feat: add ServiceAccount and TrustedIssuer schemas, storage interface, and M2M constants

Introduces the two new storage entities for the workload identity program:

- ServiceAccount: machine/workload OAuth2 client (client_id = UUID,
  client_secret = bcrypt hash). Intentionally omits all human-user fields.
- TrustedIssuer: external JWT issuer registry for K8s SA tokens, SPIFFE
  JWT-SVIDs, and generic OIDC workload tokens. Carries all fields needed
  for Phases 1-6: KeySourceType, ExpectedAud, EnableTokenReview (Phase 4),
  SpiffeRefreshHintSeconds (Phase 5), AuthMethod + proxy fields (Phase 6).

Storage changes:
- Added ServiceAccount and TrustedIssuer to CollectionList and Collections
- Extended storage.Provider interface with 5 ServiceAccount + 6 TrustedIssuer methods
- SQL provider: full GORM CRUD implementation + AutoMigrate registration
- NoSQL providers (mongodb, arangodb, cassandradb, dynamodb, couchbase):
  stubs returning not-implemented errors, to be replaced in PR 3

Constants:
- grant_types.go: RFC 6749/8693 grant types, RFC 7521/7523 client assertion
  types, RFC 8693 token type URNs, and TrustedIssuer key-source/issuer-type/
  auth-method identifiers
- audit_event.go: service_account and trusted_issuer audit events + resource types

Spec: docs/specs/WORKLOAD_IDENTITY_PROGRAM.md

Author: lakhansamani

docs/specs/WORKLOAD_IDENTITY_PROGRAM.md

@@ -26,6 +26,10 @@ const (
 	AuditResourceTypeFgaModel = "fga_model"
 	// AuditResourceTypeFgaTuple represents a fine-grained authorization tuple.
 	AuditResourceTypeFgaTuple = "fga_tuple"
+	// AuditResourceTypeServiceAccount represents a machine/workload service account.
+	AuditResourceTypeServiceAccount = "service_account"
+	// AuditResourceTypeTrustedIssuer represents a trusted external JWT issuer.
+	AuditResourceTypeTrustedIssuer = "trusted_issuer"
 )
 
 // Audit event type constants used for structured audit logging.
@@ -126,4 +130,29 @@ const (
 	AuditSessionCreatedEvent = "session.created"
 	// AuditSessionTerminatedEvent is logged when a session is terminated.
 	AuditSessionTerminatedEvent = "session.terminated"
+
+	// AuditServiceAccountCreatedEvent is logged when an admin creates a service account.
+	AuditServiceAccountCreatedEvent = "admin.service_account_created"
+	// AuditServiceAccountUpdatedEvent is logged when an admin updates a service account.
+	AuditServiceAccountUpdatedEvent = "admin.service_account_updated"
+	// AuditServiceAccountDeletedEvent is logged when an admin deletes a service account.
+	AuditServiceAccountDeletedEvent = "admin.service_account_deleted"
+	// AuditServiceAccountSecretRotatedEvent is logged when a service account secret is rotated.
+	AuditServiceAccountSecretRotatedEvent = "admin.service_account_secret_rotated"
+
+	// AuditTrustedIssuerCreatedEvent is logged when an admin adds a trusted issuer.
+	AuditTrustedIssuerCreatedEvent = "admin.trusted_issuer_created"
+	// AuditTrustedIssuerUpdatedEvent is logged when an admin updates a trusted issuer.
+	AuditTrustedIssuerUpdatedEvent = "admin.trusted_issuer_updated"
+	// AuditTrustedIssuerDeletedEvent is logged when an admin deletes a trusted issuer.
+	AuditTrustedIssuerDeletedEvent = "admin.trusted_issuer_deleted"
+
+	// AuditTokenClientCredentialsEvent is logged when a service account obtains a token
+	// via the client_credentials grant (RFC 6749 §4.4).
+	AuditTokenClientCredentialsEvent = "token.client_credentials"
+	// AuditTokenExchangeEvent is logged when a token exchange occurs (RFC 8693).
+	AuditTokenExchangeEvent = "token.exchange"
+	// AuditWorkloadAuthEvent is logged when a workload authenticates via client_assertion
+	// (K8s SA token, SPIFFE JWT-SVID, or generic OIDC workload token).
+	AuditWorkloadAuthEvent = "token.workload_auth"
 )

