tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/backchannel_logout_replay/_table.py

@@ -0,0 +1,37 @@
+"""Durable OpenID Connect Back-Channel Logout replay ledger schema."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class BackchannelLogoutReplay(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "backchannel_logout_replays"
+    __table_args__ = ({"schema": "authn"},)
+
+    replay_key: Mapped[str] = acol(
+        storage=S(String(64), nullable=False, unique=True, index=True)
+    )
+    jti: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    client_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    seen_at: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, index=True)
+    )
+    expires_at: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, index=True)
+    )
+
+
+__all__ = ["BackchannelLogoutReplay"]

tba_storage_core/tables/certificate_record/__init__.py

@@ -0,0 +1,3 @@
+from ..certificate_state import CertificateRecord
+
+__all__ = ["CertificateRecord"]

tba_storage_core/tables/certificate_state.py

@@ -0,0 +1,82 @@
+"""Durable certificate metadata, trust anchors, and status snapshots."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class CertificateRecord(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "certificate_records"
+    __table_args__ = ({"schema": "authn"},)
+    certificate_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    subject: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    issuer: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    serial_number: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    thumbprint_sha256: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, unique=True, index=True)
+    )
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    valid_from: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    key_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+
+
+class TrustAnchor(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "trust_anchors"
+    __table_args__ = ({"schema": "authn"},)
+    anchor_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    subject: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    thumbprint_sha256: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    constraints: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    active: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=True, index=True)
+    )
+
+
+class CertificateStatusSnapshot(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "certificate_status_snapshots"
+    __table_args__ = ({"schema": "authn"},)
+    certificate_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    source: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    this_update: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    next_update: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    response_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    artifact_locator: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+
+
+__all__ = ["CertificateRecord", "TrustAnchor", "CertificateStatusSnapshot"]

tba_storage_core/tables/certificate_status_snapshot/__init__.py

@@ -0,0 +1,3 @@
+from ..certificate_state import CertificateStatusSnapshot
+
+__all__ = ["CertificateStatusSnapshot"]

tba_storage_core/tables/claim_state.py

@@ -0,0 +1,98 @@
+"""Durable tenant-defined claim metadata, policy, and provenance.
+
+Standard claim semantics remain code-owned. These tables exist for private
+claim registration, source binding, release policy, and protected snapshots.
+"""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    TenantColumn,
+    Timestamped,
+    acol,
+)
+
+
+class ClaimDefinition(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "claim_definitions"
+    __table_args__ = ({"schema": "authn"},)
+
+    label: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    label_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    namespace: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, index=True))
+    registry: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    semantic_type: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    value_type: Mapped[str] = acol(storage=S(String(64), nullable=False))
+    standards: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    active: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+
+
+class ClaimSourceBinding(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "claim_source_bindings"
+    __table_args__ = ({"schema": "authn"},)
+
+    claim_definition_id: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    source_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    provider_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    source_path: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    transformation: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    active: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+
+
+class ClaimReleasePolicy(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "claim_release_policies"
+    __table_args__ = ({"schema": "authn"},)
+
+    claim_definition_id: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    audience_pattern: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, index=True))
+    protocol_tag: Mapped[str | None] = acol(storage=S(String(64), nullable=True, index=True))
+    disclosure_mode: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    purpose: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    conditions: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    active: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True, index=True))
+
+
+class ClaimProvenanceRecord(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "claim_provenance_records"
+    __table_args__ = ({"schema": "authn"},)
+
+    claim_label: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    namespace: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, index=True))
+    subject_reference: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    source_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    source_reference: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    evidence_reference: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    value_digest: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    verified_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    assurance_framework: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+
+class ClaimSnapshot(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "claim_snapshots"
+    __table_args__ = ({"schema": "authn"},)
+
+    claim_set_reference: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    protocol_tag: Mapped[str | None] = acol(storage=S(String(64), nullable=True, index=True))
+    specification_version: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    payload_digest: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    protected_artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    retention_expires_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+
+
+__all__ = [
+    "ClaimDefinition",
+    "ClaimProvenanceRecord",
+    "ClaimReleasePolicy",
+    "ClaimSnapshot",
+    "ClaimSourceBinding",
+]

tba_storage_core/tables/client/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/client/_table.py

@@ -0,0 +1,41 @@
+"""Client model for the authentication service."""
+
+from __future__ import annotations
+
+import re
+from typing import Final
+
+from tba_storage_core.framework import (
+    ClientBase,
+    relationship,
+    Mapped,
+    String,
+    ColumnSpec,
+    F,
+    IO,
+    S,
+    acol,
+)
+
+_CLIENT_ID_RE: Final[re.Pattern[str]] = re.compile(r"^[A-Za-z0-9\-_]{8,64}$")
+
+
+class Client(ClientBase):
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant = relationship("Tenant", back_populates="clients")
+
+    grant_types: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String, nullable=False, default="authorization_code"),
+            field=F(),
+            io=IO(),
+        )
+    )
+    response_types: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String, nullable=False, default="code"), field=F(), io=IO()
+        )
+    )
+
+__all__ = ["Client", "_CLIENT_ID_RE"]

tba_storage_core/tables/client_registration/__init__.py

@@ -0,0 +1,10 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+__all__ = list(_table.__all__)

tba_storage_core/tables/client_registration/_table.py

@@ -0,0 +1,47 @@
+"""Durable dynamic client registration metadata."""
+
+from __future__ import annotations
+
+import datetime as dt
+from typing import Any
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    TenantColumn,
+    Timestamped,
+    S,
+    acol,
+    JSON,
+    Mapped,
+    String,
+    TZDateTime,
+    GUIDPk,
+    ForeignKeySpec,
+    PgUUID,
+    UUID,
+)
+
+
+class ClientRegistration(RestOltpTable, GUIDPk, Timestamped, TenantColumn):
+    __tablename__ = "client_registrations"
+    __table_args__ = ({"schema": "authn"},)
+
+    client_id: Mapped[UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.clients.id"), nullable=False, unique=True, index=True)
+    )
+    software_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    software_version: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    contacts: Mapped[list[str] | None] = acol(storage=S(JSON, nullable=True))
+    registration_metadata: Mapped[dict[str, Any] | None] = acol(storage=S(JSON, nullable=True))
+    registration_access_token_hash: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, unique=True, index=True)
+    )
+    registration_client_uri: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    issued_at: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, default=lambda: dt.datetime.now(dt.timezone.utc))
+    )
+    rotated_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True))
+    disabled_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+
+
+__all__ = ["ClientRegistration"]

tba_storage_core/tables/consent/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/consent/_table.py

