Feature/update dockerfile (#6)

* chore: remove unused new.Dockerfile

* feat: add DID model definitions

* fix: Fix EncodePublicKey method in KeyInfo struct

* feat: Update `EncodePublicKey` to be the inverse of `DecodePublicKey`

* refactor: update AssetInfo protobuf definition

* fix: update default assets with correct asset types

* fix: Initialize IPFS client and check for mounted directories

* feat: Improve IPFS client initialization and mount checking

* feat: Add local filesystem check for IPFS and IPNS

* fix: Use Unixfs().Get() instead of Cat() for IPFS and IPNS content retrieval

* feat: Update GetCID and GetIPNS functions to read data from IPFS node

* fix: Ensure IPFS client is initialized before pinning CID

* feat: Add AddFile and AddFolder methods

* feat: add IPFS file system abstraction

* feat: Implement IPFS file, location, and filesystem abstractions

* refactor: remove unused functions and types

* refactor: remove unused FileSystem interface

* feat: add initial wasm entrypoint

* feat: add basic vault command operations

* docs: add vault module features

* test: remove test for MsgUpdateParams

* refactor: Replace PrimaryKey with Property struct in zkprop.go

* feat: Update the `CreateWitness` and `CreateAccumulator` and `VerifyWitness` and `UpdateAccumulator` to Use the new `Accumulator` and `Witness` types. Then Clean up the code in the file and refactor the marshalling methods

* <no value>

* feat: add KeyCurve and KeyType to KeyInfo in genesis

* feat: add WASM build step to devbox.json

* feat: Add zkgate.go file

* feat: Uncomment and modify zkgate code to work with Property struct

* feat: Merge zkgate.go and zkprop.go logic

* feat: implement API endpoints for profile management

* refactor: remove unused template file

* feat(orm): remove unused ORM models

* feat: add persistent SQLite database support in WASM

* fix: Update module names in protobuf files

* feat: Add method to initialize SQLite database

* fix: update go-sqlite3 dependency to version 1.14.23

* feat: introduce database layer

* feat: Implement database layer for Vault node

* feature/update-dockerfile

* feat: Add keyshares table

* fix: Reorder the SQL statements in the tables.go file

* feat: Update the `createCredentialsTable` method to match the proper Credential struct

* feat: Update createProfilesTable and add createPropertiesTable

* feat: Add constant SQL queries to queries.go and use prepared statements in db.go

* feat: Add createKeysharesTable to internal/db/db.go

* feat: Update `createPermissionsTable` to match Permissions struct

* feat: Add database enum types

* feat: Add DIDNamespace and PermissionScope enums

* feat: Add DBConfig and DBOption types

* feat: Update the db implementation to use the provided go library

* fix: update db implementation to use go-sqlite3 v0.18.2

* fix: Refactor database connection and statement handling

* feat: Simplify db.go implementation

* feat: Convert constant SQL queries to functions in queries.go and update db.go to use prepared statements

* feat: Add models.go file with database table structs

* fix: Remove unused statement map and prepare statements

diff --git a/internal/db/db.go b/internal/db/db.go
index 201d09b..d4d4d4e 100644
--- a/internal/db/db.go
+++ b/internal/db/db.go
@@ -32,11 +32,6 @@ func Open(config *DBConfig) (*DB, error) {
 		Conn: conn,
 	}

-	if err := createTables(db); err != nil {
-		conn.Close()
-		return nil, fmt.Errorf("failed to create tables: %w", err)
-	}
-
 	return db, nil
 }

