tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/attestation_state.py

@@ -0,0 +1,124 @@
+"""Durable attestation evidence, results, reference material, and policies."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class AttestationEvidence(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attestation_evidence"
+    __table_args__ = ({"schema": "authn"},)
+    evidence_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    format: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    issuer: Mapped[str | None] = acol(
+        storage=S(String(1000), nullable=True, index=True)
+    )
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    evidence_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class AttestationResult(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attestation_results"
+    __table_args__ = ({"schema": "authn"},)
+    evidence_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    policy_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    trusted: Mapped[bool] = acol(storage=S(Boolean, nullable=False, index=True))
+    reason: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    result_claims: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    appraised_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class AttestationReferenceManifest(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attestation_reference_manifests"
+    __table_args__ = ({"schema": "authn"},)
+    manifest_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    format: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    artifact_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    signer: Mapped[str | None] = acol(
+        storage=S(String(1000), nullable=True, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class AttestationReferenceValue(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attestation_reference_values"
+    __table_args__ = ({"schema": "authn"},)
+    manifest_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    environment: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    measurement_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    algorithm: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    digest: Mapped[str] = acol(storage=S(String(256), nullable=False, index=True))
+
+
+class AttestationEndorsement(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attestation_endorsements"
+    __table_args__ = ({"schema": "authn"},)
+    endorsement_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    artifact_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class AttestationAppraisalPolicy(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attestation_appraisal_policies"
+    __table_args__ = ({"schema": "authn"},)
+    policy_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    version: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    policy: Mapped[dict] = acol(storage=S(JSON, nullable=False))
+    enabled: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=True, index=True)
+    )
+
+
+__all__ = [
+    "AttestationEvidence",
+    "AttestationResult",
+    "AttestationReferenceManifest",
+    "AttestationReferenceValue",
+    "AttestationEndorsement",
+    "AttestationAppraisalPolicy",
+]

tba_storage_core/tables/attribute_policy/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/attribute_policy/_table.py

@@ -0,0 +1,40 @@
+"""Durable ABAC policy definitions."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class AttributePolicy(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "attribute_policies"
+    __table_args__ = ({"schema": "authn"},)
+
+    name: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    client_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    permission: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    effect: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="allow", index=True)
+    )
+    required_attributes: Mapped[dict] = acol(
+        storage=S(JSON, nullable=False, default=dict)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+__all__ = ["AttributePolicy"]

tba_storage_core/tables/audit_event/__init__.py

@@ -0,0 +1,10 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/audit_event/_table.py

@@ -0,0 +1,47 @@
+"""Durable audit events for operator and protocol actions."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    TenantColumn,
+    Timestamped,
+    S,
+    acol,
+    JSON,
+    Mapped,
+    String,
+    TZDateTime,
+    GUIDPk,
+    ForeignKeySpec,
+    PgUUID,
+)
+
+
+class AuditEvent(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "audit_events"
+    __table_args__ = ({"schema": "authn"},)
+
+    actor_user_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.users.id"), nullable=True, index=True)
+    )
+    actor_client_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.clients.id"), nullable=True, index=True)
+    )
+    session_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.sessions.id"), nullable=True, index=True)
+    )
+    event_type: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    target_type: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    target_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    outcome: Mapped[str] = acol(storage=S(String(32), nullable=False, default="success"))
+    request_id: Mapped[str | None] = acol(storage=S(String(128), nullable=True, index=True))
+    details: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    occurred_at: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, default=lambda: dt.datetime.now(dt.timezone.utc))
+    )
+
+__all__ = ["AuditEvent"]

tba_storage_core/tables/auth_code/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/auth_code/_table.py

@@ -0,0 +1,41 @@
+"""Authorization code durable table."""
+
+from __future__ import annotations
+
+import datetime as dt
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    TenantColumn,
+    Timestamped,
+    UUID,
+    UserColumn,
+    acol,
+)
+
+
+class AuthCode(RestOltpTable, GUIDPk, Timestamped, UserColumn, TenantColumn):
+    __tablename__ = "auth_codes"
+    __table_args__ = ({"schema": "authn"},)
+
+    client_id: Mapped[UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.clients.id"), nullable=False)
+    )
+    session_id: Mapped[UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.sessions.id"), nullable=True, index=True)
+    )
+    redirect_uri: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    code_challenge: Mapped[str | None] = acol(storage=S(String, nullable=True))
+    nonce: Mapped[str | None] = acol(storage=S(String, nullable=True))
+    scope: Mapped[str | None] = acol(storage=S(String, nullable=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False))
+    claims: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+__all__ = ["AuthCode"]

tba_storage_core/tables/auth_session/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/auth_session/_table.py

