tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/replay_reservation.py

@@ -0,0 +1,34 @@
+"""Canonical protocol-neutral durable replay reservations."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class ReplayReservation(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "replay_reservations"
+    __table_args__ = ({"schema": "authn"},)
+
+    namespace: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    key_digest: Mapped[str] = acol(
+        storage=S(String(64), nullable=False, unique=True, index=True)
+    )
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    issuer: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, index=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    reservation_context: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["ReplayReservation"]

tba_storage_core/tables/residency_zone/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/residency_zone/_table.py

@@ -0,0 +1,20 @@
+"""Durable residency zones."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ResidencyZone(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "residency_zones"
+    __table_args__ = ({"schema": "authn"},)
+
+    zone_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    jurisdictions: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    sovereign_controls: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["ResidencyZone"]

tba_storage_core/tables/resource_server_contract/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/resource_server_contract/_table.py

@@ -0,0 +1,21 @@
+"""Durable resource-server contract and attestation registry."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ResourceServerContract(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "resource_server_contracts"
+    __table_args__ = ({"schema": "authn"},)
+
+    contract_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    resource_server_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    contract_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(64), nullable=False, default="active", index=True))
+    contract_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["ResourceServerContract"]

tba_storage_core/tables/revoked_token/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/revoked_token/_table.py

@@ -0,0 +1,39 @@
+"""Durable revoked token registry."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+from tba_storage_core.framework import (
+    RestOltpTable,
+    Timestamped,
+    S,
+    acol,
+    Mapped,
+    String,
+    GUIDPk,
+    TZDateTime,
+    PgUUID,
+    ForeignKeySpec,
+)
+
+
+class RevokedToken(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "revoked_tokens"
+    __table_args__ = ({"schema": "authn"},)
+
+    token_hash: Mapped[str] = acol(storage=S(String(128), nullable=False, unique=True, index=True, default=lambda: uuid.uuid4().hex))
+    token_type_hint: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    refresh_family_id: Mapped[str | None] = acol(storage=S(String(64), nullable=True, index=True))
+    subject: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    tenant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.tenants.id"), nullable=True, index=True)
+    )
+    client_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.clients.id"), nullable=True, index=True)
+    )
+    revoked_reason: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    expires_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+
+
+__all__ = ["RevokedToken"]

tba_storage_core/tables/role/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/role/_table.py

@@ -0,0 +1,22 @@
+"""Durable RBAC role definitions."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class Role(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "roles"
+    __table_args__ = ({"schema": "authn"},)
+
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    permissions: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    denied_permissions: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    inherited_roles: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["Role"]

tba_storage_core/tables/runtime_qualification/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/runtime_qualification/_table.py

@@ -0,0 +1,21 @@
+"""Durable runtime qualification evidence."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class RuntimeQualificationRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "runtime_qualifications"
+    __table_args__ = ({"schema": "authn"},)
+
+    qualification_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    release_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    runtime_name: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    status: Mapped[str] = acol(storage=S(String(64), nullable=False, default="qualified", index=True))
+    qualification_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["RuntimeQualificationRecord"]

tba_storage_core/tables/scim_group/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/scim_group/_table.py

@@ -0,0 +1,21 @@
+"""Durable SCIM group projection rows."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ScimGroupRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "scim_groups"
+    __table_args__ = ({"schema": "authn"},)
+
+    group_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    display_name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    members: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["ScimGroupRecord"]

tba_storage_core/tables/scim_patch_event/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/scim_patch_event/_table.py

@@ -0,0 +1,22 @@
+"""Append-only SCIM patch operation events."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ScimPatchEvent(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "scim_patch_events"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    resource_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    resource_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    op: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    path: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    value_payload: Mapped[dict | list | str | int | float | bool | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["ScimPatchEvent"]

tba_storage_core/tables/scim_schema/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/scim_schema/_table.py

@@ -0,0 +1,21 @@
+"""Durable SCIM schema registry."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ScimSchemaRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "scim_schemas"
+    __table_args__ = ({"schema": "authn"},)
+
+    schema_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    resource_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    required_fields: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    schema_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["ScimSchemaRecord"]

tba_storage_core/tables/scim_user/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/scim_user/_table.py

@@ -0,0 +1,21 @@
+"""Durable SCIM user projection rows."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ScimUserRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "scim_users"
+    __table_args__ = ({"schema": "authn"},)
+
+    user_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    user_name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    attributes: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["ScimUserRecord"]

tba_storage_core/tables/sdk_package/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/sdk_package/_table.py

