trueppm-api 0.4.0b2__py3-none-any.whl

trueppm_api/apps/sso/apps.py

@@ -0,0 +1,19 @@
+"""App config for ``apps/sso`` — basic multi-provider SSO (ADR-0517, supersedes ADR-0187).
+
+The two extension seams (``register_oidc_identity_mapper`` and
+``register_local_login_policy_provider``) default to safe community behaviour
+with no provider registered, so this app needs no OSS-side ``ready()`` wiring —
+the module-level fallbacks in :mod:`trueppm_api.apps.sso.extensions` are the
+community defaults. ``trueppm-enterprise`` registers richer providers against the
+same seams from its own ``AppConfig.ready()`` (ADR-0177), with zero OSS change.
+"""
+
+from __future__ import annotations
+
+from django.apps import AppConfig
+
+
+class SsoConfig(AppConfig):
+    default_auto_field = "django.db.models.BigAutoField"
+    name = "trueppm_api.apps.sso"
+    verbose_name = "Single sign-on"

trueppm_api/apps/sso/extensions.py

@@ -0,0 +1,130 @@
+"""OSS extension seams for SSO (ADR-0187 §4–5, ADR-0177 idiom).
+
+Two single-slot provider registries that govern the two capabilities the
+OSS/Enterprise boundary excludes from the community edition. Each degrades to a
+**safe community default** when no provider is registered, so the OSS edition is
+fully functional standalone and ``trueppm-enterprise`` attaches with zero OSS
+change (the one-way dependency holds: enterprise → OSS, never the reverse).
+
+1. ``oidc_role_for`` — group→role mapping. OSS ignores claims and returns the
+   admin-chosen ``default_role``. Enterprise registers a mapper that reads
+   ``groups``/custom claims (requesting the wider scope through its own provider
+   extension) and maps them to roles, with an auth-event audit trail. The
+   mapper's result is clamped at this seam: any role above
+   ``WorkspaceRole.ADMIN`` (in particular ``OWNER``) or any value that is not a
+   valid ``WorkspaceRole`` ordinal is refused in favor of ``default_role`` —
+   ``OWNER`` is unreachable through this seam regardless of what a mapper
+   returns.
+2. ``local_login_allowed`` — enforced-SSO / disable-local-accounts. OSS always
+   returns ``True``; password login is never blocked. Enterprise registers a
+   provider that enforces ``allow_password_signin=False`` for non-exempt accounts.
+
+Extension inputs are treated as **untrusted** even though enterprise is "ours"
+(threat model, Boundary 5): both seams have a typed, narrow signature and the
+callers fail safe on a raising provider.
+"""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Callable
+from typing import TYPE_CHECKING, Any
+
+from trueppm_api.apps.workspace.models import WorkspaceRole
+from trueppm_api.core.extension_providers import guard_single_provider
+
+if TYPE_CHECKING:
+    from trueppm_api.apps.sso.models import SsoProviderPolicy
+
+logger = logging.getLogger("trueppm.sso")
+
+# Enterprise registers a callable mapping (claims, config) → workspace-role int.
+# OSS leaves it None → the auto-create role is always ``config.default_role``.
+_IDENTITY_MAPPER: Callable[[dict[str, Any], SsoProviderPolicy], int] | None = None
+
+# Enterprise registers a callable user → bool ("may this user complete a password
+# login?"). OSS leaves it None → password login is always allowed.
+_LOCAL_LOGIN_POLICY: Callable[[Any], bool] | None = None
+
+
+def register_oidc_identity_mapper(
+    provider: Callable[[dict[str, Any], SsoProviderPolicy], int] | None,
+) -> None:
+    """Register (or clear, with ``None``) the claims→role mapper. Enterprise calls this."""
+    global _IDENTITY_MAPPER
+    _IDENTITY_MAPPER = guard_single_provider(_IDENTITY_MAPPER, provider, "oidc identity mapper")
+
+
+def oidc_role_for(claims: dict[str, Any], config: SsoProviderPolicy) -> int:
+    """Resolve the workspace-role ordinal to grant an auto-created SSO member.
+
+    OSS default: ignore the claims entirely and return ``config.default_role`` —
+    there is no ``groups`` scope and no claim→role logic in the community edition.