@@ -61,114 +56,3 @@ func createTables(db *DB) error {
 	return nil
 }

-// AddAccount adds a new account to the database
-func (db *DB) AddAccount(name, address string) error {
-	return db.Exec(insertAccountQuery(name, address))
-}
-
-// AddAsset adds a new asset to the database
-func (db *DB) AddAsset(name, symbol string, decimals int, chainID int64) error {
-	return db.Exec(insertAssetQuery(name, symbol, decimals, chainID))
-}
-
-// AddChain adds a new chain to the database
-func (db *DB) AddChain(name, networkID string) error {
-	return db.Exec(insertChainQuery(name, networkID))
-}
-
-// AddCredential adds a new credential to the database
-func (db *DB) AddCredential(
-	handle, controller, attestationType, origin string,
-	credentialID, publicKey []byte,
-	transport string,
-	signCount uint32,
-	userPresent, userVerified, backupEligible, backupState, cloneWarning bool,
-) error {
-	return db.Exec(insertCredentialQuery(
-		handle,
-		controller,
-		attestationType,
-		origin,
-		credentialID,
-		publicKey,
-		transport,
-		signCount,
-		userPresent,
-		userVerified,
-		backupEligible,
-		backupState,
-		cloneWarning,
-	))
-}
-
-// AddProfile adds a new profile to the database
-func (db *DB) AddProfile(
-	id, subject, controller, originURI, publicMetadata, privateMetadata string,
-) error {
-	return db.statements["insertProfile"].Exec(
-		id, subject, controller, originURI, publicMetadata, privateMetadata,
-	)
-}
-
-// AddProperty adds a new property to the database
-func (db *DB) AddProperty(
-	profileID, key, accumulator, propertyKey string,
-) error {
-	return db.statements["insertProperty"].Exec(
-		profileID, key, accumulator, propertyKey,
-	)
-}
-
-// AddPermission adds a new permission to the database
-func (db *DB) AddPermission(
-	serviceID string,
-	grants []DIDNamespace,
-	scopes []PermissionScope,
-) error {
-	grantsJSON, err := json.Marshal(grants)
-	if err != nil {
-		return fmt.Errorf("failed to marshal grants: %w", err)
-	}
-
-	scopesJSON, err := json.Marshal(scopes)
-	if err != nil {
-		return fmt.Errorf("failed to marshal scopes: %w", err)
-	}
-
-	return db.statements["insertPermission"].Exec(
-		serviceID, string(grantsJSON), string(scopesJSON),
-	)
-}
-
-// GetPermission retrieves the permission for the given service ID
-func (db *DB) GetPermission(serviceID string) ([]DIDNamespace, []PermissionScope, error) {
-	row := db.statements["getPermission"].QueryRow(serviceID)
-
-	var grantsJSON, scopesJSON string
-	if err := row.Scan(&grantsJSON, &scopesJSON); err != nil {
-		return nil, nil, fmt.Errorf("failed to get permission: %w", err)
-	}
-
-	var grants []DIDNamespace
-	if err := json.Unmarshal([]byte(grantsJSON), &grants); err != nil {
-		return nil, nil, fmt.Errorf("failed to unmarshal grants: %w", err)
-	}
-
-	var scopes []PermissionScope
-	if err := json.Unmarshal([]byte(scopesJSON), &scopes); err != nil {
-		return nil, nil, fmt.Errorf("failed to unmarshal scopes: %w", err)
-	}
-
-	return grants, scopes, nil
-}
-
-// Close closes the database connection and finalizes all prepared statements
-func (db *DB) Close() error {
-	for _, stmt := range db.statements {
-		stmt.Finalize()
-	}
-	return db.Conn.Close()
-}
diff --git a/internal/db/queries.go b/internal/db/queries.go
index 807d701..e69de29 100644
--- a/internal/db/queries.go
+++ b/internal/db/queries.go
@@ -1,79 +0,0 @@
-package db
-
-import "fmt"
-
-// Account queries
-func insertAccountQuery(name, address string) string {
-	return fmt.Sprintf(`INSERT INTO accounts (name, address) VALUES (%s, %s)`, name, address)
-}
-
-// Asset queries
-func insertAssetQuery(name, symbol string, decimals int, chainID int64) string {
-	return fmt.Sprintf(
-		`INSERT INTO assets (name, symbol, decimals, chain_id) VALUES (%s, %s, %d, %d)`,
-		name,
-		symbol,
-		decimals,
-		chainID,
-	)
-}
-
-// Chain queries
-func insertChainQuery(name string, networkID string) string {
-	return fmt.Sprintf(`INSERT INTO chains (name, network_id) VALUES (%s, %d)`, name, networkID)
-}
-
-// Credential queries
-func insertCredentialQuery(
-	handle, controller, attestationType, origin string,
-	credentialID, publicKey []byte,
-	transport string,
-	signCount uint32,
-	userPresent, userVerified, backupEligible, backupState, cloneWarning bool,
-) string {
-	return fmt.Sprintf(`INSERT INTO credentials (
-		handle, controller, attestation_type, origin,
-		credential_id, public_key, transport, sign_count,
-		user_present, user_verified, backup_eligible,
-		backup_state, clone_warning
-	) VALUES (%s, %s, %s, %s, %s, %s, %s, %d, %t, %t, %t, %t, %t)`,
-		handle, controller, attestationType, origin,
-		credentialID, publicKey, transport, signCount,
-		userPresent, userVerified, backupEligible,
-		backupState, cloneWarning)
-}
-
-// Profile queries
-func insertProfileQuery(
-	id, subject, controller, originURI, publicMetadata, privateMetadata string,
-) string {
-	return fmt.Sprintf(`INSERT INTO profiles (
-		id, subject, controller, origin_uri,
-		public_metadata, private_metadata
-	) VALUES (%s, %s, %s, %s, %s, %s)`,
-		id, subject, controller, originURI,
-		publicMetadata, privateMetadata)
-}
-
-// Property queries
-func insertPropertyQuery(profileID, key, accumulator, propertyKey string) string {
-	return fmt.Sprintf(`INSERT INTO properties (
-		profile_id, key, accumulator, property_key
-	) VALUES (%s, %s, %s, %s)`,
-		profileID, key, accumulator, propertyKey)
-}
-
-// Permission queries
-func insertPermissionQuery(serviceID, grants, scopes string) string {
-	return fmt.Sprintf(
-		`INSERT INTO permissions (service_id, grants, scopes) VALUES (%s, %s, %s)`,
-		serviceID,
-		grants,
-		scopes,
-	)
-}
-
-// GetPermission query
-func getPermissionQuery(serviceID string) string {
-	return fmt.Sprintf(`SELECT grants, scopes FROM permissions WHERE service_id = %s`, serviceID)
-}

