@atlasauth/cli 0.11.0 → 0.13.0

package/dist/migrate/export/auth0.d.ts

@@ -0,0 +1,62 @@
+import type { PasswordHash } from '@atlasauth/migrate';
+import { RecordSet, type Obj } from './record-set';
+/**
+ * `atlas migrate export auth0` — Auth0 (and Okta Customer Identity Cloud,
+ * which is Auth0) onto the canonical bundle models.
+ *
+ * Read with a Management API token the owner holds (a machine-to-machine
+ * application's client id + secret, or a token pasted from the dashboard);
+ * the calls run on this machine and the credentials go nowhere else.
+ *
+ *   - users: through a user-export JOB (the only complete listing — user
+ *     search stops at 1,000), or from an export file the owner already has;
+ *   - password hashes and MFA secrets: Auth0 releases them ONLY through a
+ *     support ticket. Pass the decrypted file with --auth0-hashes-file; rows are matched
+ *     by user id (`_id.$oid` → `auth0|<oid>`) or email. Without it, enable the
+ *     `auth0` lazy-migration preset so passwords move on first sign-in;
+ *   - social and enterprise identities, app roles (role → users), organizations,
+ *     members with their roles, pending invitations, enterprise connections
+ *     (SAML / OIDC / Azure AD / ADFS / Okta / Ping / Google Workspace), and the
+ *     tenant's public signing keys;
+ *   - with --authentication-methods: per user, phone/email second factors and
+ *     passkeys (public key only — Auth0 never returns a TOTP secret by API).
+ *
+ * Sessions are not exported: Auth0 issues JWTs, bridged by the `auth0`
+ * bridge preset against the tenant's JWKS.
+ */
+export interface Auth0ExportOptions {
+    /** The tenant's canonical domain (`acme.us.auth0.com`), not a custom domain. */
+    domain: string;
+    clientId?: string;
+    clientSecret?: string;
+    /** A Management API token, instead of client credentials. */
+    token?: string;
+    /** The text of a user export file (NDJSON or JSON array), instead of running an export job. */
+    usersText?: string;
+    /** The text of the decrypted password-hash / MFA export from Auth0 support (NDJSON or JSON). */
+    hashesText?: string;
+    /** Only this database / social connection's users (export job `connection_id`). */
+    connectionId?: string;
+    /** Read each user's authentication methods (phone/email factors, passkeys). One call per user. */
+    authenticationMethods?: boolean;
+    /** The WebAuthn relying party the passkeys were registered for (default: the domain). */
+    rpId?: string;
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    onProgress?: (message: string) => void;
+}
+/** Fields requested from the export job (json format allows whole metadata objects). */
+export declare const AUTH0_EXPORT_FIELDS: readonly ["user_id", "email", "email_verified", "username", "phone_number", "phone_verified", "given_name", "family_name", "name", "nickname", "picture", "identities", "app_metadata", "user_metadata", "created_at", "last_login", "blocked"];
+export declare function exportAuth0(opts: Auth0ExportOptions): Promise<RecordSet>;
+export declare function managementToken(domain: string, opts: Auth0ExportOptions, fetchImpl: typeof fetch): Promise<string>;
+/** NDJSON (Auth0's export format) or a JSON array / `{ users: [] }`. */
+export declare function parseLines(text: string): Obj[];
+/** Auth0 role names are free text: `Billing Admin` → `billing_admin`. */
+export declare function roleKey(name: string): string;
+/**
+ * An Auth0 bulk-import `custom_password_hash` (users imported into Auth0 that
+ * never signed in since keep it) → the Atlas registry's algorithm + params.
