tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/migrations/versions/0011_delegation_grant_lifecycle_tables.py

@@ -0,0 +1,39 @@
+"""Executable DDL migration for DelegationGrant lifecycle tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    DelegationGrant,
+    DelegationGrantEdge,
+    DelegationGrantProof,
+    DelegationGrantScope,
+    DelegationGrantTokenLink,
+)
+
+revision = "0011_delegation_grant_lifecycle_tables"
+down_revision = "0010_realm_namespace_tables"
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(
+        conn,
+        DelegationGrant,
+        DelegationGrantScope,
+        DelegationGrantProof,
+        DelegationGrantEdge,
+        DelegationGrantTokenLink,
+    )
+
+
+def downgrade(conn) -> None:
+    drop_tables(
+        conn,
+        DelegationGrant,
+        DelegationGrantScope,
+        DelegationGrantProof,
+        DelegationGrantEdge,
+        DelegationGrantTokenLink,
+    )

tba_storage_core/migrations/versions/0012_key_version_and_token_provenance_tables.py

@@ -0,0 +1,36 @@
+"""Executable DDL migration for key versions and token provenance."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import AUTHN_SCHEMA, column_names, create_tables, drop_columns, drop_tables
+from tba_storage_core.tables import CryptoKey, CryptoKeyVersion
+
+revision = "0012_key_version_and_token_provenance_tables"
+down_revision = "0011_delegation_grant_lifecycle_tables"
+branch_labels = None
+depends_on = None
+
+
+def _table_name(conn, table: str) -> str:
+    return f'"{AUTHN_SCHEMA}"."{table}"'
+
+
+def _add_column_if_missing(conn, table: str, name: str, ddl: str) -> None:
+    if name in column_names(conn, table):
+        return
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(conn, table)} ADD COLUMN {ddl}")
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, CryptoKey, CryptoKeyVersion)
+    _add_column_if_missing(conn, "token_records", "jti", '"jti" VARCHAR(128)')
+    _add_column_if_missing(conn, "token_records", "token_status", '"token_status" VARCHAR(32) NOT NULL DEFAULT \'active\'')
+    _add_column_if_missing(conn, "token_records", "kid", '"kid" VARCHAR(255)')
+    _add_column_if_missing(conn, "token_records", "key_version", '"key_version" INTEGER')
+    _add_column_if_missing(conn, "revoked_tokens", "refresh_family_id", '"refresh_family_id" VARCHAR(64)')
+
+
+def downgrade(conn) -> None:
+    drop_columns(conn, "revoked_tokens", ("refresh_family_id",))
+    drop_columns(conn, "token_records", ("jti", "token_status", "kid", "key_version"))
+    drop_tables(conn, CryptoKey, CryptoKeyVersion)

tba_storage_core/migrations/versions/0013_contract_durable_state_tables.py

@@ -0,0 +1,59 @@
+"""Executable DDL migration for contract-backed durable state tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    AccessReviewCampaign,
+    AccessReviewDecision,
+    AccessReviewItem,
+    AttributePolicy,
+    Credential,
+    CredentialAuditEvent,
+    CredentialDpopKey,
+    CredentialMtlsCertificate,
+    DelegatedAdminScope,
+    Entitlement,
+    EntitlementAssignment,
+    KeyRotationPolicy,
+    PolicyCondition,
+    ResidencyZone,
+    Role,
+    SubjectAlias,
+    TenantMembership,
+    TenantResidency,
+)
+
+revision = "0013_contract_durable_state_tables"
+down_revision = "0012_key_version_and_token_provenance_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (
+    Credential,
+    CredentialAuditEvent,
+    CredentialDpopKey,
+    CredentialMtlsCertificate,
+    TenantMembership,
+    SubjectAlias,
+    Role,
+    AttributePolicy,
+    PolicyCondition,
+    DelegatedAdminScope,
+    KeyRotationPolicy,
+    Entitlement,
+    EntitlementAssignment,
+    AccessReviewCampaign,
+    AccessReviewItem,
+    AccessReviewDecision,
+    ResidencyZone,
+    TenantResidency,
+)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0014_optional_contract_state_tables.py

