ResolveSpec/pkg/security/lookup/ddl/postgres.sql

-- Reference schema for the lookup direct backend: PostgreSQL (tables only, no stored procedures). Use with lookup.Config{Mode: lookup.ModeDirect}.
-- Do not combine with the procedure schema (database_schema.sql): that schema stores credential ids as bytea and
-- list columns as text[], this one stores base64 / JSON text which is what the direct backend reads and writes.
-- Table and column names are the lookup.DefaultSchema defaults, override them with lookup.Config.Schema.
-- Generated by the project, edit freely for your deployment (types, collations, extra columns).

--   password: bcrypt hash (nullable for OAuth2 users), legacy cleartext is accepted at login
--   roles: comma-separated roles

CREATE TABLE IF NOT EXISTS users (
    id SERIAL PRIMARY KEY,
    username VARCHAR(255) NOT NULL UNIQUE,
    email VARCHAR(255) NOT NULL UNIQUE,
    password VARCHAR(255),
    user_level INTEGER DEFAULT 0,
    roles VARCHAR(500),
    is_active BOOLEAN DEFAULT true,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    last_login_at TIMESTAMP,
    program_user_id INTEGER DEFAULT 0,
    program_user_table VARCHAR(255) DEFAULT '',
    remote_id VARCHAR(255),
    auth_provider VARCHAR(50),
    totp_secret VARCHAR(255),
    totp_enabled BOOLEAN DEFAULT false,
    totp_enabled_at TIMESTAMP
);


CREATE TABLE IF NOT EXISTS user_sessions (
    id SERIAL PRIMARY KEY,
    session_token VARCHAR(500) NOT NULL UNIQUE,
    user_id INTEGER NOT NULL,
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    last_activity_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    ip_address VARCHAR(45),
    user_agent TEXT,
    access_token TEXT,
    refresh_token TEXT,
    token_type VARCHAR(50) DEFAULT 'Bearer',
    auth_provider VARCHAR(50),
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS idx_user_sessions_user_id ON user_sessions(user_id);

CREATE INDEX IF NOT EXISTS idx_user_sessions_expires_at ON user_sessions(expires_at);

CREATE INDEX IF NOT EXISTS idx_user_sessions_refresh_token ON user_sessions(refresh_token);


CREATE TABLE IF NOT EXISTS token_blacklist (
    id SERIAL PRIMARY KEY,
    token VARCHAR(500) NOT NULL,
    user_id INTEGER,
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);


--   code_hash: SHA-256 hex of the backup code

CREATE TABLE IF NOT EXISTS user_totp_backup_codes (
    id SERIAL PRIMARY KEY,
    user_id INTEGER NOT NULL,
    code_hash VARCHAR(64) NOT NULL,
    used BOOLEAN DEFAULT false,
    used_at TIMESTAMP,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS idx_totp_user_id ON user_totp_backup_codes(user_id);

CREATE INDEX IF NOT EXISTS idx_totp_code_hash ON user_totp_backup_codes(code_hash);


--   credential_id: base64 text
--   public_key: base64 text
--   aaguid: base64 text
--   transports: JSON-encoded array

CREATE TABLE IF NOT EXISTS user_passkey_credentials (
    id SERIAL PRIMARY KEY,
    user_id INTEGER NOT NULL,
    credential_id TEXT NOT NULL UNIQUE,
    public_key TEXT NOT NULL,
    attestation_type VARCHAR(50) DEFAULT 'none',
    aaguid TEXT,
    sign_count INTEGER DEFAULT 0,
    clone_warning BOOLEAN DEFAULT false,
    transports TEXT,
    backup_eligible BOOLEAN DEFAULT false,
    backup_state BOOLEAN DEFAULT false,
    name VARCHAR(255),
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    last_used_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS idx_passkey_user_id ON user_passkey_credentials(user_id);


