pub const USERS_MIGRATION: &str = "-- Every authenticated caller (ADR-0021 \u{a7} 3 of Puerto). `(issuer, subject)` is the provider\'s\n-- name for the person; in an OIDC project `roles` is not read \u{2014} the token\'s roles decide.\nCREATE TABLE users (\n id UUID PRIMARY KEY,\n issuer TEXT NOT NULL,\n subject TEXT NOT NULL,\n email TEXT,\n name TEXT,\n roles TEXT[] NOT NULL DEFAULT \'{}\',\n created_at TIMESTAMPTZ NOT NULL,\n updated_at TIMESTAMPTZ NOT NULL,\n UNIQUE (issuer, subject)\n);\n";Expand description
The users every auth project has (migrations/users.sql): auth::PgSessions reads it, so its
schema is part of this crate’s contract. Puerto’s CLI ships a byte-for-byte copy of it as a
project migration.