internal/constants/audit_event.go

@@ -0,0 +1,90 @@
+package constants
+
+// OAuth2 grant type URNs for the token endpoint (RFC 6749 + RFC 8693).
+const (
+	// GrantTypeAuthorizationCode is the standard browser-redirect grant (RFC 6749 §4.1).
+	GrantTypeAuthorizationCode = "authorization_code"
+
+	// GrantTypeRefreshToken rotates an existing refresh token (RFC 6749 §6).
+	GrantTypeRefreshToken = "refresh_token"
+
+	// GrantTypeClientCredentials issues tokens for machine/service identities
+	// without a human resource owner (RFC 6749 §4.4).
+	// Authenticate using client_id (= ServiceAccount.ID) and client_secret,
+	// or via client_assertion for workload identity federation (Phases 3–5).
+	GrantTypeClientCredentials = "client_credentials"
+
+	// GrantTypeTokenExchange enables on-behalf-of delegation and workload-to-user
+	// token exchange (RFC 8693).
+	GrantTypeTokenExchange = "urn:ietf:params:oauth:grant-type:token-exchange"
+)
+
+// OAuth2 client assertion type URNs (RFC 7521 / RFC 7523).
+const (
+	// ClientAssertionTypeJWTBearer identifies a JWT as the client credential
+	// in the client_assertion parameter (RFC 7523).
+	// Used for Kubernetes SA tokens and generic OIDC workload tokens (Phases 3–4).
+	ClientAssertionTypeJWTBearer = "urn:ietf:params:oauth:client-assertion-type:jwt-bearer"
+
+	// ClientAssertionTypeJWTSPIFFE identifies a SPIFFE JWT-SVID as the client
+	// credential (draft-schwenkschuster-oauth-spiffe-client-auth-00).
+	// PREVIEW: the underlying draft expired 2026-01-02 and is not WG-adopted.
+	// This URN is not IANA-registered and may change. Ship as experimental only.
+	ClientAssertionTypeJWTSPIFFE = "urn:ietf:params:oauth:client-assertion-type:jwt-spiffe"
+)
+
+// RFC 8693 token type URNs used in subject_token_type and issued_token_type.
+const (
+	// TokenTypeURNAccessToken identifies an OAuth2 access token.
+	TokenTypeURNAccessToken = "urn:ietf:params:oauth:token-type:access_token"
+
+	// TokenTypeURNRefreshToken identifies an OAuth2 refresh token.
+	TokenTypeURNRefreshToken = "urn:ietf:params:oauth:token-type:refresh_token"
+
+	// TokenTypeURNIDToken identifies an OpenID Connect ID token.
+	TokenTypeURNIDToken = "urn:ietf:params:oauth:token-type:id_token"
+
+	// TokenTypeURNJWT identifies a generic JWT.
+	TokenTypeURNJWT = "urn:ietf:params:oauth:token-type:jwt"
+)
+
+// TrustedIssuer key source types controlling how JWKS are fetched.
+const (
+	// KeySourceOIDCDiscovery fetches the JWKS URI from the issuer's OpenID
+	// Connect discovery document (/.well-known/openid-configuration).
+	// Not suitable for private K8s clusters that do not expose discovery publicly.
+	KeySourceOIDCDiscovery = "oidc_discovery"
+
+	// KeySourceStaticJWKSURL fetches JWKS directly from a configured URL.
+	// Preferred for private clusters — avoids exposing K8s discovery endpoints.
+	KeySourceStaticJWKSURL = "static_jwks_url"
+
+	// KeySourceSPIFFEBundleEndpoint fetches keys from a SPIFFE bundle endpoint.
+	// Requires SpiffeRefreshHintSeconds to be honoured at runtime (Phase 5).
+	KeySourceSPIFFEBundleEndpoint = "spiffe_bundle_endpoint"
+)
+
+// TrustedIssuer issuer type identifiers.
+const (
+	// IssuerTypeKubernetesSA identifies a Kubernetes projected ServiceAccount token.
+	IssuerTypeKubernetesSA = "kubernetes_sa"
+
+	// IssuerTypeSPIFFEJWT identifies a SPIFFE JWT-SVID (Phase 5, preview).
+	IssuerTypeSPIFFEJWT = "spiffe_jwt"
+
+	// IssuerTypeOIDC identifies a generic OIDC token from an external IdP.
+	IssuerTypeOIDC = "oidc"
+
+	// IssuerTypeCloudOIDC identifies a cloud-provider workload identity token
+	// (AWS IRSA, GCP Workload Identity, Azure Managed Identity).
+	IssuerTypeCloudOIDC = "cloud_oidc"
+)
+
+// TrustedIssuer authentication method identifiers.
+const (
+	// AuthMethodJWTAssertion uses a JWT as the client_assertion (Phases 3–5, default).
+	AuthMethodJWTAssertion = "jwt_assertion"
+
+	// AuthMethodX509MTLS uses an X.509-SVID via mTLS (Phase 6).
+	AuthMethodX509MTLS = "x509_mtls"
+)

