auth0-deploy-cli 8.30.0 → 8.32.0

package/CLAUDE.md

@@ -0,0 +1,3 @@
+# For project context see
+
+- [AGENTS.md](./AGENTS.md)

package/lib/args.d.ts

@@ -9,13 +9,18 @@ type SharedParams = {
     config?: Partial<Config>;
     experimental_ea?: boolean;
 };
+export type DryRunMode = 'preview';
 type ImportSpecificParams = {
     input_file: string;
+    dry_run?: boolean | '' | DryRunMode;
+    interactive?: boolean;
+    apply?: boolean;
 };
 type ExportSpecificParams = {
     format: 'yaml' | 'directory';
     output_folder: string;
     export_ids?: boolean;
+    export_ordered?: boolean;
 };
 export type ExportParams = ExportSpecificParams & SharedParams;
 export type ImportParams = ImportSpecificParams & SharedParams;

package/lib/args.js

@@ -47,6 +47,21 @@ function getParams() {
             describe: 'The client secret, this allows you to encrypt the secret in your build configuration instead of storing it in a config file',
             type: 'string',
         },
+        dry_run: {
+            alias: 'dry-run',
+            describe: 'Dry-run mode. Show plan without applying changes. Use --interactive for the menu or --apply to show the plan and apply without prompting.',
+            type: 'string',
+        },
+        interactive: {
+            describe: 'Use with --dry-run to enable the interactive menu (apply / export to file / exit). Not available in non-TTY environments.',
+            type: 'boolean',
+            default: false,
+        },
+        apply: {
+            describe: 'Use with --dry-run to show the plan and then apply without prompting.',
+            type: 'boolean',
+            default: false,
+        },
     })
         .command(['export', 'dump'], 'Export Auth0 Tenant Configuration', {
         output_folder: {
@@ -83,11 +98,19 @@ function getParams() {
             type: 'boolean',
             default: false,
         },
+        export_ordered: {
+            alias: 's',
+            describe: 'Order keys in exported JSON files for consistent diffs.',
+            type: 'boolean',
+        },
     })
         .example('$0 export -c config.json -f yaml -o path/to/export', 'Dump Auth0 config to folder in YAML format')
         .example('$0 export -c config.json -f directory -o path/to/export', 'Dump Auth0 config to folder in directory format')
         .example('$0 import -c config.json -i tenant.yaml', 'Deploy Auth0 via YAML')
         .example('$0 import -c config.json -i path/to/files', 'Deploy Auth0 via Path')
+        .example('$0 import -c config.json -i tenant.yaml --dry-run', 'Preview changes and exit without applying changes')
+        .example('$0 import -c config.json -i tenant.yaml --dry-run --apply', 'Show plan and apply without prompting (CI deployment)')
+        .example('$0 import -c config.json -i tenant.yaml --dry-run --interactive', 'Show plan with interactive menu (apply / export / exit)')
         .example('$0 dump -c config.json -f yaml -o path/to/export', 'Dump Auth0 config to folder in YAML format')
         .example('$0 dump -c config.json -f directory -o path/to/export', 'Dump Auth0 config to folder in directory format')
         .example('$0 deploy -c config.json -i tenant.yaml', 'Deploy Auth0 via YAML')

package/lib/commands/export.js

@@ -11,7 +11,7 @@ const logger_1 = __importDefault(require("../logger"));
 const utils_1 = require("../utils");
 const index_1 = require("../context/index");
 async function exportCMD(params) {
-    const { output_folder: outputFolder, base_path: basePath, config_file: configFile, config: configObj, export_ids: exportIds, secret: clientSecret, env: shouldInheritEnv = false, experimental_ea: experimentalEA, } = params;
+    const { output_folder: outputFolder, base_path: basePath, config_file: configFile, config: configObj, export_ids: exportIds, export_ordered: exportOrdered, secret: clientSecret, env: shouldInheritEnv = false, experimental_ea: experimentalEA, } = params;
     if (shouldInheritEnv) {
         nconf_1.default.env().use('memory');
     }
@@ -32,6 +32,10 @@ async function exportCMD(params) {
     if (exportIds) {
         overrides.AUTH0_EXPORT_IDENTIFIERS = exportIds;
     }
+    // Allow passed in export_ordered to override the configured one
+    if (exportOrdered) {
+        overrides.AUTH0_EXPORT_ORDERED = exportOrdered;
+    }
     // Overrides AUTH0_INCLUDE_EXPERIMENTAL_EA is experimental_ea passed in command line
     if (experimentalEA) {
         overrides.AUTH0_EXPERIMENTAL_EA = experimentalEA;

