Remove down and dev migrations (#890)

* Remove down and dev migrations

This won't be the pattern going forward, so this removes these from the
code.

internal/db/schema/migrations/postgres/0/01_domain_types.down.sql

@@ -1,15 +0,0 @@
-begin;
-
-drop domain wt_timestamp;
-drop domain wt_public_id;
-drop domain wt_private_id;
-drop domain wt_scope_id;
-drop domain wt_user_id;
-drop domain wt_version;
-
-drop function default_create_time;
-drop function update_time_column;
-drop function update_version_column;
-drop function immutable_columns;
-
-commit;

internal/db/schema/migrations/postgres/0/02_oplog.down.sql

@@ -1,7 +0,0 @@
-begin;
-
-drop table oplog_metadata cascade;
-drop table oplog_ticket cascade;
-drop table oplog_entry cascade;
-
-commit;

internal/db/schema/migrations/postgres/0/03_db.down.sql

@@ -1,8 +0,0 @@
-begin;
-
-drop table db_test_rental cascade;
-drop table db_test_car cascade;
-drop table db_test_user cascade;
-drop table db_test_scooter cascade;
-
-commit;

internal/db/schema/migrations/postgres/0/06_iam.down.sql

@@ -1,34 +0,0 @@
-BEGIN;
-
-drop table iam_group cascade;
-drop table iam_user cascade;
-drop table iam_scope_project cascade;
-drop table iam_scope_org cascade;
-drop table iam_scope_global cascade;
-drop table iam_scope cascade;
-drop table iam_scope_type_enm cascade;
-drop table iam_role cascade;
-drop view iam_principal_role cascade;
-drop table iam_group_role cascade;
-drop table iam_user_role cascade;
-drop table iam_group_member_user cascade;
-drop view iam_group_member cascade;
-drop table iam_role_grant cascade;
-
-drop function iam_sub_names cascade;
-drop function iam_immutable_scope_type_func cascade;
-drop function iam_sub_scopes_func cascade;
-drop function iam_immutable_role_principal cascade;
-drop function iam_user_role_scope_check cascade;
-drop function iam_group_role_scope_check cascade;
-drop function iam_group_member_scope_check cascade;
-drop function iam_immutable_group_member cascade;
-drop function get_scoped_member_id cascade;
-drop function grant_scope_id_valid cascade;
-drop function disallow_global_scope_deletion cascade;
-drop function user_scope_id_valid cascade;
-drop function iam_immutable_role_grant cascade;
-drop function disallow_iam_predefined_user_deletion cascade;
-drop function recovery_user_not_allowed cascade;
-
-COMMIT;

internal/db/schema/migrations/postgres/0/07_auth.down.sql

@@ -1,10 +0,0 @@
-begin;
-
-  drop function update_iam_user_auth_account;
-  drop function insert_auth_account_subtype;
-  drop function insert_auth_method_subtype;
-
-  drop table auth_account cascade;
-  drop table auth_method cascade;
-
-commit;

internal/db/schema/migrations/postgres/0/08_servers.down.sql

@@ -1,5 +0,0 @@
-begin;
-
-  drop table server;
-
-commit;

internal/db/schema/migrations/postgres/0/11_auth_token.down.sql

@@ -1,10 +0,0 @@
-begin;
-
-  drop view auth_token_account cascade;
-  drop table auth_token cascade;
-
-  drop function update_last_access_time cascade;
-  drop function immutable_auth_token_columns cascade;
-  drop function expire_time_not_older_than_token cascade;
-
-commit;

internal/db/schema/migrations/postgres/0/12_auth_password.down.sql

@@ -1,11 +0,0 @@
-begin;
-
-  drop table auth_password_credential;
-  drop table auth_password_conf cascade;
-  drop table if exists auth_password_account;
-  drop table if exists auth_password_method;
-
-  drop function insert_auth_password_credential_subtype;
-  drop function insert_auth_password_conf_subtype;
-
-commit;

internal/db/schema/migrations/postgres/0/13_auth_password_argon.down.sql

@@ -1,6 +0,0 @@
-begin;
-
-  drop table auth_password_argon2_cred;
-  drop table auth_password_argon2_conf;
-
-commit;

internal/db/schema/migrations/postgres/0/14_auth_password_views.down.sql

@@ -1,6 +0,0 @@
-begin;
-
-  drop view auth_password_current_conf;
-  drop view auth_password_conf_union;
-
-commit;

