tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/subject_alias/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/subject_alias/_table.py

@@ -0,0 +1,21 @@
+"""Durable external subject aliases."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, Mapped, S, String, Timestamped, acol
+
+
+
+class SubjectAlias(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "subject_aliases"
+    __table_args__ = ({"schema": "authn"},)
+
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    subject: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    verified: Mapped[str] = acol(storage=S(String(8), nullable=False, default="false", index=True))
+
+
+__all__ = ["SubjectAlias"]

tba_storage_core/tables/svid_record/__init__.py

@@ -0,0 +1,3 @@
+from ..spiffe_state import SvidRecord
+
+__all__ = ["SvidRecord"]

tba_storage_core/tables/tenant/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/tenant/_table.py

@@ -0,0 +1,83 @@
+"""Tenant model for the authentication service."""
+
+from __future__ import annotations
+
+import uuid
+
+from tba_storage_core.framework import (
+    Bootstrappable,
+    F,
+    IO,
+    S,
+    ColumnSpec,
+    ForeignKeySpec,
+    Mapped,
+    PgUUID,
+    String,
+    TenantBase,
+    acol,
+    relationship,
+)
+
+
+class Tenant(TenantBase, Bootstrappable):
+    __table_args__ = ({"extend_existing": True, "schema": "authn"},)
+
+    name: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String, nullable=False, unique=True),
+            field=F(constraints={"max_length": 120}, required_in=("create",)),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq", "ilike"),
+                sortable=True,
+            ),
+        )
+    )
+    email: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String, nullable=False, unique=True),
+            field=F(constraints={"max_length": 120}, required_in=("create",)),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq", "ilike"),
+                sortable=True,
+            ),
+        )
+    )
+    realm_id: Mapped[uuid.UUID | None] = acol(
+        spec=ColumnSpec(
+            storage=S(
+                PgUUID(as_uuid=True),
+                fk=ForeignKeySpec(target="authn.realms.id"),
+                nullable=True,
+                index=True,
+            ),
+            field=F(),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq",),
+                sortable=True,
+            ),
+        )
+    )
+
+    realm = relationship("Realm", back_populates="tenants")
+    users = relationship("User", back_populates="tenant", cascade="all, delete-orphan")
+    clients = relationship("Client", back_populates="tenant", cascade="all, delete-orphan")
+
+    DEFAULT_ROWS = [
+        {
+            "id": uuid.UUID("FFFFFFFF-0000-0000-0000-000000000000"),
+            "realm_id": uuid.UUID("FFFFFFFF-1000-0000-0000-000000000000"),
+            "email": "tenant@example.com",
+            "name": "Public",
+            "slug": "public",
+        }
+    ]
+
+
+__all__ = ["Tenant"]

tba_storage_core/tables/tenant_membership/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/tenant_membership/_table.py

@@ -0,0 +1,28 @@
+"""Durable principal-to-tenant memberships."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class TenantMembership(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "tenant_memberships"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    roles: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+__all__ = ["TenantMembership"]

tba_storage_core/tables/tenant_residency/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/tenant_residency/_table.py

@@ -0,0 +1,23 @@
+"""Durable tenant residency assignments."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class TenantResidency(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "tenant_residency"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    residency_zone_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    allowed_processing_regions: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    restricted_transfer_regions: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    realm: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    residency_attributes: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+
+
+__all__ = ["TenantResidency"]

tba_storage_core/tables/token_record/__init__.py

@@ -0,0 +1,10 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+__all__ = list(_table.__all__)

tba_storage_core/tables/token_record/_table.py

@@ -0,0 +1,123 @@
+"""Durable token status and introspection backing store."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    Timestamped,
+    S,
+    acol,
+    JSON,
+    Boolean,
+    Mapped,
+    String,
+    TZDateTime,
+    GUIDPk,
+    ForeignKeySpec,
+    PgUUID,
+    Integer,
+)
+
+
+class TokenRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "token_records"
+    __table_args__ = ({"schema": "authn"},)
+
+    token_hash: Mapped[str] = acol(
+        storage=S(
+            String(128),
+            nullable=False,
+            unique=True,
+            index=True,
+            default=lambda: uuid.uuid4().hex,
+        )
+    )
+    jti: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, unique=True, index=True)
+    )
+    token_kind: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="access")
+    )
+    token_profile: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    audience_digest: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    sender_constraint_kind: Mapped[str | None] = acol(
+        storage=S(String(64), nullable=True, index=True)
+    )
+    credential_or_grant_reference: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    token_type_hint: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    token_status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+    refresh_family_id: Mapped[str | None] = acol(
+        storage=S(String(64), nullable=True, index=True)
+    )
+    refresh_parent_hash: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    refresh_successor_hash: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    active: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True))
+    subject: Mapped[str] = acol(
+        storage=S(
+            String(255),
+            nullable=False,
+            index=True,
+            default="admin-created-token-record",
+        )
+    )
+    tenant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.tenants.id"),
+            nullable=True,
+            index=True,
+        )
+    )
+    client_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.clients.id"),
+            nullable=True,
+            index=True,
+        )
+    )
+    scope: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    issuer: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    kid: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    key_version: Mapped[int | None] = acol(storage=S(Integer, nullable=True))
+    audience: Mapped[dict | list | str | None] = acol(storage=S(JSON, nullable=True))
+    claims: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    issued_at: Mapped[dt.datetime] = acol(
+        storage=S(
+            TZDateTime, nullable=False, default=lambda: dt.datetime.now(dt.timezone.utc)
+        )
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    last_introspected_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True)
+    )
+    used_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    reuse_detected_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    revoked_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    revoked_reason: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+
+
+__all__ = ["TokenRecord"]

