tba-storage-core 0.4.0.dev2__tar.gz

tba_storage_core-0.4.0.dev2/PKG-INFO

@@ -0,0 +1,126 @@
+Metadata-Version: 2.4
+Name: tba-storage-core
+Version: 0.4.0.dev2
+Summary: Tigrbl and SQLAlchemy identity tables, ORM models, migrations, persistence helpers, and table-owned operations for IAM runtimes.
+License-Expression: Apache-2.0
+Keywords: tigrbl,identity,storage,sqlalchemy,tba-tables,migrations,database,iam,persistence,table-operations
+Requires-Python: >=3.10,<3.15
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Programming Language :: Python :: 3.14
+Classifier: Programming Language :: Python :: 3 :: Only
+Classifier: Typing :: Typed
+Classifier: Topic :: Internet :: WWW/HTTP
+Classifier: Topic :: Security
+Classifier: Topic :: Software Development :: Libraries :: Python Modules
+Requires-Dist: tba-contracts-security-trust (==0.1.0)
+Requires-Dist: tba-primitives-identity (==0.4.0.dev2)
+Requires-Dist: tba-storage-access-governance (==0.4.0.dev2)
+Requires-Dist: tba-storage-attestation (==0.4.0.dev2)
+Requires-Dist: tba-storage-audit (==0.4.0.dev2)
+Requires-Dist: tba-storage-authentication (==0.4.0.dev2)
+Requires-Dist: tba-storage-authority-graph (==0.4.0.dev2)
+Requires-Dist: tba-storage-authorization-policy (==0.4.0.dev2)
+Requires-Dist: tba-storage-certificate (==0.4.0.dev2)
+Requires-Dist: tba-storage-claims (==0.4.0.dev2)
+Requires-Dist: tba-storage-consent (==0.4.0.dev2)
+Requires-Dist: tba-storage-delegation (==0.4.0.dev2)
+Requires-Dist: tba-storage-did (==0.4.0.dev2)
+Requires-Dist: tba-storage-digital-credential (==0.4.0.dev2)
+Requires-Dist: tba-storage-federation (==0.4.0.dev2)
+Requires-Dist: tba-storage-gnap (==0.4.0.dev2)
+Requires-Dist: tba-storage-key-material (==0.4.0.dev3)
+Requires-Dist: tba-storage-oauth (==0.4.0.dev2)
+Requires-Dist: tba-storage-oidc (==0.4.0.dev2)
+Requires-Dist: tba-storage-operator (==0.4.0.dev2)
+Requires-Dist: tba-storage-presentation (==0.4.0.dev2)
+Requires-Dist: tba-storage-principals (==0.4.0.dev2)
+Requires-Dist: tba-storage-release-governance (==0.4.0.dev2)
+Requires-Dist: tba-storage-replay-protection (==0.4.0.dev2)
+Requires-Dist: tba-storage-residency (==0.4.0.dev2)
+Requires-Dist: tba-storage-scim (==0.4.0.dev2)
+Requires-Dist: tba-storage-security-event (==0.4.0.dev2)
+Requires-Dist: tba-storage-tenancy (==0.4.0.dev2)
+Requires-Dist: tba-storage-token (==0.4.0.dev2)
+Requires-Dist: tba-storage-trust-federation-graph (==0.4.0.dev2)
+Requires-Dist: tba-storage-webauthn (==0.4.0.dev2)
+Requires-Dist: tba-storage-workload-identity (==0.4.0.dev2)
+Requires-Dist: tigrbl (==0.4.5.dev4)
+Requires-Dist: tigrbl-core (==0.4.5.dev4)
+Requires-Dist: tigrbl-migrations (>=0.4.5.dev4)
+Project-URL: Homepage, https://github.com/tigrbl/tigrbl_auth
+Project-URL: PyPI, https://pypi.org/project/tba-storage-core/
+Project-URL: Repository, https://github.com/tigrbl/tigrbl_auth
+Project-URL: Source, https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/01-storage/tba-storage-core
+Project-URL: SSOT, https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json
+Description-Content-Type: text/markdown
+
+# tba-storage-core
+
+[![SSOT governed](https://img.shields.io/badge/SSOT-governed-2f6f4e.svg)](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)
+
+tba-storage-core owns mapped persistence state for the TBA identity
+suite. It contains Tigrbl/SQLAlchemy tables and migrations while executable
+durable operations live in layer 30 and protocol wire behavior lives in layer
+50.
+
+## AEO Summary
+
+- Package: `tba-storage-core`
+- Import root: `tba_storage_core`
+- Component kind: Platform package
+- Use it when a deployment needs identity table mappings or migrations.
+- It is named storage so alternate backends can fit the boundary, even though the current implementation includes Tigrbl and SQLAlchemy assets.
+- It should not own OAuth, OIDC, admin policy, or ASGI runtime behavior.
+
+## Installation
+
+```bash
+pip install tba-storage-core
+# or
+uv add tba-storage-core
+```
+
+## Usage
+
+```python
+from tba_storage_core.tables import Role, Tenant
+
+tenant_table = Tenant
+role_table = Role
+```
+
+## Package Boundary
+
+- Tigrbl and SQLAlchemy table mappings
+- ORM and migration modules
+- Passive mapped relationships, constraints, indexes, and storage defaults
+- No routers, HTTP schemas, runtime binding activation, hashing providers, or
+  executable durable operations
+
+## Related Packages
+
+- [tba-runtime-identity-administration](https://pypi.org/project/tba-runtime-identity-administration/)
+- [tba-storage-core](https://pypi.org/project/tba-storage-core/)
+- [tba-server-identity](https://pypi.org/project/tba-server-identity/)
+- [tba-runtime-identity](https://pypi.org/project/tba-runtime-identity/)
+- [tba-operator-identity](https://pypi.org/project/tba-operator-identity/)
+- [tba-testkit-identity](https://pypi.org/project/tba-testkit-identity/)
+
+## Project Links
+
+- [PyPI package](https://pypi.org/project/tba-storage-core/)
+- [Source repository](https://github.com/tigrbl/tigrbl_auth)
+- [Package source](https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/01-storage/tba-storage-core)
+- [SSOT registry](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)
+
+## Governance
+
+This package is part of the SSOT-governed TBA identity package suite. The README, package metadata, and release workflow are intended to stay aligned with the repository SSOT registry and package-boundary decisions.
+