--   token_hash: SHA-256 hex of the raw token

CREATE TABLE IF NOT EXISTS user_password_resets (
    id SERIAL PRIMARY KEY,
    user_id INTEGER NOT NULL,
    token_hash VARCHAR(64) NOT NULL UNIQUE,
    expires_at TIMESTAMP NOT NULL,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    used BOOLEAN DEFAULT false,
    used_at TIMESTAMP,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS idx_pw_reset_user_id ON user_password_resets(user_id);

CREATE INDEX IF NOT EXISTS idx_pw_reset_expires_at ON user_password_resets(expires_at);


--   redirect_uris: JSON-encoded array
--   grant_types: JSON-encoded array
--   allowed_scopes: JSON-encoded array
--   client_secret_hash: SHA-256 hex of the confidential-client secret, NULL for public clients

CREATE TABLE IF NOT EXISTS oauth_clients (
    id SERIAL PRIMARY KEY,
    client_id VARCHAR(255) NOT NULL UNIQUE,
    redirect_uris TEXT NOT NULL,
    client_name VARCHAR(255),
    grant_types TEXT,
    allowed_scopes TEXT,
    client_secret_hash TEXT,
    token_endpoint_auth_method VARCHAR(30) DEFAULT 'none',
    is_active BOOLEAN DEFAULT true,
    metadata TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);


--   scopes: JSON-encoded array

CREATE TABLE IF NOT EXISTS oauth_codes (
    id SERIAL PRIMARY KEY,
    code VARCHAR(255) NOT NULL UNIQUE,
    client_id VARCHAR(255) NOT NULL,
    redirect_uri TEXT NOT NULL,
    client_state TEXT,
    code_challenge VARCHAR(255) NOT NULL,
    code_challenge_method VARCHAR(10) DEFAULT 'S256',
    session_token TEXT NOT NULL,
    refresh_token TEXT,
    scopes TEXT,
    expires_at TIMESTAMP NOT NULL,
    extra TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
);

CREATE INDEX IF NOT EXISTS idx_oauth_codes_expires ON oauth_codes(expires_at);


--   oauth_consents.scopes / oauth_refresh_tokens.scopes+extra / oauth_device_codes.scopes / oauth_par_requests.params: JSON text

CREATE TABLE IF NOT EXISTS oauth_consents (
    id SERIAL PRIMARY KEY,
    user_id INTEGER NOT NULL,
    client_id VARCHAR(255) NOT NULL,
    scopes TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP NOT NULL
);

CREATE INDEX IF NOT EXISTS idx_oauth_consents_user_client ON oauth_consents(user_id, client_id);

CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
    id SERIAL PRIMARY KEY,
    token_hash VARCHAR(64) NOT NULL UNIQUE,
    family_id VARCHAR(64) NOT NULL,
    client_id VARCHAR(255) NOT NULL,
    user_id INTEGER NOT NULL,
    session_token VARCHAR(255),
    scopes TEXT,
    extra TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP NOT NULL,
    used_at TIMESTAMP,
    revoked_at TIMESTAMP
);

CREATE INDEX IF NOT EXISTS idx_oauth_refresh_family ON oauth_refresh_tokens(family_id);

CREATE INDEX IF NOT EXISTS idx_oauth_refresh_session ON oauth_refresh_tokens(session_token);

CREATE INDEX IF NOT EXISTS idx_oauth_refresh_expires ON oauth_refresh_tokens(expires_at);

CREATE TABLE IF NOT EXISTS oauth_device_codes (
    id SERIAL PRIMARY KEY,
    device_hash VARCHAR(64) NOT NULL UNIQUE,
    user_code VARCHAR(32) NOT NULL UNIQUE,
    client_id VARCHAR(255) NOT NULL,
    scopes TEXT,
    status VARCHAR(16) NOT NULL DEFAULT 'pending',
    user_id INTEGER,
    session_token VARCHAR(255),
    poll_interval INTEGER NOT NULL DEFAULT 5,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP NOT NULL,
    last_polled_at TIMESTAMP
);

