From 3536a790ccfb98f61948bbba622d4b08904eb437 Mon Sep 17 00:00:00 2001
From: alberto bogi <alberto.bogi@tirasa.net>
Date: Fri, 7 Aug 2026 17:14:17 +0200
Subject: [PATCH 1/2] [SYNCOPE-1987] Improve SQL upgrade statement generation
 for Syncope 4.0 > 4.1 persistence migration

---
 .../upgrade/AbstractUpgradeStatements.java    | 41 ++++++++++
 .../jpa/upgrade/GenerateUpgradeSQL.java       |  9 ++-
 .../jpa/upgrade/MariaDBUpgradeStatements.java | 74 +++++++++++++++++
 .../jpa/upgrade/MySQLUpgradeStatements.java   | 80 +++++++++++++++++++
 .../jpa/upgrade/OracleUpgradeStatements.java  | 77 ++++++++++++++++++
 .../upgrade/PostgreSQLUpgradeStatements.java  | 43 ++++++++++
 .../jpa/upgrade/UpgradeStatements.java        | 24 ++++++
 .../jpa/upgrade/UpgradeStatementsFactory.java | 42 ++++++++++
 .../src/main/resources/schema-mariadb.xml     | 62 +++++++-------
 .../src/main/resources/schema-mysql.xml       | 62 +++++++-------
 10 files changed, 448 insertions(+), 66 deletions(-)
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/AbstractUpgradeStatements.java
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MariaDBUpgradeStatements.java
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MySQLUpgradeStatements.java
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/OracleUpgradeStatements.java
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/PostgreSQLUpgradeStatements.java
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatements.java
 create mode 100644 core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java

diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/AbstractUpgradeStatements.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/AbstractUpgradeStatements.java
new file mode 100644
index 00000000000..2c3ef60ebcc
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/AbstractUpgradeStatements.java
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+public abstract class AbstractUpgradeStatements implements UpgradeStatements {
+
+    protected String commonStatements() {
+        return """
+                INSERT INTO GroupTypeExtension SELECT * FROM TypeExtension;
+                INSERT INTO GroupTypeExtension_Class SELECT * FROM TypeExtension_AnyTypeClass;
+
+                DROP TABLE TypeExtension_AnyTypeClass;
+                DROP TABLE TypeExtension;
+                DROP TABLE SyncopeRole_DynRealm;
+                DROP TABLE DynRealmMembership;
+                DROP TABLE DynRealm;
+                DROP TABLE UDynGroupMembership;
+                DROP TABLE ADynGroupMembership;
+                DROP TABLE UDynGroupMembers;
+                DROP TABLE ADynGroupMembers;
+                DROP TABLE DynRoleMembers;
+                DROP TABLE DynRealmMembers;
+                """;
+    }
+}
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/GenerateUpgradeSQL.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/GenerateUpgradeSQL.java
index 6de47930d2b..ecba0b63b27 100644
--- a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/GenerateUpgradeSQL.java
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/GenerateUpgradeSQL.java
@@ -38,9 +38,6 @@ public class GenerateUpgradeSQL {
             UPDATE SyncopeGroup SET gManager_id=groupOwner_id;
             ALTER TABLE SyncopeGroup DROP COLUMN groupOwner_id;
 
-            INSERT INTO OIDCOpEntity SELECT id,json AS jwks,'{}' AS customScopes FROM OIDCJWKS;
-            DROP TABLE OIDCJWKS;
-
             DROP TABLE SyncopeRole_DynRealm;
             DROP TABLE DynRealmMembership;
             DROP TABLE DynRealm;
@@ -67,7 +64,11 @@ public void run(final Writer out) throws IOException, SQLException {
             // run OpenJPA's SchemaTool to get the update statements
             schemaTool.run();
 
-            out.append('\n').append(INIT_SQL_STATEMENTS).append('\n');
+            UpgradeStatements statements = UpgradeStatementsFactory.forDatabase(jdbcConf.getDBDictionaryInstance());
+
+            out.append('\n');
+            out.append(statements.getStatements());
+            out.append('\n');
         }
     }
 }
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MariaDBUpgradeStatements.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MariaDBUpgradeStatements.java
new file mode 100644