+ */
+export declare function auth0CustomHash(c: Obj): PasswordHash | {
+    reason: string;
+};

package/dist/migrate/export/auth0.js

@@ -0,0 +1,575 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AUTH0_EXPORT_FIELDS = void 0;
+exports.exportAuth0 = exportAuth0;
+exports.managementToken = managementToken;
+exports.parseLines = parseLines;
+exports.roleKey = roleKey;
+exports.auth0CustomHash = auth0CustomHash;
+const node_zlib_1 = require("node:zlib");
+const record_set_1 = require("./record-set");
+const vendor_http_1 = require("./vendor-http");
+/** Fields requested from the export job (json format allows whole metadata objects). */
+exports.AUTH0_EXPORT_FIELDS = [
+    'user_id',
+    'email',
+    'email_verified',
+    'username',
+    'phone_number',
+    'phone_verified',
+    'given_name',
+    'family_name',
+    'name',
+    'nickname',
+    'picture',
+    'identities',
+    'app_metadata',
+    'user_metadata',
+    'created_at',
+    'last_login',
+    'blocked',
+];
+const ENTERPRISE_STRATEGIES = ['samlp', 'oidc', 'waad', 'adfs', 'okta', 'pingfederate', 'google-apps', 'ad'];
+async function exportAuth0(opts) {
+    const set = new record_set_1.RecordSet();
+    const domain = opts.domain.replace(/^https?:\/\//, '').replace(/\/+$/, '');
+    if (!/^[a-z0-9.-]+$/i.test(domain))
+        throw new Error(`Not an Auth0 domain: ${opts.domain}`);
+    const progress = opts.onProgress ?? (() => undefined);
+    const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    let token = opts.token;
+    const http = new vendor_http_1.VendorHttp({
+        vendor: 'Auth0',
+        baseUrl: `https://${domain}/api/v2`,
+        headers: async () => ({ authorization: `Bearer ${(token ??= await managementToken(domain, opts, fetchImpl))}` }),
+        fetchImpl,
+        sleep,
+    });
+    // Offline: only the files (users + hashes), no Management API calls at all.
+    const online = Boolean(opts.token || (opts.clientId && opts.clientSecret));
+    if (!online && opts.usersText === undefined) {
+        throw new Error('Auth0 export needs a Management API token (or M2M client id + secret), or a user export file.');
+    }
+    if (!online)
+        set.warn('Exported from files only: organizations, roles and enterprise connections need Management API access.');
+    const list = async (fn) => (online ? fn() : []);
+    // Enterprise connections first: identities point at them by name.
+    progress('connections');
+    const connectionIds = new Map();
+    for (const c of await list(() => pageAll(http, `/connections?${ENTERPRISE_STRATEGIES.map((s) => `strategy=${s}`).join('&')}`, 'connections'))) {
+        const added = addConnection(set, c, domain);
+        if (added)
+            connectionIds.set((0, record_set_1.str)(c.name), added);
+    }
+    progress('organizations');
+    const orgs = await list(() => checkpointAll(http, '/organizations', 'organizations'));
+    for (const o of orgs) {
+        const id = (0, record_set_1.str)(o.id);
+        const name = (0, record_set_1.str)(o.display_name) ?? (0, record_set_1.str)(o.name);
+        if (!id || !name)
+            continue;
+        set.add('organization', (0, record_set_1.compact)({
+            id,
+            name,
+            slug: (0, record_set_1.str)(o.name),
+            image_url: (0, record_set_1.str)((0, record_set_1.isObj)(o.branding) ? o.branding.logo_url : undefined),
+            public_metadata: (0, record_set_1.bag)(o.metadata),
+        }));
+    }
+    progress('roles');
+    const roles = await list(() => pageAll(http, '/roles', 'roles'));
+    const roleKeyById = new Map();
+    const userRoles = new Map();
+    for (const r of roles) {
+        const id = (0, record_set_1.str)(r.id);
+        const name = (0, record_set_1.str)(r.name);
+        if (!id || !name)
+            continue;
+        const key = roleKey(name);
+        roleKeyById.set(id, key);
+        const permissions = (await pageAll(http, `/roles/${id}/permissions`, 'permissions'))
+            .map((p) => (0, record_set_1.str)(p.permission_name))
+            .filter((p) => !!p);
+        set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'app', permissions }), `app:${key}`);
+        if (orgs.length)
+            set.add('role', (0, record_set_1.compact)({ key, name, description: (0, record_set_1.str)(r.description), scope: 'organization', permissions }), `org:${key}`);
+        for (const u of await checkpointAll(http, `/roles/${id}/users`, 'users')) {
+            const uid = (0, record_set_1.str)(u.user_id);
+            if (uid)
+                userRoles.set(uid, [...(userRoles.get(uid) ?? []), key]);
+        }
+    }