internal/db/schema/migrations/postgres/0/20_host.down.sql

@@ -1,19 +0,0 @@
-begin;
-
-  drop table host_set;
-  drop table host;
-  drop table host_catalog;
-
-  drop function insert_host_set_subtype;
-  drop function insert_host_subtype;
-  drop function insert_host_catalog_subtype;
-
-  delete
-    from oplog_ticket
-   where name in (
-          'host_catalog',
-          'host',
-          'host_set'
-        );
-
-commit;

internal/db/schema/migrations/postgres/0/22_static_host.down.sql

@@ -1,17 +0,0 @@
-begin;
-
-  drop table static_host_set_member cascade;
-  drop table static_host_set cascade;
-  drop table static_host cascade;
-  drop table static_host_catalog cascade;
-
-  delete
-    from oplog_ticket
-   where name in (
-          'static_host_catalog',
-          'static_host',
-          'static_host_set',
-          'static_host_set_member'
-        );
-
-commit;

internal/db/schema/migrations/postgres/0/30_keys.down.sql

@@ -1,5 +0,0 @@
-begin;
-
-drop function kms_version_column cascade;
-
-commit;

internal/db/schema/migrations/postgres/0/31_keys.down.sql

@@ -1,12 +0,0 @@
-begin;
-
-drop table kms_root_key cascade;
-drop table kms_root_key_version cascade;
-drop table kms_database_key cascade;
-drop table kms_database_key_version cascade;
-drop table kms_oplog_key cascade;
-drop table kms_oplog_key_version cascade;
-drop table kms_session_key cascade;
-drop table kms_session_key_version cascade;
-
-commit;

internal/db/schema/migrations/postgres/0/40_targets.down.sql

@@ -1,8 +0,0 @@
-begin;
-
-drop function insert_target_subtype;
-drop function delete_target_subtype;
-drop function target_scope_valid;
-drop function target_host_set_scope_valid
-
-commit;

internal/db/schema/migrations/postgres/0/41_targets.down.sql

@@ -1,16 +0,0 @@
-begin;
-
-drop table target cascade;
-drop table target_host_set cascade;
-drop table target_tcp;
-drop view target_all_subtypes;
-drop view target_host_set_catalog;
-
-
-delete
-from oplog_ticket
-where name in (
-        'target_tcp'
-    );
-
-commit;

internal/db/schema/migrations/postgres/0/50_session.down.sql

@@ -1,20 +0,0 @@
-begin;
-
-  drop table session_state;
-  drop table session_state_enm;
-  drop table session;
-  drop table session_termination_reason_enm;
-  drop function insert_session_state;
-  drop function insert_new_session_state;
-  drop function insert_session;
-  drop function update_session_state_on_termination_reason;
-  drop function insert_session_state;
-
-
-  delete
-  from oplog_ticket
-  where name in (
-          'session'
-      );
-
-commit;

internal/db/schema/migrations/postgres/0/51_connection.down.sql

@@ -1,10 +0,0 @@
-begin;
-
-  drop table session_connection_state;
-  drop table session_connection_state_enm;
-  drop table session_connection;
-  drop table session_connection_closed_reason_enm;
-  drop function insert_session_connection_state;
-  drop function insert_new_connection_state;
-  drop function update_connection_state_on_closed_reason;
-commit;

internal/db/schema/migrations/postgres/0/60_wh_domain_types.down.sql

@@ -1,15 +0,0 @@
-begin;
-
-  drop function wh_current_time_id;
-  drop function wh_current_date_id;
-  drop function wh_time_id;
-  drop function wh_date_id;
-  drop domain wh_dim_text;
-  drop domain wh_timestamp;
-  drop domain wh_public_id;
-  drop domain wh_dim_id;
-  drop function wh_dim_id;
-  drop domain wh_bytes_transmitted;
-  drop domain wh_inet_port;
-
-commit;

internal/db/schema/migrations/postgres/0/62_wh_datetime.down.sql

@@ -1,6 +0,0 @@
-begin;
-
-  drop table wh_time_of_day_dimension;
-  drop table wh_date_dimension;
-
-commit;

internal/db/schema/migrations/postgres/0/65_wh_session_dimensions.down.sql

@@ -1,10 +0,0 @@
-begin;
-
-  drop view whx_user_dimension_target;
-  drop view whx_user_dimension_source;
-  drop view whx_host_dimension_target;
-  drop view whx_host_dimension_source;
-  drop table wh_user_dimension;
-  drop table wh_host_dimension;
-
-commit;