index 00000000000..929ee418715
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MariaDBUpgradeStatements.java
@@ -0,0 +1,74 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+public class MariaDBUpgradeStatements extends AbstractUpgradeStatements {
+
+    @Override
+    public String getStatements() {
+
+        String mariaDBUpgradeStatements = """
+                UPDATE SyncopeGroup SET uManager_id=userOwner_id;
+
+                SET @fk_name = (
+                    SELECT CONSTRAINT_NAME
+                    FROM information_schema.KEY_COLUMN_USAGE
+                    WHERE TABLE_SCHEMA = DATABASE()
+                      AND TABLE_NAME = 'SyncopeGroup'
+                      AND COLUMN_NAME = 'userOwner_id'
+                      AND REFERENCED_TABLE_NAME IS NOT NULL
+                    LIMIT 1
+                );
+                
+                SET @sql = CONCAT('ALTER TABLE SyncopeGroup DROP FOREIGN KEY `', @fk_name, '`');
+                PREPARE stmt FROM @sql;
+                EXECUTE stmt;
+                DEALLOCATE PREPARE stmt;
+                ALTER TABLE SyncopeGroup DROP COLUMN userOwner_id;
+                
+                UPDATE SyncopeGroup SET gManager_id=groupOwner_id;
+                SET @fk_name = (
+                    SELECT CONSTRAINT_NAME
+                    FROM information_schema.KEY_COLUMN_USAGE
+                    WHERE TABLE_SCHEMA = DATABASE()
+                      AND TABLE_NAME = 'SyncopeGroup'
+                      AND COLUMN_NAME = 'groupOwner_id'
+                      AND REFERENCED_TABLE_NAME IS NOT NULL
+                    LIMIT 1
+                );
+
+                SET @sql = CONCAT('ALTER TABLE SyncopeGroup DROP FOREIGN KEY `', @fk_name, '`');
+                PREPARE stmt FROM @sql;
+                EXECUTE stmt;
+                DEALLOCATE PREPARE stmt;
+                ALTER TABLE SyncopeGroup DROP COLUMN groupOwner_id;
+
+                DELETE FROM AccessToken;
+                ALTER TABLE AccessToken MODIFY COLUMN authorities TEXT;
+
+                INSERT INTO OIDCOpEntity (id, jwks, customScopes)
+                SELECT id, json ,'{}'
+                FROM OIDCJWKS;
+
+                DROP TABLE OIDCJWKS;
+                """;
+
+        return commonStatements() + mariaDBUpgradeStatements;
+    }
+}
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MySQLUpgradeStatements.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MySQLUpgradeStatements.java
new file mode 100644
index 00000000000..c9425cbc3bc
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/MySQLUpgradeStatements.java
@@ -0,0 +1,80 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+public class MySQLUpgradeStatements extends AbstractUpgradeStatements {
+
+    @Override
+    public String getStatements() {
+
+        String mysqlUpgradeStatements = """
+                UPDATE SyncopeGroup SET uManager_id=userOwner_id;
+
+                SET @fk_name = (
+                    SELECT CONSTRAINT_NAME
+                    FROM information_schema.KEY_COLUMN_USAGE
+                    WHERE TABLE_SCHEMA = DATABASE()
+                      AND TABLE_NAME = 'SyncopeGroup'
+                      AND COLUMN_NAME = 'userOwner_id'
+                      AND REFERENCED_TABLE_NAME IS NOT NULL
+                    LIMIT 1
+                );
+                
+                SET @sql = CONCAT(
+                        'ALTER TABLE SyncopeGroup DROP FOREIGN KEY ',
+                        @fk_name
+                           );
+                PREPARE stmt FROM @sql;
+                EXECUTE stmt;
+                DEALLOCATE PREPARE stmt;
+                ALTER TABLE SyncopeGroup DROP COLUMN userOwner_id;
+                
+                UPDATE SyncopeGroup SET gManager_id=groupOwner_id;
+                SET @fk_name = (
+                    SELECT CONSTRAINT_NAME
+                    FROM information_schema.KEY_COLUMN_USAGE
+                    WHERE TABLE_SCHEMA = DATABASE()
+                      AND TABLE_NAME = 'SyncopeGroup'
+                      AND COLUMN_NAME = 'groupOwner_id'
+                      AND REFERENCED_TABLE_NAME IS NOT NULL
+                    LIMIT 1
+                );
+
+                SET @sql = CONCAT(