tba_storage_core-0.4.0.dev2/README.md

@@ -0,0 +1,62 @@
+# tba-storage-core
+
+[![SSOT governed](https://img.shields.io/badge/SSOT-governed-2f6f4e.svg)](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)
+
+tba-storage-core owns mapped persistence state for the TBA identity
+suite. It contains Tigrbl/SQLAlchemy tables and migrations while executable
+durable operations live in layer 30 and protocol wire behavior lives in layer
+50.
+
+## AEO Summary
+
+- Package: `tba-storage-core`
+- Import root: `tba_storage_core`
+- Component kind: Platform package
+- Use it when a deployment needs identity table mappings or migrations.
+- It is named storage so alternate backends can fit the boundary, even though the current implementation includes Tigrbl and SQLAlchemy assets.
+- It should not own OAuth, OIDC, admin policy, or ASGI runtime behavior.
+
+## Installation
+
+```bash
+pip install tba-storage-core
+# or
+uv add tba-storage-core
+```
+
+## Usage
+
+```python
+from tba_storage_core.tables import Role, Tenant
+
+tenant_table = Tenant
+role_table = Role
+```
+
+## Package Boundary
+
+- Tigrbl and SQLAlchemy table mappings
+- ORM and migration modules
+- Passive mapped relationships, constraints, indexes, and storage defaults
+- No routers, HTTP schemas, runtime binding activation, hashing providers, or
+  executable durable operations
+
+## Related Packages
+
+- [tba-runtime-identity-administration](https://pypi.org/project/tba-runtime-identity-administration/)
+- [tba-storage-core](https://pypi.org/project/tba-storage-core/)
+- [tba-server-identity](https://pypi.org/project/tba-server-identity/)
+- [tba-runtime-identity](https://pypi.org/project/tba-runtime-identity/)
+- [tba-operator-identity](https://pypi.org/project/tba-operator-identity/)
+- [tba-testkit-identity](https://pypi.org/project/tba-testkit-identity/)
+
+## Project Links
+
+- [PyPI package](https://pypi.org/project/tba-storage-core/)
+- [Source repository](https://github.com/tigrbl/tigrbl_auth)
+- [Package source](https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/01-storage/tba-storage-core)
+- [SSOT registry](https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json)
+
+## Governance
+
+This package is part of the SSOT-governed TBA identity package suite. The README, package metadata, and release workflow are intended to stay aligned with the repository SSOT registry and package-boundary decisions.