+    A registered enterprise mapper may read claims; if it raises, returns a
+    non-int, returns an ordinal that is not a valid :class:`WorkspaceRole`, or
+    returns a role above ``WorkspaceRole.ADMIN``, we fall back to
+    ``default_role`` (fail safe — never grant *more* than the admin-configured
+    floor on a buggy mapper).
+
+    **Enterprise extension-point contract:** this is the enforcement point, not
+    an advisory clamp — ``WorkspaceRole.OWNER`` is categorically unreachable
+    through this seam, regardless of what the registered mapper returns. This
+    mirrors the OSS write serializer's ``default_role`` restriction (SSO
+    auto-create must never mint an Owner) and treats the enterprise mapper's
+    result as untrusted input per the extension-point threat model (Boundary
+    5) — a bug in the mapper is not a privilege-escalation path.
+    """
+    if _IDENTITY_MAPPER is None:
+        return int(config.default_role)
+    try:
+        role = _IDENTITY_MAPPER(claims, config)
+    except Exception:
+        logger.exception("oidc identity mapper raised; falling back to default_role")
+        return int(config.default_role)
+    if not isinstance(role, int):
+        logger.error("oidc identity mapper returned non-int %r; using default_role", role)
+        return int(config.default_role)
+    if role not in WorkspaceRole.values or role > WorkspaceRole.ADMIN:
+        logger.error(
+            "oidc identity mapper returned unclamped role %r (above ADMIN ceiling "
+            "or not a valid WorkspaceRole); using default_role",
+            role,
+        )
+        return int(config.default_role)
+    return role
+
+
+def register_local_login_policy_provider(provider: Callable[[Any], bool] | None) -> None:
+    """Register (or clear, with ``None``) the password-login policy. Enterprise calls this."""
+    global _LOCAL_LOGIN_POLICY
+    _LOCAL_LOGIN_POLICY = guard_single_provider(_LOCAL_LOGIN_POLICY, provider, "local login policy")
+
+
+def local_login_policy_enforced() -> bool:
+    """Whether an edition actually enforces the ``allow_password_signin`` setting.
+
+    OSS returns ``False`` — the community edition never blocks password login, so
+    persisting ``allow_password_signin`` would be a set-but-ignored no-op. The SSO
+    write serializer uses this to *reject* the field in OSS instead of silently
+    swallowing it (#2025). Enterprise registers a policy provider, flipping this to
+    ``True``, and its own serializer accepts and honors the field.
+    """
+    return _LOCAL_LOGIN_POLICY is not None
+
+
+def local_login_allowed(user: Any) -> bool:
+    """Whether ``user`` may complete a username/password login.
+
+    OSS default: always ``True`` — the community edition never enforces
+    "Allow password sign-in: OFF" (that enforcement is an enterprise capability;
+    ADR-0187 §4). A registered enterprise provider may return ``False`` to block
+    local login; if it raises, OSS fails **open** (login allowed) so a buggy
+    enterprise policy can never lock every admin out of the install.
+    """
+    if _LOCAL_LOGIN_POLICY is None:
+        return True
+    try:
+        return bool(_LOCAL_LOGIN_POLICY(user))
+    except Exception:
+        logger.exception("local login policy provider raised; allowing password login")
+        return True

trueppm_api/apps/sso/management/commands/seed_sso_keycloak.py

@@ -0,0 +1,172 @@
+"""Seed a Keycloak OIDC provider for the ``sso:integration`` nightly CI job (#2274).
+
+Provisions the one enabled ``keycloak`` provider (an allauth ``SocialApp`` +
+:class:`SsoProviderPolicy`) pointing at the live Keycloak service that the CI job
+runs, plus a workspace-admin account the Playwright spec authenticates as to hit
+the admin-only ``test-connection`` endpoint. Idempotent — re-running updates the
+existing rows rather than duplicating them.
+
+The provider mirrors what an operator configures in Workspace Settings → SSO for a
+self-hosted Keycloak realm: issuer (base URL + realm), confidential client id +
+secret, a permitted email domain, and auto-create so the seeded Keycloak test
+user becomes a TruePPM member on first login (exercising the full ``resolve_user``
+path, not just the handshake).