+                        'ALTER TABLE SyncopeGroup DROP FOREIGN KEY ',
+                        @fk_name
+                           );
+                PREPARE stmt FROM @sql;
+                EXECUTE stmt;
+                DEALLOCATE PREPARE stmt;
+                ALTER TABLE SyncopeGroup DROP COLUMN groupOwner_id;
+
+                DELETE FROM AccessToken;
+                ALTER TABLE AccessToken MODIFY COLUMN authorities TEXT;
+
+                INSERT INTO OIDCOpEntity (id, jwks, customScopes)
+                SELECT id, CAST(json AS BINARY) ,'{}'
+                FROM OIDCJWKS;
+
+                DROP TABLE OIDCJWKS;
+                """;
+
+        return commonStatements() + mysqlUpgradeStatements;
+    }
+}
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/OracleUpgradeStatements.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/OracleUpgradeStatements.java
new file mode 100644
index 00000000000..5f524ee8a2d
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/OracleUpgradeStatements.java
@@ -0,0 +1,77 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+public class OracleUpgradeStatements extends AbstractUpgradeStatements {
+
+    @Override
+    public String getStatements() {
+
+        String postgreSQLUpgradeStatements = """
+                UPDATE SyncopeGroup SET uManager_id=userOwner_id;
+                ALTER TABLE SyncopeGroup DROP COLUMN userOwner_id;
+
+                UPDATE SyncopeGroup SET gManager_id=groupOwner_id;
+                ALTER TABLE SyncopeGroup DROP COLUMN groupOwner_id;
+
+                DELETE FROM ACCESSTOKEN;
+                ALTER TABLE ACCESSTOKEN MODIFY AUTHORITIES CLOB;
+                INSERT INTO OIDCOpEntity (id, jwks, customScopes)
+                      SELECT id, clob_to_blob(json),'{}' FROM OIDCJWKS;
+
+                DROP TABLE OIDCJWKS;
+                """;
+
+        return convertCLOBToBLOBFunction() + commonStatements() + postgreSQLUpgradeStatements;
+    }
+
+    private String convertCLOBToBLOBFunction() {
+        return """
+                CREATE OR REPLACE FUNCTION clob_to_blob(
+                    p_clob IN CLOB
+                ) RETURN BLOB IS
+                    l_blob        BLOB;
+                    l_dest_offset INTEGER := 1;
+                    l_src_offset  INTEGER := 1;
+                    l_lang_ctx    INTEGER := DBMS_LOB.DEFAULT_LANG_CTX;
+                    l_warning     INTEGER;
+                BEGIN
+                    IF p_clob IS NULL THEN
+                        RETURN NULL;
+                    END IF;
+                
+                    DBMS_LOB.CREATETEMPORARY(l_blob, TRUE);
+                
+                    DBMS_LOB.CONVERTTOBLOB(
+                        dest_lob     => l_blob,
+                        src_clob     => p_clob,
+                        amount       => DBMS_LOB.LOBMAXSIZE,
+                        dest_offset  => l_dest_offset,
+                        src_offset   => l_src_offset,
+                        blob_csid    => NLS_CHARSET_ID('AL32UTF8'),
+                        lang_context => l_lang_ctx,
+                        warning      => l_warning
+                    );
+
+                    RETURN l_blob;
+                END;
+
+                """;
+    }
+}
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/PostgreSQLUpgradeStatements.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/PostgreSQLUpgradeStatements.java
new file mode 100644
index 00000000000..417de714392
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/PostgreSQLUpgradeStatements.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+public class PostgreSQLUpgradeStatements extends AbstractUpgradeStatements {
+
+    @Override
+    public String getStatements() {
+
+        String postgreSQLUpgradeStatements = """
+                UPDATE SyncopeGroup SET uManager_id=userOwner_id;
+                ALTER TABLE SyncopeGroup DROP COLUMN userOwner_id;
+
+                UPDATE SyncopeGroup SET gManager_id=groupOwner_id;
+                ALTER TABLE SyncopeGroup DROP COLUMN groupOwner_id;
+
+                DELETE FROM AccessToken;
+                ALTER TABLE AccessToken ALTER COLUMN authorities TYPE TEXT;
+                INSERT INTO OIDCOpEntity (id, jwks, customScopes)