+    progress('users');
+    const userLines = opts.usersText !== undefined ? parseLines(opts.usersText) : await runExportJob(http, opts, fetchImpl, sleep, progress);
+    const secrets = opts.hashesText !== undefined ? indexHashes(parseLines(opts.hashesText)) : null;
+    const userIds = new Set();
+    let withHash = 0;
+    for (const u of userLines) {
+        const id = (0, record_set_1.str)(u.user_id);
+        if (!id)
+            continue;
+        const secret = secrets ? (secrets.byId.get(id) ?? secrets.byEmail.get((0, record_set_1.str)(u.email)?.toLowerCase() ?? '')) : undefined;
+        if (addUser(set, u, { roles: userRoles.get(id), secret, connectionIds })) {
+            userIds.add(id);
+            if (secret?.password)
+                withHash++;
+        }
+    }
+    const dbUsers = set.list('user').filter((u) => u.id.startsWith('auth0|')).length;
+    if (!secrets && dbUsers > 0) {
+        set.warn(`${dbUsers} database user(s) without password hashes: Auth0 releases hashes only through a support ticket. Import them later with --auth0-hashes-file, or turn on the auth0 lazy-migration preset so each password moves on its first sign-in.`);
+    }
+    else if (secrets && withHash < dbUsers) {
+        set.omit('password', 'no row in the hash export for this database user', dbUsers - withHash);
+    }
+    if (opts.authenticationMethods && online) {
+        progress('authentication methods');
+        for (const id of userIds)
+            await addAuthenticationMethods(set, http, id, opts.rpId ?? domain);
+    }
+    else {
+        set.warn('Second factors and passkeys were not read (pass --authentication-methods). Without them, users re-enrol MFA in Atlas.');
+    }
+    progress('organization members');
+    for (const o of orgs) {
+        const orgId = (0, record_set_1.str)(o.id);
+        if (!orgId)
+            continue;
+        for (const m of await checkpointAll(http, `/organizations/${orgId}/members?fields=user_id,roles&include_fields=true`, 'members')) {
+            const uid = (0, record_set_1.str)(m.user_id);
+            if (!uid || !userIds.has(uid))
+                continue;
+            const role = (0, record_set_1.objs)(m.roles).map((r) => roleKeyById.get((0, record_set_1.str)(r.id) ?? '') ?? ((0, record_set_1.str)(r.name) ? roleKey((0, record_set_1.str)(r.name)) : undefined)).find(Boolean) ?? 'member';
+            set.add('membership', { organization_id: orgId, user_id: uid, role }, `${orgId}:${uid}`);
+            if ((0, record_set_1.objs)(m.roles).length > 1)
+                set.warn(`Some organization members hold several Auth0 roles; Atlas seats each member with one role (the first).`);
+        }
+        for (const inv of await pageAll(http, `/organizations/${orgId}/invitations`, 'invitations')) {
+            const id = (0, record_set_1.str)(inv.id);
+            const email = (0, record_set_1.str)((0, record_set_1.isObj)(inv.invitee) ? inv.invitee.email : undefined);
+            if (!id || !email)
+                continue;
+            const roleIds = Array.isArray(inv.roles) ? inv.roles : [];
+            set.add('invitation', (0, record_set_1.compact)({
+                id,
+                organization_id: orgId,
+                email,
+                role: roleIds.map((r) => roleKeyById.get(String(r))).find(Boolean),
+                status: 'pending',
+                expires_at: (0, record_set_1.str)(inv.expires_at),
+                created_at: (0, record_set_1.str)(inv.created_at),
+            }));
+        }
+    }
+    progress('signing keys');
+    if (online) {
+        try {
+            const res = await fetchImpl(`https://${domain}/.well-known/jwks.json`, { headers: { accept: 'application/json' } });
+            if (res.ok) {
+                const body = (await res.json());
+                for (const k of (0, record_set_1.objs)(body.keys))
+                    if ((0, record_set_1.str)(k.kid))
+                        set.add('jwks', { kid: (0, record_set_1.str)(k.kid), jwk: k });
+            }
+        }
+        catch {
+            set.warn('The tenant JWKS could not be read; the bridge preset fetches it live instead.');
+        }
+    }
+    set.manifest = {
+        origin: domain,
+        rpId: opts.authenticationMethods ? (opts.rpId ?? domain) : null,
+        providers: [...new Set(set.list('identity').map((i) => i.provider))].sort(),
+    };
+    return set;
+}
+// ── tokens and paging ───────────────────────────────────────────────────────
+async function managementToken(domain, opts, fetchImpl) {
+    if (!opts.clientId || !opts.clientSecret) {