+
+Environment variables (all have CI-friendly defaults; the job sets them
+explicitly so the values match the baked realm export):
+
+    SSO_KEYCLOAK_ISSUER          e.g. http://keycloak:8080/realms/trueppm-ci
+    SSO_KEYCLOAK_CLIENT_ID       confidential client id (default: trueppm-web)
+    SSO_KEYCLOAK_CLIENT_SECRET   confidential client secret
+    SSO_KEYCLOAK_ALLOWED_DOMAIN  domain of the Keycloak test user's email
+    SSO_ADMIN_EMAIL              workspace-admin account for test-connection
+    INTEGRATION_USER_PASSWORD    password for the admin account (shared with the
+                                 web:integration fixtures)
+
+The issuer host must be present in ``EGRESS_ALLOWLISTED_HOSTS`` (ADR-0590) or the
+SSRF egress guard blocks discovery/token/JWKS — the CI job sets both together.
+"""
+
+from __future__ import annotations
+
+import os
+import secrets
+
+from allauth.socialaccount.models import SocialApp
+from django.conf import settings
+from django.contrib.auth import get_user_model
+from django.core.management.base import BaseCommand, CommandError
+from django.db import transaction
+
+from trueppm_api.apps.sso import services
+from trueppm_api.apps.sso.models import SsoProviderPolicy
+from trueppm_api.apps.workspace.models import (
+    MemberStatus,
+    Workspace,
+    WorkspaceMembership,
+    WorkspaceRole,
+)
+
+_SLUG = "keycloak"
+_DEFAULT_ISSUER = "http://keycloak:8080/realms/trueppm-ci"
+_DEFAULT_CLIENT_ID = "trueppm-web"
+_DEFAULT_CLIENT_SECRET = "trueppm-ci-secret"  # matches the baked realm export
+_DEFAULT_ALLOWED_DOMAIN = "trueppm-ci.test"
+_DEFAULT_ADMIN_EMAIL = "sso-admin@trueppm-ci.test"
+
+_PASSWORD_ENV = "INTEGRATION_USER_PASSWORD"
+_DEBUG_DEFAULT_PASSWORD = "ci-integration-pw"  # only honored under settings.DEBUG
+
+
+def _resolve_admin_password() -> tuple[str, str]:
+    """Resolve the seeded admin's password + its source (mirrors #1375).
+
+    The seeded admin is a real, loginable, workspace-admin account, so a fixed weak
+    password must never reach a public (non-DEBUG) instance. Resolution order:
+    ``INTEGRATION_USER_PASSWORD`` env (operator/CI opt-in) → the static default
+    under DEBUG (local dev) → a random token otherwise. Returns ``(password,
+    source)`` where source is ``"env"`` / ``"debug"`` / ``"generated"``.
+    """
+    env_pw = os.environ.get(_PASSWORD_ENV)
+    if env_pw:
+        return env_pw, "env"
+    if settings.DEBUG:
+        return _DEBUG_DEFAULT_PASSWORD, "debug"
+    return secrets.token_urlsafe(16), "generated"
+
+
+class Command(BaseCommand):
+    """Seed the Keycloak SSO provider + a workspace-admin (idempotent)."""
+
+    help = "Seed a live-Keycloak OIDC provider for the sso:integration CI job."
+
+    def add_arguments(self, parser: object) -> None:
+        parser.add_argument(  # type: ignore[attr-defined]
+            "--force",
+            action="store_true",
+            help=(
+                "Allow the seed to run even when a throwaway password would be "
+                "generated (DEBUG off and no INTEGRATION_USER_PASSWORD)."
+            ),
+        )
+
+    @transaction.atomic
+    def handle(self, *args: object, **options: object) -> None:
+        # Prod guard (mirrors seed_integration_fixtures, #1375): this command
+        # creates an *enabled* SSO provider and a loginable workspace-admin account.
+        # On a non-DEBUG instance with no env password the only resolvable password
+        # is a useless random throwaway, so refuse to create the admin unless the
+        # operator explicitly opts in — it must never mint a known-credential admin
+        # (or a stray CI provider) on a real instance.
+        password, password_source = _resolve_admin_password()
+        if password_source == "generated" and not options.get("force"):
+            raise CommandError(
+                "Refusing to seed the Keycloak CI provider on a non-DEBUG instance "
+                "without a password — this creates an enabled SSO provider and a "
+                f"loginable workspace-admin. Set {_PASSWORD_ENV} (as the CI job does) "
+                "or pass --force to override."
