@pulumi/auth0 3.54.0-alpha.1790140918 → 3.54.0

package/types/output.d.ts

@@ -1210,6 +1210,12 @@ export interface ClientAddonsZoom {
      */
     account?: string;
 }
+export interface ClientAnonymousSessions {
+    /**
+     * If set to true, this client is allowed to create anonymous sessions. Requires `oidcConformant` to be set to `true`. Set to `false` to disable. (EA only)
+     */
+    active: boolean;
+}
 export interface ClientB2bIntegrationConfiguration {
     /**
      * The type of integration used to connect to this B2B integration client. One of custom*auth*server, third_party, application
@@ -1677,6 +1683,14 @@ export interface ClientMyOrganizationConfiguration {
      * The ID of the connection profile to use when creating organizations for this client.
      */
     connectionProfileId?: string;
+    /**
+     * When true, limits the permissions that organization admins can assign to members to only those held by the admin themselves. Requires the `myOrgMemberManagementEa` feature flag. Available in Early Access (EA).
+     */
+    enforcePermissionCeiling?: boolean;
+    /**
+     * When true, prevents organization admins from assigning permissions to themselves. Requires the `myOrgMemberManagementEa` feature flag. Available in Early Access (EA).
+     */
+    enforceSelfAssignmentRestriction?: boolean;
     /**
      * The client ID used as the invitation landing page when creating invitations through the My Organization API. Requires the tenant to have member management enabled, and the referenced client must allow organizations.
      */
@@ -4573,6 +4587,12 @@ export interface GetClientAddonZoom {
      */
     account: string;
 }
+export interface GetClientAnonymousSession {
+    /**
+     * If set to true, this client is allowed to create anonymous sessions. Requires `oidcConformant` to be set to `true`. Set to `false` to disable. (EA only)
+     */
+    active: boolean;
+}
 export interface GetClientB2bIntegrationConfiguration {
     /**
      * The type of integration used to connect to this B2B integration client. One of custom_auth_server, third_party, application
@@ -4922,6 +4942,14 @@ export interface GetClientMyOrganizationConfiguration {
      * The ID of the connection profile to use when creating organizations for this client.
      */
     connectionProfileId: string;
+    /**
+     * When true, limits the permissions that organization admins can assign to members to only those held by the admin themselves. Requires the `myOrgMemberManagementEa` feature flag. Available in Early Access (EA).
+     */
+    enforcePermissionCeiling: boolean;
+    /**
+     * When true, prevents organization admins from assigning permissions to themselves. Requires the `myOrgMemberManagementEa` feature flag. Available in Early Access (EA).
+     */
+    enforceSelfAssignmentRestriction: boolean;
     /**
      * The client ID used as the invitation landing page when creating invitations through the My Organization API. Requires the tenant to have member management enabled, and the referenced client must allow organizations.
      */
@@ -5153,6 +5181,10 @@ export interface GetClientsClient {
      * URLs that represent valid origins for cross-origin resource sharing. By default, all your callback URLs will be allowed.
      */
     allowedOrigins: string[];
+    /**
+     * Anonymous Sessions settings for the client. Removing this block clears the setting on the API. (EA only)
+     */
+    anonymousSessions: outputs.GetClientsClientAnonymousSession[];
     /**
      * Type of application the client represents. Possible values are: `native`, `spa`, `regularWeb`, `nonInteractive`, `resourceServer`,`ssoIntegration`. Specific SSO integrations types accepted as well are: `rms`, `box`, `cloudbees`, `concur`, `dropbox`, `mscrm`, `echosign`, `egnyte`, `newrelic`, `office365`, `salesforce`, `sentry`, `sharepoint`, `slack`, `springcm`, `zendesk`, `zoom`, `expressConfiguration`
      */
@@ -5273,6 +5305,12 @@ export interface GetClientsClient {
      */
     webOrigins: string[];
 }
+export interface GetClientsClientAnonymousSession {
+    /**
+     * If set to true, this client is allowed to create anonymous sessions. Requires `oidcConformant` to be set to `true`. Set to `false` to disable. (EA only)
+     */
+    active: boolean;
+}
 export interface GetClientsClientB2bIntegrationConfiguration {
     /**
      * The type of integration used to connect to this B2B integration client. One of custom_auth_server, third_party, application
@@ -5358,6 +5396,14 @@ export interface GetClientsClientMyOrganizationConfiguration {
      * The ID of the connection profile to use when creating organizations for this client.
      */
     connectionProfileId: string;
+    /**
+     * When true, limits the permissions that organization admins can assign to members to only those held by the admin themselves. Requires the `myOrgMemberManagementEa` feature flag. Available in Early Access (EA).