internal/db/schema/migrations/postgres/0/66_wh_session_dimensions.down.sql

@@ -1,6 +0,0 @@
-begin;
-
-  drop function wh_upsert_user;
-  drop function wh_upsert_host;
-
-commit;

internal/db/schema/migrations/postgres/0/68_wh_session_facts.down.sql

@@ -1,6 +0,0 @@
-begin;
-
-  drop table wh_session_connection_accumulating_fact;
-  drop table wh_session_accumulating_fact;
-
-commit;

internal/db/schema/migrations/postgres/0/69_wh_session_facts.down.sql

@@ -1,20 +0,0 @@
-begin;
-
-  drop trigger wh_insert_session_connection_state on session_connection_state;
-  drop function wh_insert_session_connection_state;
-
-  drop trigger wh_insert_session_state on session_state;
-  drop function wh_insert_session_state;
-
-  drop trigger wh_update_session_connection on session_connection;
-  drop function wh_update_session_connection;
-
-  drop trigger wh_insert_session_connection on session_connection;
-  drop function wh_insert_session_connection;
-
-  drop trigger wh_insert_session on session;
-  drop function wh_insert_session;
-
-  drop function wh_rollup_connections;
-
-commit;

internal/db/schema/migrations/postgres/dev/01_server_tags_migrations.down.sql

@@ -1,8 +0,0 @@
-begin;
-
-drop domain wt_bexprfilter;
-
-drop table server_tag;
-drop domain wt_tagpair;
-
-commit;

internal/db/schema/migrations/postgres/dev/80_domains.down.sql

@@ -1,4 +0,0 @@
-begin;
-
-
-commit;

internal/db/schema/migrations/postgres/dev/82_kms.down.sql

@@ -1,2 +0,0 @@
-begin;
-commit;

internal/db/schema/migrations/postgres/dev/83_oidc_enm.down.sql

@@ -1,3 +0,0 @@
-begin;
-
-commit;

internal/db/schema/migrations/postgres/dev/83_oidc_enm.up.sql

@@ -1,71 +0,0 @@
-begin;
-
--- auth_oidc_method_state_enum entries define the possible oidc auth method
--- states. 
-create table auth_oidc_method_state_enm (
-  name text primary key
-    constraint only_predefined_oidc_method_states_allowed
-    check (
-        name in ('inactive', 'active-private', 'active-public', 'stopping')
-    )
-);
-
--- populate the values of auth_oidc_method_state_enm
-insert into auth_oidc_method_state_enm(name)
-  values
-    ('inactive'),
-    ('active-private'),
-    ('active-public'),
-    ('stopping'); 
-
- -- define the immutable fields for auth_oidc_method_state_enm (all of them)
-create trigger 
-  immutable_columns
-before
-update on auth_oidc_method_state_enm
-  for each row execute procedure immutable_columns('name');
-
-
--- auth_oidc_signing_alg entries define the supported oidc auth method
--- signing algorithms.
-create table auth_oidc_signing_alg_enm (
-  name text primary key
-    constraint only_predefined_auth_oidc_signing_algs_allowed
-    check (
-        name in (
-          'RS256', 
-          'RS384', 
-          'RS512', 
-          'ES256', 
-          'ES384', 
-          'ES512', 
-          'PS256', 
-          'PS384', 
-          'PS512', 
-          'EdDSA')
-    )
-);
-
--- populate the values of auth_oidc_signing_alg
-insert into auth_oidc_signing_alg_enm (name)
-  values
-    ('RS256'),
-    ('RS384'),
-    ('RS512'),
-    ('ES256'),
-    ('ES384'),
-    ('ES512'),
-    ('PS256'),
-    ('PS384'),
-    ('PS512'),
-    ('EdDSA')
-    ; 
-
- -- define the immutable fields for auth_oidc_signing_alg (all of them)
-create trigger 
-  immutable_columns
-before
-update on auth_oidc_signing_alg_enm
-  for each row execute procedure immutable_columns('name');
-
-commit;

internal/db/schema/migrations/postgres/dev/84_oidc.down.sql

@@ -1,3 +0,0 @@
-begin;
-
-commit;