+            )
+
+        issuer = os.environ.get("SSO_KEYCLOAK_ISSUER", _DEFAULT_ISSUER)
+        client_id = os.environ.get("SSO_KEYCLOAK_CLIENT_ID", _DEFAULT_CLIENT_ID)
+        client_secret = os.environ.get("SSO_KEYCLOAK_CLIENT_SECRET", _DEFAULT_CLIENT_SECRET)
+        allowed_domain = os.environ.get("SSO_KEYCLOAK_ALLOWED_DOMAIN", _DEFAULT_ALLOWED_DOMAIN)
+        admin_email = os.environ.get("SSO_ADMIN_EMAIL", _DEFAULT_ADMIN_EMAIL)
+
+        workspace = Workspace.load()
+
+        # allauth SocialApp holds the endpoint/claim knowledge; the real secret
+        # lives Fernet-encrypted on the policy side row (SocialApp.secret stays
+        # empty — ADR-0517 §3.1), so update_or_create the app with an empty secret.
+        # get-or-create-ok: CI seed command, fixed constant provider slug — no duplicate reachable
+        app, _ = SocialApp.objects.update_or_create(
+            provider_id=_SLUG,
+            defaults={
+                "provider": services.ALLAUTH_OPENID_CONNECT,
+                "name": "Keycloak (CI)",
+                "client_id": client_id,
+                "secret": "",
+                "settings": {"server_url": issuer},
+            },
+        )
+        app.sites.add(int(getattr(settings, "SITE_ID", 1)))
+
+        policy, _ = SsoProviderPolicy.objects.update_or_create(
+            social_app=app,
+            defaults={
+                "workspace": workspace,
+                "slug": _SLUG,
+                "enabled": True,
+                "allowed_email_domains": [allowed_domain.lower()],
+                # Auto-create so the seeded Keycloak user becomes a member on first
+                # login — the smoke exercises the full resolve/create path.
+                "auto_create_members": True,
+            },
+        )
+        policy.set_client_secret(client_secret)
+        policy.save(update_fields=["secret_ciphertext"])
+
+        # Workspace-admin for the admin-only test-connection call. Least privilege:
+        # an explicit WorkspaceMembership at ADMIN (not a Django superuser) is enough
+        # to clear IsWorkspaceAdminStrict, and is workspace-scoped rather than a
+        # global backdoor. username == email so the password login (/auth/token/)
+        # succeeds (Django's default USERNAME_FIELD is "username").
+        user_model = get_user_model()
+        admin, _ = user_model.objects.update_or_create(
+            email=admin_email,
+            defaults={"username": admin_email},
+        )
+        # nosemgrep: unvalidated-password  # CI fixture, not an interactive signup.
+        admin.set_password(password)
+        admin.save(update_fields=["password"])
+        WorkspaceMembership.objects.update_or_create(
+            workspace=workspace,
+            user=admin,
+            defaults={"role": WorkspaceRole.ADMIN, "status": MemberStatus.ACTIVE},
+        )
+
+        self.stdout.write(self.style.SUCCESS("Keycloak SSO provider seeded"))
+        self.stdout.write(f"  issuer:  {issuer}")
+        self.stdout.write(f"  client:  {client_id}")
+        self.stdout.write(f"  domain:  {allowed_domain}")
+        self.stdout.write(f"  admin:   {admin_email}")

trueppm_api/apps/sso/migrations/0001_initial.py

@@ -0,0 +1,119 @@
+# Generated by Django 5.2.14 on 2026-06-30 12:54
+
+import uuid
+
+import django.contrib.postgres.fields
+import django.db.models.deletion
+from django.conf import settings
+from django.db import migrations, models
+
+
+def _default_scopes() -> list[str]:
+    # Inlined default (ADR-0517 drops this model in 0002). Kept as a module-level
+    # callable so the historical migration replays deterministically after the
+    # ``OIDCProvider.scopes`` field (and its former model helper) were removed.