CREATE INDEX IF NOT EXISTS idx_oauth_device_expires ON oauth_device_codes(expires_at);

CREATE TABLE IF NOT EXISTS oauth_par_requests (
    id SERIAL PRIMARY KEY,
    request_uri VARCHAR(255) NOT NULL UNIQUE,
    client_id VARCHAR(255) NOT NULL,
    params TEXT,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    expires_at TIMESTAMP NOT NULL
);

CREATE INDEX IF NOT EXISTS idx_oauth_par_expires ON oauth_par_requests(expires_at);

CREATE TABLE IF NOT EXISTS oauth_jti (
    id SERIAL PRIMARY KEY,
    jti_key VARCHAR(255) NOT NULL UNIQUE,
    expires_at TIMESTAMP NOT NULL
);

CREATE INDEX IF NOT EXISTS idx_oauth_jti_expires ON oauth_jti(expires_at);


--   key_hash: SHA-256 hex
--   scopes: JSON-encoded array
--   meta: JSON-encoded object

CREATE TABLE IF NOT EXISTS user_keys (
    id SERIAL PRIMARY KEY,
    user_id INTEGER NOT NULL,
    key_type VARCHAR(50) NOT NULL,
    key_hash VARCHAR(64) NOT NULL UNIQUE,
    name VARCHAR(255) NOT NULL DEFAULT '',
    scopes TEXT,
    meta TEXT,
    expires_at TIMESTAMP,
    created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
    last_used_at TIMESTAMP,
    is_active BOOLEAN DEFAULT true,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);

CREATE INDEX IF NOT EXISTS idx_user_keys_user_id ON user_keys(user_id);

CREATE INDEX IF NOT EXISTS idx_user_keys_key_type ON user_keys(key_type);


-- Optional: omit to use per-user rules only.

CREATE TABLE IF NOT EXISTS sec_group_members (
    group_id INTEGER NOT NULL,
    user_id INTEGER NOT NULL,
    PRIMARY KEY (group_id, user_id),
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
);


--   column_path: dot path under the table: col or col.sub.field
--   access_type: mask, hide, read, ...
--   extra_filters: JSON object

CREATE TABLE IF NOT EXISTS sec_column_rules (
    id SERIAL PRIMARY KEY,
    user_id INTEGER,
    group_id INTEGER,
    schema_name TEXT NOT NULL,
    table_name TEXT NOT NULL,
    column_path TEXT NOT NULL,
    access_type VARCHAR(50) NOT NULL,
    mask_start INTEGER DEFAULT 0,
    mask_end INTEGER DEFAULT 0,
    mask_invert BOOLEAN DEFAULT false,
    mask_char VARCHAR(10) DEFAULT '*',
    extra_filters TEXT,
    is_active BOOLEAN NOT NULL DEFAULT true,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
    CHECK ((user_id IS NULL AND group_id IS NOT NULL) OR (user_id IS NOT NULL AND group_id IS NULL))
);

CREATE INDEX IF NOT EXISTS idx_sec_column_rules_table ON sec_column_rules(schema_name, table_name);


--   template: SQL fragment, e.g. user_id = {UserID}

CREATE TABLE IF NOT EXISTS sec_row_rules (
    id SERIAL PRIMARY KEY,
    user_id INTEGER,
    group_id INTEGER,
    schema_name TEXT NOT NULL,
    table_name TEXT NOT NULL,
    template TEXT,
    has_block BOOLEAN NOT NULL DEFAULT false,
    is_active BOOLEAN NOT NULL DEFAULT true,
    FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE,
    CHECK ((user_id IS NULL AND group_id IS NOT NULL) OR (user_id IS NOT NULL AND group_id IS NULL))
);

CREATE INDEX IF NOT EXISTS idx_sec_row_rules_table ON sec_row_rules(schema_name, table_name);