gatehouse-api/migrations/versions/6a4c4ed4a5c6_initial_migration.py

"""Initial migration

Revision ID: 6a4c4ed4a5c6
Revises: None
Create Date: 2026-04-03 14:31:49.172415

"""
from alembic import op
import sqlalchemy as sa


# revision identifiers, used by Alembic.
revision = '6a4c4ed4a5c6'
down_revision = None
branch_labels = None
depends_on = None


def upgrade():
    # ### commands auto generated by Alembic - please adjust! ###
    op.create_table('application_provider_configs',
    sa.Column('provider_type', sa.String(length=50), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('client_secret_encrypted', sa.String(length=512), nullable=True),
    sa.Column('is_enabled', sa.Boolean(), nullable=False),
    sa.Column('default_redirect_url', sa.String(length=2048), nullable=True),
    sa.Column('additional_config', sa.JSON(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_application_provider_configs_provider_type'), 'application_provider_configs', ['provider_type'], unique=True)
    op.create_table('oidc_jwks_keys',
    sa.Column('id', sa.Integer(), nullable=False),
    sa.Column('expires_at', sa.DateTime(), nullable=True),
    sa.Column('kid', sa.String(length=255), nullable=False),
    sa.Column('key_type', sa.String(length=50), nullable=False),
    sa.Column('algorithm', sa.String(length=50), nullable=False),
    sa.Column('private_key', sa.Text(), nullable=False),
    sa.Column('public_key', sa.Text(), nullable=False),
    sa.Column('is_active', sa.Boolean(), nullable=False),
    sa.Column('is_primary', sa.Boolean(), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_jwks_keys_kid'), 'oidc_jwks_keys', ['kid'], unique=True)
    op.create_table('organizations',
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('slug', sa.String(length=255), nullable=False),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('logo_url', sa.String(length=512), nullable=True),
    sa.Column('is_active', sa.Boolean(), nullable=False),
    sa.Column('settings', sa.JSON(), nullable=True),
    sa.Column('zt_api_token', sa.String(length=512), nullable=True),
    sa.Column('zt_api_url', sa.String(length=512), nullable=True),
    sa.Column('zt_api_mode', sa.String(length=32), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_organizations_slug'), 'organizations', ['slug'], unique=True)
    op.create_table('users',
    sa.Column('email', sa.String(length=255), nullable=False),
    sa.Column('email_verified', sa.Boolean(), nullable=False),
    sa.Column('full_name', sa.String(length=255), nullable=True),
    sa.Column('avatar_url', sa.String(length=512), nullable=True),
    sa.Column('status', sa.Enum('ACTIVE', 'INACTIVE', 'SUSPENDED', 'PENDING', 'COMPLIANCE_SUSPENDED', name='userstatus'), nullable=False),
    sa.Column('last_login_at', sa.DateTime(), nullable=True),
    sa.Column('last_login_ip', sa.String(length=45), nullable=True),
    sa.Column('activated', sa.Boolean(), nullable=False),
    sa.Column('activation_key', sa.String(length=128), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_users_activation_key'), 'users', ['activation_key'], unique=True)
    op.create_index(op.f('ix_users_email'), 'users', ['email'], unique=True)
    op.create_index(op.f('ix_users_status'), 'users', ['status'], unique=False)
    op.create_table('audit_logs',
    sa.Column('user_id', sa.String(length=36), nullable=True),
    sa.Column('action', sa.String(length=100), nullable=False),
    sa.Column('resource_type', sa.String(length=50), nullable=True),
    sa.Column('resource_id', sa.String(length=36), nullable=True),
    sa.Column('organization_id', sa.String(length=36), nullable=True),
    sa.Column('ip_address', sa.String(length=45), nullable=True),
    sa.Column('user_agent', sa.Text(), nullable=True),
    sa.Column('request_id', sa.String(length=36), nullable=True),
    sa.Column('extra_data', sa.JSON(), nullable=True),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('success', sa.Boolean(), nullable=False),
    sa.Column('error_message', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index('idx_audit_org', 'audit_logs', ['organization_id', 'created_at'], unique=False)
    op.create_index('idx_audit_resource', 'audit_logs', ['resource_type', 'resource_id'], unique=False)
    op.create_index('idx_audit_user_action', 'audit_logs', ['user_id', 'action'], unique=False)
    op.create_index(op.f('ix_audit_logs_action'), 'audit_logs', ['action'], unique=False)
    op.create_index(op.f('ix_audit_logs_organization_id'), 'audit_logs', ['organization_id'], unique=False)
    op.create_index(op.f('ix_audit_logs_request_id'), 'audit_logs', ['request_id'], unique=False)
    op.create_index(op.f('ix_audit_logs_resource_id'), 'audit_logs', ['resource_id'], unique=False)
    op.create_index(op.f('ix_audit_logs_resource_type'), 'audit_logs', ['resource_type'], unique=False)
    op.create_index(op.f('ix_audit_logs_user_id'), 'audit_logs', ['user_id'], unique=False)
    op.create_table('authentication_methods',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('method_type', sa.Enum('PASSWORD', 'TOTP', 'GOOGLE', 'GITHUB', 'MICROSOFT', 'SAML', 'OIDC', 'WEBAUTHN', name='authmethodtype'), nullable=False),
    sa.Column('password_hash', sa.String(length=255), nullable=True),
    sa.Column('provider_user_id', sa.String(length=255), nullable=True),
    sa.Column('provider_data', sa.JSON(), nullable=True),
    sa.Column('totp_secret', sa.String(length=32), nullable=True),
    sa.Column('totp_backup_codes', sa.JSON(), nullable=True),
    sa.Column('totp_verified_at', sa.DateTime(), nullable=True),
    sa.Column('is_primary', sa.Boolean(), nullable=False),
    sa.Column('verified', sa.Boolean(), nullable=False),
    sa.Column('last_used_at', sa.DateTime(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'method_type', 'provider_user_id', name='uix_user_method_provider')
    )
    op.create_index('idx_user_method', 'authentication_methods', ['user_id', 'method_type'], unique=False)
    op.create_index(op.f('ix_authentication_methods_method_type'), 'authentication_methods', ['method_type'], unique=False)
    op.create_index(op.f('ix_authentication_methods_user_id'), 'authentication_methods', ['user_id'], unique=False)
    op.create_table('cas',
    sa.Column('organization_id', sa.String(length=36), nullable=True),
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('ca_type', sa.Enum('user', 'host', name='catype'), nullable=False),
    sa.Column('key_type', sa.Enum('ed25519', 'rsa', 'ecdsa', name='keytype'), nullable=False),
    sa.Column('private_key', sa.Text(), nullable=False),
    sa.Column('public_key', sa.Text(), nullable=False),
    sa.Column('fingerprint', sa.String(length=255), nullable=False),
    sa.Column('crl_enabled', sa.Boolean(), nullable=False),
    sa.Column('crl_endpoint', sa.String(length=512), nullable=True),
    sa.Column('default_cert_validity_hours', sa.Integer(), nullable=False),
    sa.Column('max_cert_validity_hours', sa.Integer(), nullable=False),
    sa.Column('is_active', sa.Boolean(), nullable=False),
    sa.Column('rotated_at', sa.DateTime(), nullable=True),
