tba-storage-core 0.4.0.dev2__py3-none-any.whl

tba_storage_core/tables/crypto_key_version/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/crypto_key_version/_table.py

@@ -0,0 +1,53 @@
+"""Durable provider-neutral crypto key version metadata."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+from typing import Any
+
+from tba_storage_core.framework import (
+    ForeignKeySpec,
+    GUIDPk,
+    Integer,
+    JSON,
+    Mapped,
+    PgUUID,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+from tba_contracts_security_trust import normalize_key_operations
+
+
+
+def _operation_list(values: Any) -> list[str]:
+    return [operation.value for operation in normalize_key_operations(values)]
+
+
+class CryptoKeyVersion(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "crypto_key_versions"
+    __table_args__ = ({"schema": "authn"},)
+
+    key_id: Mapped[uuid.UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.crypto_keys.id"), nullable=False, index=True)
+    )
+    version: Mapped[int] = acol(storage=S(Integer, nullable=False, default=1))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, default="active", index=True))
+    provider: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    provider_key_ref: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    allowed_ops: Mapped[list[str] | None] = acol(storage=S(JSON, nullable=True))
+    public_material_format: Mapped[str | None] = acol(storage=S(String(64), nullable=True))
+    public_material: Mapped[dict | str | None] = acol(storage=S(JSON, nullable=True))
+    fingerprint: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    not_before: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    not_after: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    activated_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    retired_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    version_metadata: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+__all__ = ["CryptoKeyVersion"]

tba_storage_core/tables/delegated_admin_scope/__init__.py

@@ -0,0 +1,9 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/delegated_admin_scope/_table.py

@@ -0,0 +1,34 @@
+"""Durable delegated administration scopes."""
+
+from __future__ import annotations
+
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    GUIDPk,
+    JSON,
+    Mapped,
+    S,
+    String,
+    Timestamped,
+    acol,
+)
+
+
+class DelegatedAdminScope(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegated_admin_scopes"
+    __table_args__ = ({"schema": "authn"},)
+
+    subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    tenant_ids: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    permissions: Mapped[list] = acol(storage=S(JSON, nullable=False, default=list))
+    visible_client_fields: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    mutable_client_fields: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    service_identity_permissions: Mapped[list | None] = acol(
+        storage=S(JSON, nullable=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+__all__ = ["DelegatedAdminScope"]

tba_storage_core/tables/delegation_grant/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/delegation_grant/_table.py