* fix: update Makefile to use sonrd instead of wasmd

* feat: Add targets for templ and vault in Makefile and use only make in devbox.json

* feat: add SQLite database support

* bump: version 0.6.0 → 0.7.0

* refactor: upgrade actions to latest versions

internal/db/db.go

@@ -0,0 +1,174 @@
+package db
+
+import (
+	"fmt"
+
+	"github.com/ncruces/go-sqlite3"
+	_ "github.com/ncruces/go-sqlite3/embed"
+)
+
+type DB struct {
+	*sqlite3.Conn
+}
+
+func New(opts ...DBOption) *DBConfig {
+	config := &DBConfig{
+		fileName: "vault.db",
+	}
+	for _, opt := range opts {
+		opt(config)
+	}
+	return config
+}
+
+func Open(config *DBConfig) (*DB, error) {
+	conn, err := sqlite3.Open(config.ConnectionString())
+	if err != nil {
+		return nil, fmt.Errorf("failed to open database: %w", err)
+	}
+
+	db := &DB{
+		Conn: conn,
+	}
+
+	if err := createTables(db); err != nil {
+		conn.Close()
+		return nil, fmt.Errorf("failed to create tables: %w", err)
+	}
+	return db, nil
+}
+
+func createTables(db *DB) error {
+	tables := []string{
+		createAccountsTable,
+		createAssetsTable,
+		createChainsTable,
+		createCredentialsTable,
+		createKeysharesTable,
+		createProfilesTable,
+		createPropertiesTable,
+		createPermissionsTable,
+	}
+
+	for _, table := range tables {
+		err := db.Exec(table)
+		if err != nil {
+			return fmt.Errorf("failed to create table: %w", err)
+		}
+	}
+
+	return nil
+}
+
+// AddAccount adds a new account to the database
+func (db *DB) AddAccount(name, address string) error {
+	return db.Exec(insertAccountQuery(name, address))
+}
+
+// AddAsset adds a new asset to the database
+func (db *DB) AddAsset(name, symbol string, decimals int, chainID int64) error {
+	return db.Exec(insertAssetQuery(name, symbol, decimals, chainID))
+}
+
+// AddChain adds a new chain to the database
+func (db *DB) AddChain(name, networkID string) error {
+	return db.Exec(insertChainQuery(name, networkID))
+}
+
+// AddCredential adds a new credential to the database
+func (db *DB) AddCredential(
+	handle, controller, attestationType, origin string,
+	credentialID, publicKey []byte,
+	transport string,
+	signCount uint32,
+	userPresent, userVerified, backupEligible, backupState, cloneWarning bool,
+) error {
+	return db.Exec(insertCredentialQuery(
+		handle,
+		controller,
+		attestationType,
+		origin,
+		credentialID,
+		publicKey,
+		transport,
+		signCount,
+		userPresent,
+		userVerified,
+		backupEligible,
+		backupState,
+		cloneWarning,
+	))
+}
+
+//
+// // AddProfile adds a new profile to the database
+// func (db *DB) AddProfile(
+// 	id, subject, controller, originURI string,
+// 	publicMetadata, privateMetadata string,
+// ) error {
+// 	return db.statements["insertProfile"].Exec(
+// 		id,
+// 		subject,
+// 		controller,
+// 		originURI,