@@ -0,0 +1,23 @@
+"""Durable SDK package catalog."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class SDKPackageRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "sdk_packages"
+    __table_args__ = ({"schema": "authn"},)
+
+    sdk_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    package_name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    language: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    version: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    release_channel: Mapped[str] = acol(storage=S(String(64), nullable=False, default="stable", index=True))
+    contract_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["SDKPackageRecord"]

tba_storage_core/tables/security_event/__init__.py

@@ -0,0 +1,3 @@
+from ..security_event_state import SecurityEvent
+
+__all__ = ["SecurityEvent"]

tba_storage_core/tables/security_event_delivery/__init__.py

@@ -0,0 +1,3 @@
+from ..security_event_state import SecurityEventDelivery
+
+__all__ = ["SecurityEventDelivery"]

tba_storage_core/tables/security_event_replay/__init__.py

@@ -0,0 +1,3 @@
+from ..security_event_state import SecurityEventReplay
+
+__all__ = ["SecurityEventReplay"]

tba_storage_core/tables/security_event_state.py

@@ -0,0 +1,100 @@
+"""Durable security-event, subscription, delivery, and replay state."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class SecurityEvent(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "security_events"
+    __table_args__ = ({"schema": "authn"},)
+    event_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    event_type: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    subject_identifier: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    token_digest: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    issued_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class SecurityEventSubscription(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "security_event_subscriptions"
+    __table_args__ = ({"schema": "authn"},)
+    subscription_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    receiver: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    delivery_method: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, index=True)
+    )
+    endpoint: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    event_types: Mapped[list] = acol(storage=S(JSON, nullable=False))
+    active: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=True, index=True)
+    )
+
+
+class SecurityEventDelivery(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "security_event_deliveries"
+    __table_args__ = ({"schema": "authn"},)
+    event_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    subscription_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    attempt_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="pending", index=True)
+    )
+    error_code: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    acknowledged_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    next_attempt_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class SecurityEventReplay(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "security_event_replays"
+    __table_args__ = ({"schema": "authn"},)
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    jti: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    replay_key_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, unique=True, index=True)
+    )
+    expires_at: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, index=True)
+    )
+    consumed: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=True, index=True)
+    )
+
+
+__all__ = [
+    "SecurityEvent",
+    "SecurityEventSubscription",
+    "SecurityEventDelivery",
+    "SecurityEventReplay",
+]

tba_storage_core/tables/security_event_subscription/__init__.py

@@ -0,0 +1,3 @@
+from ..security_event_state import SecurityEventSubscription
+
+__all__ = ["SecurityEventSubscription"]

tba_storage_core/tables/service_identity/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/service_identity/_table.py

@@ -0,0 +1,47 @@
+"""Durable service identity records."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    GUIDPk,
+    Timestamped,
+    TenantBound,
+    Principal as PrincipalMixin,
+    ActiveToggle,
+    Mapped,
+    String,
+    relationship,
+    F,
+    IO,
+    S,
+    acol,
+    ColumnSpec,
+)
+
+
+class ServiceIdentity(RestOltpTable, GUIDPk, Timestamped, TenantBound, PrincipalMixin, ActiveToggle):
+    __tablename__ = "service_identities"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    name: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(120), unique=True, nullable=False),
+            field=F(constraints={"max_length": 120}, required_in=("create",)),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq", "ilike"),
+                sortable=True,
+            ),
+        )
+    )
+    _credential_service_keys = relationship(
+        "CredentialServiceKey",
+        back_populates="_service_identity",
+        cascade="all, delete-orphan",
+    )
+
+
+__all__ = ["ServiceIdentity"]

tba_storage_core/tables/spiffe_state.py

@@ -0,0 +1,83 @@
+"""Durable SPIFFE SVID, trust-bundle, and federation metadata."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class SvidRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "svid_records"
+    __table_args__ = ({"schema": "authn"},)
+    spiffe_id: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    svid_type: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    serial_or_jti: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    key_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    proof_key_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    confirmation_key_thumbprint: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    profile_revision: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    bundle_version: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    artifact_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    valid_from: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    revoked: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=False, index=True)
+    )
+
+
+class SpiffeTrustBundle(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "spiffe_trust_bundles"
+    __table_args__ = ({"schema": "authn"},)
+    trust_domain: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    version: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    artifact_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    active: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=True, index=True)
+    )
+
+
+class TrustDomainFederation(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "trust_domain_federations"
+    __table_args__ = ({"schema": "authn"},)
+    local_trust_domain: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    remote_trust_domain: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    bundle_endpoint: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+    federation_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["SvidRecord", "SpiffeTrustBundle", "TrustDomainFederation"]

tba_storage_core/tables/spiffe_trust_bundle/__init__.py

@@ -0,0 +1,3 @@
+from ..spiffe_state import SpiffeTrustBundle
+
+__all__ = ["SpiffeTrustBundle"]