| 1 | -- Single sign-on, after review. See src/sso.rs. |
| 2 | |
| 3 | -- A SAML trip is bound to the browser that set off: the hash of a value |
| 4 | -- kept in a SameSite=None cookie, which the provider's cross-site POST |
| 5 | -- carries back (the session cookie, SameSite=Lax, does not). |
| 6 | ALTER TABLE sso_states ADD COLUMN browser TEXT; |
| 7 | |
| 8 | -- Every stable id the provider gave for the person (the subject first, |
| 9 | -- and Entra's object id), as a JSON array: SCIM finds them by any of |
| 10 | -- them, and a new app registration with another subject is still them. |
| 11 | ALTER TABLE sso_identities ADD COLUMN ids TEXT NOT NULL DEFAULT '[]'; |
| 12 | -- Their address, when the provider vouched for it. |
| 13 | ALTER TABLE sso_identities ADD COLUMN trusted_email TEXT; |
| 14 | |
| 15 | -- A person's links, for their tokens and keys on every request. |
| 16 | CREATE INDEX IF NOT EXISTS sso_identities_by_user ON sso_identities (user_id); |
| 17 | -- SCIM looks people up by externalId. |
| 18 | CREATE INDEX IF NOT EXISTS scim_users_by_external ON scim_users (workspace_id, external_id); |