internal/db/schema/migrations/postgres/dev/84_oidc.up.sql

@@ -1,193 +0,0 @@
-begin;
-
--- auth_oidc_method entries are the current oidc auth methods configured for
--- existing scopes. 
-create table auth_oidc_method (
-  public_id wt_public_id
-    primary key,
-  scope_id wt_scope_id
-    not null,
-  name wt_name,
-  description wt_description, 
-  create_time wt_timestamp,
-  update_time wt_timestamp,
-  version wt_version,
-  state text not null
-    references auth_oidc_method_state_enm(name)
-    on delete restrict
-    on update cascade,
-  discovery_url wt_url not null, -- oidc discovery URL without any .well-known component
-  client_id text not null -- oidc client identifier issued by the oidc provider.
-    constraint client_id_not_empty
-    check(length(trim(client_id)) > 0), 
-  client_secret bytea not null, -- encrypted oidc client secret issued by the oidc provider.
-  key_id wt_private_id not null -- key used to encrypt entries via wrapping wrapper. 
-    references kms_oidc_key_version(private_id) 
-    on delete restrict
-    on update cascade, 
-  max_age int not null -- the allowable elapsed time in secs since the last time the user was authenticated. zero is allowed and should force the user to be re-authenticated.
-    constraint max_age_equal_or_greater_than_zero
-    check(max_age >= 0), 
-  foreign key (scope_id, public_id)
-      references auth_method (scope_id, public_id)
-      on delete cascade
-      on update cascade,
-  unique(scope_id, name),
-  unique(scope_id, public_id),
-  unique(scope_id, discovery_url, client_id) -- a client_id must be unique for a provider within a scope.
-);
-
--- auth_oidc_signing_alg entries are the signing algorithms allowed for an oidc
--- auth method.  There must be at least one allowed alg for each oidc auth method.
-create table auth_oidc_signing_alg (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  signing_alg_name text 
-    references auth_oidc_signing_alg_enm(name)
-    on delete restrict
-    on update cascade,
-  primary key(oidc_method_id, signing_alg_name)
-);
-
--- auth_oidc_callback_url entries are the callback URLs allowed for a specific
--- oidc auth method.  There must be at least one callback url for each oidc auth
--- method. 
-create table auth_oidc_callback_url (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  callback_url wt_url not null
-);
-
--- auth_oidc_aud_claim entries are the audience claims for a specific oidc auth
--- method.  There can be 0 or more for each parent oidc auth method.  If an auth
--- method has any aud claims, an ID token must contain one of them to be valid. 
-create table auth_oidc_aud_claim (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  aud_claim text not null
-    constraint aud_claim_must_not_be_empty
-    check(length(trim(aud_claim)) > 0) 
-    constraint aud_claim_must_be_less_than_1024_chars
-      check(length(trim(aud_claim)) < 1024),
-  primary key(oidc_method_id, aud_claim)
-);
-
--- auth_oidc_certificate entries are optional PEM encoded x509 certificates.
--- Each entry is a single certificate.  An oidc auth method may have 0 or more
--- of these optional x509s.  If an auth method has any cert entries, they are
--- used as trust anchors when connecting to the auth method's oidc provider
--- (instead of the host system's cert chain).
-create table auth_oidc_certificate (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  certificate bytea not null,
-  primary key(oidc_method_id, certificate)
-);
-
-
-create table auth_oidc_account (
-    public_id wt_public_id
-      primary key,
-    auth_method_id wt_public_id
-      not null,
-    -- NOTE(mgaffney): The scope_id type is not wt_scope_id because the domain
-    -- check is executed before the insert trigger which retrieves the scope_id
-    -- causing an insert to fail.
-    scope_id text not null,
-    name wt_name,
-    description wt_description,
-    create_time wt_timestamp,
-    update_time wt_timestamp,
-    version wt_version,
-    issuer_id wt_url not null, -- case-sensitive URL that maps to an id_token's iss claim
-    subject_id text not null -- case-senstive string that maps to an id_token's sub claim
-      constraint subject_id_must_not_be_empty 
-      check (
-        length(trim(subject_id)) > 0
-      )
-      constraint subject_id_must_be_less_than_256_chars 
-      check(
-        length(trim(subject_id)) <= 255 -- length limit per OIDC spec
-      ),
-    full_name wt_full_name, -- may be null and maps to an id_token's name claim
-    email wt_email, -- may be null and maps to the id_token's email claim
-    foreign key (scope_id, auth_method_id)
-      references auth_oidc_method (scope_id, public_id)
-      on delete cascade
-      on update cascade,
-    foreign key (scope_id, auth_method_id, public_id)
-      references auth_account (scope_id, auth_method_id, public_id)
-      on delete cascade
-      on update cascade,
-    unique(auth_method_id, name),
-    unique(auth_method_id, issuer_id, subject_id), -- subject must be unique for a provider within specific auth method
-    unique(auth_method_id, public_id)
-);
-
--- auth_oidc_method column triggers
-create trigger
-  insert_auth_method_subtype
-before insert on auth_oidc_method
-  for each row execute procedure insert_auth_method_subtype();
-
-create trigger
-  update_time_column
-before
-update on auth_oidc_method
-  for each row execute procedure update_time_column();
-
-create trigger
-  immutable_columns
-before
-update on auth_oidc_method
-  for each row execute procedure immutable_columns('public_id', 'scope_id', 'create_time');
-
-create trigger
-  default_create_time_column
-before
-insert on auth_oidc_method
-  for each row execute procedure default_create_time();
-
-create trigger
-  update_version_column
-after update on auth_oidc_method
-  for each row execute procedure update_version_column();
-
--- auth_oidc_account column triggers
-create trigger
-  update_time_column
-before
-update on auth_oidc_account
-  for each row execute procedure update_time_column();
-
-create trigger
-  immutable_columns
-before
-update on auth_oidc_account
-  for each row execute procedure immutable_columns('public_id', 'auth_method_id', 'scope_id', 'create_time', 'issuer_id', 'subject_id');
-
-create trigger
-  default_create_time_column
-before
-insert on auth_oidc_account
-  for each row execute procedure default_create_time();
-
-create trigger
-  update_version_column
-after update on auth_oidc_account
-  for each row execute procedure update_version_column();
-
-create trigger
-  insert_auth_account_subtype
-before insert on auth_oidc_account
-  for each row execute procedure insert_auth_account_subtype();
-
-commit;