@@ -0,0 +1,57 @@
+"""Executable DDL migration for optional contract state tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    AuthzVerificationReport,
+    ControlCorrectnessReport,
+    PluginDescriptorRecord,
+    PluginLifecycleEventRecord,
+    ProviderArtifact,
+    ReleaseAttestationEvent,
+    ReleaseAuthorizationState,
+    ReleaseCapabilityRecord,
+    ReleasePosture,
+    ReleaseSecurityPosture,
+    ResourceServerContract,
+    RuntimeQualificationRecord,
+    SDKPackageRecord,
+    ScimGroupRecord,
+    ScimPatchEvent,
+    ScimSchemaRecord,
+    ScimUserRecord,
+)
+
+revision = "0014_optional_contract_state_tables"
+down_revision = "0013_contract_durable_state_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (
+    SDKPackageRecord,
+    PluginDescriptorRecord,
+    PluginLifecycleEventRecord,
+    ScimSchemaRecord,
+    ScimUserRecord,
+    ScimGroupRecord,
+    ScimPatchEvent,
+    ReleaseCapabilityRecord,
+    ReleaseAuthorizationState,
+    RuntimeQualificationRecord,
+    ReleaseSecurityPosture,
+    ReleasePosture,
+    ReleaseAttestationEvent,
+    ControlCorrectnessReport,
+    AuthzVerificationReport,
+    ResourceServerContract,
+    ProviderArtifact,
+)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *reversed(TABLES))

tba_storage_core/migrations/versions/0015_principal_identity_credential_tables.py

@@ -0,0 +1,85 @@
+"""Executable DDL migration for principal, identity, and credential subtype tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import column_names, create_tables, drop_tables, ensure_schema, table_names
+from tba_storage_core.tables import (
+    CredentialApiKey,
+    CredentialClientSecret,
+    CredentialMfaFactor,
+    CredentialPassword,
+    CredentialRecoveryCode,
+    CredentialServiceKey,
+    CredentialWebAuthnPasskey,
+    MachineIdentity,
+    Principal,
+    ServiceIdentity,
+    WorkloadIdentity,
+)
+
+revision = "0015_principal_identity_credential_tables"
+down_revision = "0014_optional_contract_state_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (
+    Principal,
+    ServiceIdentity,
+    MachineIdentity,
+    WorkloadIdentity,
+    CredentialApiKey,
+    CredentialServiceKey,
+    CredentialPassword,
+    CredentialClientSecret,
+    CredentialWebAuthnPasskey,
+    CredentialMfaFactor,
+    CredentialRecoveryCode,
+)
+
+
+def _table_name(table: str) -> str:
+    return f'"authn"."{table}"'
+
+
+def _rename_table_if_present(conn, old: str, new: str) -> None:
+    names = table_names(conn)
+    if old not in names or new in names:
+        return
+    conn.exec_driver_sql(f'ALTER TABLE {_table_name(old)} RENAME TO "{new}"')
+
+
+def _rename_column_if_present(conn, table: str, old: str, new: str) -> None:
+    columns = column_names(conn, table)
+    if old not in columns or new in columns:
+        return
+    conn.exec_driver_sql(f'ALTER TABLE {_table_name(table)} RENAME COLUMN "{old}" TO "{new}"')
+
+
+def _add_column_if_missing(conn, table: str, column_sql: str, column_name: str) -> None:
+    if table not in table_names(conn) or column_name in column_names(conn, table):
+        return
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(table)} ADD COLUMN {column_sql}")
+
+
+def _adopt_legacy_identity_credential_tables(conn) -> None:
+    ensure_schema(conn)
+    _rename_table_if_present(conn, "services", "service_identities")
+    _rename_table_if_present(conn, "service_keys", "credential_service_keys")
+    _rename_table_if_present(conn, "api_keys", "credential_api_keys")
+    _rename_column_if_present(conn, "credential_service_keys", "service_id", "service_identity_id")
+    _rename_column_if_present(conn, "credential_api_keys", "user_id", "principal_id")
+    _add_column_if_missing(
+        conn,
+        "credential_api_keys",
+        '"principal_kind" VARCHAR(64) NOT NULL DEFAULT \'user\'',
+        "principal_kind",
+    )
+
+
+def upgrade(conn) -> None:
+    _adopt_legacy_identity_credential_tables(conn)
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0016_crypto_key_storage_tables.py