internal/constants/grant_types.go

@@ -0,0 +1,39 @@
+package arangodb
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/storage/schemas"
+)
+
+// AddServiceAccount creates a new service account record.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) AddServiceAccount(_ context.Context, _ *schemas.ServiceAccount) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("arangodb: AddServiceAccount not implemented")
+}
+
+// UpdateServiceAccount updates a service account record.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) UpdateServiceAccount(_ context.Context, _ *schemas.ServiceAccount) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("arangodb: UpdateServiceAccount not implemented")
+}
+
+// DeleteServiceAccount removes a service account record.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) DeleteServiceAccount(_ context.Context, _ *schemas.ServiceAccount) error {
+	return fmt.Errorf("arangodb: DeleteServiceAccount not implemented")
+}
+
+// GetServiceAccountByID fetches a service account by primary key.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) GetServiceAccountByID(_ context.Context, _ string) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("arangodb: GetServiceAccountByID not implemented")
+}
+
+// ListServiceAccounts returns a paginated list of service accounts.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) ListServiceAccounts(_ context.Context, _ *model.Pagination) ([]*schemas.ServiceAccount, *model.Pagination, error) {
+	return nil, nil, fmt.Errorf("arangodb: ListServiceAccounts not implemented")
+}

internal/storage/db/arangodb/service_account.go

@@ -0,0 +1,45 @@
+package arangodb
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/storage/schemas"
+)
+
+// AddTrustedIssuer creates a new trusted issuer record.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) AddTrustedIssuer(_ context.Context, _ *schemas.TrustedIssuer) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("arangodb: AddTrustedIssuer not implemented")
+}
+
+// UpdateTrustedIssuer updates a trusted issuer record.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) UpdateTrustedIssuer(_ context.Context, _ *schemas.TrustedIssuer) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("arangodb: UpdateTrustedIssuer not implemented")
+}
+
+// DeleteTrustedIssuer removes a trusted issuer record.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) DeleteTrustedIssuer(_ context.Context, _ *schemas.TrustedIssuer) error {
+	return fmt.Errorf("arangodb: DeleteTrustedIssuer not implemented")
+}
+
+// GetTrustedIssuerByID fetches a trusted issuer by primary key.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) GetTrustedIssuerByID(_ context.Context, _ string) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("arangodb: GetTrustedIssuerByID not implemented")
+}
+
+// GetTrustedIssuerByIssuerURL fetches a trusted issuer by its unique issuer URL.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) GetTrustedIssuerByIssuerURL(_ context.Context, _ string) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("arangodb: GetTrustedIssuerByIssuerURL not implemented")
+}
+
+// ListTrustedIssuers returns paginated trusted issuers, optionally filtered by serviceAccountID.
+// TODO(phase1-pr3): implement ArangoDB provider.
+func (p *provider) ListTrustedIssuers(_ context.Context, _ string, _ *model.Pagination) ([]*schemas.TrustedIssuer, *model.Pagination, error) {
+	return nil, nil, fmt.Errorf("arangodb: ListTrustedIssuers not implemented")
+}

internal/storage/db/arangodb/trusted_issuer.go

@@ -0,0 +1,47 @@
+package cassandradb
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/storage/schemas"
+)
+
+// AddServiceAccount creates a new service account record.
+// TODO(phase1-pr3): implement CassandraDB provider.
+// DDL required before implementation:
+//
+//	CREATE TABLE IF NOT EXISTS authorizer_service_accounts (
+//	  id text PRIMARY KEY,
+//	  name text, description text, client_secret text,
+//	  allowed_scopes text, is_active boolean,
+//	  created_at bigint, updated_at bigint
+//	);
+func (p *provider) AddServiceAccount(_ context.Context, _ *schemas.ServiceAccount) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("cassandradb: AddServiceAccount not implemented")
+}
+
+// UpdateServiceAccount updates a service account record.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) UpdateServiceAccount(_ context.Context, _ *schemas.ServiceAccount) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("cassandradb: UpdateServiceAccount not implemented")
+}
+
+// DeleteServiceAccount removes a service account record.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) DeleteServiceAccount(_ context.Context, _ *schemas.ServiceAccount) error {
+	return fmt.Errorf("cassandradb: DeleteServiceAccount not implemented")
+}
+
+// GetServiceAccountByID fetches a service account by primary key.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) GetServiceAccountByID(_ context.Context, _ string) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("cassandradb: GetServiceAccountByID not implemented")
+}
+
+// ListServiceAccounts returns a paginated list of service accounts.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) ListServiceAccounts(_ context.Context, _ *model.Pagination) ([]*schemas.ServiceAccount, *model.Pagination, error) {
+	return nil, nil, fmt.Errorf("cassandradb: ListServiceAccounts not implemented")
+}

