auth0-deploy-cli 8.26.0 → 8.28.0

package/CHANGELOG.md

@@ -7,6 +7,26 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [8.28.0] - 2026-02-20
+
+### Added
+
+- Add support for managing `action-modules`.(EA) [#1302]
+- Add support for managing `modules` in `actions`.(EA) [#1302]
+
+## [8.27.0] - 2026-02-13
+
+### Added
+
+- Add support for `custom_password_hash.action_id` in `databases` (Universal Custom Password Hash EA). [#1288]
+- Add support for `allowed_strategies` in `selfServiceProfiles`. [#1298]
+
+### Fixed
+
+- Fix validation handling for `authentication_methods.password.enabled` and `disable_self_service_change_password` in `databases`. [#1297]
+- Fix stripping deprecated `enabled_clients` for `connections` with enhanced client management. [#1294]
+- Fix exclude third-party `clientGrants` when `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` is enabled. [#1289]
+
 ## [8.26.0] - 2026-01-30
 
 ### Added
@@ -1634,7 +1654,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 [#1282]: https://github.com/auth0/auth0-deploy-cli/issues/1282
 [#1283]: https://github.com/auth0/auth0-deploy-cli/issues/1283
 [#1284]: https://github.com/auth0/auth0-deploy-cli/issues/1284
-[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.26.0...HEAD
+[#1288]: https://github.com/auth0/auth0-deploy-cli/issues/1288
+[#1289]: https://github.com/auth0/auth0-deploy-cli/issues/1289
+[#1294]: https://github.com/auth0/auth0-deploy-cli/issues/1294
+[#1297]: https://github.com/auth0/auth0-deploy-cli/issues/1297
+[#1298]: https://github.com/auth0/auth0-deploy-cli/issues/1298
+[#1302]: https://github.com/auth0/auth0-deploy-cli/issues/1302
+[Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.28.0...HEAD
+[8.28.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.27.0...v8.28.0
+[8.27.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.26.0...v8.27.0
 [8.26.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.25.0...v8.26.0
 [8.25.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.24.0...v8.25.0
 [8.24.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.23.2...v8.24.0

package/lib/context/directory/handlers/actionModules.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedActionModules = ParsedAsset<'actionModules', Asset[]>;
+declare const actionModulesHandler: DirectoryHandler<ParsedActionModules>;
+export default actionModulesHandler;

package/lib/context/directory/handlers/actionModules.js

@@ -0,0 +1,91 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+function parse(context) {
+    const modulesFolder = path_1.default.join(context.filePath, tools_1.constants.ACTION_MODULES_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(modulesFolder))
+        return { actionModules: null };
+    const files = (0, utils_1.getFiles)(modulesFolder, ['.json']);
+    const actionModules = files.map((file) => {
+        const module = {
+            ...(0, utils_1.loadJSON)(file, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            }),
+        };
+        const moduleFolder = path_1.default.join(tools_1.constants.ACTION_MODULES_DIRECTORY, `${module.name}`);
+        if (module.code) {
+            // The `module.code` can be a file path. It needs to be loaded.
+            // It can be a relative path, so we need to handle both cases.
+            const unixPath = module.code.replace(/[\\/]+/g, '/').replace(/^([a-zA-Z]+:|\.\/)/, '');
+            if (fs_extra_1.default.existsSync(unixPath)) {
+                module.code = context.loadFile(unixPath, moduleFolder);
+            }
+            else {
+                module.code = context.loadFile(path_1.default.join(context.filePath, module.code), moduleFolder);
+            }
+        }
+        return module;
+    });
+    return { actionModules };
+}
+function mapSecrets(secrets) {
+    if (typeof secrets === 'string') {
+        return secrets;
+    }
+    if (secrets && secrets.length > 0) {
+        return secrets.map((secret) => ({ name: secret.name, value: secret.value }));
+    }
+    return [];
+}
+function mapModuleCode(filePath, module) {
+    const { code } = module;
+    if (!code) {
+        return '';
+    }
+    const moduleName = (0, utils_1.sanitize)(module.name);
+    const moduleFolder = path_1.default.join(filePath, tools_1.constants.ACTION_MODULES_DIRECTORY, `${moduleName}`);
+    fs_extra_1.default.ensureDirSync(moduleFolder);
+    const codeFile = path_1.default.join(moduleFolder, 'code.js');
+    logger_1.default.info(`Writing ${codeFile}`);
+    fs_extra_1.default.writeFileSync(codeFile, code);
+    return `./${tools_1.constants.ACTION_MODULES_DIRECTORY}/${moduleName}/code.js`;
+}
+function mapToActionModule(filePath, module, includeIdentifiers) {
+    return {
+        ...(includeIdentifiers && module.id ? { id: module.id } : {}),
+        name: module.name,
+        code: mapModuleCode(filePath, module),
+        dependencies: module.dependencies,
+        secrets: mapSecrets(module.secrets),
+        actions_using_module_total: module.actions_using_module_total,
+        all_changes_published: module.all_changes_published,
+        latest_version_number: module.latest_version_number,
+    };
+}
+async function dump(context) {
+    const { actionModules } = context.assets;
+    if (!actionModules)
+        return;
+    // Create action modules folder
+    const modulesFolder = path_1.default.join(context.filePath, tools_1.constants.ACTION_MODULES_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(modulesFolder);
+    const includeIdentifiers = Boolean(context.config.AUTH0_EXPORT_IDENTIFIERS);
+    actionModules.forEach((module) => {
+        const name = (0, utils_1.sanitize)(module.name);
+        const moduleFile = path_1.default.join(modulesFolder, `${name}.json`);
+        (0, utils_1.dumpJSON)(moduleFile, mapToActionModule(context.filePath, module, includeIdentifiers));
+    });
+}
+const actionModulesHandler = {
+    parse,
+    dump,
+};
+exports.default = actionModulesHandler;