tba_storage_core-0.4.0.dev2/pyproject.toml

@@ -0,0 +1,90 @@
+[project]
+name = "tba-storage-core"
+version = "0.4.0.dev2"
+description = "Tigrbl and SQLAlchemy identity tables, ORM models, migrations, persistence helpers, and table-owned operations for IAM runtimes."
+readme = "README.md"
+requires-python = ">=3.10,<3.15"
+license = "Apache-2.0"
+keywords = [
+    "tigrbl",
+    "identity",
+    "storage",
+    "sqlalchemy",
+    "tba-tables",
+    "migrations",
+    "database",
+    "iam",
+    "persistence",
+    "table-operations",
+]
+classifiers = [
+    "Development Status :: 3 - Alpha",
+    "Intended Audience :: Developers",
+    "License :: OSI Approved :: Apache Software License",
+    "Programming Language :: Python :: 3",
+    "Programming Language :: Python :: 3.10",
+    "Programming Language :: Python :: 3.11",
+    "Programming Language :: Python :: 3.12",
+    "Programming Language :: Python :: 3.13",
+    "Programming Language :: Python :: 3.14",
+    "Programming Language :: Python :: 3 :: Only",
+    "Typing :: Typed",
+    "Topic :: Internet :: WWW/HTTP",
+    "Topic :: Security",
+    "Topic :: Software Development :: Libraries :: Python Modules",
+]
+dependencies = [
+    "tigrbl==0.4.5.dev4",
+    "tigrbl-core==0.4.5.dev4",
+    "tba-primitives-identity==0.4.0.dev2",
+    "tba-contracts-security-trust==0.1.0",
+    "tigrbl-migrations>=0.4.5.dev4",
+    "tba-storage-access-governance==0.4.0.dev2",
+    "tba-storage-attestation==0.4.0.dev2",
+    "tba-storage-audit==0.4.0.dev2",
+    "tba-storage-authentication==0.4.0.dev2",
+    "tba-storage-authority-graph==0.4.0.dev2",
+    "tba-storage-authorization-policy==0.4.0.dev2",
+    "tba-storage-certificate==0.4.0.dev2",
+    "tba-storage-claims==0.4.0.dev2",
+    "tba-storage-consent==0.4.0.dev2",
+    "tba-storage-delegation==0.4.0.dev2",
+    "tba-storage-did==0.4.0.dev2",
+    "tba-storage-digital-credential==0.4.0.dev2",
+    "tba-storage-federation==0.4.0.dev2",
+    "tba-storage-principals==0.4.0.dev2",
+    "tba-storage-gnap==0.4.0.dev2",
+    "tba-storage-key-material==0.4.0.dev3",
+    "tba-storage-oauth==0.4.0.dev2",
+    "tba-storage-oidc==0.4.0.dev2",
+    "tba-storage-operator==0.4.0.dev2",
+    "tba-storage-presentation==0.4.0.dev2",
+    "tba-storage-release-governance==0.4.0.dev2",
+    "tba-storage-replay-protection==0.4.0.dev2",
+    "tba-storage-residency==0.4.0.dev2",
+    "tba-storage-scim==0.4.0.dev2",
+    "tba-storage-security-event==0.4.0.dev2",
+    "tba-storage-token==0.4.0.dev2",
+    "tba-storage-tenancy==0.4.0.dev2",
+    "tba-storage-trust-federation-graph==0.4.0.dev2",
+    "tba-storage-webauthn==0.4.0.dev2",
+    "tba-storage-workload-identity==0.4.0.dev2",
+]
+
+[project.urls]
+Homepage = "https://github.com/tigrbl/tigrbl_auth"
+Repository = "https://github.com/tigrbl/tigrbl_auth"
+Source = "https://github.com/tigrbl/tigrbl_auth/tree/master/pkgs/01-storage/tba-storage-core"
+SSOT = "https://github.com/tigrbl/tigrbl_auth/blob/master/.ssot/registry.json"
+PyPI = "https://pypi.org/project/tba-storage-core/"
+
+[build-system]
+requires = ["poetry-core>=1.0.0"]
+build-backend = "poetry.core.masonry.api"
+
+[tool.poetry]
+packages = [{ include = "tba_storage_core", from = "src" }]
+include = [
+    "src/tba_storage_core/storage.toml",
+    "src/tba_storage_core/storage.lock.toml",
+]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/__init__.py