+        throw new Error('Auth0 export needs a Management API token, or the client id and secret of a machine-to-machine application authorized for the Management API.');
+    }
+    const res = await fetchImpl(`https://${domain}/oauth/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/json', accept: 'application/json' },
+        body: JSON.stringify({ grant_type: 'client_credentials', client_id: opts.clientId, client_secret: opts.clientSecret, audience: `https://${domain}/api/v2/` }),
+    });
+    const body = (await res.json().catch(() => ({})));
+    if (!res.ok || !body.access_token) {
+        throw new vendor_http_1.VendorApiError('Auth0', res.status, '/oauth/token', body.error_description ?? 'could not get a Management API token');
+    }
+    return body.access_token;
+}
+/** page/per_page listing with include_totals (Auth0's classic paging). */
+async function pageAll(http, path, key) {
+    const out = [];
+    const sep = path.includes('?') ? '&' : '?';
+    for (let page = 0;; page++) {
+        const { body } = await http.get(`${path}${sep}page=${page}&per_page=100&include_totals=true`);
+        const rows = Array.isArray(body) ? body.filter(record_set_1.isObj) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        out.push(...rows);
+        const total = (0, record_set_1.isObj)(body) && typeof body.total === 'number' ? body.total : undefined;
+        if (rows.length < 100 || (total !== undefined && out.length >= total))
+            return out;
+    }
+}
+/** Checkpoint paging (`from` / `take`, `next` in the body): no 1,000-row ceiling. */
+async function checkpointAll(http, path, key) {
+    const out = [];
+    const sep = path.includes('?') ? '&' : '?';
+    let from;
+    for (;;) {
+        const { body } = await http.get(`${path}${sep}take=100${from ? `&from=${encodeURIComponent(from)}` : ''}`);
+        const rows = Array.isArray(body) ? body.filter(record_set_1.isObj) : (0, record_set_1.isObj)(body) ? (0, record_set_1.objs)(body[key]) : [];
+        out.push(...rows);
+        from = (0, record_set_1.isObj)(body) ? (0, record_set_1.str)(body.next) : undefined;
+        if (!from || rows.length === 0)
+            return out;
+    }
+}
+async function runExportJob(http, opts, fetchImpl, sleep, progress) {
+    const body = { format: 'json', fields: exports.AUTH0_EXPORT_FIELDS.map((name) => ({ name })) };
+    if (opts.connectionId)
+        body.connection_id = opts.connectionId;
+    let job;
+    try {
+        job = (await http.post('/jobs/users-exports', body)).body;
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 402)) {
+            throw new Error(`Auth0 refused the user export job (${err.message}). Export jobs need a paid plan and the read:users scope; or download an export yourself and pass it with --auth0-users-file.`);
+        }
+        throw err;
+    }
+    const id = (0, record_set_1.str)(job.id);
+    if (!id)
+        throw new Error('Auth0 did not return an export job id.');
+    for (let i = 0;; i++) {
+        const { body: status } = await http.get(`/jobs/${id}`);
+        const state = (0, record_set_1.str)(status.status);
+        if (state === 'completed' && (0, record_set_1.str)(status.location)) {
+            // The location is a short-lived pre-signed URL: no Auth0 credentials go with it.
+            const res = await fetchImpl((0, record_set_1.str)(status.location));
+            if (!res.ok)
+                throw new vendor_http_1.VendorApiError('Auth0', res.status, 'export download', 'the export file could not be downloaded');
+            const raw = Buffer.from(await res.arrayBuffer());
+            const text = raw[0] === 0x1f && raw[1] === 0x8b ? (0, node_zlib_1.gunzipSync)(raw).toString('utf8') : raw.toString('utf8');
+            return parseLines(text);
+        }
+        if (state === 'failed')
+            throw new Error(`The Auth0 export job ${id} failed${(0, record_set_1.str)(status.summary) ? `: ${(0, record_set_1.str)(status.summary)}` : ''}.`);
+        if (i % 6 === 0)
+            progress(`waiting for export job ${id} (${state ?? 'pending'}${typeof status.time_left_seconds === 'number' ? `, ~${status.time_left_seconds}s left` : ''})`);
+        await sleep(5000);
+    }
+}
+/** NDJSON (Auth0's export format) or a JSON array / `{ users: [] }`. */
+function parseLines(text) {
+    const t = text.trim();
+    if (!t)
+        return [];
+    if (t.startsWith('['))
+        return (0, record_set_1.objs)(JSON.parse(t));
+    try {
+        const one = JSON.parse(t);
+        if ((0, record_set_1.isObj)(one))
+            return Array.isArray(one.users) ? (0, record_set_1.objs)(one.users) : [one];
+    }
+    catch {
+        // NDJSON: one object per line.