    sa.Column('rotation_reason', sa.String(length=255), nullable=True),
    sa.Column('next_serial_number', sa.BigInteger(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('fingerprint'),
    sa.UniqueConstraint('organization_id', 'name', name='uix_org_ca_name')
    )
    op.create_index('idx_ca_org_active', 'cas', ['organization_id', 'is_active'], unique=False)
    op.create_index(op.f('ix_cas_is_active'), 'cas', ['is_active'], unique=False)
    op.create_index(op.f('ix_cas_organization_id'), 'cas', ['organization_id'], unique=False)
    op.create_table('departments',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('can_sudo', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('organization_id', 'name', name='uix_org_dept_name')
    )
    op.create_index(op.f('ix_departments_name'), 'departments', ['name'], unique=False)
    op.create_index(op.f('ix_departments_organization_id'), 'departments', ['organization_id'], unique=False)
    op.create_table('devices',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('node_id', sa.String(length=10), nullable=False),
    sa.Column('device_nickname', sa.String(length=255), nullable=True),
    sa.Column('hostname', sa.String(length=255), nullable=True),
    sa.Column('asset_tag', sa.String(length=255), nullable=True),
    sa.Column('serial_number', sa.String(length=255), nullable=True),
    sa.Column('status', sa.Enum('active', 'inactive', name='device_status'), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_devices_node_id'), 'devices', ['node_id'], unique=False)
    op.create_index(op.f('ix_devices_organization_id'), 'devices', ['organization_id'], unique=False)
    op.create_index(op.f('ix_devices_user_id'), 'devices', ['user_id'], unique=False)
    op.create_table('email_verification_tokens',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('token', sa.String(length=128), nullable=False),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('used_at', sa.DateTime(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_email_verification_tokens_token'), 'email_verification_tokens', ['token'], unique=True)
    op.create_index(op.f('ix_email_verification_tokens_user_id'), 'email_verification_tokens', ['user_id'], unique=False)
    op.create_table('external_provider_configs',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('provider_type', sa.String(length=50), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('client_secret_encrypted', sa.String(length=512), nullable=True),
    sa.Column('auth_url', sa.String(length=2048), nullable=False),
    sa.Column('token_url', sa.String(length=2048), nullable=False),
    sa.Column('userinfo_url', sa.String(length=2048), nullable=True),
    sa.Column('jwks_url', sa.String(length=2048), nullable=True),
    sa.Column('scopes', sa.JSON(), nullable=False),
    sa.Column('redirect_uris', sa.JSON(), nullable=False),
    sa.Column('settings', sa.JSON(), nullable=True),
    sa.Column('is_active', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('organization_id', 'provider_type', name='uix_org_provider_type')
    )
    op.create_index('idx_provider_config_org', 'external_provider_configs', ['organization_id', 'provider_type'], unique=False)
    op.create_index(op.f('ix_external_provider_configs_organization_id'), 'external_provider_configs', ['organization_id'], unique=False)
    op.create_index(op.f('ix_external_provider_configs_provider_type'), 'external_provider_configs', ['provider_type'], unique=False)
    op.create_table('kill_switch_events',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('target_user_id', sa.String(length=36), nullable=False),
    sa.Column('scope', sa.Enum('organization', 'selected_networks', name='kill_switch_scope'), nullable=False),
    sa.Column('triggered_by_user_id', sa.String(length=36), nullable=False),
    sa.Column('reason', sa.Text(), nullable=True),
    sa.Column('network_ids', sa.JSON(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['target_user_id'], ['users.id'], ),
    sa.ForeignKeyConstraint(['triggered_by_user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_kill_switch_events_organization_id'), 'kill_switch_events', ['organization_id'], unique=False)
    op.create_index(op.f('ix_kill_switch_events_target_user_id'), 'kill_switch_events', ['target_user_id'], unique=False)
    op.create_table('mfa_policy_compliance',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('status', sa.Enum('NOT_APPLICABLE', 'PENDING', 'IN_GRACE', 'COMPLIANT', 'PAST_DUE', 'SUSPENDED', name='mfacompliancestatus'), nullable=False),
    sa.Column('policy_version', sa.Integer(), nullable=False),
    sa.Column('applied_at', sa.DateTime(), nullable=True),
    sa.Column('deadline_at', sa.DateTime(), nullable=True),
    sa.Column('compliant_at', sa.DateTime(), nullable=True),
    sa.Column('suspended_at', sa.DateTime(), nullable=True),
    sa.Column('last_notified_at', sa.DateTime(), nullable=True),
    sa.Column('notification_count', sa.Integer(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'organization_id', name='uix_user_org_compliance')
    )
    op.create_index(op.f('ix_mfa_policy_compliance_organization_id'), 'mfa_policy_compliance', ['organization_id'], unique=False)
    op.create_index(op.f('ix_mfa_policy_compliance_user_id'), 'mfa_policy_compliance', ['user_id'], unique=False)
    op.create_table('oauth_states',
    sa.Column('state', sa.String(length=64), nullable=False),
    sa.Column('flow_type', sa.String(length=50), nullable=False),
    sa.Column('provider_type', sa.String(length=50), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=True),
    sa.Column('organization_id', sa.String(length=36), nullable=True),
    sa.Column('nonce', sa.String(length=128), nullable=True),
    sa.Column('code_verifier', sa.String(length=128), nullable=True),
    sa.Column('code_challenge', sa.String(length=128), nullable=True),
    sa.Column('redirect_uri', sa.String(length=2048), nullable=True),
    sa.Column('return_url', sa.String(length=2048), nullable=True),
    sa.Column('extra_data', sa.JSON(), nullable=True),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('used', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oauth_states_expires_at'), 'oauth_states', ['expires_at'], unique=False)
    op.create_index(op.f('ix_oauth_states_organization_id'), 'oauth_states', ['organization_id'], unique=False)
    op.create_index(op.f('ix_oauth_states_state'), 'oauth_states', ['state'], unique=True)
    op.create_table('oidc_clients',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('client_secret_hash', sa.String(length=255), nullable=False),
    sa.Column('redirect_uris', sa.JSON(), nullable=False),
    sa.Column('grant_types', sa.JSON(), nullable=False),
    sa.Column('response_types', sa.JSON(), nullable=False),
    sa.Column('scopes', sa.JSON(), nullable=False),
    sa.Column('logo_uri', sa.String(length=512), nullable=True),
    sa.Column('client_uri', sa.String(length=512), nullable=True),
    sa.Column('policy_uri', sa.String(length=512), nullable=True),