@@ -0,0 +1,84 @@
+"""Executable DDL migration for generic crypto key storage tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import column_names, create_tables, drop_tables, ensure_schema, table_names
+from tba_storage_core.tables import (
+    CryptoKey,
+    CryptoKeyVersion,
+    KeyAttestationEvidence,
+    KeyEnvelope,
+    PrincipalKeyBinding,
+)
+
+revision = "0016_crypto_key_storage_tables"
+down_revision = "0015_principal_identity_credential_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (
+    CryptoKey,
+    CryptoKeyVersion,
+    PrincipalKeyBinding,
+    KeyEnvelope,
+    KeyAttestationEvidence,
+)
+
+
+def _table_name(table: str) -> str:
+    return f'"authn"."{table}"'
+
+
+def _rename_table_if_present(conn, old: str, new: str) -> None:
+    names = table_names(conn)
+    if old not in names or new in names:
+        return
+    conn.exec_driver_sql(f'ALTER TABLE {_table_name(old)} RENAME TO "{new}"')
+
+
+def _rename_column_if_present(conn, table: str, old: str, new: str) -> None:
+    columns = column_names(conn, table)
+    if old not in columns or new in columns:
+        return
+    conn.exec_driver_sql(f'ALTER TABLE {_table_name(table)} RENAME COLUMN "{old}" TO "{new}"')
+
+
+def _add_column_if_missing(conn, table: str, ddl: str, column_name: str) -> None:
+    if table not in table_names(conn) or column_name in column_names(conn, table):
+        return
+    conn.exec_driver_sql(f"ALTER TABLE {_table_name(table)} ADD COLUMN {ddl}")
+
+
+def _adopt_legacy_key_tables(conn) -> None:
+    ensure_schema(conn)
+    _rename_table_if_present(conn, "identity_keys", "crypto_keys")
+    _rename_table_if_present(conn, "identity_key_versions", "crypto_key_versions")
+    _rename_column_if_present(conn, "crypto_keys", "public_jwk", "public_material")
+    _rename_column_if_present(conn, "crypto_key_versions", "public_jwk", "public_material")
+    _rename_column_if_present(conn, "crypto_keys", "key_profiles", "key_usages")
+
+    _add_column_if_missing(conn, "crypto_keys", '"key_kind" VARCHAR(64) NOT NULL DEFAULT \'asymmetric\'', "key_kind")
+    _add_column_if_missing(conn, "crypto_keys", '"key_usages" JSON', "key_usages")
+    _add_column_if_missing(conn, "crypto_keys", '"allowed_ops" JSON', "allowed_ops")
+    _add_column_if_missing(conn, "crypto_keys", '"export_policy" VARCHAR(64) NOT NULL DEFAULT \'public_only\'', "export_policy")
+    _add_column_if_missing(conn, "crypto_keys", '"origin" VARCHAR(64) NOT NULL DEFAULT \'generated\'', "origin")
+    _add_column_if_missing(conn, "crypto_keys", '"extractable" BOOLEAN NOT NULL DEFAULT FALSE', "extractable")
+    _add_column_if_missing(conn, "crypto_keys", '"public_material_format" VARCHAR(64)', "public_material_format")
+    _add_column_if_missing(conn, "crypto_keys", '"fingerprint" VARCHAR(255)', "fingerprint")
+
+    _add_column_if_missing(conn, "crypto_key_versions", '"allowed_ops" JSON', "allowed_ops")
+    _add_column_if_missing(conn, "crypto_key_versions", '"public_material_format" VARCHAR(64)', "public_material_format")
+    _add_column_if_missing(conn, "crypto_key_versions", '"fingerprint" VARCHAR(255)', "fingerprint")
+    _add_column_if_missing(conn, "crypto_key_versions", '"not_before" TIMESTAMP', "not_before")
+    _add_column_if_missing(conn, "crypto_key_versions", '"not_after" TIMESTAMP', "not_after")
+    _add_column_if_missing(conn, "crypto_key_versions", '"activated_at" TIMESTAMP', "activated_at")
+    _add_column_if_missing(conn, "crypto_key_versions", '"retired_at" TIMESTAMP', "retired_at")
+
+
+def upgrade(conn) -> None:
+    _adopt_legacy_key_tables(conn)
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, KeyAttestationEvidence, KeyEnvelope, PrincipalKeyBinding)