+                      SELECT id,convert_to(json, 'UTF-8') AS jwks,'{}' AS customScopes FROM OIDCJWKS;
+
+                DROP TABLE OIDCJWKS;
+                """;
+
+        return commonStatements() + postgreSQLUpgradeStatements;
+    }
+}
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatements.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatements.java
new file mode 100644
index 00000000000..4c7b7bf8461
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatements.java
@@ -0,0 +1,24 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+public interface UpgradeStatements {
+
+    String getStatements();
+}
diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java
new file mode 100644
index 00000000000..b5f2e57ea0c
--- /dev/null
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java
@@ -0,0 +1,42 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.syncope.core.persistence.jpa.upgrade;
+
+import org.apache.openjpa.jdbc.sql.DBDictionary;
+import org.apache.openjpa.jdbc.sql.MariaDBDictionary;
+import org.apache.openjpa.jdbc.sql.MySQLDictionary;
+import org.apache.openjpa.jdbc.sql.OracleDictionary;
+import org.apache.openjpa.jdbc.sql.PostgresDictionary;
+
+public final class UpgradeStatementsFactory {
+
+    private UpgradeStatementsFactory() {
+    }
+
+    public static UpgradeStatements forDatabase(final DBDictionary dictionary) {
+
+        return switch (dictionary) {
+            case PostgresDictionary ignore -> new PostgreSQLUpgradeStatements();
+            case MySQLDictionary ignore -> new MySQLUpgradeStatements();
+            case MariaDBDictionary ignore -> new MariaDBUpgradeStatements();
+            case OracleDictionary ignore -> new OracleUpgradeStatements();
+            default -> throw new IllegalArgumentException(dictionary.platform);
+        };
+    }
+}
diff --git a/core/persistence-jpa-upgrader/src/main/resources/schema-mariadb.xml b/core/persistence-jpa-upgrader/src/main/resources/schema-mariadb.xml
index 25aa8bbebd1..f2e5fa8aa02 100644
--- a/core/persistence-jpa-upgrader/src/main/resources/schema-mariadb.xml
+++ b/core/persistence-jpa-upgrader/src/main/resources/schema-mariadb.xml
@@ -62,7 +62,7 @@ under the License.
             <column name="id" type="varchar" not-null="true" size="255"/>
             <column name="authorities" type="clob" size="-1"/>
             <column name="body" type="clob" size="-1"/>
-            <column name="expirationTime" type="unknown(2014)"/>
+            <column name="expirationTime" type="timestamp"/>
             <column name="owner" type="varchar" size="255"/>
             <unique name="U_CCSSTKN_OWNER" column="owner"/>
         </table>
@@ -104,10 +104,10 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="creationContext" type="varchar" size="255"/>
-            <column name="creationDate" type="unknown(2014)"/>
+            <column name="creationDate" type="timestamp"/>
             <column name="creator" type="varchar" size="255"/>
             <column name="lastChangeContext" type="varchar" size="255"/>
-            <column name="lastChangeDate" type="unknown(2014)"/>
+            <column name="lastChangeDate" type="timestamp"/>
             <column name="lastModifier" type="varchar" size="255"/>
             <column name="status" type="varchar" size="255"/>
             <column name="name" type="varchar" size="255"/>
@@ -245,7 +245,7 @@ under the License.
             <column name="opEvent" type="varchar" size="255"/>
             <column name="output" type="clob" size="-1"/>
             <column name="throwable" type="clob" size="-1"/>
-            <column name="event_date" type="unknown(2014)" not-null="true"/>
+            <column name="event_date" type="timestamp" not-null="true"/>
             <column name="who" type="varchar" size="255"/>
         </table>
         <table name="AuthModule">
@@ -333,8 +333,8 @@ under the License.
         <table name="Delegation">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="endDate" type="timestamp"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="DELEGATED_ID" type="varchar" size="36"/>
             <column name="DELEGATING_ID" type="varchar" size="36"/>
             <fk to-table="SyncopeUser" column="DELEGATED_ID"/>
@@ -589,10 +589,10 @@ under the License.
