __table_args__ = ({"schema": "authn"},)
+
+    policy_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    field_name: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    operator: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    expected: Mapped[dict | list | str | int | float | bool | None] = acol(storage=S(JSON, nullable=True))
+    condition_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicyCondition"]

tba_storage_core/tables/policy_set/__init__.py

@@ -0,0 +1,5 @@
+"""Policy set table export."""
+
+from ._table import PolicySet
+
+__all__ = ["PolicySet"]

tba_storage_core/tables/policy_set/_table.py

@@ -0,0 +1,33 @@
+"""Durable policy set records for XACML-style policy grouping."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicySet(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_sets"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    description: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    combining_algorithm: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, default="deny_overrides", index=True)
+    )
+    priority: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    policy_set_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicySet"]

tba_storage_core/tables/policy_set_member/__init__.py

@@ -0,0 +1,5 @@
+"""Policy set member table export."""
+
+from ._table import PolicySetMember
+
+__all__ = ["PolicySetMember"]

tba_storage_core/tables/policy_set_member/_table.py

@@ -0,0 +1,32 @@
+"""Durable policy set member records."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicySetMember(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_set_members"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    policy_set_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    member_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    member_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    priority: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0, index=True))
+    condition_expression: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    member_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicySetMember"]

tba_storage_core/tables/policy_target/__init__.py

@@ -0,0 +1,5 @@
+"""Policy target table export."""
+
+from ._table import PolicyTarget
+
+__all__ = ["PolicyTarget"]

tba_storage_core/tables/policy_target/_table.py

@@ -0,0 +1,36 @@
+"""Durable policy target records."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class PolicyTarget(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "policy_targets"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    owner_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    owner_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    subject_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    resource_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    action_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    environment_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    scope_selector: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    condition_expression: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    priority: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    target_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["PolicyTarget"]

tba_storage_core/tables/policy_version/__init__.py

@@ -0,0 +1,5 @@
+"""Policy version table export."""
+
+from ._table import PolicyVersion
+
+__all__ = ["PolicyVersion"]