tba_storage_core/migrations/versions/0017_authorization_server_table.py

@@ -0,0 +1,21 @@
+"""Executable DDL migration for durable authorization-server state."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import AuthorizationServer
+
+revision = "0017_authorization_server_table"
+down_revision = "0016_crypto_key_storage_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (AuthorizationServer,)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0018_policy_tables.py

@@ -0,0 +1,27 @@
+"""Executable DDL migration for durable policy table state."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    Policy,
+    PolicySet,
+    PolicySetMember,
+    PolicyTarget,
+    PolicyVersion,
+)
+
+revision = "0018_policy_tables"
+down_revision = "0017_authorization_server_table"
+branch_labels = None
+depends_on = None
+
+TABLES = (Policy, PolicyVersion, PolicySet, PolicySetMember, PolicyTarget)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0019_federation_and_invariant_tables.py

@@ -0,0 +1,35 @@
+"""Executable DDL migration for federation and invariant table-owned state."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    AuthorizationInvariant,
+    Federation,
+    FederatedSession,
+    IdentityProvider,
+    InvariantEvaluation,
+    InvariantViolation,
+)
+
+revision = "0019_federation_and_invariant_tables"
+down_revision = "0018_policy_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (
+    IdentityProvider,
+    Federation,
+    FederatedSession,
+    AuthorizationInvariant,
+    InvariantEvaluation,
+    InvariantViolation,
+)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0020_backchannel_logout_replay_table.py

@@ -0,0 +1,21 @@
+"""Executable DDL migration for OIDC back-channel logout replay state."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import BackchannelLogoutReplay
+
+revision = "0020_backchannel_logout_replay_table"
+down_revision = "0019_federation_and_invariant_tables"
+branch_labels = None
+depends_on = None
+
+TABLES = (BackchannelLogoutReplay,)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0021_authentication_challenge_table.py

@@ -0,0 +1,21 @@
+"""Executable DDL migration for advanced-authentication challenge state."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import AuthenticationChallenge
+
+revision = "0021_authentication_challenge_table"
+down_revision = "0020_backchannel_logout_replay_table"
+branch_labels = None
+depends_on = None
+
+TABLES = (AuthenticationChallenge,)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0022_authority_and_trust_graph_tables.py

@@ -0,0 +1,35 @@
+"""Executable DDL migration for authority and trust graph tables."""
+
+from __future__ import annotations
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import (
+    AuthorityDerivationGraph,
+    AuthorityDerivationGraphEdge,
+    AuthorityDerivationGraphNode,
+    TrustFederationGraph,
+    TrustFederationGraphEdge,
+    TrustFederationGraphNode,
+)
+
+revision = "0022_authority_and_trust_graph_tables"
+down_revision = "0021_authentication_challenge_table"
+branch_labels = None
+depends_on = None
+
+TABLES = (
+    AuthorityDerivationGraph,
+    AuthorityDerivationGraphNode,
+    AuthorityDerivationGraphEdge,
+    TrustFederationGraph,
+    TrustFederationGraphNode,
+    TrustFederationGraphEdge,
+)
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0023_artifact_and_token_profile_discriminators.py