         <table name="LiveSyncTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="LiveSyncTask" column="TASK_ID"/>
@@ -633,10 +633,10 @@ under the License.
         <table name="MacroTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="MacroTask" column="TASK_ID"/>
@@ -696,10 +696,10 @@ under the License.
         <table name="NotificationTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="NotificationTask" column="TASK_ID"/>
@@ -852,10 +852,10 @@ under the License.
         <table name="PropagationTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="PropagationTask" column="TASK_ID"/>
@@ -906,10 +906,10 @@ under the License.
         <table name="PullTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="PullTask" column="TASK_ID"/>
@@ -979,10 +979,10 @@ under the License.
         <table name="PushTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="PushTask" column="TASK_ID"/>
@@ -1094,7 +1094,7 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="error" type="clob" size="-1"/>
-            <column name="instant" type="unknown(2014)"/>
+            <column name="instant" type="timestamp"/>
             <column name="operation" type="varchar" size="20"/>
             <column name="payload" type="clob" size="-1"/>
             <column name="remoteName" type="varchar" size="255"/>
@@ -1121,10 +1121,10 @@ under the License.
         <table name="ReportExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="execResult" type="blob" size="-1"/>
             <column name="REPORT_ID" type="varchar" size="36"/>
@@ -1223,10 +1223,10 @@ under the License.
         <table name="SchedTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="SchedTask" column="TASK_ID"/>
@@ -1245,7 +1245,7 @@ under the License.
         <table name="SyncopeBatch">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="255"/>
-            <column name="expiryTime" type="unknown(2014)"/>
+            <column name="expiryTime" type="timestamp"/>
             <column name="results" type="clob" size="-1"/>
         </table>
         <table name="SyncopeDomain">
@@ -1257,10 +1257,10 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="creationContext" type="varchar" size="255"/>
-            <column name="creationDate" type="unknown(2014)"/>
+            <column name="creationDate" type="timestamp"/>
             <column name="creator" type="varchar" size="255"/>
             <column name="lastChangeContext" type="varchar" size="255"/>
-            <column name="lastChangeDate" type="unknown(2014)"/>
+            <column name="lastChangeDate" type="timestamp"/>
             <column name="lastModifier" type="varchar" size="255"/>
             <column name="status" type="varchar" size="255"/>
             <column name="name" type="varchar" size="255"/>
@@ -1327,16 +1327,16 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="creationContext" type="varchar" size="255"/>
-            <column name="creationDate" type="unknown(2014)"/>
+            <column name="creationDate" type="timestamp"/>
             <column name="creator" type="varchar" size="255"/>
             <column name="lastChangeContext" type="varchar" size="255"/>
-            <column name="lastChangeDate" type="unknown(2014)"/>
+            <column name="lastChangeDate" type="timestamp"/>
             <column name="lastModifier" type="varchar" size="255"/>
             <column name="status" type="varchar" size="255"/>
-            <column name="changePwdDate" type="unknown(2014)"/>
+            <column name="changePwdDate" type="timestamp"/>
             <column name="cipherAlgorithm" type="varchar" size="20"/>
             <column name="failedLogins" type="integer"/>
-            <column name="lastLoginDate" type="unknown(2014)"/>
+            <column name="lastLoginDate" type="timestamp"/>
             <column name="mustChangePassword" type="bit"/>
             <column name="password" type="varchar" size="255"/>
             <column name="passwordHistory" type="clob" size="-1"/>
@@ -1344,7 +1344,7 @@ under the License.
             <column name="securityAnswer" type="varchar" size="255"/>
             <column name="suspended" type="bit"/>
             <column name="token" type="clob" size="-1"/>
-            <column name="tokenExpireTime" type="unknown(2014)"/>
+            <column name="tokenExpireTime" type="timestamp"/>
             <column name="username" type="varchar" size="255"/>
             <column name="GMANAGER_ID" type="varchar" size="36"/>
             <column name="REALM_ID" type="varchar" size="36"/>
diff --git a/core/persistence-jpa-upgrader/src/main/resources/schema-mysql.xml b/core/persistence-jpa-upgrader/src/main/resources/schema-mysql.xml
index 91d6c120310..8519c8f6d5d 100644
--- a/core/persistence-jpa-upgrader/src/main/resources/schema-mysql.xml
+++ b/core/persistence-jpa-upgrader/src/main/resources/schema-mysql.xml
@@ -62,7 +62,7 @@ under the License.