@@ -0,0 +1,45 @@
+"""Authentication session model with durable browser-session cookie state."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    TenantColumn,
+    Timestamped,
+    UserColumn,
+    S,
+    acol,
+    Mapped,
+    String,
+    TZDateTime,
+    GUIDPk,
+    ForeignKeySpec,
+    PgUUID,
+    UUID,
+)
+
+
+class AuthSession(RestOltpTable, GUIDPk, Timestamped, UserColumn, TenantColumn):
+    __tablename__ = "sessions"
+    __table_args__ = ({"schema": "authn"},)
+
+    username: Mapped[str] = acol(storage=S(String(120), nullable=False))
+    client_id: Mapped[UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.clients.id"), nullable=True, index=True)
+    )
+    auth_time: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, default=lambda: dt.datetime.now(dt.timezone.utc))
+    )
+    session_state: Mapped[str] = acol(storage=S(String(64), nullable=False, default="active"))
+    session_state_salt: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    cookie_secret_hash: Mapped[str | None] = acol(storage=S(String(128), nullable=True, index=True))
+    cookie_issued_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True))
+    cookie_rotated_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True))
+    expires_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    last_seen_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True))
+    ended_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    logout_reason: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+
+__all__ = ["AuthSession"]

tba_storage_core/tables/authentication_challenge/__init__.py

@@ -0,0 +1,7 @@
+"""Authentication challenge table export."""
+
+from __future__ import annotations
+
+from ._table import AuthenticationChallenge
+
+__all__ = ["AuthenticationChallenge"]

tba_storage_core/tables/authentication_challenge/_table.py

@@ -0,0 +1,38 @@
+"""Durable advanced-authentication challenge records."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class AuthenticationChallenge(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authentication_challenges"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    challenge_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    subject_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    challenge_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    expected_nonce: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    issued_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    allowed_methods: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    step_up_required: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    bound_credential_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    consumed: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+
+
+__all__ = ["AuthenticationChallenge"]

tba_storage_core/tables/authority_derivation_graph/__init__.py

@@ -0,0 +1,15 @@
+"""Authority derivation graph table exports."""
+
+from __future__ import annotations
+
+from ._table import (
+    AuthorityDerivationGraph,
+    AuthorityDerivationGraphEdge,
+    AuthorityDerivationGraphNode,
+)
+
+__all__ = [
+    "AuthorityDerivationGraph",
+    "AuthorityDerivationGraphNode",
+    "AuthorityDerivationGraphEdge",
+]

tba_storage_core/tables/authority_derivation_graph/_table.py

@@ -0,0 +1,94 @@
+"""Durable authority derivation graph tables."""
+
+from __future__ import annotations
+
+from sqlalchemy import Index, UniqueConstraint
+
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    S,
+    String,
+    UUID,
+    acol,
+)
+from tba_storage_core.tables._graph_base import GraphBase, GraphEdgeBase, GraphNodeBase
+
+
+class AuthorityDerivationGraph(GraphBase, GUIDPk):
+    __tablename__ = "authority_derivation_graphs"
+    __table_args__ = (
+        UniqueConstraint("graph_key", name="uq_authority_derivation_graph_key"),
+        {"extend_existing": True, "schema": "authn"},
+    )
+
+
+class AuthorityDerivationGraphNode(GraphNodeBase, GUIDPk):
+    __tablename__ = "authority_derivation_graph_nodes"
+    __table_args__ = (
+        UniqueConstraint("graph_id", "node_key", name="uq_authority_derivation_graph_node_key"),
+        Index("ix_authority_derivation_graph_node_graph_kind", "graph_id", "kind"),
+        Index("ix_authority_derivation_graph_node_tenant_kind", "tenant_id", "kind"),
+        {"extend_existing": True, "schema": "authn"},
+    )
+
+    graph_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.authority_derivation_graphs.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+
+
+class AuthorityDerivationGraphEdge(GraphEdgeBase, GUIDPk):
+    __tablename__ = "authority_derivation_graph_edges"
+    __table_args__ = (
+        UniqueConstraint("graph_id", "edge_key", name="uq_authority_derivation_graph_edge_key"),
+        Index("ix_authority_derivation_graph_edge_src_kind", "graph_id", "src_id", "kind"),
+        Index("ix_authority_derivation_graph_edge_dst_kind", "graph_id", "dst_id", "kind"),
+        Index("ix_authority_derivation_graph_edge_tenant_kind", "tenant_id", "kind"),
+        {"extend_existing": True, "schema": "authn"},
+    )
+
+    graph_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.authority_derivation_graphs.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    src_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.authority_derivation_graph_nodes.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    dst_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.authority_derivation_graph_nodes.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    policy_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    policy_version_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    policy_version: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    provenance_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    scopes: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    constraints: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = [
+    "AuthorityDerivationGraph",
+    "AuthorityDerivationGraphNode",
+    "AuthorityDerivationGraphEdge",
+]