+     */
+    enforcePermissionCeiling: boolean;
+    /**
+     * When true, prevents organization admins from assigning permissions to themselves. Requires the `myOrgMemberManagementEa` feature flag. Available in Early Access (EA).
+     */
+    enforceSelfAssignmentRestriction: boolean;
     /**
      * The client ID used as the invitation landing page when creating invitations through the My Organization API. Requires the tenant to have member management enabled, and the referenced client must allow organizations.
      */
@@ -7533,6 +7579,28 @@ export interface GetRateLimitPolicyConfiguration {
      */
     redirectUri: string;
 }
+export interface GetResourceServerAccessToken {
+    /**
+     * Configuration for mapping claims into the access tokens issued for this resource server. (EA only)
+     */
+    claimsMappings: outputs.GetResourceServerAccessTokenClaimsMapping[];
+}
+export interface GetResourceServerAccessTokenClaimsMapping {
+    /**
+     * Custom claims to include in the access tokens issued for this resource server. Maximum of 20 claims. Setting an empty list clears the custom claims on the API. (EA only)
+     */
+    customClaims: outputs.GetResourceServerAccessTokenClaimsMappingCustomClaim[];
+}
+export interface GetResourceServerAccessTokenClaimsMappingCustomClaim {
+    /**
+     * Expression used to resolve the claim value, given as a dot-path read from the request context (for example `anonymous_session.metadata.country`).
+     */
+    expression: string;
+    /**
+     * Name of the claim to emit in the access token. Reserved OIDC/JWT claim names are not allowed.
+     */
+    name: string;
+}
 export interface GetResourceServerAuthorizationDetail {
     /**
      * Disable authorization details.
@@ -7578,6 +7646,10 @@ export interface GetResourceServerScope {
     name: string;
 }
 export interface GetResourceServerSubjectTypeAuthorization {
+    /**
+     * Anonymous user authorization policies for the resource server. (EA only)
+     */
+    anonymousUsers: outputs.GetResourceServerSubjectTypeAuthorizationAnonymousUser[];
     /**
      * Client authorization policies for the resource server.
      */
@@ -7587,6 +7659,12 @@ export interface GetResourceServerSubjectTypeAuthorization {
      */
     users: outputs.GetResourceServerSubjectTypeAuthorizationUser[];
 }
+export interface GetResourceServerSubjectTypeAuthorizationAnonymousUser {
+    /**
+     * Anonymous user flows policy. One of `denyAll`, `requireClientGrant`. Defaults to `denyAll` (EA only)
+     */
+    policy: string;
+}
 export interface GetResourceServerSubjectTypeAuthorizationClient {
     /**
      * Client flows policy. One of `denyAll`, `requireClientGrant`.
@@ -7910,11 +7988,25 @@ export interface GetTenantOidcLogout {
     rpLogoutEndSessionEndpointDiscovery: boolean;
 }
 export interface GetTenantSession {
+    /**
+     * Anonymous Sessions settings for the tenant. (EA only)
+     */
+    anonymouses: outputs.GetTenantSessionAnonymouse[];
     /**
      * When active, users will be presented with a consent prompt to confirm the logout request if the request is not trustworthy. Turn off the consent prompt to bypass user confirmation.
      */
     oidcLogoutPromptEnabled: boolean;
 }
+export interface GetTenantSessionAnonymouse {
+    /**
+     * Whether anonymous session requests return the `auth0Anon` cookie. (EA only)
+     */
+    activateCookie: boolean;
+    /**
+     * Number of minutes during which an anonymous session will stay valid. Minimum 1, maximum 525600. (EA only)
+     */
+    lifetimeInMinutes: number;
+}
 export interface GetTenantSessionCooky {
     /**
      * Behavior of tenant session cookie. Accepts either "persistent" or "non-persistent".
@@ -8175,6 +8267,16 @@ export interface GuardianDuo {
      */
     secretKey?: string;
 }
+export interface GuardianEmailSettings {
+    /**
+     * The OTP expiration time in seconds. Defaults to `300` (5 minutes).
+     */
+    otpExpirationTime: number;
+    /**
+     * The length of the OTP code. Defaults to `6`.
+     */
+    otpLength: number;
+}
 export interface GuardianPhone {
     /**
      * Indicates whether Phone MFA is enabled.
@@ -8223,6 +8325,16 @@ export interface GuardianPhoneOptions {
      */
     verificationMessage?: string;
 }
+export interface GuardianPhoneSettings {
+    /**
+     * The OTP expiration time in seconds. Defaults to `300` (5 minutes).