tba_storage_core/tables/trust_anchor/__init__.py

@@ -0,0 +1,3 @@
+from ..certificate_state import TrustAnchor
+
+__all__ = ["TrustAnchor"]

tba_storage_core/tables/trust_domain_federation/__init__.py

@@ -0,0 +1,3 @@
+from ..spiffe_state import TrustDomainFederation
+
+__all__ = ["TrustDomainFederation"]

tba_storage_core/tables/trust_federation_graph/__init__.py

@@ -0,0 +1,15 @@
+"""Trust federation graph table exports."""
+
+from __future__ import annotations
+
+from ._table import (
+    TrustFederationGraph,
+    TrustFederationGraphEdge,
+    TrustFederationGraphNode,
+)
+
+__all__ = [
+    "TrustFederationGraph",
+    "TrustFederationGraphNode",
+    "TrustFederationGraphEdge",
+]

tba_storage_core/tables/trust_federation_graph/_table.py

@@ -0,0 +1,94 @@
+"""Durable trust federation graph tables."""
+
+from __future__ import annotations
+
+from sqlalchemy import Index, UniqueConstraint
+
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    S,
+    String,
+    UUID,
+    acol,
+)
+from tba_storage_core.tables._graph_base import GraphBase, GraphEdgeBase, GraphNodeBase
+
+
+class TrustFederationGraph(GraphBase, GUIDPk):
+    __tablename__ = "trust_federation_graphs"
+    __table_args__ = (
+        UniqueConstraint("graph_key", name="uq_trust_federation_graph_key"),
+        {"extend_existing": True, "schema": "authn"},
+    )
+
+
+class TrustFederationGraphNode(GraphNodeBase, GUIDPk):
+    __tablename__ = "trust_federation_graph_nodes"
+    __table_args__ = (
+        UniqueConstraint("graph_id", "node_key", name="uq_trust_federation_graph_node_key"),
+        Index("ix_trust_federation_graph_node_graph_kind", "graph_id", "kind"),
+        Index("ix_trust_federation_graph_node_tenant_kind", "tenant_id", "kind"),
+        {"extend_existing": True, "schema": "authn"},
+    )
+
+    graph_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.trust_federation_graphs.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    issuers: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    clouds: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    identity_provider_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    federation_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+
+
+class TrustFederationGraphEdge(GraphEdgeBase, GUIDPk):
+    __tablename__ = "trust_federation_graph_edges"
+    __table_args__ = (
+        UniqueConstraint("graph_id", "edge_key", name="uq_trust_federation_graph_edge_key"),
+        Index("ix_trust_federation_graph_edge_src_kind", "graph_id", "src_id", "kind"),
+        Index("ix_trust_federation_graph_edge_dst_kind", "graph_id", "dst_id", "kind"),
+        Index("ix_trust_federation_graph_edge_tenant_kind", "tenant_id", "kind"),
+        {"extend_existing": True, "schema": "authn"},
+    )
+
+    graph_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.trust_federation_graphs.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    src_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.trust_federation_graph_nodes.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    dst_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.trust_federation_graph_nodes.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    exchange_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    constraints: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = [
+    "TrustFederationGraph",
+    "TrustFederationGraphNode",
+    "TrustFederationGraphEdge",
+]

tba_storage_core/tables/user/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/user/_table.py