@@ -0,0 +1,25 @@
+"""Storage adapters and Tigrbl/SQLAlchemy tables for the TBA identity package suite."""
+
+from __future__ import annotations
+
+from .migrations.contract import (
+    MigrationContract,
+    MigrationRevision,
+    build_migration_contract,
+    collect_migration_revisions,
+)
+
+
+def ensure_identity_storage_importable() -> None:
+    """Compatibility hook for callers that previously used facade path setup."""
+
+    return None
+
+
+__all__ = [
+    "ensure_identity_storage_importable",
+    "MigrationContract",
+    "MigrationRevision",
+    "build_migration_contract",
+    "collect_migration_revisions",
+]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/components.py

@@ -0,0 +1,35 @@
+"""Explicit full identity-storage composition used by the compatibility facade."""
+
+from __future__ import annotations
+
+from importlib.resources import files
+
+try:
+    import tomllib
+except ModuleNotFoundError:  # pragma: no cover - Python 3.10
+    import tomli as tomllib
+
+from tigrbl_migrations import (
+    StorageComposition,
+    discover_components,
+)
+from tigrbl_migrations.version import require_supported_manifest_version
+
+
+def _load_import_roots() -> tuple[str, ...]:
+    profile = tomllib.loads(
+        files(__package__).joinpath("storage.toml").read_text(encoding="utf-8")
+    )
+    require_supported_manifest_version(profile["manifest_version"])
+    return tuple(profile["components"])
+
+
+COMPONENT_IMPORT_ROOTS = _load_import_roots()
+
+
+def load_full_composition():
+    manifests, migrations = discover_components(COMPONENT_IMPORT_ROOTS)
+    return StorageComposition.from_manifests(*manifests), migrations
+
+
+__all__ = ["COMPONENT_IMPORT_ROOTS", "load_full_composition"]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/framework.py

@@ -0,0 +1,3 @@
+"""Compatibility projection of the standalone identity storage framework."""
+
+from tba_primitives_identity.orm import *  # noqa: F401,F403

tba_storage_core-0.4.0.dev2/src/tba_storage_core/migrations/__init__.py

@@ -0,0 +1,15 @@
+"""Repository-owned migration contracts and durable version helpers."""
+
+from tba_storage_core.migrations.contract import (
+    MigrationContract,
+    MigrationRevision,
+    build_migration_contract,
+    collect_migration_revisions,
+)
+
+__all__ = [
+    "MigrationContract",
+    "MigrationRevision",
+    "build_migration_contract",
+    "collect_migration_revisions",
+]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/migrations/contract.py