+    }
+    return t
+        .split(/\r?\n/)
+        .filter((l) => l.trim())
+        .map((l) => JSON.parse(l))
+        .filter(record_set_1.isObj);
+}
+function indexHashes(rows) {
+    const byId = new Map();
+    const byEmail = new Map();
+    for (const r of rows) {
+        const oid = (0, record_set_1.isObj)(r._id) ? (0, record_set_1.str)(r._id.$oid) : (0, record_set_1.str)(r._id);
+        const id = (0, record_set_1.str)(r.user_id) ?? (oid ? `auth0|${oid}` : undefined);
+        const secret = {};
+        const hash = (0, record_set_1.str)(r.passwordHash) ?? (0, record_set_1.str)(r.password_hash);
+        if (hash)
+            secret.password = { algorithm: 'auto', hash };
+        else if ((0, record_set_1.isObj)(r.custom_password_hash)) {
+            const mapped = auth0CustomHash(r.custom_password_hash);
+            if ('reason' in mapped)
+                secret.passwordReason = mapped.reason;
+            else
+                secret.password = mapped;
+        }
+        // MFA secrets, when support includes them, in the bulk-import `mfa_factors` shape.
+        for (const f of (0, record_set_1.objs)(r.mfa_factors)) {
+            const totp = (0, record_set_1.isObj)(f.totp) ? (0, record_set_1.str)(f.totp.secret) : undefined;
+            if (totp)
+                (secret.totp ??= []).push(totp);
+            const phone = (0, record_set_1.isObj)(f.phone) ? (0, record_set_1.str)(f.phone.value) : undefined;
+            if (phone)
+                (secret.phones ??= []).push(phone);
+            const email = (0, record_set_1.isObj)(f.email) ? (0, record_set_1.str)(f.email.value) : undefined;
+            if (email)
+                (secret.emails ??= []).push(email);
+        }
+        if (id)
+            byId.set(id, secret);
+        const email = (0, record_set_1.str)(r.email)?.toLowerCase();
+        if (email && !byEmail.has(email))
+            byEmail.set(email, secret);
+    }
+    return { byId, byEmail };
+}
+function addUser(set, u, ctx) {
+    const id = (0, record_set_1.str)(u.user_id);
+    const email = (0, record_set_1.str)(u.email)?.toLowerCase();
+    const phone = (0, record_set_1.e164)(u.phone_number);
+    const user = (0, record_set_1.compact)({
+        id,
+        emails: email ? [{ email, verified: u.email_verified === true, primary: true }] : [],
+        phones: phone ? [{ phone, verified: u.phone_verified === true, primary: !email }] : [],
+        username: (0, record_set_1.str)(u.username),
+        first_name: (0, record_set_1.str)(u.given_name),
+        last_name: (0, record_set_1.str)(u.family_name),
+        name: (0, record_set_1.str)(u.given_name) || (0, record_set_1.str)(u.family_name) ? undefined : (0, record_set_1.str)(u.name) && (0, record_set_1.str)(u.name) !== email ? (0, record_set_1.str)(u.name) : undefined,
+        image_url: (0, record_set_1.str)(u.picture),
+        roles: ctx.roles,
+        banned: u.blocked === true ? true : undefined,
+        // app_metadata is server-controlled in Auth0 (often holds entitlements): it
+        // lands in the backend-only bag. user_metadata is user-editable.