+    return ["openid", "email", "profile"]
+
+
+class Migration(migrations.Migration):
+    initial = True
+
+    dependencies = [
+        (
+            "workspace",
+            "0001_squashed_0014_workspacemembership_availability_effective_from_and_more",
+        ),
+        migrations.swappable_dependency(settings.AUTH_USER_MODEL),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="OIDCIdentity",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("issuer", models.CharField(max_length=512)),
+                ("subject", models.CharField(max_length=255)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                (
+                    "user",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="oidc_identities",
+                        to=settings.AUTH_USER_MODEL,
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "sso_oidc_identity",
+                "constraints": [
+                    models.UniqueConstraint(
+                        fields=("issuer", "subject"), name="uniq_oidc_identity_iss_sub"
+                    )
+                ],
+            },
+        ),
+        migrations.CreateModel(
+            name="OIDCProvider",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("enabled", models.BooleanField(default=False)),
+                ("display_name", models.CharField(blank=True, default="", max_length=255)),
+                ("issuer_url", models.URLField(blank=True, default="")),
+                ("client_id", models.CharField(blank=True, default="", max_length=255)),
+                ("client_secret_ciphertext", models.BinaryField(blank=True, default=b"")),
+                (
+                    "scopes",
+                    django.contrib.postgres.fields.ArrayField(
+                        base_field=models.CharField(max_length=64),
+                        default=_default_scopes,
+                        size=None,
+                    ),
+                ),
+                (
+                    "allowed_email_domains",
+                    django.contrib.postgres.fields.ArrayField(
+                        base_field=models.CharField(max_length=255),
+                        blank=True,
+                        default=list,
+                        size=None,
+                    ),
+                ),
+                ("auto_create_members", models.BooleanField(default=False)),
+                (
+                    "default_role",
+                    models.PositiveSmallIntegerField(
+                        choices=[(100, "Member"), (300, "Admin"), (400, "Owner")], default=100
+                    ),
+                ),
+                ("allow_password_signin", models.BooleanField(default=True)),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "workspace",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="oidc_providers",
+                        to="workspace.workspace",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "sso_oidc_provider",
+                "constraints": [
+                    models.UniqueConstraint(
+                        fields=("workspace",), name="uniq_oidc_provider_workspace"
+                    )
+                ],
+            },
+        ),
+    ]

trueppm_api/apps/sso/migrations/0002_remove_oidcprovider_workspace_ssoproviderpolicy_and_more.py

@@ -0,0 +1,169 @@
+# Generated by Django 5.2.16 on 2026-07-18 01:11
+#
+# ADR-0517: adopt allauth.socialaccount. Create the SsoProviderPolicy side row,
+# migrate every OIDCProvider → (SocialApp + SsoProviderPolicy) and every
+# OIDCIdentity → SocialAccount, then drop the bespoke sso_oidc_* tables. SSO is
+# unshipped, so this is a NO-OP on a fresh install (no OIDCProvider rows exist);
+# it exists for dev-DB parity and to keep makemigrations --check honest.
+
+import uuid
+from typing import Any
+
+import django.contrib.postgres.fields
+import django.db.models.deletion
+from django.conf import settings as django_settings
+from django.db import migrations, models
+
+# The two allauth provider modules we enable; the migrated singleton is generic OIDC.
+_ALLAUTH_OPENID_CONNECT = "openid_connect"
+_MIGRATED_SLUG = "generic"
+
+
+def _copy_oidc_config_to_allauth(apps: Any, schema_editor: Any) -> None:
+    """Port each OIDCProvider → SocialApp + SsoProviderPolicy, each OIDCIdentity → SocialAccount.
+
+    Uses ``apps.get_model`` (never a direct import) so it runs against the historical
+    schema. The client secret is already Fernet-encrypted under the same
+    ``INTEGRATION_ENCRYPTION_KEY``, so the ciphertext bytes are copied verbatim into
+    the side row — ``SocialApp.secret`` stays empty (control 2, ADR-0517 §3.1).
+
+    Assumes the OSS single-workspace topology: every OIDCProvider collapses into one
+    SocialApp under the constant "generic" slug. Multiple OIDCProviders across
+    multiple workspaces would collide on that slug — but that cannot occur in OSS,
+    which is single-workspace (Workspace is a singleton).