package/lib/context/directory/handlers/actions.js

@@ -73,6 +73,10 @@ function mapToAction(filePath, action, includeIdentifiers) {
         supported_triggers: action.supported_triggers,
         deployed: action.deployed || action.all_changes_deployed,
         installed_integration_id: action.installed_integration_id,
+        modules: action.modules?.map((module) => ({
+            module_name: module.module_name,
+            module_version_number: module.module_version_number,
+        })),
     };
 }
 async function dump(context) {

package/lib/context/directory/handlers/index.js

@@ -20,6 +20,7 @@ const guardianPhoneFactorSelectedProvider_1 = __importDefault(require("./guardia
 const guardianPolicies_1 = __importDefault(require("./guardianPolicies"));
 const roles_1 = __importDefault(require("./roles"));
 const actions_1 = __importDefault(require("./actions"));
+const actionModules_1 = __importDefault(require("./actionModules"));
 const organizations_1 = __importDefault(require("./organizations"));
 const triggers_1 = __importDefault(require("./triggers"));
 const attackProtection_1 = __importDefault(require("./attackProtection"));
@@ -63,6 +64,7 @@ const directoryHandlers = {
     guardianPolicies: guardianPolicies_1.default,
     roles: roles_1.default,
     actions: actions_1.default,
+    actionModules: actionModules_1.default,
     organizations: organizations_1.default,
     triggers: triggers_1.default,
     attackProtection: attackProtection_1.default,

package/lib/context/yaml/handlers/actionModules.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { ActionModule } from '../../../tools/auth0/handlers/actionModules';
+type ParsedActionModules = ParsedAsset<'actionModules', Partial<ActionModule>[]>;
+declare const ActionModulesHandler: YAMLHandler<ParsedActionModules>;
+export default ActionModulesHandler;

package/lib/context/yaml/handlers/actionModules.js

@@ -0,0 +1,68 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+async function parse(context) {
+    const { actionModules } = context.assets;
+    if (!actionModules)
+        return { actionModules: null };
+    return {
+        actionModules: [
+            ...actionModules.map((module) => ({
+                ...module,
+                code: context.loadFile(module.code || ''),
+            })),
+        ],
+    };
+}
+function mapSecrets(secrets) {
+    if (typeof secrets === 'string') {
+        return secrets;
+    }
+    if (secrets && secrets.length > 0) {
+        return secrets.map((secret) => ({ name: secret.name, value: secret.value }));
+    }
+    return [];
+}
+function mapModuleCode(basePath, module) {
+    const { code } = module;
+    if (!code) {
+        return '';
+    }
+    const moduleName = (0, utils_1.sanitize)(module.name);
+    const modulesFolder = path_1.default.join(basePath, tools_1.constants.ACTION_MODULES_DIRECTORY, moduleName);
+    fs_extra_1.default.ensureDirSync(modulesFolder);
+    const codeFile = path_1.default.join(modulesFolder, 'code.js');
+    logger_1.default.info(`Writing ${codeFile}`);
+    fs_extra_1.default.writeFileSync(codeFile, code);
+    return `./${tools_1.constants.ACTION_MODULES_DIRECTORY}/${moduleName}/code.js`;
+}
+async function dump(context) {
+    const { actionModules } = context.assets;
+    if (!actionModules || actionModules.length === 0)
+        return { actionModules: null };
+    const includeIdentifiers = Boolean(context.config.AUTH0_EXPORT_IDENTIFIERS);
+    return {
+        actionModules: actionModules?.map((module) => ({
+            ...(includeIdentifiers && module.id ? { id: module.id } : {}),
+            name: module.name,
+            code: mapModuleCode(context.basePath, module),
+            dependencies: module.dependencies || [],
+            secrets: mapSecrets(module.secrets),
+            actions_using_module_total: module.actions_using_module_total,
+            all_changes_published: module.all_changes_published,
+            latest_version_number: module.latest_version_number,
+        })),
+    };
+}
+const ActionModulesHandler = {
+    parse,
+    dump,
+};
+exports.default = ActionModulesHandler;