    sa.Column('tos_uri', sa.String(length=512), nullable=True),
    sa.Column('is_active', sa.Boolean(), nullable=False),
    sa.Column('is_confidential', sa.Boolean(), nullable=False),
    sa.Column('require_pkce', sa.Boolean(), nullable=False),
    sa.Column('access_token_lifetime', sa.Integer(), nullable=False),
    sa.Column('refresh_token_lifetime', sa.Integer(), nullable=False),
    sa.Column('id_token_lifetime', sa.Integer(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_clients_client_id'), 'oidc_clients', ['client_id'], unique=True)
    op.create_index(op.f('ix_oidc_clients_organization_id'), 'oidc_clients', ['organization_id'], unique=False)
    op.create_table('org_invite_tokens',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('invited_by_id', sa.String(length=36), nullable=True),
    sa.Column('email', sa.String(length=255), nullable=False),
    sa.Column('role', sa.String(length=64), nullable=False),
    sa.Column('token', sa.String(length=128), nullable=False),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('accepted_at', sa.DateTime(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['invited_by_id'], ['users.id'], ondelete='SET NULL'),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ondelete='CASCADE'),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_org_invite_tokens_email'), 'org_invite_tokens', ['email'], unique=False)
    op.create_index(op.f('ix_org_invite_tokens_organization_id'), 'org_invite_tokens', ['organization_id'], unique=False)
    op.create_index(op.f('ix_org_invite_tokens_token'), 'org_invite_tokens', ['token'], unique=True)
    op.create_table('organization_api_keys',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('key_hash', sa.String(length=255), nullable=False),
    sa.Column('last_used_at', sa.DateTime(), nullable=True),
    sa.Column('is_revoked', sa.Boolean(), nullable=False),
    sa.Column('revoked_at', sa.DateTime(), nullable=True),
    sa.Column('revoke_reason', sa.String(length=255), nullable=True),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index('idx_api_key_last_used', 'organization_api_keys', ['last_used_at'], unique=False)
    op.create_index('idx_org_api_key_org_active', 'organization_api_keys', ['organization_id', 'is_revoked'], unique=False)
    op.create_index(op.f('ix_organization_api_keys_is_revoked'), 'organization_api_keys', ['is_revoked'], unique=False)
    op.create_index(op.f('ix_organization_api_keys_key_hash'), 'organization_api_keys', ['key_hash'], unique=True)
    op.create_index(op.f('ix_organization_api_keys_organization_id'), 'organization_api_keys', ['organization_id'], unique=False)
    op.create_table('organization_members',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('role', sa.Enum('OWNER', 'ADMIN', 'MEMBER', 'GUEST', name='organizationrole'), nullable=False),
    sa.Column('invited_by_id', sa.String(length=36), nullable=True),
    sa.Column('invited_at', sa.DateTime(), nullable=True),
    sa.Column('joined_at', sa.DateTime(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['invited_by_id'], ['users.id'], ),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'organization_id', name='uix_user_org')
    )
    op.create_index(op.f('ix_organization_members_organization_id'), 'organization_members', ['organization_id'], unique=False)
    op.create_index(op.f('ix_organization_members_user_id'), 'organization_members', ['user_id'], unique=False)
    op.create_table('organization_provider_overrides',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('provider_type', sa.String(length=50), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=True),
    sa.Column('client_secret_encrypted', sa.String(length=512), nullable=True),
    sa.Column('is_enabled', sa.Boolean(), nullable=False),
    sa.Column('redirect_url_override', sa.String(length=2048), nullable=True),
    sa.Column('additional_config', sa.JSON(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('organization_id', 'provider_type', name='uix_org_provider_override_type')
    )
    op.create_index(op.f('ix_organization_provider_overrides_organization_id'), 'organization_provider_overrides', ['organization_id'], unique=False)
    op.create_index(op.f('ix_organization_provider_overrides_provider_type'), 'organization_provider_overrides', ['provider_type'], unique=False)
    op.create_table('organization_security_policies',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('mfa_policy_mode', sa.Enum('DISABLED', 'OPTIONAL', 'REQUIRE_TOTP', 'REQUIRE_WEBAUTHN', 'REQUIRE_TOTP_OR_WEBAUTHN', name='mfapolicymode'), nullable=False),
    sa.Column('mfa_grace_period_days', sa.Integer(), nullable=False),
    sa.Column('notify_days_before', sa.Integer(), nullable=False),
    sa.Column('policy_version', sa.Integer(), nullable=False),
    sa.Column('updated_by_user_id', sa.String(length=36), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['updated_by_user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_organization_security_policies_organization_id'), 'organization_security_policies', ['organization_id'], unique=True)
    op.create_table('password_reset_tokens',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('token', sa.String(length=128), nullable=False),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('used_at', sa.DateTime(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_password_reset_tokens_token'), 'password_reset_tokens', ['token'], unique=True)
    op.create_index(op.f('ix_password_reset_tokens_user_id'), 'password_reset_tokens', ['user_id'], unique=False)
    op.create_table('portal_networks',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('owner_user_id', sa.String(length=36), nullable=False),
    sa.Column('zerotier_network_id', sa.String(length=16), nullable=False),
    sa.Column('environment', sa.Enum('production', 'staging', 'development', 'lab', name='network_environment'), nullable=False),
    sa.Column('request_mode', sa.Enum('open', 'approval_required', 'invite_only', name='network_request_mode'), nullable=False),
    sa.Column('default_activation_lifetime_minutes', sa.Integer(), nullable=False),
    sa.Column('max_activation_lifetime_minutes', sa.Integer(), nullable=True),
    sa.Column('is_active', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['owner_user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('organization_id', 'zerotier_network_id', name='uix_org_zt_network_id')
    )
    op.create_index(op.f('ix_portal_networks_organization_id'), 'portal_networks', ['organization_id'], unique=False)
    op.create_index(op.f('ix_portal_networks_zerotier_network_id'), 'portal_networks', ['zerotier_network_id'], unique=False)
    op.create_table('principals',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('name', sa.String(length=255), nullable=False),
    sa.Column('description', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('organization_id', 'name', name='uix_org_principal_name')
    )
    op.create_index(op.f('ix_principals_name'), 'principals', ['name'], unique=False)