@@ -0,0 +1,134 @@
+"""Canonical persisted DelegationGrant lifecycle tables."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    Boolean,
+    ForeignKeySpec,
+    GUIDPk,
+    JSON,
+    Mapped,
+    PgUUID,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class DelegationGrant(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegation_grants"
+    __table_args__ = ({"schema": "authn"},)
+
+    tenant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.tenants.id"), nullable=True, index=True)
+    )
+    realm: Mapped[str] = acol(storage=S(String(120), nullable=False, default=""))
+    delegator_subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    delegate_subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    delegate_type: Mapped[str] = acol(storage=S(String(64), nullable=False, default="subject"))
+    status: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True, default="draft"))
+    parent_grant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=True, index=True)
+    )
+    source_authority_ref: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    policy_version: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    provenance_id: Mapped[str | None] = acol(storage=S(String(128), nullable=True, index=True))
+    constraints: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    effective_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    expires_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    revoked_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    revoked_by: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    revoked_reason: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    replaced_by_grant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=True)
+    )
+
+
+class DelegationGrantScope(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegation_grant_scopes"
+    __table_args__ = ({"schema": "authn"},)
+
+    grant_id: Mapped[uuid.UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=False, index=True)
+    )
+    tenant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    realm: Mapped[str] = acol(storage=S(String(120), nullable=False, default=""))
+    resource_type: Mapped[str | None] = acol(storage=S(String(120), nullable=True))
+    resource_id: Mapped[str] = acol(storage=S(String(255), nullable=False, default="*"))
+    action: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    scope: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    audience: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    resource_indicator: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    constraints: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+
+
+class DelegationGrantProof(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegation_grant_proofs"
+    __table_args__ = ({"schema": "authn"},)
+
+    grant_id: Mapped[uuid.UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=False, index=True)
+    )
+    source_scope_hash: Mapped[str] = acol(storage=S(String(128), nullable=False))
+    delegated_scope_hash: Mapped[str] = acol(storage=S(String(128), nullable=False))
+    attenuation_result: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False))
+    uncovered_scopes: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+    proof_version: Mapped[str] = acol(storage=S(String(32), nullable=False, default="v1"))
+    proof_hash: Mapped[str] = acol(storage=S(String(128), nullable=False, unique=True, index=True))
+    evaluated_at: Mapped[dt.datetime] = acol(
+        storage=S(TZDateTime, nullable=False, default=lambda: dt.datetime.now(dt.timezone.utc))
+    )
+
+
+class DelegationGrantEdge(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegation_grant_edges"
+    __table_args__ = ({"schema": "authn"},)
+
+    parent_grant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=True, index=True)
+    )
+    child_grant_id: Mapped[uuid.UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=False, index=True)
+    )
+    delegator_subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    delegate_subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    edge_type: Mapped[str] = acol(storage=S(String(64), nullable=False, default="grant"))
+    provenance_id: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    active: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=True))
+
+
+class DelegationGrantTokenLink(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "delegation_grant_token_links"
+    __table_args__ = ({"schema": "authn"},)
+
+    grant_id: Mapped[uuid.UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.delegation_grants.id"), nullable=False, index=True)
+    )
+    token_hash: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    token_kind: Mapped[str] = acol(storage=S(String(32), nullable=False, default="access"))
+    authorization_trace_id: Mapped[str | None] = acol(storage=S(String(128), nullable=True, index=True))
+    delegation_provenance_id: Mapped[str | None] = acol(storage=S(String(128), nullable=True, index=True))
+    actor_subject: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    subject: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    exchange_mode: Mapped[str] = acol(storage=S(String(32), nullable=False, default="delegation"))
+    source_token_hash: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+    actor_token_hash: Mapped[str | None] = acol(storage=S(String(128), nullable=True))
+
+
+DelegationGrantRecord = DelegationGrant
+
+
+__all__ = [
+    "DelegationGrant",
+    "DelegationGrantEdge",
+    "DelegationGrantProof",
+    "DelegationGrantRecord",
+    "DelegationGrantScope",
+    "DelegationGrantTokenLink",
+]

tba_storage_core/tables/device_code/__init__.py

@@ -0,0 +1,13 @@
+from __future__ import annotations
+
+from . import _table as _table
+from ._table import *
+
+for _name in dir(_table):
+    if not _name.startswith("__"):
+        globals().setdefault(_name, getattr(_table, _name))
+
+try:
+    __all__ = list(_table.__all__)
+except AttributeError:
+    __all__ = [name for name in globals() if not name.startswith("_")]

tba_storage_core/tables/device_code/_table.py

@@ -0,0 +1,54 @@
+"""Device code model with durable authorization lifecycle fields."""
+
+from __future__ import annotations
+
+import datetime as dt
+import uuid
+
+from tba_storage_core.framework import (
+    RestOltpTable,
+    Timestamped,
+    S,
+    acol,
+    ForeignKeySpec,
+    Boolean,
+    Integer,
+    Mapped,
+    PgUUID,
+    String,
+    TZDateTime,
+    GUIDPk,
+)
+
+
+class DeviceCode(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "device_codes"
+    __table_args__ = ({"schema": "authn"},)
+
+    device_code: Mapped[str] = acol(storage=S(String(128), nullable=False, unique=True))
+    user_code: Mapped[str] = acol(storage=S(String(32), nullable=False, index=True))
+    client_id: Mapped[uuid.UUID] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.clients.id"), nullable=False)
+    )
+    scope: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    audience: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    resource: Mapped[str | None] = acol(storage=S(String(1000), nullable=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False))
+    interval: Mapped[int] = acol(storage=S(Integer, nullable=False))
+    poll_count: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0))
+    slow_down_count: Mapped[int] = acol(storage=S(Integer, nullable=False, default=0))
+    last_polled_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    authorized: Mapped[bool] = acol(storage=S(Boolean, nullable=False, default=False))
+    authorized_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    denied_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    denial_reason: Mapped[str | None] = acol(storage=S(String(255), nullable=True))
+    consumed_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    user_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.users.id"), nullable=True, index=True)
+    )
+    tenant_id: Mapped[uuid.UUID | None] = acol(
+        storage=S(PgUUID(as_uuid=True), fk=ForeignKeySpec(target="authn.tenants.id"), nullable=True, index=True)
+    )
+
+
+__all__ = ["DeviceCode"]