+    """
+    OIDCProvider = apps.get_model("sso", "OIDCProvider")
+    OIDCIdentity = apps.get_model("sso", "OIDCIdentity")
+    SsoProviderPolicy = apps.get_model("sso", "SsoProviderPolicy")
+    SocialApp = apps.get_model("socialaccount", "SocialApp")
+    SocialAccount = apps.get_model("socialaccount", "SocialAccount")
+    Site = apps.get_model("sites", "Site")
+
+    site_id = int(getattr(django_settings, "SITE_ID", 1))
+    site = Site.objects.filter(pk=site_id).first()
+
+    for provider in OIDCProvider.objects.all():
+        app, _created = SocialApp.objects.get_or_create(
+            provider=_ALLAUTH_OPENID_CONNECT,
+            provider_id=_MIGRATED_SLUG,
+            defaults={
+                "name": provider.display_name or "OIDC",
+                "client_id": provider.client_id,
+                "secret": "",
+                "settings": {"server_url": provider.issuer_url},
+            },
+        )
+        if site is not None:
+            app.sites.add(site)
+
+        SsoProviderPolicy.objects.get_or_create(
+            social_app=app,
+            defaults={
+                "workspace_id": provider.workspace_id,
+                "slug": _MIGRATED_SLUG,
+                "enabled": provider.enabled,
+                "allowed_email_domains": list(provider.allowed_email_domains or []),
+                "auto_create_members": provider.auto_create_members,
+                "default_role": provider.default_role,
+                "allow_password_signin": provider.allow_password_signin,
+                "github_org": "",
+                "secret_ciphertext": bytes(provider.client_secret_ciphertext or b""),
+            },
+        )
+
+    for identity in OIDCIdentity.objects.all():
+        SocialAccount.objects.get_or_create(
+            provider=_MIGRATED_SLUG,
+            uid=identity.subject,
+            defaults={
+                "user_id": identity.user_id,
+                "extra_data": {"iss": identity.issuer},
+            },
+        )
+
+
+def _noop_reverse(apps: Any, schema_editor: Any) -> None:
+    """Reverse is a no-op: the bespoke tables are gone; we do not reconstruct them."""
+
+
+class Migration(migrations.Migration):
+    dependencies = [
+        ("socialaccount", "0006_alter_socialaccount_extra_data"),
+        ("sites", "0002_alter_domain_unique"),
+        ("sso", "0001_initial"),
+        ("workspace", "0016_historicalworkspace_calendar_and_more"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="SsoProviderPolicy",
+            fields=[
+                (
+                    "id",
+                    models.UUIDField(
+                        default=uuid.uuid4, editable=False, primary_key=True, serialize=False
+                    ),
+                ),
+                ("enabled", models.BooleanField(default=False)),
+                ("slug", models.CharField(max_length=64)),
+                (
+                    "allowed_email_domains",
+                    django.contrib.postgres.fields.ArrayField(
+                        base_field=models.CharField(max_length=255),
+                        blank=True,
+                        default=list,
+                        size=None,
+                    ),
+                ),
+                ("auto_create_members", models.BooleanField(default=False)),
+                (
+                    "default_role",
+                    models.PositiveSmallIntegerField(
+                        choices=[(100, "Member"), (300, "Admin"), (400, "Owner")], default=100
+                    ),
+                ),
+                ("allow_password_signin", models.BooleanField(default=True)),
+                ("github_org", models.CharField(blank=True, default="", max_length=255)),
+                ("secret_ciphertext", models.BinaryField(blank=True, default=b"")),
+                ("created_at", models.DateTimeField(auto_now_add=True)),
+                ("updated_at", models.DateTimeField(auto_now=True)),
+                (
+                    "social_app",
+                    models.OneToOneField(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="trueppm_policy",
+                        to="socialaccount.socialapp",
+                    ),
+                ),
+                (
+                    "workspace",
+                    models.ForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="sso_provider_policies",
+                        to="workspace.workspace",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "sso_provider_policy",
+            },
+        ),
+        migrations.AddConstraint(
+            model_name="ssoproviderpolicy",
+            constraint=models.UniqueConstraint(
+                fields=("workspace", "slug"), name="uniq_sso_policy_workspace_slug"
+            ),
+        ),
+        # Data copy MUST run before the fields/models it reads are dropped below.
+        migrations.RunPython(_copy_oidc_config_to_allauth, _noop_reverse),
+        migrations.RemoveField(
+            model_name="oidcprovider",
+            name="workspace",
+        ),
+        migrations.DeleteModel(
+            name="OIDCIdentity",
+        ),
+        migrations.DeleteModel(
+            name="OIDCProvider",
+        ),
+    ]