package/lib/context/yaml/handlers/actions.js

@@ -77,6 +77,10 @@ async function dump(context) {
             status: action.status,
             secrets: mapSecrets(action.secrets),
             supported_triggers: action.supported_triggers,
+            modules: action.modules?.map((module) => ({
+                module_name: module.module_name,
+                module_version_number: module.module_version_number,
+            })),
         })),
     };
 }

package/lib/context/yaml/handlers/index.js

@@ -21,6 +21,7 @@ const guardianPolicies_1 = __importDefault(require("./guardianPolicies"));
 const roles_1 = __importDefault(require("./roles"));
 const organizations_1 = __importDefault(require("./organizations"));
 const actions_1 = __importDefault(require("./actions"));
+const actionModules_1 = __importDefault(require("./actionModules"));
 const triggers_1 = __importDefault(require("./triggers"));
 const attackProtection_1 = __importDefault(require("./attackProtection"));
 const riskAssessment_1 = __importDefault(require("./riskAssessment"));
@@ -63,6 +64,7 @@ const yamlHandlers = {
     guardianPhoneFactorSelectedProvider: guardianPhoneFactorSelectedProvider_1.default,
     guardianPolicies: guardianPolicies_1.default,
     actions: actions_1.default,
+    actionModules: actionModules_1.default,
     organizations: organizations_1.default,
     triggers: triggers_1.default,
     attackProtection: attackProtection_1.default,

package/lib/tools/auth0/handlers/actionModules.d.ts

@@ -0,0 +1,64 @@
+import DefaultAPIHandler from './default';
+import { Asset, Assets } from '../../../types';
+import { Management } from 'auth0';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+        required: string[];
+        additionalProperties: boolean;
+        properties: {
+            name: {
+                type: string;
+            };
+            code: {
+                type: string;
+            };
+            dependencies: {
+                type: string;
+                items: {
+                    type: string;
+                    additionalProperties: boolean;
+                    properties: {
+                        name: {
+                            type: string;
+                        };
+                        version: {
+                            type: string;
+                        };
+                    };
+                };
+            };
+            secrets: {
+                type: string;
+                items: {
+                    type: string;
+                    properties: {
+                        name: {
+                            type: string;
+                        };
+                        value: {
+                            type: string;
+                        };
+                    };
+                    required: string[];
+                };
+            };
+            all_changes_published: {
+                type: string;
+            };
+        };
+    };
+};
+export type ActionModule = Management.ActionModuleListItem;
+export default class ActionModulesHandler extends DefaultAPIHandler {
+    existing: ActionModule[] | null;
+    constructor(options: DefaultAPIHandler);
+    createModule(module: Management.CreateActionModuleRequestContent): Promise<Management.CreateActionModuleResponseContent>;
+    updateModule(moduleId: string, module: Management.UpdateActionModuleRequestContent): Promise<Management.UpdateActionModuleResponseContent>;
+    deleteModule(moduleId: string): Promise<void>;
+    objString(module: ActionModule): string;
+    publishActionModules(modules: ActionModule[]): Promise<void>;
+    getType(): Promise<Asset[] | null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/actionModules.js