+     */
+    otpExpirationTime: number;
+    /**
+     * The length of the OTP code. Defaults to `6`.
+     */
+    otpLength: number;
+}
 export interface GuardianPush {
     /**
      * Configuration for Amazon SNS.
@@ -8309,6 +8421,24 @@ export interface GuardianPushDirectFcm {
      */
     serverKey: string;
 }
+export interface GuardianSettings {
+    /**
+     * Determines whether to display the "Remember me" checkbox on the MFA prompt in Universal Login. Defaults to `true`.
+     */
+    displayRememberMeCheckbox: boolean;
+    /**
+     * Duration of inactivity (seconds) after which the user will be prompted for MFA. Cannot exceed the overall timeout. Defaults to `604800` (7 days).
+     */
+    mfaSessionInactivityTimeout: number;
+    /**
+     * Maximum duration (seconds) after which the user will be prompted for MFA regardless of activity. Defaults to `2592000` (30 days).
+     */
+    mfaSessionOverallTimeout: number;
+    /**
+     * Determines the default state of the "Remember Me" checkbox on the MFA prompt in Universal Login. Defaults to `false`.
+     */
+    rememberMeDefaultValue: boolean;
+}
 export interface GuardianWebauthnPlatform {
     /**
      * Indicates whether WebAuthn with FIDO Device Biometrics MFA is enabled.
@@ -8926,6 +9056,28 @@ export interface RateLimitPolicyConfiguration {
      */
     redirectUri?: string;
 }
+export interface ResourceServerAccessToken {
+    /**
+     * Configuration for mapping claims into the access tokens issued for this resource server. (EA only)
+     */
+    claimsMapping?: outputs.ResourceServerAccessTokenClaimsMapping;
+}
+export interface ResourceServerAccessTokenClaimsMapping {
+    /**
+     * Custom claims to include in the access tokens issued for this resource server. Maximum of 20 claims. Setting an empty list clears the custom claims on the API. (EA only)
+     */
+    customClaims?: outputs.ResourceServerAccessTokenClaimsMappingCustomClaim[];
+}
+export interface ResourceServerAccessTokenClaimsMappingCustomClaim {
+    /**
+     * Expression used to resolve the claim value, given as a dot-path read from the request context (for example `anonymous_session.metadata.country`).
+     */
+    expression: string;
+    /**
+     * Name of the claim to emit in the access token. Reserved OIDC/JWT claim names are not allowed.
+     */
+    name: string;
+}
 export interface ResourceServerAuthorizationDetail {
     /**
      * Disable authorization details.
@@ -8971,6 +9123,10 @@ export interface ResourceServerScopesScope {
     name: string;
 }
 export interface ResourceServerSubjectTypeAuthorization {
+    /**
+     * Anonymous user authorization policies for the resource server. (EA only)
+     */
+    anonymousUser: outputs.ResourceServerSubjectTypeAuthorizationAnonymousUser;
     /**
      * Client authorization policies for the resource server.
      */
@@ -8980,6 +9136,12 @@ export interface ResourceServerSubjectTypeAuthorization {
      */
     user: outputs.ResourceServerSubjectTypeAuthorizationUser;
 }
+export interface ResourceServerSubjectTypeAuthorizationAnonymousUser {
+    /**
+     * Anonymous user flows policy. One of `denyAll`, `requireClientGrant`. Defaults to `denyAll` (EA only)
+     */
+    policy: string;
+}
 export interface ResourceServerSubjectTypeAuthorizationClient {
     /**
      * Client flows policy. One of `denyAll`, `requireClientGrant`.
@@ -9273,11 +9435,25 @@ export interface TenantSessionCookie {
     mode?: string;
 }
 export interface TenantSessions {
+    /**
+     * Anonymous Sessions settings for the tenant. (EA only)
+     */
+    anonymous?: outputs.TenantSessionsAnonymous;
     /**
      * When active, users will be presented with a consent prompt to confirm the logout request if the request is not trustworthy. Turn off the consent prompt to bypass user confirmation.
      */
     oidcLogoutPromptEnabled: boolean;
 }
+export interface TenantSessionsAnonymous {
+    /**
+     * Whether anonymous session requests return the `auth0Anon` cookie. (EA only)
+     */
+    activateCookie?: boolean;
+    /**
+     * Number of minutes during which an anonymous session will stay valid. Minimum 1, maximum 525600. (EA only)
+     */
+    lifetimeInMinutes?: number;
+}
 export interface TriggerActionsAction {
     /**
      * The display name of the action within the flow.