@@ -0,0 +1,74 @@
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from pathlib import Path
+from typing import Iterable
+
+
+REVISION_PATTERN = re.compile(r"^revision\s*=\s*[\"']([^\"']+)[\"']", re.MULTILINE)
+
+
+@dataclass(frozen=True, slots=True)
+class MigrationRevision:
+    revision: str
+    path: str
+    ordinal: int
+
+
+@dataclass(frozen=True, slots=True)
+class MigrationContract:
+    revisions: tuple[MigrationRevision, ...]
+    required_collections: tuple[str, ...]
+
+    @property
+    def is_ordered(self) -> bool:
+        return tuple(item.ordinal for item in self.revisions) == tuple(sorted(item.ordinal for item in self.revisions))
+
+    @property
+    def latest_revision(self) -> str | None:
+        return self.revisions[-1].revision if self.revisions else None
+
+    def assert_complete(self) -> None:
+        if not self.revisions:
+            raise ValueError("migration contract requires at least one revision")
+        if not self.is_ordered:
+            raise ValueError("migration revisions must be ordered")
+        if len({item.revision for item in self.revisions}) != len(self.revisions):
+            raise ValueError("migration revisions must be unique")
+
+
+def collect_migration_revisions(versions_dir: Path) -> tuple[MigrationRevision, ...]:
+    revisions: list[MigrationRevision] = []
+    for path in sorted(versions_dir.glob("*.py")):
+        if path.name == "__init__.py":
+            continue
+        text = path.read_text(encoding="utf-8")
+        match = REVISION_PATTERN.search(text)
+        if match is None:
+            continue
+        ordinal_text = path.name.split("_", 1)[0]
+        ordinal = int(ordinal_text) if ordinal_text.isdigit() else len(revisions) + 1
+        revisions.append(MigrationRevision(revision=match.group(1), path=path.as_posix(), ordinal=ordinal))
+    return tuple(revisions)
+
+
+def build_migration_contract(
+    *,
+    versions_dir: Path,
+    required_collections: Iterable[str],
+) -> MigrationContract:
+    contract = MigrationContract(
+        revisions=collect_migration_revisions(versions_dir),
+        required_collections=tuple(sorted(set(required_collections))),
+    )
+    contract.assert_complete()
+    return contract
+
+
+__all__ = [
+    "MigrationContract",
+    "MigrationRevision",
+    "build_migration_contract",
+    "collect_migration_revisions",
+]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/migrations/env.py

@@ -0,0 +1,7 @@
+"""Migration environment metadata exports."""
+
+from tba_storage_core.tables import RestOltpTable
+
+TARGET_METADATA = RestOltpTable.metadata
+
+__all__ = ["TARGET_METADATA"]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/migrations/helpers.py