tba_storage_core/tables/authorization_invariant/__init__.py

@@ -0,0 +1,5 @@
+"""Authorization invariant table export."""
+
+from ._table import AuthorizationInvariant
+
+__all__ = ["AuthorizationInvariant"]

tba_storage_core/tables/authorization_invariant/_table.py

@@ -0,0 +1,34 @@
+"""Durable authorization invariant definitions."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class AuthorizationInvariant(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_invariants"
+    __table_args__ = ({"schema": "authn"},)
+
+    invariant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    title: Mapped[str] = acol(storage=S(String(255), nullable=False))
+    property_family: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    statement: Mapped[str] = acol(storage=S(String(2000), nullable=False))
+    verification_method: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    severity: Mapped[str] = acol(storage=S(String(64), nullable=False, default="error", index=True))
+    enabled: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+    feature_ids: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    spec_ids: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+    tags: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["AuthorizationInvariant"]

tba_storage_core/tables/authorization_server/__init__.py

@@ -0,0 +1,6 @@
+"""Authorization-server table exports."""
+
+from ._table import *
+from ._table import __all__ as _table_exports
+
+__all__ = list(_table_exports)

tba_storage_core/tables/authorization_server/_table.py

@@ -0,0 +1,61 @@
+"""Durable authorization-server configuration and metadata state."""
+
+from __future__ import annotations
+
+import uuid
+
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class AuthorizationServer(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authorization_servers"
+    __table_args__ = ({"schema": "authn"},)
+
+    issuer: Mapped[str] = acol(storage=S(String(512), nullable=False, unique=True, index=True))
+    tenant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.tenants.id"),
+            nullable=True,
+            index=True,
+        )
+    )
+    realm_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.realms.id"),
+            nullable=True,
+            index=True,
+        )
+    )
+    status: Mapped[str] = acol(storage=S(String(64), nullable=False, default="active", index=True))
+    authorization_endpoint: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    token_endpoint: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    jwks_uri: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    introspection_endpoint: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    revocation_endpoint: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    registration_endpoint: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    userinfo_endpoint: Mapped[str | None] = acol(storage=S(String(512), nullable=True))
+    server_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    oauth_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    oidc_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    scopes_supported: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    response_types_supported: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    grant_types_supported: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    token_endpoint_auth_methods_supported: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    subject_types_supported: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    signing_alg_values_supported: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["AuthorizationServer"]

tba_storage_core/tables/authz_verification_report/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/authz_verification_report/_table.py

@@ -0,0 +1,29 @@
+"""Durable authorization verification report artifacts."""
+
+from __future__ import annotations
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class AuthzVerificationReport(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "authz_verification_reports"
+    __table_args__ = ({"schema": "authn"},)
+
+    report_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    report_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    tenant_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    passed: Mapped[bool | None] = acol(storage=S(Boolean, nullable=True, index=True))
+    report_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["AuthzVerificationReport"]

tba_storage_core/tables/backchannel_logout_replay/__init__.py

@@ -0,0 +1,5 @@
+"""Back-channel logout replay table export."""
+
+from ._table import BackchannelLogoutReplay
+
+__all__ = ["BackchannelLogoutReplay"]