+        private_metadata: (0, record_set_1.bag)(u.app_metadata),
+        unsafe_metadata: (0, record_set_1.bag)(u.user_metadata),
+        created_at: (0, record_set_1.str)(u.created_at),
+        last_sign_in_at: (0, record_set_1.str)(u.last_login),
+    });
+    if (ctx.secret?.password)
+        user.password = ctx.secret.password;
+    else if (ctx.secret?.passwordReason)
+        set.omit('password', ctx.secret.passwordReason);
+    if (!user.emails?.length && !user.phones?.length && !user.username) {
+        set.omit('user', 'no email, phone number or username');
+        return false;
+    }
+    set.add('user', user);
+    for (const i of (0, record_set_1.objs)(u.identities)) {
+        const provider = (0, record_set_1.str)(i.provider);
+        const sub = (0, record_set_1.str)(i.user_id);
+        if (!provider || !sub || provider === 'auth0' || provider === 'sms' || provider === 'email')
+            continue;
+        const connection = (0, record_set_1.str)(i.connection);
+        const enterprise = connection ? ctx.connectionIds.get(connection) : undefined;
+        set.add('identity', (0, record_set_1.compact)({
+            user_id: id,
+            provider: enterprise ? connection : provider,
+            provider_user_id: sub,
+            kind: enterprise ? (provider === 'samlp' || provider === 'adfs' ? 'saml' : 'oidc') : i.isSocial === true ? 'oauth' : 'enterprise',
+            sso_connection_id: enterprise,
+            profile: (0, record_set_1.bag)(i.profileData),
+        }));
+    }
+    for (const secret of ctx.secret?.totp ?? []) {
+        set.add('mfa_factor', { user_id: id, type: 'totp', secret_base32: secret.replace(/=+$/, '').toUpperCase(), digits: 6, period: 30, algorithm: 'SHA1', verified: true });
+    }
+    for (const p of ctx.secret?.phones ?? []) {
+        const n = (0, record_set_1.e164)(p);
+        if (n)
+            set.add('mfa_factor', { user_id: id, type: 'phone', phone: n, verified: true }, `phone:${id}:${n}`);
+    }
+    for (const _ of ctx.secret?.emails ?? [])
+        set.add('mfa_factor', { user_id: id, type: 'email', verified: true }, `email:${id}`);
+    return true;
+}
+async function addAuthenticationMethods(set, http, userId, rpId) {
+    let methods;
+    try {
+        methods = await pageAll(http, `/users/${encodeURIComponent(userId)}/authentication-methods`, 'authenticators');
+    }
+    catch (err) {
+        if (err instanceof vendor_http_1.VendorApiError && (err.status === 403 || err.status === 404))
+            return;
+        throw err;
+    }
+    for (const m of methods) {
+        const type = (0, record_set_1.str)(m.type);
+        if (m.confirmed === false)
+            continue;
+        if (type === 'phone' || type === 'sms') {
+            const phone = (0, record_set_1.e164)(m.phone_number);
+            if (phone)
+                set.add('mfa_factor', { user_id: userId, type: 'phone', phone, verified: true, created_at: (0, record_set_1.str)(m.created_at) }, `phone:${userId}:${phone}`);
+        }
+        else if (type === 'email') {
+            set.add('mfa_factor', { user_id: userId, type: 'email', verified: true, created_at: (0, record_set_1.str)(m.created_at) }, `email:${userId}`);
+        }
+        else if ((type === 'passkey' || type === 'webauthn-platform' || type === 'webauthn-roaming') && (0, record_set_1.str)(m.key_id) && (0, record_set_1.str)(m.public_key)) {
+            set.add('passkey', (0, record_set_1.compact)({
+                id: (0, record_set_1.str)(m.id),
+                user_id: userId,
+                credential_id: b64url((0, record_set_1.str)(m.key_id)),
+                public_key: b64url((0, record_set_1.str)(m.public_key)),
+                rp_id: (0, record_set_1.str)(m.relying_party_identifier) ?? rpId,
+                aaguid: (0, record_set_1.str)(m.aaguid),
+                name: (0, record_set_1.str)(m.name),
+                backed_up: m.credential_backed_up === true ? true : undefined,
+                created_at: (0, record_set_1.str)(m.created_at),
+            }));
+        }
+        else if (type === 'totp' || type === 'guardian' || type === 'push' || type === 'recovery-code' || type === 'webauthn-roaming' || type === 'webauthn-platform') {
+            set.omit('mfa_factor', `Auth0 does not return ${type} secrets by API (support export, or re-enrolment)`);
+        }
+    }
+}
+const b64url = (v) => v.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+/** Auth0 role names are free text: `Billing Admin` → `billing_admin`. */
+function roleKey(name) {
+    return name.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_+|_+$/g, '') || 'role';
+}
+/**
+ * An Auth0 bulk-import `custom_password_hash` (users imported into Auth0 that
+ * never signed in since keep it) → the Atlas registry's algorithm + params.