+// 		publicMetadata,
+// 		privateMetadata,
+// 	)
+// }
+//
+// // AddProperty adds a new property to the database
+// func (db *DB) AddProperty(profileID, key string, accumulator, propertyKey []byte) error {
+// 	return db.statements["insertProperty"].Exec(profileID, key, accumulator, propertyKey)
+// }
+//
+// // AddPermission adds a new permission to the database
+// func (db *DB) AddPermission(
+// 	serviceID string,
+// 	grants []DIDNamespace,
+// 	scopes []PermissionScope,
+// ) error {
+// 	grantsJSON, err := json.Marshal(grants)
+// 	if err != nil {
+// 		return fmt.Errorf("failed to marshal grants: %w", err)
+// 	}
+//
+// 	scopesJSON, err := json.Marshal(scopes)
+// 	if err != nil {
+// 		return fmt.Errorf("failed to marshal scopes: %w", err)
+// 	}
+//
+// 	return db.statements["insertPermission"].Exec(
+// 		serviceID,
+// 		string(grantsJSON),
+// 		string(scopesJSON),
+// 	)
+// }
+//
+// // GetPermission retrieves a permission from the database
+// func (db *DB) GetPermission(serviceID string) ([]DIDNamespace, []PermissionScope, error) {
+// 	stmt := db.statements["getPermission"]
+// 	if err := stmt.Exec(serviceID); err != nil {
+// 		return nil, nil, fmt.Errorf("failed to execute statement: %w", err)
+// 	}
+//
+// 	if !stmt.Step() {
+// 		return nil, nil, fmt.Errorf("permission not found")
+// 	}
+//
+// 	grantsJSON := stmt.ColumnText(0)
+// 	scopesJSON := stmt.ColumnText(1)
+//
+// 	var grants []DIDNamespace
+// 	err := json.Unmarshal([]byte(grantsJSON), &grants)
+// 	if err != nil {
+// 		return nil, nil, fmt.Errorf("failed to unmarshal grants: %w", err)
+// 	}
+//
+// 	var scopes []PermissionScope
+// 	err = json.Unmarshal([]byte(scopesJSON), &scopes)
+// 	if err != nil {
+// 		return nil, nil, fmt.Errorf("failed to unmarshal scopes: %w", err)
+// 	}
+//
+// 	return grants, scopes, nil
+// }

internal/db/enums.go

@@ -0,0 +1,36 @@
+package db
+
+// DIDNamespace defines the different namespaces of DID
+type DIDNamespace int
+
+const (
+	DIDNamespaceUnspecified DIDNamespace = iota
+	DIDNamespaceIPFS
+	DIDNamespaceSonr
+	DIDNamespaceBitcoin
+	DIDNamespaceEthereum
+	DIDNamespaceIBC
+	DIDNamespaceWebauthn
+	DIDNamespaceDWN
+	DIDNamespaceService
+)
+
+// PermissionScope defines the Capabilities Controllers can grant for Services
+type PermissionScope int
+
+const (
+	PermissionScopeUnspecified PermissionScope = iota
+	PermissionScopeBasicInfo
+	PermissionScopeRecordsRead
+	PermissionScopeRecordsWrite
+	PermissionScopeTransactionsRead
+	PermissionScopeTransactionsWrite
+	PermissionScopeWalletsRead
+	PermissionScopeWalletsCreate
+	PermissionScopeWalletsSubscribe
+	PermissionScopeWalletsUpdate
+	PermissionScopeTransactionsVerify
+	PermissionScopeTransactionsBroadcast
+	PermissionScopeAdminUser
+	PermissionScopeAdminValidator
+)