    op.create_index(op.f('ix_principals_organization_id'), 'principals', ['organization_id'], unique=False)
    op.create_table('sessions',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('token', sa.String(length=255), nullable=False),
    sa.Column('status', sa.Enum('ACTIVE', 'EXPIRED', 'REVOKED', name='sessionstatus'), nullable=False),
    sa.Column('ip_address', sa.String(length=45), nullable=True),
    sa.Column('user_agent', sa.Text(), nullable=True),
    sa.Column('device_info', sa.JSON(), nullable=True),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('last_activity_at', sa.DateTime(), nullable=False),
    sa.Column('revoked_at', sa.DateTime(), nullable=True),
    sa.Column('revoked_reason', sa.String(length=255), nullable=True),
    sa.Column('is_compliance_only', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_sessions_token'), 'sessions', ['token'], unique=True)
    op.create_index(op.f('ix_sessions_user_id'), 'sessions', ['user_id'], unique=False)
    op.create_table('ssh_keys',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('payload', sa.Text(), nullable=False),
    sa.Column('fingerprint', sa.String(length=255), nullable=False),
    sa.Column('description', sa.String(length=255), nullable=True),
    sa.Column('verified', sa.Boolean(), nullable=False),
    sa.Column('verified_at', sa.DateTime(), nullable=True),
    sa.Column('verify_text', sa.String(length=255), nullable=True),
    sa.Column('verify_text_created_at', sa.DateTime(), nullable=True),
    sa.Column('key_type', sa.String(length=50), nullable=True),
    sa.Column('key_bits', sa.Integer(), nullable=True),
    sa.Column('key_comment', sa.String(length=255), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('payload')
    )
    op.create_index('idx_ssh_key_user_verified', 'ssh_keys', ['user_id', 'verified'], unique=False)
    op.create_index(op.f('ix_ssh_keys_fingerprint'), 'ssh_keys', ['fingerprint'], unique=True)
    op.create_index(op.f('ix_ssh_keys_user_id'), 'ssh_keys', ['user_id'], unique=False)
    op.create_index(op.f('ix_ssh_keys_verified'), 'ssh_keys', ['verified'], unique=False)
    op.create_table('user_security_policies',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('mfa_override_mode', sa.Enum('INHERIT', 'REQUIRED', 'EXEMPT', name='mfarequirementoverride'), nullable=False),
    sa.Column('force_totp', sa.Boolean(), nullable=False),
    sa.Column('force_webauthn', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'organization_id', name='uix_user_org_policy')
    )
    op.create_index(op.f('ix_user_security_policies_organization_id'), 'user_security_policies', ['organization_id'], unique=False)
    op.create_index(op.f('ix_user_security_policies_user_id'), 'user_security_policies', ['user_id'], unique=False)
    op.create_table('ca_permissions',
    sa.Column('ca_id', sa.String(length=36), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('permission', sa.String(length=50), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['ca_id'], ['cas.id'], ondelete='CASCADE'),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ondelete='CASCADE'),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('ca_id', 'user_id', name='uix_ca_permission')
    )
    op.create_index(op.f('ix_ca_permissions_ca_id'), 'ca_permissions', ['ca_id'], unique=False)
    op.create_index(op.f('ix_ca_permissions_user_id'), 'ca_permissions', ['user_id'], unique=False)
    op.create_table('department_cert_policies',
    sa.Column('department_id', sa.String(length=36), nullable=False),
    sa.Column('allow_user_expiry', sa.Boolean(), nullable=False),
    sa.Column('default_expiry_hours', sa.Integer(), nullable=False),
    sa.Column('max_expiry_hours', sa.Integer(), nullable=False),
    sa.Column('allowed_extensions', sa.JSON(), nullable=False),
    sa.Column('custom_extensions', sa.JSON(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['department_id'], ['departments.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_department_cert_policies_department_id'), 'department_cert_policies', ['department_id'], unique=True)
    op.create_table('department_memberships',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('department_id', sa.String(length=36), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['department_id'], ['departments.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'department_id', name='uix_user_dept')
    )
    op.create_index(op.f('ix_department_memberships_department_id'), 'department_memberships', ['department_id'], unique=False)
    op.create_index(op.f('ix_department_memberships_user_id'), 'department_memberships', ['user_id'], unique=False)
    op.create_table('department_principals',
    sa.Column('department_id', sa.String(length=36), nullable=False),
    sa.Column('principal_id', sa.String(length=36), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['department_id'], ['departments.id'], ),
    sa.ForeignKeyConstraint(['principal_id'], ['principals.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('department_id', 'principal_id', name='uix_dept_principal')
    )
    op.create_index(op.f('ix_department_principals_department_id'), 'department_principals', ['department_id'], unique=False)
    op.create_index(op.f('ix_department_principals_principal_id'), 'department_principals', ['principal_id'], unique=False)
    op.create_table('oidc_audit_logs',
    sa.Column('event_type', sa.String(length=100), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=True),
    sa.Column('user_id', sa.String(length=36), nullable=True),
    sa.Column('success', sa.Boolean(), nullable=False),
    sa.Column('error_code', sa.String(length=100), nullable=True),
    sa.Column('error_description', sa.Text(), nullable=True),
    sa.Column('ip_address', sa.String(length=45), nullable=True),
    sa.Column('user_agent', sa.Text(), nullable=True),
    sa.Column('request_id', sa.String(length=36), nullable=True),
    sa.Column('event_metadata', sa.JSON(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['client_id'], ['oidc_clients.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_audit_logs_client_id'), 'oidc_audit_logs', ['client_id'], unique=False)
    op.create_index(op.f('ix_oidc_audit_logs_event_type'), 'oidc_audit_logs', ['event_type'], unique=False)
    op.create_index(op.f('ix_oidc_audit_logs_ip_address'), 'oidc_audit_logs', ['ip_address'], unique=False)
    op.create_index(op.f('ix_oidc_audit_logs_request_id'), 'oidc_audit_logs', ['request_id'], unique=False)
    op.create_index(op.f('ix_oidc_audit_logs_success'), 'oidc_audit_logs', ['success'], unique=False)
    op.create_index(op.f('ix_oidc_audit_logs_user_id'), 'oidc_audit_logs', ['user_id'], unique=False)
    op.create_table('oidc_authorization_codes',
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('code_hash', sa.String(length=255), nullable=False),
    sa.Column('redirect_uri', sa.String(length=512), nullable=False),
    sa.Column('scope', sa.JSON(), nullable=True),
    sa.Column('nonce', sa.String(length=255), nullable=True),
