tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/credential_dpop_key/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_dpop_key/_table.py

@@ -0,0 +1,22 @@
+"""Durable DPoP key credential bindings."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class CredentialDpopKey(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_dpop_keys"
+    __table_args__ = ({"schema": "authn"},)
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    jwk_thumbprint: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    public_jwk: Mapped[dict] = acol(storage=S(JSON, nullable=False))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    key_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialDpopKey"]

tba_storage_core/tables/credential_ecosystem_registry.py

@@ -0,0 +1,119 @@
+"""Durable credential issuer, configuration, and wallet registry state."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class CredentialIssuer(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_issuers"
+    __table_args__ = ({"schema": "authn"},)
+    issuer: Mapped[str] = acol(
+        storage=S(String(1000), nullable=False, unique=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+    metadata_document: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+class CredentialConfiguration(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_configurations"
+    __table_args__ = ({"schema": "authn"},)
+    issuer_id: Mapped[str] = acol(storage=S(String(36), nullable=False, index=True))
+    configuration_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    format: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    credential_type: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    configuration: Mapped[dict] = acol(storage=S(JSON, nullable=False))
+    enabled: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=True, index=True)
+    )
+
+
+class WalletRegistration(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "wallet_registrations"
+    __table_args__ = ({"schema": "authn"},)
+    wallet_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    subject_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+    wallet_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+class WalletInstance(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "wallet_instances"
+    __table_args__ = ({"schema": "authn"},)
+    wallet_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    instance_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    key_reference: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+
+class WalletAttestation(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "wallet_attestations"
+    __table_args__ = ({"schema": "authn"},)
+    wallet_instance_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    profile: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    evidence_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    verification_result: Mapped[str] = acol(
+        storage=S(String(64), nullable=False, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class WalletKeyBinding(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "wallet_key_bindings"
+    __table_args__ = ({"schema": "authn"},)
+    wallet_instance_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    key_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    binding_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    valid_from: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+__all__ = [
+    "CredentialIssuer",
+    "CredentialConfiguration",
+    "WalletRegistration",
+    "WalletInstance",
+    "WalletAttestation",
+    "WalletKeyBinding",
+]

tba_storage_core/tables/credential_issuance_state.py

@@ -0,0 +1,154 @@
+"""Durable credential offer, issuance, notification, and status state."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class CredentialOffer(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_offers"
+    __table_args__ = ({"schema": "authn"},)
+    offer_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    issuer_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    configuration_ids: Mapped[list] = acol(storage=S(JSON, nullable=False))
+    grant_types: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    consumed_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class CredentialIssuanceTransaction(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_issuance_transactions"
+    __table_args__ = ({"schema": "authn"},)
+    transaction_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    issuer_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    subject_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    wallet_instance_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    configuration_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="pending", index=True)
+    )
+    request_digest: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    result_reference: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class CredentialDeferredTransaction(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_deferred_transactions"
+    __table_args__ = ({"schema": "authn"},)
+    transaction_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    issuance_transaction_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="pending", index=True)
+    )
+    interval_seconds: Mapped[str | None] = acol(storage=S(String(16), nullable=True))
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class CredentialNotification(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_notifications"
+    __table_args__ = ({"schema": "authn"},)
+    notification_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    issuance_transaction_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    event: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    description: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    acknowledged: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=False, index=True)
+    )
+
+
+class CredentialStatusList(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_status_lists"
+    __table_args__ = ({"schema": "authn"},)
+    status_list_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    issuer_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    purpose: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    size: Mapped[str] = acol(storage=S(String(32), nullable=False))
+    current_version: Mapped[str] = acol(
+        storage=S(String(64), nullable=False, default="1", index=True)
+    )
+
+
+class CredentialStatusEntry(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_status_entries"
+    __table_args__ = ({"schema": "authn"},)
+    status_list_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    credential_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    status_index: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="valid", index=True)
+    )
+    changed_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class CredentialStatusPublication(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_status_publications"
+    __table_args__ = ({"schema": "authn"},)
+    status_list_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    version: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    artifact_locator: Mapped[str] = acol(storage=S(String(1000), nullable=False))
+    artifact_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    published_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+__all__ = [
+    "CredentialOffer",
+    "CredentialIssuanceTransaction",
+    "CredentialDeferredTransaction",
+    "CredentialNotification",
+    "CredentialStatusList",
+    "CredentialStatusEntry",
+    "CredentialStatusPublication",
+]