tba_storage_core/tables/did_document/__init__.py

@@ -0,0 +1,3 @@
+from ..did_gnap_state import DidDocument
+
+__all__ = ["DidDocument"]

tba_storage_core/tables/did_document_version/__init__.py

@@ -0,0 +1,3 @@
+from ..did_gnap_state import DidDocumentVersion
+
+__all__ = ["DidDocumentVersion"]

tba_storage_core/tables/did_gnap_state.py

@@ -0,0 +1,169 @@
+"""Optional durable DID authority/cache and GNAP transaction state."""
+
+from __future__ import annotations
+import datetime as dt
+from tba_storage_core.framework import (
+    Boolean,
+    GUIDPk,
+    JSON,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class DidDocument(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "did_documents"
+    __table_args__ = ({"schema": "authn"},)
+    did: Mapped[str] = acol(
+        storage=S(String(1000), nullable=False, unique=True, index=True)
+    )
+    method: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    authoritative: Mapped[bool] = acol(
+        storage=S(Boolean, nullable=False, default=False, index=True)
+    )
+    current_version: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+
+
+class DidDocumentVersion(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "did_document_versions"
+    __table_args__ = ({"schema": "authn"},)
+    did: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    version: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    document: Mapped[dict] = acol(storage=S(JSON, nullable=False))
+    document_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    valid_until: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class DidVerificationMethod(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "did_verification_methods"
+    __table_args__ = ({"schema": "authn"},)
+    did: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    method_id: Mapped[str] = acol(
+        storage=S(String(1000), nullable=False, unique=True, index=True)
+    )
+    method_type: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    controller: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    public_key: Mapped[dict] = acol(storage=S(JSON, nullable=False))
+    relationships: Mapped[list | None] = acol(storage=S(JSON, nullable=True))
+
+
+class DidService(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "did_services"
+    __table_args__ = ({"schema": "authn"},)
+    did: Mapped[str] = acol(storage=S(String(1000), nullable=False, index=True))
+    service_id: Mapped[str] = acol(
+        storage=S(String(1000), nullable=False, unique=True, index=True)
+    )
+    service_type: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    endpoint: Mapped[dict | list | str] = acol(storage=S(JSON, nullable=False))
+
+
+class DidResolutionCache(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "did_resolution_cache"
+    __table_args__ = ({"schema": "authn"},)
+    did_url: Mapped[str] = acol(
+        storage=S(String(1000), nullable=False, unique=True, index=True)
+    )
+    result_digest: Mapped[str] = acol(
+        storage=S(String(128), nullable=False, index=True)
+    )
+    result: Mapped[dict] = acol(storage=S(JSON, nullable=False))
+    resolved_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class GnapGrant(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "gnap_grants"
+    __table_args__ = ({"schema": "authn"},)
+    grant_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    client_instance_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, index=True)
+    )
+    access_request: Mapped[dict | list] = acol(storage=S(JSON, nullable=False))
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="pending", index=True)
+    )
+    subject_id: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class GnapContinuation(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "gnap_continuations"
+    __table_args__ = ({"schema": "authn"},)
+    grant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    continuation_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    token_digest: Mapped[str] = acol(storage=S(String(128), nullable=False, index=True))
+    wait_seconds: Mapped[str | None] = acol(storage=S(String(16), nullable=True))
+    expires_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+class GnapClientInstance(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "gnap_client_instances"
+    __table_args__ = ({"schema": "authn"},)
+    instance_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    key_reference: Mapped[str | None] = acol(
+        storage=S(String(255), nullable=True, index=True)
+    )
+    client_display: Mapped[dict | None] = acol(storage=S(JSON, nullable=True))
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="active", index=True)
+    )
+
+
+class GnapInteraction(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "gnap_interactions"
+    __table_args__ = ({"schema": "authn"},)
+    grant_id: Mapped[str] = acol(storage=S(String(255), nullable=False, index=True))
+    interaction_id: Mapped[str] = acol(
+        storage=S(String(255), nullable=False, unique=True, index=True)
+    )
+    mode: Mapped[str] = acol(storage=S(String(64), nullable=False, index=True))
+    finish_nonce_digest: Mapped[str | None] = acol(
+        storage=S(String(128), nullable=True, index=True)
+    )
+    status: Mapped[str] = acol(
+        storage=S(String(32), nullable=False, default="pending", index=True)
+    )
+    completed_at: Mapped[dt.datetime | None] = acol(
+        storage=S(TZDateTime, nullable=True, index=True)
+    )
+
+
+__all__ = [
+    "DidDocument",
+    "DidDocumentVersion",
+    "DidVerificationMethod",
+    "DidService",
+    "DidResolutionCache",
+    "GnapGrant",
+    "GnapContinuation",
+    "GnapClientInstance",
+    "GnapInteraction",
+]