    sa.Column('code_verifier', sa.String(length=255), nullable=True),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('used_at', sa.DateTime(), nullable=True),
    sa.Column('is_used', sa.Boolean(), nullable=False),
    sa.Column('ip_address', sa.String(length=45), nullable=True),
    sa.Column('user_agent', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['client_id'], ['oidc_clients.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_authorization_codes_client_id'), 'oidc_authorization_codes', ['client_id'], unique=False)
    op.create_index(op.f('ix_oidc_authorization_codes_expires_at'), 'oidc_authorization_codes', ['expires_at'], unique=False)
    op.create_index(op.f('ix_oidc_authorization_codes_user_id'), 'oidc_authorization_codes', ['user_id'], unique=False)
    op.create_table('oidc_refresh_tokens',
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('token_hash', sa.String(length=255), nullable=False),
    sa.Column('access_token_id', sa.String(length=255), nullable=True),
    sa.Column('scope', sa.JSON(), nullable=True),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('revoked_at', sa.DateTime(), nullable=True),
    sa.Column('revoked_reason', sa.String(length=255), nullable=True),
    sa.Column('previous_token_hash', sa.String(length=255), nullable=True),
    sa.Column('rotation_count', sa.Integer(), nullable=False),
    sa.Column('ip_address', sa.String(length=45), nullable=True),
    sa.Column('user_agent', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['client_id'], ['oidc_clients.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_refresh_tokens_access_token_id'), 'oidc_refresh_tokens', ['access_token_id'], unique=False)
    op.create_index(op.f('ix_oidc_refresh_tokens_client_id'), 'oidc_refresh_tokens', ['client_id'], unique=False)
    op.create_index(op.f('ix_oidc_refresh_tokens_expires_at'), 'oidc_refresh_tokens', ['expires_at'], unique=False)
    op.create_index(op.f('ix_oidc_refresh_tokens_token_hash'), 'oidc_refresh_tokens', ['token_hash'], unique=True)
    op.create_index(op.f('ix_oidc_refresh_tokens_user_id'), 'oidc_refresh_tokens', ['user_id'], unique=False)
    op.create_table('oidc_sessions',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('state', sa.String(length=255), nullable=False),
    sa.Column('nonce', sa.String(length=255), nullable=True),
    sa.Column('redirect_uri', sa.String(length=512), nullable=False),
    sa.Column('scope', sa.JSON(), nullable=True),
    sa.Column('code_challenge', sa.String(length=255), nullable=True),
    sa.Column('code_challenge_method', sa.String(length=10), nullable=True),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('authenticated_at', sa.DateTime(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['client_id'], ['oidc_clients.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_sessions_client_id'), 'oidc_sessions', ['client_id'], unique=False)
    op.create_index(op.f('ix_oidc_sessions_expires_at'), 'oidc_sessions', ['expires_at'], unique=False)
    op.create_index(op.f('ix_oidc_sessions_state'), 'oidc_sessions', ['state'], unique=False)
    op.create_index(op.f('ix_oidc_sessions_user_id'), 'oidc_sessions', ['user_id'], unique=False)
    op.create_table('oidc_token_metadata',
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('client_id', sa.String(length=255), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('token_type', sa.String(length=50), nullable=False),
    sa.Column('token_jti', sa.String(length=255), nullable=False),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('revoked_at', sa.DateTime(), nullable=True),
    sa.Column('revoked_reason', sa.String(length=255), nullable=True),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['client_id'], ['oidc_clients.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_oidc_token_metadata_client_id'), 'oidc_token_metadata', ['client_id'], unique=False)
    op.create_index(op.f('ix_oidc_token_metadata_expires_at'), 'oidc_token_metadata', ['expires_at'], unique=False)
    op.create_index(op.f('ix_oidc_token_metadata_token_jti'), 'oidc_token_metadata', ['token_jti'], unique=False)
    op.create_index(op.f('ix_oidc_token_metadata_user_id'), 'oidc_token_metadata', ['user_id'], unique=False)
    op.create_table('principal_memberships',
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('principal_id', sa.String(length=36), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['principal_id'], ['principals.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'principal_id', name='uix_user_principal')
    )
    op.create_index(op.f('ix_principal_memberships_principal_id'), 'principal_memberships', ['principal_id'], unique=False)
    op.create_index(op.f('ix_principal_memberships_user_id'), 'principal_memberships', ['user_id'], unique=False)
    op.create_table('ssh_certificates',
    sa.Column('ca_id', sa.String(length=36), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('ssh_key_id', sa.String(length=36), nullable=True),
    sa.Column('certificate', sa.Text(), nullable=False),
    sa.Column('serial', sa.String(length=255), nullable=False),
    sa.Column('key_id', sa.String(length=255), nullable=False),
    sa.Column('cert_type', sa.Enum('user', 'host', name='certtype'), nullable=False),
    sa.Column('principals', sa.JSON(), nullable=False),
    sa.Column('valid_after', sa.DateTime(), nullable=False),
    sa.Column('valid_before', sa.DateTime(), nullable=False),
    sa.Column('revoked', sa.Boolean(), nullable=False),
    sa.Column('revoked_at', sa.DateTime(), nullable=True),
    sa.Column('revoke_reason', sa.String(length=255), nullable=True),
    sa.Column('status', sa.Enum('requested', 'issued', 'revoked', 'expired', 'superseded', name='certificatestatus'), nullable=False),
    sa.Column('request_ip', sa.String(length=45), nullable=True),
    sa.Column('request_user_agent', sa.String(length=512), nullable=True),
    sa.Column('critical_options', sa.JSON(), nullable=True),
    sa.Column('extensions', sa.JSON(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['ca_id'], ['cas.id'], ),
    sa.ForeignKeyConstraint(['ssh_key_id'], ['ssh_keys.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('ca_id', 'serial', name='uq_ssh_certificates_ca_serial')
    )
    op.create_index('idx_cert_revoked', 'ssh_certificates', ['revoked', 'revoked_at'], unique=False)
    op.create_index('idx_cert_user_status', 'ssh_certificates', ['user_id', 'status'], unique=False)
    op.create_index('idx_cert_validity', 'ssh_certificates', ['valid_after', 'valid_before'], unique=False)
    op.create_index(op.f('ix_ssh_certificates_ca_id'), 'ssh_certificates', ['ca_id'], unique=False)
    op.create_index(op.f('ix_ssh_certificates_revoked'), 'ssh_certificates', ['revoked'], unique=False)
    op.create_index('ix_ssh_certificates_serial', 'ssh_certificates', ['serial'], unique=False)
    op.create_index(op.f('ix_ssh_certificates_ssh_key_id'), 'ssh_certificates', ['ssh_key_id'], unique=False)
    op.create_index(op.f('ix_ssh_certificates_status'), 'ssh_certificates', ['status'], unique=False)
    op.create_index(op.f('ix_ssh_certificates_user_id'), 'ssh_certificates', ['user_id'], unique=False)