@@ -0,0 +1,200 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importStar(require("./default"));
+const logger_1 = __importDefault(require("../../../logger"));
+const client_1 = require("../client");
+exports.schema = {
+    type: 'array',
+    items: {
+        type: 'object',
+        required: ['name', 'code'],
+        additionalProperties: true,
+        properties: {
+            name: { type: 'string' },
+            code: { type: 'string' },
+            dependencies: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    additionalProperties: false,
+                    properties: {
+                        name: { type: 'string' },
+                        version: { type: 'string' },
+                    },
+                },
+            },
+            secrets: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        name: { type: 'string' },
+                        value: { type: 'string' },
+                    },
+                    required: ['name'],
+                },
+            },
+            all_changes_published: { type: 'boolean' },
+        },
+    },
+};
+class ActionModulesHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'actionModules',
+            id: 'id',
+            identifiers: ['id', 'name'],
+            stripUpdateFields: [
+                'name',
+                'actions_using_module_total',
+                'all_changes_published',
+                'latest_version_number',
+                'created_at',
+                'updated_at',
+            ],
+            stripCreateFields: [
+                'actions_using_module_total',
+                'latest_version_number',
+                'created_at',
+                'updated_at',
+            ],
+            functions: {
+                create: (module) => this.createModule(module),
+                update: (id, module) => this.updateModule(id, module),
+                delete: (id) => this.deleteModule(id),
+            },
+        });
+    }
+    async createModule(module) {
+        if ('all_changes_published' in module) {
+            delete module.all_changes_published;
+        }
+        const createdModule = await this.client.actions.modules.create(module);
+        return createdModule;
+    }
+    async updateModule(moduleId, module) {
+        const updatableModule = {
+            code: module.code,
+            dependencies: module.dependencies,
+            secrets: module.secrets,
+        };
+        return this.client.actions.modules.update(moduleId, updatableModule);
+    }
+    async deleteModule(moduleId) {
+        return this.client.actions.modules.delete(moduleId);
+    }
+    objString(module) {
+        return super.objString({ id: module.id, name: module.name });
+    }
+    async publishActionModules(modules) {
+        await this.client.pool
+            .addEachTask({
+            data: modules || [],
+            generator: (module) => this.client.actions.modules.versions
+                .create(module.id)
+                .then(() => {
+                logger_1.default.info(`Published [${this.type}]: ${this.objString(module)}`);
+            })
+                .catch((err) => {
+                throw new Error(`Problem Publishing ${this.type} ${this.objString(module)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const modules = await (0, client_1.paginate)(this.client.actions.modules.list, {
+                paginate: true,
+            });
+            this.existing = modules;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
+                logger_1.default.debug('Skipping action modules because it is not enabled.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    // Before actions are processed
+    async processChanges(assets) {
+        const { actionModules } = assets;
+        // Do nothing if not set
+        if (!actionModules)
+            return;
+        const changes = await this.calcChanges(assets);
+        await super.processChanges(assets, changes);
+        // Refresh module list to get latest state with all_changes_published field
+        const postProcessedModules = await (async () => {
+            this.existing = null; // Clear the cache
+            return this.getType();
+        })();
+        // Publish modules that have unpublished changes
+        const modulesToPublish = [
+            ...changes.create
+                .filter((module) => module.all_changes_published === true)
+                .map((moduleWithoutId) => {
+                // Add IDs to just-created modules
+                const moduleId = postProcessedModules?.find((postProcessedModule) => postProcessedModule.name === moduleWithoutId.name)?.id;
+                const module = postProcessedModules?.find((postProcessedModule) => postProcessedModule.id === moduleId);
+                return module;
+            }),
+            ...changes.update.filter((module) => module.all_changes_published === true),
+        ].filter((module) => module !== undefined);
+        await this.publishActionModules(modulesToPublish);
+    }
+}
+exports.default = ActionModulesHandler;
+__decorate([
+    (0, default_1.order)('50')
+], ActionModulesHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/actions.d.ts

@@ -1,6 +1,7 @@
 import { Management } from 'auth0';
 import DefaultAPIHandler from './default';
-import { Asset, Assets } from '../../../types';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+import { ActionModule } from './actionModules';
 export type Action = Management.Action & {
     deployed?: boolean;
 };
@@ -80,6 +81,21 @@ export declare const schema: {
                     };
                 };
             };
+            modules: {
+                type: string;
+                items: {
+                    type: string;
+                    required: string[];
+                    properties: {
+                        module_name: {
+                            type: string;
+                        };
+                        module_version_number: {
+                            type: string;
+                        };
+                    };
+                };
+            };
             deployed: {
                 type: string;
             };
@@ -101,6 +117,8 @@ export default class ActionHandler extends DefaultAPIHandler {
     deployAction(action: any): Promise<void>;
     actionChanges(action: any, found: any): Promise<Asset>;
     getType(): Promise<Asset[] | null>;
+    calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    enrichActionWithModuleIds(action: Action, modules: ActionModule[]): Promise<Action>;
     processChanges(assets: Assets): Promise<void>;
 }
 export {};