+ */
+function auth0CustomHash(c) {
+    const algorithm = (0, record_set_1.str)(c.algorithm)?.toLowerCase();
+    const hash = (0, record_set_1.isObj)(c.hash) ? c.hash : {};
+    const value = (0, record_set_1.str)(hash.value);
+    if (!algorithm || !value)
+        return { reason: 'custom_password_hash without algorithm or hash value' };
+    const salt = (0, record_set_1.isObj)(c.salt) ? c.salt : undefined;
+    const pwEnc = (0, record_set_1.isObj)(c.password) ? (0, record_set_1.str)(c.password.encoding) : undefined;
+    if (pwEnc && !['utf8', 'utf-8', 'ascii'].includes(pwEnc)) {
+        return { reason: `custom_password_hash password.encoding "${pwEnc}" is not supported` };
+    }
+    const encoding = (0, record_set_1.str)(hash.encoding) ?? (algorithm === 'scrypt' ? 'hex' : 'hex');
+    const saltParams = salt
+        ? { salt_position: (0, record_set_1.str)(salt.position) ?? 'prefix', salt_encoding: (0, record_set_1.str)(salt.encoding) ?? 'utf8' }
+        : {};
+    switch (algorithm) {
+        case 'bcrypt':
+            return { algorithm: 'bcrypt', hash: value };
+        case 'argon2':
+            return { algorithm: 'argon2', hash: value };
+        case 'pbkdf2':
+            // A PHC string `$pbkdf2-<digest>$i=<iterations>,l=<keylen>$<salt>$<hash>`.
+            return { algorithm: 'auto', hash: value };
+        case 'ldap':
+            // RFC 2307: Atlas verifies the SHA family ({SHA}, {SSHA}, {SSHA256}, {SSHA512}).
+            return /^\{S?SHA(256|512)?\}/i.test(value) ? { algorithm: 'ldap_ssha', hash: value } : { reason: 'custom_password_hash ldap scheme other than {SHA}/{SSHA} is not supported' };
+        case 'md5':
+        case 'sha1':
+        case 'sha256':
+        case 'sha512': {
+            const s = salt ? (0, record_set_1.str)(salt.value) : undefined;
+            if (!s)
+                return { algorithm, hash: value, params: { encoding } };
+            return { algorithm: `${algorithm}_salted`, hash: value, salt: s, params: { encoding, ...saltParams } };
+        }
+        case 'hmac': {
+            const digest = (0, record_set_1.str)(hash.digest)?.toLowerCase();
+            const key = (0, record_set_1.isObj)(hash.key) ? (0, record_set_1.str)(hash.key.value) : undefined;
+            if (digest !== 'sha256' || !key)
+                return { reason: `custom_password_hash hmac with digest "${digest ?? '?'}" is not supported (sha256 only)` };
+            if (salt)
+                return { reason: 'custom_password_hash hmac with a salt is not supported' };
+            return { algorithm: 'hmac_sha256', hash: value, params: { key, key_encoding: ((0, record_set_1.isObj)(hash.key) ? (0, record_set_1.str)(hash.key.encoding) : undefined) ?? 'utf8', encoding } };
+        }
+        case 'scrypt': {
+            const s = salt ? (0, record_set_1.str)(salt.value) : undefined;
+            const keylen = typeof c.keylen === 'number' ? c.keylen : undefined;
+            if (!s || !keylen)
+                return { reason: 'custom_password_hash scrypt needs salt and keylen' };
+            return {
+                algorithm: 'scrypt',
+                hash: value,
+                salt: s,
+                params: {
+                    n: typeof c.cost === 'number' ? c.cost : 16384,
+                    r: typeof c.blockSize === 'number' ? c.blockSize : 8,
+                    p: typeof c.parallelization === 'number' ? c.parallelization : 1,
+                    key_length: keylen,
+                    encoding,
+                    salt_encoding: (0, record_set_1.str)(salt?.encoding) ?? 'utf8',
+                },
+            };
+        }
+        default:
+            return { reason: `custom_password_hash algorithm "${algorithm}" is not supported` };
+    }
+}
+// ── enterprise connections ──────────────────────────────────────────────────
+function addConnection(set, c, domain) {
+    const id = (0, record_set_1.str)(c.id);
+    const name = (0, record_set_1.str)(c.name);