    op.create_table('user_network_approvals',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('portal_network_id', sa.String(length=36), nullable=False),
    sa.Column('granted_by_user_id', sa.String(length=36), nullable=True),
    sa.Column('grant_type', sa.Enum('requested', 'assigned', name='approval_grant_type'), nullable=False),
    sa.Column('state', sa.Enum('pending', 'approved', 'rejected', 'revoked', 'suspended', name='approval_state'), nullable=False),
    sa.Column('justification', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['granted_by_user_id'], ['users.id'], ),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['portal_network_id'], ['portal_networks.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('user_id', 'portal_network_id', 'deleted_at', name='uix_user_network_approval')
    )
    op.create_index(op.f('ix_user_network_approvals_organization_id'), 'user_network_approvals', ['organization_id'], unique=False)
    op.create_index(op.f('ix_user_network_approvals_portal_network_id'), 'user_network_approvals', ['portal_network_id'], unique=False)
    op.create_index(op.f('ix_user_network_approvals_state'), 'user_network_approvals', ['state'], unique=False)
    op.create_index(op.f('ix_user_network_approvals_user_id'), 'user_network_approvals', ['user_id'], unique=False)
    op.create_table('certificate_audit_logs',
    sa.Column('certificate_id', sa.String(length=36), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=True),
    sa.Column('action', sa.String(length=50), nullable=False),
    sa.Column('ip_address', sa.String(length=45), nullable=True),
    sa.Column('user_agent', sa.String(length=512), nullable=True),
    sa.Column('request_id', sa.String(length=36), nullable=True),
    sa.Column('message', sa.Text(), nullable=True),
    sa.Column('extra_data', sa.JSON(), nullable=True),
    sa.Column('success', sa.Boolean(), nullable=False),
    sa.Column('error_message', sa.Text(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['certificate_id'], ['ssh_certificates.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index('idx_cert_audit_cert_action', 'certificate_audit_logs', ['certificate_id', 'action'], unique=False)
    op.create_index('idx_cert_audit_user', 'certificate_audit_logs', ['user_id', 'created_at'], unique=False)
    op.create_index(op.f('ix_certificate_audit_logs_action'), 'certificate_audit_logs', ['action'], unique=False)
    op.create_index(op.f('ix_certificate_audit_logs_certificate_id'), 'certificate_audit_logs', ['certificate_id'], unique=False)
    op.create_index(op.f('ix_certificate_audit_logs_user_id'), 'certificate_audit_logs', ['user_id'], unique=False)
    op.create_table('device_network_memberships',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('device_id', sa.String(length=36), nullable=False),
    sa.Column('portal_network_id', sa.String(length=36), nullable=False),
    sa.Column('user_network_approval_id', sa.String(length=36), nullable=True),
    sa.Column('state', sa.Enum('pending_device_registration', 'pending_request', 'pending_manager_approval', 'approved_inactive', 'joined_deauthorized', 'active_authorized', 'activation_expired', 'suspended', 'revoked', 'rejected', name='membership_state'), nullable=False),
    sa.Column('join_seen', sa.Boolean(), nullable=False),
    sa.Column('currently_authorized', sa.Boolean(), nullable=False),
    sa.Column('approved_for_activation', sa.Boolean(), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['device_id'], ['devices.id'], ),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['portal_network_id'], ['portal_networks.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.ForeignKeyConstraint(['user_network_approval_id'], ['user_network_approvals.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('device_id', 'portal_network_id', 'deleted_at', name='uix_device_network')
    )
    op.create_index(op.f('ix_device_network_memberships_device_id'), 'device_network_memberships', ['device_id'], unique=False)
    op.create_index(op.f('ix_device_network_memberships_organization_id'), 'device_network_memberships', ['organization_id'], unique=False)
    op.create_index(op.f('ix_device_network_memberships_portal_network_id'), 'device_network_memberships', ['portal_network_id'], unique=False)
    op.create_index(op.f('ix_device_network_memberships_state'), 'device_network_memberships', ['state'], unique=False)
    op.create_index(op.f('ix_device_network_memberships_user_id'), 'device_network_memberships', ['user_id'], unique=False)
    op.create_index(op.f('ix_device_network_memberships_user_network_approval_id'), 'device_network_memberships', ['user_network_approval_id'], unique=False)
    op.create_table('activation_sessions',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('user_id', sa.String(length=36), nullable=False),
    sa.Column('device_network_membership_id', sa.String(length=36), nullable=False),
    sa.Column('authenticated_at', sa.DateTime(), nullable=False),
    sa.Column('expires_at', sa.DateTime(), nullable=False),
    sa.Column('ended_at', sa.DateTime(), nullable=True),
    sa.Column('end_reason', sa.Enum('expired', 'logout', 'kill_switch', 'manual_revoke', 'approval_revoked', 'admin_action', name='activation_end_reason'), nullable=True),
    sa.Column('created_by', sa.String(length=36), nullable=False),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['created_by'], ['users.id'], ),
    sa.ForeignKeyConstraint(['device_network_membership_id'], ['device_network_memberships.id'], ),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.ForeignKeyConstraint(['user_id'], ['users.id'], ),
    sa.PrimaryKeyConstraint('id')
    )
    op.create_index(op.f('ix_activation_sessions_device_network_membership_id'), 'activation_sessions', ['device_network_membership_id'], unique=False)
    op.create_index(op.f('ix_activation_sessions_organization_id'), 'activation_sessions', ['organization_id'], unique=False)
    op.create_index(op.f('ix_activation_sessions_user_id'), 'activation_sessions', ['user_id'], unique=False)
    op.create_table('zerotier_memberships',
    sa.Column('organization_id', sa.String(length=36), nullable=False),
    sa.Column('device_network_membership_id', sa.String(length=36), nullable=True),
    sa.Column('zerotier_network_id', sa.String(length=16), nullable=False),
    sa.Column('node_id', sa.String(length=10), nullable=False),
    sa.Column('member_seen', sa.Boolean(), nullable=False),
    sa.Column('authorized', sa.Boolean(), nullable=False),
    sa.Column('join_seen_at', sa.DateTime(), nullable=True),
    sa.Column('last_synced_at', sa.DateTime(), nullable=True),
    sa.Column('raw_controller_payload', sa.JSON(), nullable=True),
    sa.Column('id', sa.String(length=36), nullable=False),
    sa.Column('created_at', sa.DateTime(), nullable=False),
    sa.Column('updated_at', sa.DateTime(), nullable=False),
    sa.Column('deleted_at', sa.DateTime(), nullable=True),
    sa.ForeignKeyConstraint(['device_network_membership_id'], ['device_network_memberships.id'], ),