internal/db/options.go

@@ -0,0 +1,83 @@
+package db
+
+import (
+	"crypto/rand"
+
+	"github.com/ncruces/go-sqlite3/gormlite"
+	"github.com/ncruces/go-sqlite3/vfs"
+	"golang.org/x/crypto/argon2"
+	"gorm.io/gorm"
+	"lukechampine.com/adiantum/hbsh"
+	"lukechampine.com/adiantum/hpolyc"
+)
+
+type DBOption func(config *DBConfig)
+
+func WithDir(dir string) DBOption {
+	return func(config *DBConfig) {
+		config.Dir = dir
+	}
+}
+
+func WithInMemory() DBOption {
+	return func(config *DBConfig) {
+		config.InMemory = true
+	}
+}
+
+func WithSecretKey(secretKey string) DBOption {
+	return func(config *DBConfig) {
+		config.SecretKey = secretKey
+	}
+}
+
+func WithOpenFlag(flag vfs.OpenFlag) DBOption {
+	return func(config *DBConfig) {
+		config.OpenFlag = flag
+	}
+}
+
+type DBConfig struct {
+	Dir       string
+	InMemory  bool
+	SecretKey string
+	OpenFlag  vfs.OpenFlag
+
+	fileName string
+}
+
+func (config *DBConfig) ConnectionString() string {
+	connStr := "file:"
+	if config.InMemory {
+		connStr += ":memory:"
+	} else {
+		connStr += config.Dir + "/" + config.fileName
+	}
+	return connStr
+}
+
+// GormDialector creates a gorm dialector for the database.
+func (config *DBConfig) GormDialector() (*gorm.DB, error) {
+	return gorm.Open(gormlite.Open(config.ConnectionString()))
+}
+
+// HBSH creates an HBSH cipher given a key.
+func (c *DBConfig) HBSH(key []byte) *hbsh.HBSH {
+	if len(key) != 32 {
+		// Key is not appropriate, return nil.
+		return nil
+	}
+	return hpolyc.New(key)
+}
+
+// KDF gets a key from a secret.
+func (c *DBConfig) KDF(secret string) []byte {
+	if secret == "" {
+		// No secret is given, generate a random key.
+		key := make([]byte, 32)
+		n, _ := rand.Read(key)
+		return key[:n]
+	}
+	// Hash the secret with a KDF.
+	return argon2.IDKey([]byte(secret), []byte("hpolyc"), 3, 64*1024, 4, 32)
+}

internal/db/queries.go

@@ -0,0 +1,79 @@
+package db
+
+import "fmt"
+
+// Account queries
+func insertAccountQuery(name, address string) string {
+	return fmt.Sprintf(`INSERT INTO accounts (name, address) VALUES (%s, %s)`, name, address)
+}
+
+// Asset queries
+func insertAssetQuery(name, symbol string, decimals int, chainID int64) string {
+	return fmt.Sprintf(
+		`INSERT INTO assets (name, symbol, decimals, chain_id) VALUES (%s, %s, %d, %d)`,
+		name,
+		symbol,
+		decimals,
+		chainID,
+	)
+}
+
+// Chain queries
+func insertChainQuery(name string, networkID string) string {
+	return fmt.Sprintf(`INSERT INTO chains (name, network_id) VALUES (%s, %d)`, name, networkID)
+}
+
+// Credential queries
+func insertCredentialQuery(
+	handle, controller, attestationType, origin string,
+	credentialID, publicKey []byte,
+	transport string,
+	signCount uint32,
+	userPresent, userVerified, backupEligible, backupState, cloneWarning bool,
+) string {
+	return fmt.Sprintf(`INSERT INTO credentials (
+		handle, controller, attestation_type, origin, 
+		credential_id, public_key, transport, sign_count, 
+		user_present, user_verified, backup_eligible, 
+		backup_state, clone_warning
+	) VALUES (%s, %s, %s, %s, %s, %s, %s, %d, %t, %t, %t, %t, %t)`,
+		handle, controller, attestationType, origin,
+		credentialID, publicKey, transport, signCount,
+		userPresent, userVerified, backupEligible,
+		backupState, cloneWarning)
+}
+
+// Profile queries
+func insertProfileQuery(
+	id, subject, controller, originURI, publicMetadata, privateMetadata string,
+) string {
+	return fmt.Sprintf(`INSERT INTO profiles (
+		id, subject, controller, origin_uri, 
+		public_metadata, private_metadata
+	) VALUES (%s, %s, %s, %s, %s, %s)`,
+		id, subject, controller, originURI,
+		publicMetadata, privateMetadata)
+}
+
+// Property queries
+func insertPropertyQuery(profileID, key, accumulator, propertyKey string) string {
+	return fmt.Sprintf(`INSERT INTO properties (
+		profile_id, key, accumulator, property_key
+	) VALUES (%s, %s, %s, %s)`,
+		profileID, key, accumulator, propertyKey)
+}
+
+// Permission queries
+func insertPermissionQuery(serviceID, grants, scopes string) string {
+	return fmt.Sprintf(
+		`INSERT INTO permissions (service_id, grants, scopes) VALUES (%s, %s, %s)`,
+		serviceID,
+		grants,
+		scopes,
+	)
+}
+
+// GetPermission query
+func getPermissionQuery(serviceID string) string {
+	return fmt.Sprintf(`SELECT grants, scopes FROM permissions WHERE service_id = %s`, serviceID)
+}