             <column name="id" type="varchar" not-null="true" size="255"/>
             <column name="authorities" type="clob" size="-1"/>
             <column name="body" type="clob" size="-1"/>
-            <column name="expirationTime" type="unknown(2014)"/>
+            <column name="expirationTime" type="timestamp"/>
             <column name="owner" type="varchar" size="255"/>
             <unique name="U_CCSSTKN_OWNER" column="owner"/>
         </table>
@@ -104,10 +104,10 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="creationContext" type="varchar" size="255"/>
-            <column name="creationDate" type="unknown(2014)"/>
+            <column name="creationDate" type="timestamp"/>
             <column name="creator" type="varchar" size="255"/>
             <column name="lastChangeContext" type="varchar" size="255"/>
-            <column name="lastChangeDate" type="unknown(2014)"/>
+            <column name="lastChangeDate" type="timestamp"/>
             <column name="lastModifier" type="varchar" size="255"/>
             <column name="status" type="varchar" size="255"/>
             <column name="name" type="varchar" size="255"/>
@@ -245,7 +245,7 @@ under the License.
             <column name="opEvent" type="varchar" size="255"/>
             <column name="output" type="clob" size="-1"/>
             <column name="throwable" type="clob" size="-1"/>
-            <column name="event_date" type="unknown(2014)" not-null="true"/>
+            <column name="event_date" type="timestamp" not-null="true"/>
             <column name="who" type="varchar" size="255"/>
         </table>
         <table name="AuthModule">
@@ -333,8 +333,8 @@ under the License.
         <table name="Delegation">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="endDate" type="timestamp"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="DELEGATED_ID" type="varchar" size="36"/>
             <column name="DELEGATING_ID" type="varchar" size="36"/>
             <fk to-table="SyncopeUser" column="DELEGATED_ID"/>
@@ -589,10 +589,10 @@ under the License.
         <table name="LiveSyncTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="LiveSyncTask" column="TASK_ID"/>
@@ -633,10 +633,10 @@ under the License.
         <table name="MacroTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="MacroTask" column="TASK_ID"/>
@@ -696,10 +696,10 @@ under the License.
         <table name="NotificationTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="NotificationTask" column="TASK_ID"/>
@@ -852,10 +852,10 @@ under the License.
         <table name="PropagationTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="PropagationTask" column="TASK_ID"/>
@@ -906,10 +906,10 @@ under the License.
         <table name="PullTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="PullTask" column="TASK_ID"/>
@@ -979,10 +979,10 @@ under the License.
         <table name="PushTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="PushTask" column="TASK_ID"/>
@@ -1094,7 +1094,7 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="error" type="clob" size="-1"/>
-            <column name="instant" type="unknown(2014)"/>
+            <column name="instant" type="timestamp"/>
             <column name="operation" type="varchar" size="20"/>
             <column name="payload" type="clob" size="-1"/>
             <column name="remoteName" type="varchar" size="255"/>
@@ -1121,10 +1121,10 @@ under the License.
         <table name="ReportExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="execResult" type="blob" size="-1"/>
             <column name="REPORT_ID" type="varchar" size="36"/>
@@ -1223,10 +1223,10 @@ under the License.
         <table name="SchedTaskExec">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
-            <column name="endDate" type="unknown(2014)"/>
+            <column name="endDate" type="timestamp"/>
             <column name="executor" type="varchar" size="255"/>
             <column name="message" type="clob" size="-1"/>
-            <column name="startDate" type="unknown(2014)" not-null="true"/>
+            <column name="startDate" type="timestamp" not-null="true"/>
             <column name="status" type="varchar" size="255"/>
             <column name="TASK_ID" type="varchar" size="36"/>
             <fk to-table="SchedTask" column="TASK_ID"/>
@@ -1245,7 +1245,7 @@ under the License.