    sa.ForeignKeyConstraint(['organization_id'], ['organizations.id'], ),
    sa.PrimaryKeyConstraint('id'),
    sa.UniqueConstraint('zerotier_network_id', 'node_id', name='uix_zt_network_node')
    )
    op.create_index(op.f('ix_zerotier_memberships_device_network_membership_id'), 'zerotier_memberships', ['device_network_membership_id'], unique=False)
    op.create_index(op.f('ix_zerotier_memberships_node_id'), 'zerotier_memberships', ['node_id'], unique=False)
    op.create_index(op.f('ix_zerotier_memberships_organization_id'), 'zerotier_memberships', ['organization_id'], unique=False)
    op.create_index(op.f('ix_zerotier_memberships_zerotier_network_id'), 'zerotier_memberships', ['zerotier_network_id'], unique=False)
    # ### end Alembic commands ###


def downgrade():
    # ### commands auto generated by Alembic - please adjust! ###
    op.drop_index(op.f('ix_zerotier_memberships_zerotier_network_id'), table_name='zerotier_memberships')
    op.drop_index(op.f('ix_zerotier_memberships_organization_id'), table_name='zerotier_memberships')
    op.drop_index(op.f('ix_zerotier_memberships_node_id'), table_name='zerotier_memberships')
    op.drop_index(op.f('ix_zerotier_memberships_device_network_membership_id'), table_name='zerotier_memberships')
    op.drop_table('zerotier_memberships')
    op.drop_index(op.f('ix_activation_sessions_user_id'), table_name='activation_sessions')
    op.drop_index(op.f('ix_activation_sessions_organization_id'), table_name='activation_sessions')
    op.drop_index(op.f('ix_activation_sessions_device_network_membership_id'), table_name='activation_sessions')
    op.drop_table('activation_sessions')
    op.drop_index(op.f('ix_device_network_memberships_user_network_approval_id'), table_name='device_network_memberships')
    op.drop_index(op.f('ix_device_network_memberships_user_id'), table_name='device_network_memberships')
    op.drop_index(op.f('ix_device_network_memberships_state'), table_name='device_network_memberships')
    op.drop_index(op.f('ix_device_network_memberships_portal_network_id'), table_name='device_network_memberships')
    op.drop_index(op.f('ix_device_network_memberships_organization_id'), table_name='device_network_memberships')
    op.drop_index(op.f('ix_device_network_memberships_device_id'), table_name='device_network_memberships')
    op.drop_table('device_network_memberships')
    op.drop_index(op.f('ix_certificate_audit_logs_user_id'), table_name='certificate_audit_logs')
    op.drop_index(op.f('ix_certificate_audit_logs_certificate_id'), table_name='certificate_audit_logs')
    op.drop_index(op.f('ix_certificate_audit_logs_action'), table_name='certificate_audit_logs')
    op.drop_index('idx_cert_audit_user', table_name='certificate_audit_logs')
    op.drop_index('idx_cert_audit_cert_action', table_name='certificate_audit_logs')
    op.drop_table('certificate_audit_logs')
    op.drop_index(op.f('ix_user_network_approvals_user_id'), table_name='user_network_approvals')
    op.drop_index(op.f('ix_user_network_approvals_state'), table_name='user_network_approvals')
    op.drop_index(op.f('ix_user_network_approvals_portal_network_id'), table_name='user_network_approvals')
    op.drop_index(op.f('ix_user_network_approvals_organization_id'), table_name='user_network_approvals')
    op.drop_table('user_network_approvals')
    op.drop_index(op.f('ix_ssh_certificates_user_id'), table_name='ssh_certificates')
    op.drop_index(op.f('ix_ssh_certificates_status'), table_name='ssh_certificates')
    op.drop_index(op.f('ix_ssh_certificates_ssh_key_id'), table_name='ssh_certificates')
    op.drop_index('ix_ssh_certificates_serial', table_name='ssh_certificates')
    op.drop_index(op.f('ix_ssh_certificates_revoked'), table_name='ssh_certificates')
    op.drop_index(op.f('ix_ssh_certificates_ca_id'), table_name='ssh_certificates')
    op.drop_index('idx_cert_validity', table_name='ssh_certificates')
    op.drop_index('idx_cert_user_status', table_name='ssh_certificates')
    op.drop_index('idx_cert_revoked', table_name='ssh_certificates')
    op.drop_table('ssh_certificates')
    op.drop_index(op.f('ix_principal_memberships_user_id'), table_name='principal_memberships')
    op.drop_index(op.f('ix_principal_memberships_principal_id'), table_name='principal_memberships')
    op.drop_table('principal_memberships')
    op.drop_index(op.f('ix_oidc_token_metadata_user_id'), table_name='oidc_token_metadata')
    op.drop_index(op.f('ix_oidc_token_metadata_token_jti'), table_name='oidc_token_metadata')
    op.drop_index(op.f('ix_oidc_token_metadata_expires_at'), table_name='oidc_token_metadata')
    op.drop_index(op.f('ix_oidc_token_metadata_client_id'), table_name='oidc_token_metadata')
    op.drop_table('oidc_token_metadata')
    op.drop_index(op.f('ix_oidc_sessions_user_id'), table_name='oidc_sessions')
    op.drop_index(op.f('ix_oidc_sessions_state'), table_name='oidc_sessions')
    op.drop_index(op.f('ix_oidc_sessions_expires_at'), table_name='oidc_sessions')
    op.drop_index(op.f('ix_oidc_sessions_client_id'), table_name='oidc_sessions')
    op.drop_table('oidc_sessions')
    op.drop_index(op.f('ix_oidc_refresh_tokens_user_id'), table_name='oidc_refresh_tokens')
    op.drop_index(op.f('ix_oidc_refresh_tokens_token_hash'), table_name='oidc_refresh_tokens')
    op.drop_index(op.f('ix_oidc_refresh_tokens_expires_at'), table_name='oidc_refresh_tokens')
    op.drop_index(op.f('ix_oidc_refresh_tokens_client_id'), table_name='oidc_refresh_tokens')
    op.drop_index(op.f('ix_oidc_refresh_tokens_access_token_id'), table_name='oidc_refresh_tokens')
    op.drop_table('oidc_refresh_tokens')
    op.drop_index(op.f('ix_oidc_authorization_codes_user_id'), table_name='oidc_authorization_codes')
    op.drop_index(op.f('ix_oidc_authorization_codes_expires_at'), table_name='oidc_authorization_codes')
    op.drop_index(op.f('ix_oidc_authorization_codes_client_id'), table_name='oidc_authorization_codes')
    op.drop_table('oidc_authorization_codes')
    op.drop_index(op.f('ix_oidc_audit_logs_user_id'), table_name='oidc_audit_logs')
    op.drop_index(op.f('ix_oidc_audit_logs_success'), table_name='oidc_audit_logs')
    op.drop_index(op.f('ix_oidc_audit_logs_request_id'), table_name='oidc_audit_logs')
    op.drop_index(op.f('ix_oidc_audit_logs_ip_address'), table_name='oidc_audit_logs')
    op.drop_index(op.f('ix_oidc_audit_logs_event_type'), table_name='oidc_audit_logs')
    op.drop_index(op.f('ix_oidc_audit_logs_client_id'), table_name='oidc_audit_logs')
    op.drop_table('oidc_audit_logs')
    op.drop_index(op.f('ix_department_principals_principal_id'), table_name='department_principals')
    op.drop_index(op.f('ix_department_principals_department_id'), table_name='department_principals')
    op.drop_table('department_principals')
    op.drop_index(op.f('ix_department_memberships_user_id'), table_name='department_memberships')
    op.drop_index(op.f('ix_department_memberships_department_id'), table_name='department_memberships')
    op.drop_table('department_memberships')