tba_storage_core/tables/did_resolution_cache/__init__.py

@@ -0,0 +1,3 @@
+from ..did_gnap_state import DidResolutionCache
+
+__all__ = ["DidResolutionCache"]

tba_storage_core/tables/did_service/__init__.py

@@ -0,0 +1,3 @@
+from ..did_gnap_state import DidService
+
+__all__ = ["DidService"]

tba_storage_core/tables/did_verification_method/__init__.py

@@ -0,0 +1,3 @@
+from ..did_gnap_state import DidVerificationMethod
+
+__all__ = ["DidVerificationMethod"]

tba_storage_core/tables/dpop_nonce/__init__.py

@@ -0,0 +1,5 @@
+"""Durable DPoP nonce table."""
+
+from ._table import DpopNonce, nonce_hash, nonce_payload
+
+__all__ = ["DpopNonce", "nonce_hash", "nonce_payload"]

tba_storage_core/tables/dpop_nonce/_table.py

@@ -0,0 +1,77 @@
+"""Durable DPoP nonce ledger."""
+
+from __future__ import annotations
+
+import datetime as dt
+import hashlib
+from datetime import timezone
+from typing import Any
+
+from tba_storage_core.framework import (
+    GUIDPk,
+    Mapped,
+    RestOltpTable,
+    S,
+    String,
+    TZDateTime,
+    Timestamped,
+    acol,
+)
+
+
+class DpopNonce(RestOltpTable, GUIDPk, Timestamped):
+    __tablename__ = "dpop_nonces"
+    __table_args__ = ({"schema": "authn"},)
+
+    nonce_hash: Mapped[str] = acol(storage=S(String(64), nullable=False, unique=True, index=True))
+    issued_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    expires_at: Mapped[dt.datetime] = acol(storage=S(TZDateTime, nullable=False, index=True))
+    consumed_at: Mapped[dt.datetime | None] = acol(storage=S(TZDateTime, nullable=True, index=True))
+    client_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    authorization_server_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    resource_server_id: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+    jkt: Mapped[str | None] = acol(storage=S(String(255), nullable=True, index=True))
+
+
+def _as_aware(value: Any) -> dt.datetime:
+    if isinstance(value, dt.datetime):
+        parsed = value
+    elif isinstance(value, (int, float)):
+        parsed = dt.datetime.fromtimestamp(value, tz=timezone.utc)
+    else:
+        parsed = dt.datetime.fromisoformat(str(value))
+    if parsed.tzinfo is None:
+        return parsed.replace(tzinfo=timezone.utc)
+    return parsed.astimezone(timezone.utc)
+
+
+def nonce_hash(nonce: str) -> str:
+    return hashlib.sha256(str(nonce).strip().encode("utf-8")).hexdigest()
+
+
+def nonce_payload(
+    *,
+    nonce: str,
+    issued_at: dt.datetime,
+    expires_at: dt.datetime,
+    consumed_at: dt.datetime | None = None,
+    client_id: str | None = None,
+    authorization_server_id: str | None = None,
+    resource_server_id: str | None = None,
+    jkt: str | None = None,
+) -> dict[str, Any]:
+    return {
+        "nonce_hash": nonce_hash(nonce),
+        "issued_at": _as_aware(issued_at),
+        "expires_at": _as_aware(expires_at),
+        "consumed_at": _as_aware(consumed_at) if consumed_at is not None else None,
+        "client_id": str(client_id).strip() if client_id not in {None, ""} else None,
+        "authorization_server_id": (
+            str(authorization_server_id).strip() if authorization_server_id not in {None, ""} else None
+        ),
+        "resource_server_id": str(resource_server_id).strip() if resource_server_id not in {None, ""} else None,
+        "jkt": str(jkt).strip() if jkt not in {None, ""} else None,
+    }
+
+
+__all__ = ["DpopNonce", "nonce_hash", "nonce_payload"]

tba_storage_core/tables/dpop_replay/__init__.py

@@ -0,0 +1,5 @@
+"""Durable DPoP replay table."""
+
+from ._table import DpopReplay, replay_key, replay_payload
+
+__all__ = ["DpopReplay", "replay_key", "replay_payload"]