internal/db/schema/migrations/postgres/dev/85_authtoken.down.sql

@@ -1,3 +0,0 @@
-begin;
-
-commit;

internal/db/schema/migrations/postgres/dev/85_authtoken.up.sql

@@ -1,31 +0,0 @@
-begin;
-
--- auth_token_status_enm entries define the possible auth token
--- states. 
-create table auth_token_status_enm (
-  name text primary key
-    constraint only_predefined_auth_token_states_allowed
-    check (
-        name in ('auth token pending','token issued', 'authentication failed', 'system error')
-    )
-);
-
--- populate the values of auth_token_status_enm
-insert into auth_token_status_enm(name)
-  values
-    ('auth token pending'),
-    ('token issued'),
-    ('authentication failed'),
-    ('system error'); 
-
-
--- add the state column with a default to the auth_token table.
-alter table auth_token
-add column status text 
-not null
-default 'token issued' -- safest default
-references auth_token_status_enm(name)
-  on update cascade
-  on delete restrict;
-
-commit;

internal/db/schema/migrations/postgres/dev/86_iam.down.sql

@@ -1,3 +0,0 @@
-begin;
-
-commit;

internal/db/schema/migrations/postgres/dev/86_iam.up.sql

@@ -1,66 +0,0 @@
-begin;
-
--- add the account_info_auth_method_id which determines which auth_method is
--- designated as for "account info" in the user's scope.  
-alter table iam_scope
-add column account_info_auth_method_id wt_public_id  -- allowed to be null and is mutable of course.
-references auth_method(public_id)
-    on update cascade
-    on delete set null;
-
--- establish a compond fk, but there's no cascading of deletes or updates, since
--- we only want to cascade changes to the account_info_auth_method_id portion of
--- the compond fk and that is handled in a separate fk declaration.
-alter table iam_scope
-add foreign key (public_id, account_info_auth_method_id) references auth_method(scope_id, public_id); 
-
--- iam_user_acct_info provides account info for users by determining which
--- auth_method is designated as for "account info" in the user's scope via the
--- scope's account_info_auth_method_id.  Every sub-type of auth_account must be
--- added to this view's union.
-create view iam_acct_info as
-select 
-    aa.iam_user_id,
-    oa.subject_id as login_name,
-    oa.full_name as full_name,
-    oa.email as email
-from 	
-    iam_scope s,
-    auth_account aa,
-    auth_oidc_account oa
-where
-    aa.public_id = oa.public_id and 
-    aa.auth_method_id = s.account_info_auth_method_id 
-union 
-select 
-    aa.iam_user_id,
-    pa.login_name,
-    '' as full_name,
-    '' as email
-from 	
-    iam_scope s,
-    auth_account aa,
-    auth_password_account pa
-where
-    aa.public_id = pa.public_id and 
-    aa.auth_method_id = s.account_info_auth_method_id;
-
--- iam_user_acct_info provides a simple way to retrieve entries that include
--- both the iam_user fields with an outer join to the user's account info.
-create view iam_user_acct_info as
-select 
-    u.public_id,
-    u.scope_id,
-    u.name,
-    u.description, 
-    u.create_time,
-    u.update_time,
-    u.version,
-    i.login_name,
-    i.full_name,
-    i.email
-from 	
-	iam_user u
-left outer join iam_acct_info i on u.public_id = i.iam_user_id;
-
-commit;