    op.drop_index(op.f('ix_department_cert_policies_department_id'), table_name='department_cert_policies')
    op.drop_table('department_cert_policies')
    op.drop_index(op.f('ix_ca_permissions_user_id'), table_name='ca_permissions')
    op.drop_index(op.f('ix_ca_permissions_ca_id'), table_name='ca_permissions')
    op.drop_table('ca_permissions')
    op.drop_index(op.f('ix_user_security_policies_user_id'), table_name='user_security_policies')
    op.drop_index(op.f('ix_user_security_policies_organization_id'), table_name='user_security_policies')
    op.drop_table('user_security_policies')
    op.drop_index(op.f('ix_ssh_keys_verified'), table_name='ssh_keys')
    op.drop_index(op.f('ix_ssh_keys_user_id'), table_name='ssh_keys')
    op.drop_index(op.f('ix_ssh_keys_fingerprint'), table_name='ssh_keys')
    op.drop_index('idx_ssh_key_user_verified', table_name='ssh_keys')
    op.drop_table('ssh_keys')
    op.drop_index(op.f('ix_sessions_user_id'), table_name='sessions')
    op.drop_index(op.f('ix_sessions_token'), table_name='sessions')
    op.drop_table('sessions')
    op.drop_index(op.f('ix_principals_organization_id'), table_name='principals')
    op.drop_index(op.f('ix_principals_name'), table_name='principals')
    op.drop_table('principals')
    op.drop_index(op.f('ix_portal_networks_zerotier_network_id'), table_name='portal_networks')
    op.drop_index(op.f('ix_portal_networks_organization_id'), table_name='portal_networks')
    op.drop_table('portal_networks')
    op.drop_index(op.f('ix_password_reset_tokens_user_id'), table_name='password_reset_tokens')
    op.drop_index(op.f('ix_password_reset_tokens_token'), table_name='password_reset_tokens')
    op.drop_table('password_reset_tokens')
    op.drop_index(op.f('ix_organization_security_policies_organization_id'), table_name='organization_security_policies')
    op.drop_table('organization_security_policies')
    op.drop_index(op.f('ix_organization_provider_overrides_provider_type'), table_name='organization_provider_overrides')
    op.drop_index(op.f('ix_organization_provider_overrides_organization_id'), table_name='organization_provider_overrides')
    op.drop_table('organization_provider_overrides')
    op.drop_index(op.f('ix_organization_members_user_id'), table_name='organization_members')
    op.drop_index(op.f('ix_organization_members_organization_id'), table_name='organization_members')
    op.drop_table('organization_members')
    op.drop_index(op.f('ix_organization_api_keys_organization_id'), table_name='organization_api_keys')
    op.drop_index(op.f('ix_organization_api_keys_key_hash'), table_name='organization_api_keys')
    op.drop_index(op.f('ix_organization_api_keys_is_revoked'), table_name='organization_api_keys')
    op.drop_index('idx_org_api_key_org_active', table_name='organization_api_keys')
    op.drop_index('idx_api_key_last_used', table_name='organization_api_keys')
    op.drop_table('organization_api_keys')
    op.drop_index(op.f('ix_org_invite_tokens_token'), table_name='org_invite_tokens')
    op.drop_index(op.f('ix_org_invite_tokens_organization_id'), table_name='org_invite_tokens')
    op.drop_index(op.f('ix_org_invite_tokens_email'), table_name='org_invite_tokens')
    op.drop_table('org_invite_tokens')
    op.drop_index(op.f('ix_oidc_clients_organization_id'), table_name='oidc_clients')
    op.drop_index(op.f('ix_oidc_clients_client_id'), table_name='oidc_clients')
    op.drop_table('oidc_clients')
    op.drop_index(op.f('ix_oauth_states_state'), table_name='oauth_states')
    op.drop_index(op.f('ix_oauth_states_organization_id'), table_name='oauth_states')
    op.drop_index(op.f('ix_oauth_states_expires_at'), table_name='oauth_states')
    op.drop_table('oauth_states')
    op.drop_index(op.f('ix_mfa_policy_compliance_user_id'), table_name='mfa_policy_compliance')
    op.drop_index(op.f('ix_mfa_policy_compliance_organization_id'), table_name='mfa_policy_compliance')
    op.drop_table('mfa_policy_compliance')
    op.drop_index(op.f('ix_kill_switch_events_target_user_id'), table_name='kill_switch_events')
    op.drop_index(op.f('ix_kill_switch_events_organization_id'), table_name='kill_switch_events')
    op.drop_table('kill_switch_events')
    op.drop_index(op.f('ix_external_provider_configs_provider_type'), table_name='external_provider_configs')
    op.drop_index(op.f('ix_external_provider_configs_organization_id'), table_name='external_provider_configs')
    op.drop_index('idx_provider_config_org', table_name='external_provider_configs')
    op.drop_table('external_provider_configs')
    op.drop_index(op.f('ix_email_verification_tokens_user_id'), table_name='email_verification_tokens')
    op.drop_index(op.f('ix_email_verification_tokens_token'), table_name='email_verification_tokens')
    op.drop_table('email_verification_tokens')
    op.drop_index(op.f('ix_devices_user_id'), table_name='devices')
    op.drop_index(op.f('ix_devices_organization_id'), table_name='devices')
    op.drop_index(op.f('ix_devices_node_id'), table_name='devices')
    op.drop_table('devices')
    op.drop_index(op.f('ix_departments_organization_id'), table_name='departments')
    op.drop_index(op.f('ix_departments_name'), table_name='departments')
    op.drop_table('departments')
    op.drop_index(op.f('ix_cas_organization_id'), table_name='cas')
    op.drop_index(op.f('ix_cas_is_active'), table_name='cas')
    op.drop_index('idx_ca_org_active', table_name='cas')
    op.drop_table('cas')
    op.drop_index(op.f('ix_authentication_methods_user_id'), table_name='authentication_methods')
    op.drop_index(op.f('ix_authentication_methods_method_type'), table_name='authentication_methods')
    op.drop_index('idx_user_method', table_name='authentication_methods')
    op.drop_table('authentication_methods')
    op.drop_index(op.f('ix_audit_logs_user_id'), table_name='audit_logs')
    op.drop_index(op.f('ix_audit_logs_resource_type'), table_name='audit_logs')
    op.drop_index(op.f('ix_audit_logs_resource_id'), table_name='audit_logs')
    op.drop_index(op.f('ix_audit_logs_request_id'), table_name='audit_logs')
    op.drop_index(op.f('ix_audit_logs_organization_id'), table_name='audit_logs')
    op.drop_index(op.f('ix_audit_logs_action'), table_name='audit_logs')
    op.drop_index('idx_audit_user_action', table_name='audit_logs')
    op.drop_index('idx_audit_resource', table_name='audit_logs')
    op.drop_index('idx_audit_org', table_name='audit_logs')
    op.drop_table('audit_logs')
    op.drop_index(op.f('ix_users_status'), table_name='users')
    op.drop_index(op.f('ix_users_email'), table_name='users')
    op.drop_index(op.f('ix_users_activation_key'), table_name='users')
    op.drop_table('users')
    op.drop_index(op.f('ix_organizations_slug'), table_name='organizations')
    op.drop_table('organizations')
    op.drop_index(op.f('ix_oidc_jwks_keys_kid'), table_name='oidc_jwks_keys')
    op.drop_table('oidc_jwks_keys')
    op.drop_index(op.f('ix_application_provider_configs_provider_type'), table_name='application_provider_configs')
    op.drop_table('application_provider_configs')
    # ### end Alembic commands ###