+    const strategy = (0, record_set_1.str)(c.strategy);
+    if (!id || !name || !strategy)
+        return undefined;
+    const o = (0, record_set_1.isObj)(c.options) ? c.options : {};
+    const domains = Array.isArray(o.domain_aliases) ? o.domain_aliases.map((d) => (0, record_set_1.str)(d)).filter((d) => !!d) : [];
+    if (strategy === 'samlp' || strategy === 'adfs' || strategy === 'pingfederate') {
+        const cert = (0, record_set_1.str)(o.signingCert) ?? (0, record_set_1.str)(o.cert);
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(c.display_name) ?? name,
+            protocol: 'saml',
+            domains,
+            saml: (0, record_set_1.compact)({
+                idp_entity_id: (0, record_set_1.str)(o.entityId) ?? (0, record_set_1.str)(o.issuer),
+                idp_sso_url: (0, record_set_1.str)(o.signInEndpoint) ?? (0, record_set_1.str)(o.pingFederateBaseUrl),
+                idp_certificate: cert ? pemFromAuth0Cert(cert) : undefined,
+                idp_metadata_url: (0, record_set_1.str)(o.metadataUrl) ?? (0, record_set_1.str)(o.adfs_server),
+                idp_metadata_xml: (0, record_set_1.str)(o.metadataXml),
+                sp_entity_id: `urn:auth0:${domain.split('.')[0]}:${name}`,
+                sp_acs_url: `https://${domain}/login/callback?connection=${encodeURIComponent(name)}`,
+                attribute_mapping: (0, record_set_1.isObj)(o.fieldsMap)
+                    ? Object.fromEntries(Object.entries(o.fieldsMap).filter(([, v]) => typeof v === 'string'))
+                    : undefined,
+            }),
+        }));
+        return id;
+    }
+    if (strategy === 'oidc' || strategy === 'okta' || strategy === 'waad' || strategy === 'google-apps') {
+        const issuer = strategy === 'waad'
+            ? (0, record_set_1.str)(o.tenant_domain)
+                ? `https://login.microsoftonline.com/${(0, record_set_1.str)(o.tenant_id) ?? (0, record_set_1.str)(o.tenant_domain)}/v2.0`
+                : undefined
+            : strategy === 'google-apps'
+                ? 'https://accounts.google.com'
+                : (0, record_set_1.str)(o.issuer) ?? ((0, record_set_1.str)(o.domain) ? `https://${(0, record_set_1.str)(o.domain)}` : undefined);
+        set.add('sso_connection', (0, record_set_1.compact)({
+            id,
+            name: (0, record_set_1.str)(c.display_name) ?? name,
+            protocol: 'oidc',
+            domains: strategy === 'google-apps' && (0, record_set_1.str)(o.domain) ? [...domains, (0, record_set_1.str)(o.domain)] : domains,
+            oidc: (0, record_set_1.compact)({
+                issuer,
+                discovery_url: (0, record_set_1.str)(o.discovery_url),
+                client_id: (0, record_set_1.str)(o.client_id),
+                client_secret: (0, record_set_1.str)(o.client_secret),
+                scopes: (0, record_set_1.str)(o.scope)?.split(/\s+/),
+            }),
+        }));
+        if (!(0, record_set_1.str)(o.client_secret))
+            set.warn(`Enterprise connection ${name}: Auth0 does not return its client secret; enter it in Atlas after the import.`);
+        return id;
+    }
+    set.warn(`Enterprise connection ${name} (${strategy}) has no Atlas counterpart and was not exported (LDAP/AD connector: use lazy migration).`);
+    return undefined;
+}
+/** Auth0 returns the IdP signing certificate as base64 DER or PEM. */
+function pemFromAuth0Cert(cert) {
+    if (cert.includes('BEGIN CERTIFICATE'))
+        return cert;
+    const body = cert.replace(/\s+/g, '');
+    let der = body;
+    // Some tenants store the PEM itself base64-encoded.
+    try {
+        const decoded = Buffer.from(body, 'base64').toString('utf8');
+        if (decoded.includes('BEGIN CERTIFICATE'))
+            return decoded;
+    }
+    catch {
+        der = body;
+    }
+    return `-----BEGIN CERTIFICATE-----\n${der.match(/.{1,64}/g).join('\n')}\n-----END CERTIFICATE-----`;
+}
+//# sourceMappingURL=auth0.js.map