internal/db/schema/postgres_migration.gen.go

@@ -4,8 +4,8 @@ package schema
 
 func init() {
 	migrationStates["postgres"] = migrationState{
-		devMigration:        true,
-		binarySchemaVersion: 1086,
+		devMigration:        false,
+		binarySchemaVersion: 1003,
 		upMigrations: map[int][]byte{
 			1: []byte(`
 create domain wt_public_id as text
@@ -4865,7 +4865,7 @@ create table server_tag (
   primary key(server_id, key, value)
 );
 `),
-			1080: []byte(`
+			1002: []byte(`
 -- wt_email defines a type for email which must be less than 320 chars and only
 -- contain lower case values.  The type is defined to allow nulls and not be
 -- unique, which can be overriden as needed when used in tables.
@@ -4921,7 +4921,7 @@ create domain wt_description as text
 comment on domain wt_description is
 'standard column for resource descriptions';
 `),
-			1082: []byte(`
+			1003: []byte(`
 -- kms_oidc_key entries are DEKs for encrypting oidc entries.
 create table kms_oidc_key (
   private_id wt_private_id primary key,
@@ -4983,359 +4983,6 @@ create trigger
 	kms_version_column
 before insert on kms_oidc_key_version
 	for each row execute procedure kms_version_column('oidc_key_id');
-`),
-			1083: []byte(`
--- auth_oidc_method_state_enum entries define the possible oidc auth method
--- states. 
-create table auth_oidc_method_state_enm (
-  name text primary key
-    constraint only_predefined_oidc_method_states_allowed
-    check (
-        name in ('inactive', 'active-private', 'active-public', 'stopping')
-    )
-);
-
--- populate the values of auth_oidc_method_state_enm
-insert into auth_oidc_method_state_enm(name)
-  values
-    ('inactive'),
-    ('active-private'),
-    ('active-public'),
-    ('stopping'); 
-
- -- define the immutable fields for auth_oidc_method_state_enm (all of them)
-create trigger 
-  immutable_columns
-before
-update on auth_oidc_method_state_enm
-  for each row execute procedure immutable_columns('name');
-
-
--- auth_oidc_signing_alg entries define the supported oidc auth method
--- signing algorithms.
-create table auth_oidc_signing_alg_enm (
-  name text primary key
-    constraint only_predefined_auth_oidc_signing_algs_allowed
-    check (
-        name in (
-          'RS256', 
-          'RS384', 
-          'RS512', 
-          'ES256', 
-          'ES384', 
-          'ES512', 
-          'PS256', 
-          'PS384', 
-          'PS512', 
-          'EdDSA')
-    )
-);
-
--- populate the values of auth_oidc_signing_alg
-insert into auth_oidc_signing_alg_enm (name)
-  values
-    ('RS256'),
-    ('RS384'),
-    ('RS512'),
-    ('ES256'),
-    ('ES384'),
-    ('ES512'),
-    ('PS256'),
-    ('PS384'),
-    ('PS512'),
-    ('EdDSA')
-    ; 
-
- -- define the immutable fields for auth_oidc_signing_alg (all of them)
-create trigger 
-  immutable_columns
-before
-update on auth_oidc_signing_alg_enm
-  for each row execute procedure immutable_columns('name');
-`),
-			1084: []byte(`
--- auth_oidc_method entries are the current oidc auth methods configured for
--- existing scopes. 
-create table auth_oidc_method (
-  public_id wt_public_id
-    primary key,
-  scope_id wt_scope_id
-    not null,
-  name wt_name,
-  description wt_description, 
-  create_time wt_timestamp,
-  update_time wt_timestamp,
-  version wt_version,
-  state text not null
-    references auth_oidc_method_state_enm(name)
-    on delete restrict
-    on update cascade,
-  discovery_url wt_url not null, -- oidc discovery URL without any .well-known component
-  client_id text not null -- oidc client identifier issued by the oidc provider.
-    constraint client_id_not_empty
-    check(length(trim(client_id)) > 0), 
-  client_secret bytea not null, -- encrypted oidc client secret issued by the oidc provider.
-  key_id wt_private_id not null -- key used to encrypt entries via wrapping wrapper. 
-    references kms_oidc_key_version(private_id) 
-    on delete restrict
-    on update cascade, 
-  max_age int not null -- the allowable elapsed time in secs since the last time the user was authenticated. zero is allowed and should force the user to be re-authenticated.
-    constraint max_age_equal_or_greater_than_zero