@@ -0,0 +1,65 @@
+"""Add digital-artifact and explicit token-profile discriminators."""
+
+from tba_storage_core.migrations.helpers import (
+    AUTHN_SCHEMA,
+    column_names,
+    drop_columns,
+)
+
+revision = "0023_artifact_and_token_profile_discriminators"
+down_revision = "0022_authority_and_trust_graph_tables"
+branch_labels = None
+depends_on = None
+
+GROUPS = {
+    "credentials": (
+        ("format", "format VARCHAR(64)"),
+        ("credential_type", "credential_type VARCHAR(255)"),
+        ("issuer_id", "issuer_id VARCHAR(255)"),
+        ("subject_id", "subject_id VARCHAR(255)"),
+        ("holder_binding_kind", "holder_binding_kind VARCHAR(64)"),
+        ("status_reference", "status_reference VARCHAR(1000)"),
+        ("payload_digest", "payload_digest VARCHAR(128)"),
+        ("issued_at", "issued_at TIMESTAMP"),
+        ("valid_from", "valid_from TIMESTAMP"),
+        ("valid_until", "valid_until TIMESTAMP"),
+    ),
+    "token_records": (
+        ("token_profile", "token_profile VARCHAR(128)"),
+        ("audience_digest", "audience_digest VARCHAR(128)"),
+        ("sender_constraint_kind", "sender_constraint_kind VARCHAR(64)"),
+        ("credential_or_grant_reference", "credential_or_grant_reference VARCHAR(255)"),
+    ),
+    "workload_identities": (
+        ("spiffe_id", "spiffe_id VARCHAR(1000)"),
+        ("selector_digest", "selector_digest VARCHAR(128)"),
+        ("svid_type", "svid_type VARCHAR(32)"),
+        ("bundle_version", "bundle_version VARCHAR(128)"),
+    ),
+    "key_attestation_evidence": (
+        ("profile", "profile VARCHAR(255)"),
+        ("issuer", "issuer VARCHAR(1000)"),
+        ("evidence_digest", "evidence_digest VARCHAR(128)"),
+        ("verification_result", "verification_result VARCHAR(64)"),
+        ("valid_until", "valid_until TIMESTAMP"),
+    ),
+}
+
+
+def _table(conn, name: str) -> str:
+    return f'"{AUTHN_SCHEMA}"."{name}"'
+
+
+def upgrade(conn) -> None:
+    for table, columns in GROUPS.items():
+        existing = column_names(conn, table)
+        for name, ddl in columns:
+            if name not in existing:
+                conn.exec_driver_sql(
+                    f"ALTER TABLE {_table(conn, table)} ADD COLUMN {ddl}"
+                )
+
+
+def downgrade(conn) -> None:
+    for table, columns in reversed(tuple(GROUPS.items())):
+        drop_columns(conn, table, tuple(name for name, _ in columns))

tba_storage_core/migrations/versions/0024_credential_issuer_wallet_and_configuration.py

@@ -0,0 +1,32 @@
+"""Create credential issuer, configuration, and wallet registry tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_digital_credential.tables.credential_ecosystem_registry import (
+    CredentialConfiguration,
+    CredentialIssuer,
+    WalletAttestation,
+    WalletInstance,
+    WalletKeyBinding,
+    WalletRegistration,
+)
+
+revision = "0024_credential_issuer_wallet_and_configuration"
+down_revision = "0023_artifact_and_token_profile_discriminators"
+branch_labels = None
+depends_on = None
+TABLES = (
+    CredentialIssuer,
+    CredentialConfiguration,
+    WalletRegistration,
+    WalletInstance,
+    WalletAttestation,
+    WalletKeyBinding,
+)
+
+
+def upgrade(conn):
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn):
+    drop_tables(conn, *TABLES)

tba_storage_core/migrations/versions/0025_credential_issuance_and_status.py

@@ -0,0 +1,34 @@
+"""Create credential issuance and status lifecycle tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_digital_credential.tables.credential_issuance_state import (
+    CredentialDeferredTransaction,
+    CredentialIssuanceTransaction,
+    CredentialNotification,
+    CredentialOffer,
+    CredentialStatusEntry,
+    CredentialStatusList,
+    CredentialStatusPublication,
+)
+
+revision = "0025_credential_issuance_and_status"
+down_revision = "0024_credential_issuer_wallet_and_configuration"
+branch_labels = None
+depends_on = None
+TABLES = (
+    CredentialOffer,
+    CredentialIssuanceTransaction,
+    CredentialDeferredTransaction,
+    CredentialNotification,
+    CredentialStatusList,
+    CredentialStatusEntry,
+    CredentialStatusPublication,
+)
+
+
+def upgrade(conn):
+    create_tables(conn, *TABLES)
+
+
+def downgrade(conn):
+    drop_tables(conn, *TABLES)