         <table name="SyncopeBatch">
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="255"/>
-            <column name="expiryTime" type="unknown(2014)"/>
+            <column name="expiryTime" type="timestamp"/>
             <column name="results" type="clob" size="-1"/>
         </table>
         <table name="SyncopeDomain">
@@ -1257,10 +1257,10 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="creationContext" type="varchar" size="255"/>
-            <column name="creationDate" type="unknown(2014)"/>
+            <column name="creationDate" type="timestamp"/>
             <column name="creator" type="varchar" size="255"/>
             <column name="lastChangeContext" type="varchar" size="255"/>
-            <column name="lastChangeDate" type="unknown(2014)"/>
+            <column name="lastChangeDate" type="timestamp"/>
             <column name="lastModifier" type="varchar" size="255"/>
             <column name="status" type="varchar" size="255"/>
             <column name="name" type="varchar" size="255"/>
@@ -1327,16 +1327,16 @@ under the License.
             <pk column="id"/>
             <column name="id" type="varchar" not-null="true" size="36"/>
             <column name="creationContext" type="varchar" size="255"/>
-            <column name="creationDate" type="unknown(2014)"/>
+            <column name="creationDate" type="timestamp"/>
             <column name="creator" type="varchar" size="255"/>
             <column name="lastChangeContext" type="varchar" size="255"/>
-            <column name="lastChangeDate" type="unknown(2014)"/>
+            <column name="lastChangeDate" type="timestamp"/>
             <column name="lastModifier" type="varchar" size="255"/>
             <column name="status" type="varchar" size="255"/>
-            <column name="changePwdDate" type="unknown(2014)"/>
+            <column name="changePwdDate" type="timestamp"/>
             <column name="cipherAlgorithm" type="varchar" size="20"/>
             <column name="failedLogins" type="integer"/>
-            <column name="lastLoginDate" type="unknown(2014)"/>
+            <column name="lastLoginDate" type="timestamp"/>
             <column name="mustChangePassword" type="bit"/>
             <column name="password" type="varchar" size="255"/>
             <column name="passwordHistory" type="clob" size="-1"/>
@@ -1344,7 +1344,7 @@ under the License.
             <column name="securityAnswer" type="varchar" size="255"/>
             <column name="suspended" type="bit"/>
             <column name="token" type="clob" size="-1"/>
-            <column name="tokenExpireTime" type="unknown(2014)"/>
+            <column name="tokenExpireTime" type="timestamp"/>
             <column name="username" type="varchar" size="255"/>
             <column name="GMANAGER_ID" type="varchar" size="36"/>
             <column name="REALM_ID" type="varchar" size="36"/>

From 42221608c2460e0df037c661849a327b9d09713a Mon Sep 17 00:00:00 2001
From: alberto bogi <alberto.bogi@tirasa.net>
Date: Fri, 7 Aug 2026 17:46:58 +0200
Subject: [PATCH 2/2] [SYNCOPE-1987] Fix for CodeQL

---
 .../jpa/upgrade/UpgradeStatementsFactory.java | 21 ++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java
index b5f2e57ea0c..dce3d268447 100644
--- a/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java
+++ b/core/persistence-jpa-upgrader/src/main/java/org/apache/syncope/core/persistence/jpa/upgrade/UpgradeStatementsFactory.java
@@ -31,12 +31,19 @@ private UpgradeStatementsFactory() {
 
     public static UpgradeStatements forDatabase(final DBDictionary dictionary) {
 
-        return switch (dictionary) {
-            case PostgresDictionary ignore -> new PostgreSQLUpgradeStatements();
-            case MySQLDictionary ignore -> new MySQLUpgradeStatements();
-            case MariaDBDictionary ignore -> new MariaDBUpgradeStatements();
-            case OracleDictionary ignore -> new OracleUpgradeStatements();
-            default -> throw new IllegalArgumentException(dictionary.platform);
-        };
+        if (dictionary instanceof PostgresDictionary) {
+            return new PostgreSQLUpgradeStatements();
+        }
+        if (dictionary instanceof MySQLDictionary) {
+            return new MySQLUpgradeStatements();
+        }
+        if (dictionary instanceof MariaDBDictionary) {
+            return new MariaDBUpgradeStatements();
+        }
+        if (dictionary instanceof OracleDictionary) {
+            return new OracleUpgradeStatements();
+        }
+
+        throw new IllegalArgumentException(dictionary.platform);
     }
 }