@@ -0,0 +1,57 @@
+"""Durable consent schema for scopes and claims grants."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    TenantColumn,
+    Timestamped,
+    UUID,
+    UserColumn,
+    acol,
+)
+
+
+class Consent(RestOltpTable, GUIDPk, Timestamped, UserColumn, TenantColumn):
+    __tablename__ = "consents"
+    __table_args__ = ({"schema": "authn"},)
+
+    client_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.clients.id"),
+            nullable=False,
+            index=True,
+        )
+    )
+    scope: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    claims: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    state: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active")
+    )
+    granted_at: Mapped[dt.datetime] = acol(
+        storage=S(
+            TZDateTime,
+            nullable=False,
+            default=lambda: dt.datetime.now(dt.timezone.utc),
+        )
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    revoked_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+__all__ = ["Consent"]

tba_storage_core/tables/control_correctness_report/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/control_correctness_report/_table.py

@@ -0,0 +1,20 @@
+"""Durable control-plane correctness report artifacts."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, Boolean, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class ControlCorrectnessReport(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "control_correctness_reports"
+    __table_args__ = ({"schema": "authn"},)
+
+    report_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    release_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    passed: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    report_payload: Mapped[dict] = acol(storage=S(JSON, nullable=False, default=dict))
+
+
+__all__ = ["ControlCorrectnessReport"]

tba_storage_core/tables/credential/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential/_table.py

@@ -0,0 +1,74 @@
+"""Durable credential lifecycle records."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class Credential(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credentials"
+    __table_args__ = ({"schema": "authn"},)
+
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    credential_kind: Mapped[str] = acol(
+        storage=S(String(64), nullable=False, index=True)
+    )
+    format: Mapped[str | None] = acol(storage=S(String(64), nullable=True, index=True))
+    credential_type: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    issuer_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    subject_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    holder_binding_kind: Mapped[str | None] = acol(
+        storage=S(String(64), nullable=True, index=True)
+    )
+    status_reference: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    payload_digest: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    issued_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    valid_from: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    secret_digest: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    public_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+    version: Mapped[int] = acol(storage=S(Integer, nullable=False, default=1))
+    rotated_from: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    credential_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["Credential"]

tba_storage_core/tables/credential_api_key/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_api_key/_table.py

@@ -0,0 +1,50 @@
+"""Durable API-key credential records."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import (
+    Created,
+    ColumnSpec,
+    F,
+    GUIDPk,
+    IO,
+    KeyDigest,
+    LastUsed,
+    ValidityWindow,
+    RestOltpTable,
+    S,
+    acol,
+    Mapped,
+    String,
+)
+
+
+class CredentialApiKey(RestOltpTable, GUIDPk, Created, LastUsed, ValidityWindow, KeyDigest):
+    __tablename__ = "credential_api_keys"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    label: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String, nullable=False),
+            field=F(constraints={"max_length": 120}, required_in=("create",)),
+            io=IO(in_verbs=("create",), out_verbs=("read", "list"), filter_ops=("eq",)),
+        )
+    )
+    principal_id: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(255), nullable=False, index=True),
+            field=F(constraints={"max_length": 255}, required_in=("create",)),
+            io=IO(in_verbs=("create",), out_verbs=("read", "list"), filter_ops=("eq",)),
+        )
+    )
+    principal_kind: Mapped[str] = acol(
+        spec=ColumnSpec(
+            storage=S(String(64), nullable=False, default="user", index=True),
+            field=F(constraints={"max_length": 64}, required_in=("create",)),
+            io=IO(in_verbs=("create",), out_verbs=("read", "list"), filter_ops=("eq",)),
+        )
+    )
+
+
+__all__ = ["CredentialApiKey"]

tba_storage_core/tables/credential_audit_event/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_audit_event/_table.py

@@ -0,0 +1,25 @@
+"""Durable credential audit events."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, TZDateTime, Timestamped, acol
+from tba_primitives_identity.clock import utc_now
+
+
+class CredentialAuditEvent(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_audit_events"
+    __table_args__ = ({"schema": "authn"},)
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    action: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    principal_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    actor: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    outcome: Mapped[str] = acol(storage=S(String(32), nullable=False, default="ok", index=True))
+    reason: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    occurred_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, default=utc_now))
+    details: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialAuditEvent"]

tba_storage_core/tables/credential_client_secret/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_client_secret/_table.py

@@ -0,0 +1,24 @@
+"""Durable OAuth client-secret credential records."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import GUIDPk, JSON, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+
+class CredentialClientSecret(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_client_secrets"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    client_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    secret_digest: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    expires_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    secret_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialClientSecret"]

tba_storage_core/tables/credential_configuration/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_ecosystem_registry import CredentialConfiguration
+
+__all__ = ["CredentialConfiguration"]

tba_storage_core/tables/credential_deferred_transaction/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialDeferredTransaction
+
+__all__ = ["CredentialDeferredTransaction"]