-    check(max_age >= 0), 
-  foreign key (scope_id, public_id)
-      references auth_method (scope_id, public_id)
-      on delete cascade
-      on update cascade,
-  unique(scope_id, name),
-  unique(scope_id, public_id),
-  unique(scope_id, discovery_url, client_id) -- a client_id must be unique for a provider within a scope.
-);
-
--- auth_oidc_signing_alg entries are the signing algorithms allowed for an oidc
--- auth method.  There must be at least one allowed alg for each oidc auth method.
-create table auth_oidc_signing_alg (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  signing_alg_name text 
-    references auth_oidc_signing_alg_enm(name)
-    on delete restrict
-    on update cascade,
-  primary key(oidc_method_id, signing_alg_name)
-);
-
--- auth_oidc_callback_url entries are the callback URLs allowed for a specific
--- oidc auth method.  There must be at least one callback url for each oidc auth
--- method. 
-create table auth_oidc_callback_url (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  callback_url wt_url not null
-);
-
--- auth_oidc_aud_claim entries are the audience claims for a specific oidc auth
--- method.  There can be 0 or more for each parent oidc auth method.  If an auth
--- method has any aud claims, an ID token must contain one of them to be valid. 
-create table auth_oidc_aud_claim (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  aud_claim text not null
-    constraint aud_claim_must_not_be_empty
-    check(length(trim(aud_claim)) > 0) 
-    constraint aud_claim_must_be_less_than_1024_chars
-      check(length(trim(aud_claim)) < 1024),
-  primary key(oidc_method_id, aud_claim)
-);
-
--- auth_oidc_certificate entries are optional PEM encoded x509 certificates.
--- Each entry is a single certificate.  An oidc auth method may have 0 or more
--- of these optional x509s.  If an auth method has any cert entries, they are
--- used as trust anchors when connecting to the auth method's oidc provider
--- (instead of the host system's cert chain).
-create table auth_oidc_certificate (
-  oidc_method_id wt_public_id 
-    references auth_oidc_method(public_id)
-    on delete cascade
-    on update cascade,
-  certificate bytea not null,
-  primary key(oidc_method_id, certificate)
-);
-
-
-create table auth_oidc_account (
-    public_id wt_public_id
-      primary key,
-    auth_method_id wt_public_id
-      not null,
-    -- NOTE(mgaffney): The scope_id type is not wt_scope_id because the domain
-    -- check is executed before the insert trigger which retrieves the scope_id
-    -- causing an insert to fail.
-    scope_id text not null,
-    name wt_name,
-    description wt_description,
-    create_time wt_timestamp,
-    update_time wt_timestamp,
-    version wt_version,
-    issuer_id wt_url not null, -- case-sensitive URL that maps to an id_token's iss claim
-    subject_id text not null -- case-senstive string that maps to an id_token's sub claim
-      constraint subject_id_must_not_be_empty 
-      check (
-        length(trim(subject_id)) > 0
-      )
-      constraint subject_id_must_be_less_than_256_chars 
-      check(
-        length(trim(subject_id)) <= 255 -- length limit per OIDC spec
-      ),
-    full_name wt_full_name, -- may be null and maps to an id_token's name claim
-    email wt_email, -- may be null and maps to the id_token's email claim
-    foreign key (scope_id, auth_method_id)
-      references auth_oidc_method (scope_id, public_id)
-      on delete cascade
-      on update cascade,
-    foreign key (scope_id, auth_method_id, public_id)
-      references auth_account (scope_id, auth_method_id, public_id)
-      on delete cascade
-      on update cascade,
-    unique(auth_method_id, name),
-    unique(auth_method_id, issuer_id, subject_id), -- subject must be unique for a provider within specific auth method
-    unique(auth_method_id, public_id)
-);
-
--- auth_oidc_method column triggers
-create trigger
-  insert_auth_method_subtype
-before insert on auth_oidc_method
-  for each row execute procedure insert_auth_method_subtype();
-
-create trigger
-  update_time_column
-before
-update on auth_oidc_method