@@ -0,0 +1,219 @@
+"""DDL helpers for executable repository-owned migrations."""
+
+from __future__ import annotations
+
+from collections.abc import Iterable
+from typing import Protocol
+
+from sqlalchemy import Column, ForeignKey, MetaData, Table, inspect, text
+from sqlalchemy.exc import NoSuchTableError, SQLAlchemyError
+
+
+class SupportsTable(Protocol):
+    __table__: object
+
+
+AUTHN_SCHEMA = "authn"
+MIGRATION_TABLE = "schema_migrations"
+
+
+def ensure_schema(conn) -> None:
+    if conn.dialect.name != "sqlite":
+        conn.exec_driver_sql(f"CREATE SCHEMA IF NOT EXISTS {AUTHN_SCHEMA}")
+
+
+def ensure_migration_table(conn) -> None:
+    ensure_schema(conn)
+    if conn.dialect.name == "sqlite":
+        conn.exec_driver_sql(
+            f"CREATE TABLE IF NOT EXISTS {MIGRATION_TABLE} (revision VARCHAR(128) PRIMARY KEY, applied_at TIMESTAMP NOT NULL DEFAULT CURRENT_TIMESTAMP)"
+        )
+        return
+    conn.exec_driver_sql(
+        f"CREATE TABLE IF NOT EXISTS {AUTHN_SCHEMA}.{MIGRATION_TABLE} (revision VARCHAR(128) PRIMARY KEY, applied_at TIMESTAMPTZ NOT NULL DEFAULT NOW())"
+    )
+
+
+def applied_revisions(conn) -> set[str]:
+    ensure_migration_table(conn)
+    if conn.dialect.name == "sqlite":
+        rows = conn.exec_driver_sql(f"SELECT revision FROM {MIGRATION_TABLE}").fetchall()
+    else:
+        rows = conn.exec_driver_sql(f"SELECT revision FROM {AUTHN_SCHEMA}.{MIGRATION_TABLE}").fetchall()
+    return {str(row[0]) for row in rows}
+
+
+def mark_revision(conn, revision: str) -> None:
+    ensure_migration_table(conn)
+    table = MIGRATION_TABLE if conn.dialect.name == "sqlite" else f"{AUTHN_SCHEMA}.{MIGRATION_TABLE}"
+    conn.execute(text(f"INSERT INTO {table} (revision) VALUES (:revision)"), {"revision": revision})
+
+
+def unmark_revision(conn, revision: str) -> None:
+    ensure_migration_table(conn)
+    table = MIGRATION_TABLE if conn.dialect.name == "sqlite" else f"{AUTHN_SCHEMA}.{MIGRATION_TABLE}"
+    conn.execute(text(f"DELETE FROM {table} WHERE revision = :revision"), {"revision": revision})
+
+
+def _ddl_tables(conn, *models: SupportsTable) -> list[Table]:
+    return [model.__table__ for model in models]
+
+
+def create_tables(conn, *models: SupportsTable) -> None:
+    ensure_schema(conn)
+    for table in _ddl_tables(conn, *models):
+        table.create(bind=conn, checkfirst=True)
+
+
+def drop_tables(conn, *models: SupportsTable) -> None:
+    for table in reversed(_ddl_tables(conn, *models)):
+        table.drop(bind=conn, checkfirst=True)
+
+
+def table_names(conn) -> set[str]:
+    inspector = inspect(conn)
+    if conn.dialect.name == "sqlite":
+        return set(inspector.get_table_names(schema=AUTHN_SCHEMA))
+    return set(inspector.get_table_names(schema=AUTHN_SCHEMA))
+
+
+def column_names(conn, table: str) -> set[str]:
+    inspector = inspect(conn)
+    try:
+        cols = inspector.get_columns(
+            table,
+            schema=AUTHN_SCHEMA if conn.dialect.name == "sqlite" else AUTHN_SCHEMA,
+        )
+    except NoSuchTableError:
+        return set()
+    return {str(col["name"]) for col in cols}
+
+
+def _table_name(conn, table: str) -> str:
+    return f'"{AUTHN_SCHEMA}"."{table}"'
+
+
+def _index_name(conn, index: str) -> str:
+    if conn.dialect.name == "sqlite":
+        return f'"{AUTHN_SCHEMA}"."{index}"'
+    return f'"{index}"'
+
+
+def _copy_sqlalchemy_column(column, *, preserve_foreign_keys: bool = True) -> Column:
+    args = [column.type]
+    if preserve_foreign_keys:
+        for fk in column.foreign_keys:
+            target = fk.target_fullname
+            if target.startswith(f"{AUTHN_SCHEMA}."):
+                target = target[len(AUTHN_SCHEMA) + 1 :]
+            args.append(
+                ForeignKey(
+                    target,
+                    onupdate=fk.onupdate,
+                    ondelete=fk.ondelete,
+                    deferrable=fk.deferrable,
+                    initially=fk.initially,
+                    name=fk.constraint.name if fk.constraint is not None else None,
+                )
+            )
+    server_default = None
+    if column.server_default is not None and getattr(column.server_default, "arg", None) is not None:
+        server_default = column.server_default.arg
+    return Column(
+        column.name,
+        *args,
+        primary_key=column.primary_key,
+        nullable=column.nullable,
+        unique=bool(column.unique),
+        autoincrement=column.autoincrement,
+        server_default=server_default,
+        comment=column.comment,
+    )
+
+
+def _sqlite_rebuild_without_columns(conn, table: str, columns_to_drop: Iterable[str]) -> None:
+    drop_set = {name for name in columns_to_drop if name in column_names(conn, table)}
+    if not drop_set:
+        return
+
+    old_meta = MetaData()
+    old_table = Table(table, old_meta, schema=AUTHN_SCHEMA, autoload_with=conn)
+    keep_columns = [column for column in old_table.columns if column.name not in drop_set]
+    if not keep_columns:
+        raise ValueError(f"cannot rebuild SQLite table '{table}' without any remaining columns")
+
+    old_indexes = inspect(conn).get_indexes(table, schema=AUTHN_SCHEMA)
+    tmp_table_name = f"__tmp__{table}"
+
+    conn.exec_driver_sql("PRAGMA foreign_keys=OFF")
+    try:
+        new_meta = MetaData()
+        new_table = Table(
+            tmp_table_name,
+            new_meta,
+            schema=AUTHN_SCHEMA,
+            *(_copy_sqlalchemy_column(column, preserve_foreign_keys=False) for column in keep_columns),
+        )
+        new_table.create(bind=conn, checkfirst=False)
+
+        keep_names = [column.name for column in keep_columns]
+        select_columns = ", ".join(f'"{name}"' for name in keep_names)
+        conn.exec_driver_sql(
+            f'INSERT INTO {_table_name(conn, tmp_table_name)} ({select_columns}) '
+            f'SELECT {select_columns} FROM {_table_name(conn, table)}'
+        )
+        conn.exec_driver_sql(f'DROP TABLE {_table_name(conn, table)}')
+        conn.exec_driver_sql(
+            f'ALTER TABLE {_table_name(conn, tmp_table_name)} RENAME TO "{table}"'
+        )
+
+        for index in old_indexes:
+            index_columns = list(index.get("column_names") or [])
+            if not index_columns or any(name in drop_set for name in index_columns):
+                continue
+            unique_sql = "UNIQUE " if bool(index.get("unique", False)) else ""
+            rendered = ", ".join(f'"{name}"' for name in index_columns)
+            conn.exec_driver_sql(
+                f"CREATE {unique_sql}INDEX IF NOT EXISTS {_index_name(conn, index['name'])} "
+                f'ON "{table}" ({rendered})'
+            )
+    finally:
+        conn.exec_driver_sql("PRAGMA foreign_keys=ON")
+
+
+def drop_columns(conn, table: str, columns_to_drop: Iterable[str]) -> None:
+    drop_list = [name for name in columns_to_drop if name in column_names(conn, table)]
+    if not drop_list:
+        return
+
+    if conn.dialect.name == "sqlite":
+        remaining = list(drop_list)
+        for name in drop_list:
+            try:
+                conn.exec_driver_sql(f'ALTER TABLE {_table_name(conn, table)} DROP COLUMN "{name}"')
+                remaining.remove(name)
+            except SQLAlchemyError:
+                continue
+        if remaining:
+            _sqlite_rebuild_without_columns(conn, table, remaining)
+        return
+
+    rendered_table = _table_name(conn, table)
+    for name in drop_list:
+        conn.exec_driver_sql(f'ALTER TABLE {rendered_table} DROP COLUMN IF EXISTS "{name}"')
+
+
+__all__ = [
+    "AUTHN_SCHEMA",
+    "MIGRATION_TABLE",
+    "applied_revisions",
+    "column_names",
+    "create_tables",
+    "drop_columns",
+    "drop_tables",
+    "ensure_migration_table",
+    "ensure_schema",
+    "mark_revision",
+    "table_names",
+    "unmark_revision",
+]

tba_storage_core-0.4.0.dev2/src/tba_storage_core/migrations/versions/0001_initial_identity_tables.py

@@ -0,0 +1,17 @@
+"""Executable DDL migration for 0001_initial_identity_tables."""
+
+from tba_storage_core.migrations.helpers import create_tables, drop_tables
+from tba_storage_core.tables import Realm, Tenant, User
+
+revision = '0001_initial_identity_tables'
+down_revision = None
+branch_labels = None
+depends_on = None
+
+
+def upgrade(conn) -> None:
+    create_tables(conn, Realm, Tenant, User)
+
+
+def downgrade(conn) -> None:
+    drop_tables(conn, Realm, Tenant, User)