tba_storage_core/tables/credential_issuance_transaction/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialIssuanceTransaction
+
+__all__ = ["CredentialIssuanceTransaction"]

tba_storage_core/tables/credential_issuer/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_ecosystem_registry import CredentialIssuer
+
+__all__ = ["CredentialIssuer"]

tba_storage_core/tables/credential_mfa_factor/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_mfa_factor/_table.py

@@ -0,0 +1,24 @@
+"""Durable MFA factor credential records."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import GUIDPk, JSON, Mapped, RestOltpTable, S, String, Timestamped, acol
+
+
+
+class CredentialMfaFactor(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_mfa_factors"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    factor_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    method: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    secret_digest: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    public_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    factor_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialMfaFactor"]

tba_storage_core/tables/credential_mtls_certificate/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_mtls_certificate/_table.py

@@ -0,0 +1,26 @@
+"""Durable mTLS credential bindings."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import RestOltpTable, GUIDPk, JSON, Mapped, S, String, Timestamped, acol
+
+
+
+class CredentialMtlsCertificate(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_mtls_certificates"
+    __table_args__ = ({"schema": "authn"},)
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    certificate_thumbprint: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    subject_dn: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    san_dns: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    san_uri: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    san_ip: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    san_email: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    certificate_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialMtlsCertificate"]

tba_storage_core/tables/credential_notification/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialNotification
+
+__all__ = ["CredentialNotification"]

tba_storage_core/tables/credential_offer/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialOffer
+
+__all__ = ["CredentialOffer"]

tba_storage_core/tables/credential_password/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_password/_table.py

@@ -0,0 +1,24 @@
+"""Durable password credential records."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import GUIDPk, JSON, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+
+class CredentialPassword(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_passwords"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    password_digest: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    rotated_from: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    expires_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    password_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialPassword"]

tba_storage_core/tables/credential_recovery_code/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_recovery_code/_table.py

@@ -0,0 +1,23 @@
+"""Durable recovery-code credential records."""
+
+from __future__ import annotations
+
+import datetime as dt
+
+from tba_storage_core.framework import GUIDPk, JSON, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+
+class CredentialRecoveryCode(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_recovery_codes"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    code_digest: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    consumed_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    recovery_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CredentialRecoveryCode"]

tba_storage_core/tables/credential_service_key/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_service_key/_table.py

@@ -0,0 +1,49 @@
+"""Durable service-identity key credential records."""
+
+from __future__ import annotations
+
+from uuid import UUID
+
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    Created,
+    GUIDPk,
+    KeyDigest,
+    LastUsed,
+    ValidityWindow,
+    RestOltpTable,
+    F,
+    IO,
+    S,
+    acol,
+    Mapped,
+    PgUUID,
+    String,
+    relationship,
+)
+
+
+class CredentialServiceKey(RestOltpTable, GUIDPk, Created, LastUsed, ValidityWindow, KeyDigest):
+    __tablename__ = "credential_service_keys"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    label: Mapped[str] = acol(
+        storage=S(String, nullable=False),
+        field=F(constraints={"max_length": 120}, required_in=("create",)),
+        io=IO(in_verbs=("create",), out_verbs=("read", "list"), filter_ops=("eq",)),
+    )
+    service_identity_id: Mapped[UUID] = acol(
+        storage=S(
+            PgUUID(as_uuid=True),
+            fk=ForeignKeySpec(target="authn.service_identities.id"),
+            index=True,
+            nullable=False,
+        ),
+        field=F(py_type=UUID, required_in=("create",)),
+        io=IO(in_verbs=("create",), out_verbs=("read", "list"), filter_ops=("eq",)),
+    )
+
+    _service_identity = relationship("ServiceIdentity", back_populates="_credential_service_keys", lazy="joined")
+
+
+__all__ = ["CredentialServiceKey"]