-  for each row execute procedure update_time_column();
-
-create trigger
-  immutable_columns
-before
-update on auth_oidc_method
-  for each row execute procedure immutable_columns('public_id', 'scope_id', 'create_time');
-
-create trigger
-  default_create_time_column
-before
-insert on auth_oidc_method
-  for each row execute procedure default_create_time();
-
-create trigger
-  update_version_column
-after update on auth_oidc_method
-  for each row execute procedure update_version_column();
-
--- auth_oidc_account column triggers
-create trigger
-  update_time_column
-before
-update on auth_oidc_account
-  for each row execute procedure update_time_column();
-
-create trigger
-  immutable_columns
-before
-update on auth_oidc_account
-  for each row execute procedure immutable_columns('public_id', 'auth_method_id', 'scope_id', 'create_time', 'issuer_id', 'subject_id');
-
-create trigger
-  default_create_time_column
-before
-insert on auth_oidc_account
-  for each row execute procedure default_create_time();
-
-create trigger
-  update_version_column
-after update on auth_oidc_account
-  for each row execute procedure update_version_column();
-
-create trigger
-  insert_auth_account_subtype
-before insert on auth_oidc_account
-  for each row execute procedure insert_auth_account_subtype();
-`),
-			1085: []byte(`
--- auth_token_status_enm entries define the possible auth token
--- states. 
-create table auth_token_status_enm (
-  name text primary key
-    constraint only_predefined_auth_token_states_allowed
-    check (
-        name in ('auth token pending','token issued', 'authentication failed', 'system error')
-    )
-);
-
--- populate the values of auth_token_status_enm
-insert into auth_token_status_enm(name)
-  values
-    ('auth token pending'),
-    ('token issued'),
-    ('authentication failed'),
-    ('system error'); 
-
-
--- add the state column with a default to the auth_token table.
-alter table auth_token
-add column status text 
-not null
-default 'token issued' -- safest default
-references auth_token_status_enm(name)
-  on update cascade
-  on delete restrict;
-`),
-			1086: []byte(`
--- add the account_info_auth_method_id which determines which auth_method is
--- designated as for "account info" in the user's scope.  
-alter table iam_scope
-add column account_info_auth_method_id wt_public_id  -- allowed to be null and is mutable of course.
-references auth_method(public_id)
-    on update cascade
-    on delete set null;
-
--- establish a compond fk, but there's no cascading of deletes or updates, since
--- we only want to cascade changes to the account_info_auth_method_id portion of
--- the compond fk and that is handled in a separate fk declaration.
-alter table iam_scope
-add foreign key (public_id, account_info_auth_method_id) references auth_method(scope_id, public_id); 
-
--- iam_user_acct_info provides account info for users by determining which
--- auth_method is designated as for "account info" in the user's scope via the
--- scope's account_info_auth_method_id.  Every sub-type of auth_account must be
--- added to this view's union.
-create view iam_acct_info as
-select 
-    aa.iam_user_id,
-    oa.subject_id as login_name,
-    oa.full_name as full_name,
-    oa.email as email
-from 	
-    iam_scope s,
-    auth_account aa,
-    auth_oidc_account oa
-where
-    aa.public_id = oa.public_id and 
-    aa.auth_method_id = s.account_info_auth_method_id 
-union 
-select 
-    aa.iam_user_id,
-    pa.login_name,
-    '' as full_name,
-    '' as email
-from 	
-    iam_scope s,
-    auth_account aa,
-    auth_password_account pa
-where
-    aa.public_id = pa.public_id and 
-    aa.auth_method_id = s.account_info_auth_method_id;
-
--- iam_user_acct_info provides a simple way to retrieve entries that include
--- both the iam_user fields with an outer join to the user's account info.
-create view iam_user_acct_info as
-select 
-    u.public_id,
-    u.scope_id,
-    u.name,
-    u.description, 
-    u.create_time,
-    u.update_time,
-    u.version,
-    i.login_name,
-    i.full_name,
-    i.email
-from 	
-	iam_user u
-left outer join iam_acct_info i on u.public_id = i.iam_user_id;
 `),
 		},
 	}