internal/db/tables.go

@@ -0,0 +1,104 @@
+package db
+
+const (
+	createAccountsTable = `
+		CREATE TABLE IF NOT EXISTS accounts (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			name TEXT NOT NULL,
+			address TEXT NOT NULL UNIQUE,
+			public_key BLOB NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`
+
+	createAssetsTable = `
+		CREATE TABLE IF NOT EXISTS assets (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			name TEXT NOT NULL,
+			symbol TEXT NOT NULL,
+			decimals INTEGER NOT NULL,
+			chain_id INTEGER,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			FOREIGN KEY (chain_id) REFERENCES chains(id)
+		)
+	`
+
+	createChainsTable = `
+		CREATE TABLE IF NOT EXISTS chains (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			name TEXT NOT NULL,
+			network_id TEXT NOT NULL UNIQUE,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`
+
+	createCredentialsTable = `
+		CREATE TABLE IF NOT EXISTS credentials (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			handle TEXT NOT NULL,
+			controller TEXT NOT NULL,
+			attestation_type TEXT NOT NULL,
+			origin TEXT NOT NULL,
+			credential_id BLOB NOT NULL,
+			public_key BLOB NOT NULL,
+			transport TEXT NOT NULL,
+			sign_count INTEGER NOT NULL,
+			user_present BOOLEAN NOT NULL,
+			user_verified BOOLEAN NOT NULL,
+			backup_eligible BOOLEAN NOT NULL,
+			backup_state BOOLEAN NOT NULL,
+			clone_warning BOOLEAN NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`
+
+	createProfilesTable = `
+		CREATE TABLE IF NOT EXISTS profiles (
+			id TEXT PRIMARY KEY,
+			subject TEXT NOT NULL,
+			controller TEXT NOT NULL,
+			origin_uri TEXT,
+			public_metadata TEXT,
+			private_metadata TEXT,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`
+
+	createPropertiesTable = `
+		CREATE TABLE IF NOT EXISTS properties (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			profile_id TEXT NOT NULL,
+			key TEXT NOT NULL,
+			accumulator BLOB NOT NULL,
+			property_key BLOB NOT NULL,
+			FOREIGN KEY (profile_id) REFERENCES profiles(id)
+		)
+	`
+
+	createKeysharesTable = `
+		CREATE TABLE IF NOT EXISTS keyshares (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			metadata TEXT NOT NULL,
+			payloads TEXT NOT NULL,
+			protocol TEXT NOT NULL,
+			public_key BLOB NOT NULL,
+			role INTEGER NOT NULL,
+			version INTEGER NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP
+		)
+	`
+
+	createPermissionsTable = `
+		CREATE TABLE IF NOT EXISTS permissions (
+			id INTEGER PRIMARY KEY AUTOINCREMENT,
+			service_id TEXT NOT NULL,
+			grants TEXT NOT NULL,
+			scopes TEXT NOT NULL,
+			created_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			updated_at TIMESTAMP DEFAULT CURRENT_TIMESTAMP,
+			FOREIGN KEY (service_id) REFERENCES services(id)
+		)
+	`
+)