internal/storage/db/cassandradb/service_account.go

@@ -0,0 +1,58 @@
+package cassandradb
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/storage/schemas"
+)
+
+// AddTrustedIssuer creates a new trusted issuer record.
+// TODO(phase1-pr3): implement CassandraDB provider.
+// DDL required before implementation:
+//
+//	CREATE TABLE IF NOT EXISTS authorizer_trusted_issuers (
+//	  id text PRIMARY KEY,
+//	  service_account_id text, name text, issuer_url text,
+//	  key_source_type text, jwks_url text, expected_aud text,
+//	  subject_claim text, issuer_type text, auth_method text,
+//	  is_active boolean, enable_token_review boolean,
+//	  kubernetes_api_server_url text,
+//	  spiffe_refresh_hint_seconds bigint,
+//	  trusted_proxy_header text, trusted_proxy_cidrs text,
+//	  created_at bigint, updated_at bigint
+//	);
+func (p *provider) AddTrustedIssuer(_ context.Context, _ *schemas.TrustedIssuer) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("cassandradb: AddTrustedIssuer not implemented")
+}
+
+// UpdateTrustedIssuer updates a trusted issuer record.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) UpdateTrustedIssuer(_ context.Context, _ *schemas.TrustedIssuer) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("cassandradb: UpdateTrustedIssuer not implemented")
+}
+
+// DeleteTrustedIssuer removes a trusted issuer record.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) DeleteTrustedIssuer(_ context.Context, _ *schemas.TrustedIssuer) error {
+	return fmt.Errorf("cassandradb: DeleteTrustedIssuer not implemented")
+}
+
+// GetTrustedIssuerByID fetches a trusted issuer by primary key.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) GetTrustedIssuerByID(_ context.Context, _ string) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("cassandradb: GetTrustedIssuerByID not implemented")
+}
+
+// GetTrustedIssuerByIssuerURL fetches a trusted issuer by its unique issuer URL.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) GetTrustedIssuerByIssuerURL(_ context.Context, _ string) (*schemas.TrustedIssuer, error) {
+	return nil, fmt.Errorf("cassandradb: GetTrustedIssuerByIssuerURL not implemented")
+}
+
+// ListTrustedIssuers returns paginated trusted issuers, optionally filtered by serviceAccountID.
+// TODO(phase1-pr3): implement CassandraDB provider.
+func (p *provider) ListTrustedIssuers(_ context.Context, _ string, _ *model.Pagination) ([]*schemas.TrustedIssuer, *model.Pagination, error) {
+	return nil, nil, fmt.Errorf("cassandradb: ListTrustedIssuers not implemented")
+}

internal/storage/db/cassandradb/trusted_issuer.go

@@ -0,0 +1,39 @@
+package couchbase
+
+import (
+	"context"
+	"fmt"
+
+	"github.com/authorizerdev/authorizer/internal/graph/model"
+	"github.com/authorizerdev/authorizer/internal/storage/schemas"
+)
+
+// AddServiceAccount creates a new service account record.
+// TODO(phase1-pr3): implement Couchbase provider.
+func (p *provider) AddServiceAccount(_ context.Context, _ *schemas.ServiceAccount) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("couchbase: AddServiceAccount not implemented")
+}
+
+// UpdateServiceAccount updates a service account record.
+// TODO(phase1-pr3): implement Couchbase provider.
+func (p *provider) UpdateServiceAccount(_ context.Context, _ *schemas.ServiceAccount) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("couchbase: UpdateServiceAccount not implemented")
+}
+
+// DeleteServiceAccount removes a service account record.
+// TODO(phase1-pr3): implement Couchbase provider.
+func (p *provider) DeleteServiceAccount(_ context.Context, _ *schemas.ServiceAccount) error {
+	return fmt.Errorf("couchbase: DeleteServiceAccount not implemented")
+}
+
+// GetServiceAccountByID fetches a service account by primary key.
+// TODO(phase1-pr3): implement Couchbase provider.
+func (p *provider) GetServiceAccountByID(_ context.Context, _ string) (*schemas.ServiceAccount, error) {
+	return nil, fmt.Errorf("couchbase: GetServiceAccountByID not implemented")
+}
+
+// ListServiceAccounts returns a paginated list of service accounts.
+// TODO(phase1-pr3): implement Couchbase provider.
+func (p *provider) ListServiceAccounts(_ context.Context, _ *model.Pagination) ([]*schemas.ServiceAccount, *model.Pagination, error) {
+	return nil, nil, fmt.Errorf("couchbase: ListServiceAccounts not implemented")
+}