tba_storage_core/tables/credential_status_entry/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialStatusEntry
+
+__all__ = ["CredentialStatusEntry"]

tba_storage_core/tables/credential_status_list/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialStatusList
+
+__all__ = ["CredentialStatusList"]

tba_storage_core/tables/credential_status_publication/__init__.py

@@ -0,0 +1,3 @@
+from ..credential_issuance_state import CredentialStatusPublication
+
+__all__ = ["CredentialStatusPublication"]

tba_storage_core/tables/credential_webauthn_passkey/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/credential_webauthn_passkey/_table.py

@@ -0,0 +1,42 @@
+"""Durable WebAuthn passkey credential records."""
+
+from __future__ import annotations
+
+
+import datetime as dt
+
+from tba_storage_core.framework import Boolean, GUIDPk, Integer, JSON, LargeBinary, Mapped, RestOltpTable, S, String, TZDateTime, Timestamped, acol
+
+
+
+class CredentialWebAuthnPasskey(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "credential_webauthn_passkeys"
+    __table_args__ = {"extend_existing": True, "schema": "authn"}
+
+    credential_id: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    principal_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    webauthn_credential_id: Mapped[str] = acol(storage=S(String(1000), nullable=False, unique=True, index=True))
+    public_key: Mapped[str] = acol(storage=S(String(4000), nullable=False))
+    rp_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    algorithm: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    sign_count: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0))
+    transports: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    passkey_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    credential_external_id: Mapped[str | None] = acol(storage=S(String(1000), nullable=True, unique=True, index=True))
+    credential_public_key_cose: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True))
+    user_handle: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    cose_algorithm: Mapped[int | None] = acol(storage=S(Integer, nullable=True))
+    aaguid: Mapped[bytes | None] = acol(storage=S(LargeBinary, nullable=True, index=True))
+    attestation_format: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    attestation_type: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    attestation_trust_status: Mapped[str | None] = acol(storage=S(String(32), nullable=True, index=True))
+    discoverable: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    backup_eligible: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    backup_state: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False, index=True))
+    last_used_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    revoked_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    display_name: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+
+
+__all__ = ["CredentialWebAuthnPasskey"]

tba_storage_core/tables/crypto_key/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/crypto_key/_table.py

@@ -0,0 +1,52 @@
+"""Durable provider-neutral crypto key metadata."""
+
+from __future__ import annotations
+
+import uuid
+
+from tba_storage_core.framework import (
+    Boolean,
+    ForeignKeySpec,
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    PgUUID,
+    RestOltpTable,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+
+class CryptoKey(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "crypto_keys"
+    __table_args__ = ({"schema": "authn"},)
+
+    kid: Mapped[str] = acol(storage=S(String(255), nullable=False, unique=True, index=True))
+    algorithm: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    key_kind: Mapped[str] = acol(storage=S(String(64), nullable=False, default="asymmetric", index=True))
+    key_usages: Mapped[list[str] | None] = acol(storage=S(JSON, nullable=True))
+    allowed_ops: Mapped[list[str] | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    primary_version: Mapped[int | None] = acol(storage=S(Integer, nullable=True, default=1))
+    provider: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    provider_key_ref: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    export_policy: Mapped[str] = acol(storage=S(String(64), nullable=False, default="public_only", index=True))
+    origin: Mapped[str] = acol(storage=S(String(64), nullable=False, default="generated", index=True))
+    extractable: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False))
+    public_material_format: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    public_material: Mapped[dict | str | None] = acol(storage=S(JSON, nullable=True))
+    fingerprint: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    key_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    tenant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.tenants.id"), nullable=True, index=True)
+    )
+    realm_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.realms.id"), nullable=True, index=True)
+    )
+
+
+__all__ = ["CryptoKey"]