@@ -0,0 +1,127 @@
+"""User model for the authentication service."""
+
+from __future__ import annotations
+
+import uuid
+import datetime as dt
+
+from tba_storage_core.framework import (
+    UserBase,
+    LargeBinary,
+    Mapped,
+    Boolean,
+    String,
+    TZDateTime,
+    relationship,
+    F,
+    IO,
+    S,
+    acol,
+    ColumnSpec,
+)
+
+DEFAULT_BOOTSTRAP_SUPERUSER_ID = uuid.UUID("FFFFFFFF-0000-0000-0000-000000000001")
+
+
+class User(UserBase):
+    __table_args__ = ({"extend_existing": True, "schema": "authn"},)
+
+    username: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(32), nullable=False),
+            field=F(constraints={"max_length": 32}, required_in=("create",)),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq", "ilike"),
+                sortable=True,
+            ),
+        )
+    )
+    email: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(120), nullable=False, unique=True),
+            field=F(constraints={"max_length": 120}, required_in=("create",)),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq", "ilike"),
+                sortable=True,
+            ),
+        )
+    )
+    password_hash: Mapped[bytes | None] = acol(
+        spec=ColumnSpec(
+            storage=S(LargeBinary(60)), io=IO(in_verbs=("create", "update", "replace"))
+        )
+    )
+    is_admin: Mapped[bool] = acol(
+        spec=ColumnSpec(
+            storage=S(Boolean, nullable=False, default=False),
+            field=F(),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq",),
+            ),
+        )
+    )
+    is_superuser: Mapped[bool] = acol(
+        spec=ColumnSpec(
+            storage=S(Boolean, nullable=False, default=False),
+            field=F(),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq",),
+            ),
+        )
+    )
+    must_change_password: Mapped[bool] = acol(
+        spec=ColumnSpec(
+            storage=S(Boolean, nullable=False, default=False),
+            field=F(),
+            io=IO(
+                in_verbs=("create", "update", "replace"),
+                out_verbs=("read", "list"),
+                filter_ops=("eq",),
+            ),
+        )
+    )
+    password_reset_token_hash: Mapped[str | None] = acol(
+        spec=ColumnSpec(
+            storage=S(String(128), nullable=True, index=True),
+            io=IO(in_verbs=("update", "replace")),
+        )
+    )
+    password_reset_expires_at: Mapped[dt.datetime | None] = acol(
+        spec=ColumnSpec(
+            storage=S(TZDateTime, nullable=True),
+            io=IO(in_verbs=("update", "replace"), out_verbs=("read",)),
+        )
+    )
+
+    tenant = relationship("Tenant", back_populates="users")
+
+    @property
+    def roles(self) -> tuple[str, ...]:
+        roles: list[str] = []
+        if self.is_admin:
+            roles.append("admin")
+        if self.is_superuser:
+            roles.append("superuser")
+        return tuple(roles)
+
+    @property
+    def scopes(self) -> tuple[str, ...]:
+        scopes: list[str] = []
+        if self.is_admin:
+            scopes.append("tba_auth:admin")
+        if self.is_superuser:
+            scopes.append("tba_auth:superuser")
+        return tuple(scopes)
+
+__all__ = [
+    "DEFAULT_BOOTSTRAP_SUPERUSER_ID",
+    "User",
+]

tba_storage_core/tables/verifier_registration/__init__.py

@@ -0,0 +1,3 @@
+from ..presentation_state import VerifierRegistration
+
+__all__ = ["VerifierRegistration"]

tba_storage_core/tables/wallet_attestation/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_ecosystem_registry import WalletAttestation
+
+__all__ = ["WalletAttestation"]

tba_storage_core/tables/wallet_instance/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_ecosystem_registry import WalletInstance
+
+__all__ = ["WalletInstance"]

tba_storage_core/tables/wallet_key_binding/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_ecosystem_registry import WalletKeyBinding
+
+__all__ = ["WalletKeyBinding"]

tba_storage_core/tables/wallet_registration/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_ecosystem_registry import WalletRegistration
+
+__all__ = ["WalletRegistration"]

tba_storage_core/tables/webauthn_attestation_record/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnAttestationRecord
+
+__all__ = ["WebAuthnAttestationRecord"]

tba_storage_core/tables/webauthn_attestation_record/_table.py

@@ -0,0 +1,28 @@
+"""Durable result of authenticator attestation appraisal."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import GUIDPk, LargeBinary, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+class WebAuthnAttestationRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "webauthn_attestation_records"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    attestation_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    format: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    type: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    aaguid: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    statement_digest: Mapped[bytes] = acol(storage=S(LargeBinary, nullable=False))
+    certificate_chain_artifact_ref: Mapped[str | None] = acol(storage=S(String(1024), nullable=True))
+    trust_anchor_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    metadata_statement_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    verification_status: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    verified_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    valid_until: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+
+
+__all__ = ["WebAuthnAttestationRecord"]

tba_storage_core/tables/webauthn_ceremony/__init__.py

@@ -0,0 +1,3 @@
+from ._table import WebAuthnCeremony
+
+__all__ = ["WebAuthnCeremony"]