package/lib/commands/import.js

@@ -9,8 +9,29 @@ const configFactory_1 = require("../configFactory");
 const tools_1 = require("../tools");
 const logger_1 = __importDefault(require("../logger"));
 const context_1 = require("../context");
+const utils_1 = require("../utils");
 async function importCMD(params) {
-    const { input_file: inputFile, base_path: basePath, config_file: configFile, config: configObj, env: shouldInheritEnv = false, secret: clientSecret, experimental_ea: experimentalEA, } = params;
+    const { input_file: inputFile, base_path: basePath, config_file: configFile, config: configObj, env: shouldInheritEnv = false, secret: clientSecret, experimental_ea: experimentalEA, dry_run: dryRun, interactive = false, apply = false, } = params;
+    const normalizedDryRun = dryRun === true || dryRun === '' ? 'preview' : dryRun;
+    let effectiveDryRun;
+    if (!normalizedDryRun) {
+        effectiveDryRun = undefined;
+    }
+    else if (normalizedDryRun !== 'preview') {
+        throw new Error(`Invalid value for --dry-run: ${normalizedDryRun}. Use --dry-run or --dry-run=preview.`);
+    }
+    else {
+        effectiveDryRun = normalizedDryRun;
+    }
+    if (apply && !effectiveDryRun) {
+        throw new Error('--apply must be used with --dry-run.');
+    }
+    if (interactive && !effectiveDryRun) {
+        throw new Error('--interactive must be used with --dry-run.');
+    }
+    if (interactive && apply) {
+        throw new Error('--interactive and --apply cannot be used together.');
+    }
     if (shouldInheritEnv) {
         nconf_1.default.env().use('memory');
         const mappings = nconf_1.default.get('AUTH0_KEYWORD_REPLACE_MAPPINGS') || {};
@@ -36,13 +57,29 @@ async function importCMD(params) {
         // nconf.overrides() sometimes doesn't work, so we need to set it manually to ensure it's set
         nconf_1.default.set('AUTH0_EXPERIMENTAL_EA', experimentalEA);
     }
+    // Override AUTH0_DRY_RUN if dry_run passed in command line
+    if (effectiveDryRun) {
+        overrides.AUTH0_DRY_RUN = effectiveDryRun;
+        nconf_1.default.set('AUTH0_DRY_RUN', effectiveDryRun);
+    }
+    if (interactive) {
+        overrides.AUTH0_DRY_RUN_INTERACTIVE = interactive;
+        nconf_1.default.set('AUTH0_DRY_RUN_INTERACTIVE', interactive);
+    }
+    const existingDryRunApply = nconf_1.default.get('AUTH0_DRY_RUN_APPLY');
+    if (apply || (0, utils_1.isTruthy)(existingDryRunApply)) {
+        overrides.AUTH0_DRY_RUN_APPLY = true;
+        nconf_1.default.set('AUTH0_DRY_RUN_APPLY', true);
+    }
     nconf_1.default.overrides(overrides);
     // Setup context and load
     const context = await (0, context_1.setupContext)(nconf_1.default.get(), 'import');
     await context.loadAssetsFromLocal();
     const config = (0, configFactory_1.configFactory)();
     config.setProvider((key) => nconf_1.default.get(key));
-    //@ts-ignore because context and assets still need to be typed TODO: type assets and type context
+    // @ts-ignore because context and assets still need to be typed TODO: type assets and type context
     await (0, tools_1.deploy)(context.assets, context.mgmtClient, config);
-    logger_1.default.info('Import Successful');
+    if (!effectiveDryRun) {
+        logger_1.default.info('Import Successful');
+    }
 }

package/lib/context/directory/handlers/actions.js

@@ -99,8 +99,7 @@ async function dump(context) {
         // Dump template metadata
         const name = (0, utils_1.sanitize)(action.name);
         const actionFile = path_1.default.join(actionsFolder, `${name}.json`);
-        logger_1.default.info(`Writing ${actionFile}`);
-        fs_extra_1.default.writeFileSync(actionFile, JSON.stringify(mapToAction(context.filePath, action, includeIdentifiers), null, 2));
+        (0, utils_1.dumpJSON)(actionFile, mapToAction(context.filePath, action, includeIdentifiers));
     });
 }
 const actionsHandler = {

package/lib/context/directory/handlers/clients.js

@@ -77,6 +77,20 @@ async function dump(context) {
                 client.express_configuration.okta_oin_client_id = o?.name || oktaOinClientId;
             }
         }
+        if (client.my_organization_configuration) {
+            const myOrganizationUserAttributeProfileId = client.my_organization_configuration.user_attribute_profile_id;
+            if (myOrganizationUserAttributeProfileId) {
+                const p = userAttributeProfiles?.find((uap) => uap.id === myOrganizationUserAttributeProfileId);
+                client.my_organization_configuration.user_attribute_profile_id =
+                    p?.name || myOrganizationUserAttributeProfileId;
+            }
+            const myOrganizationConnectionProfileId = client.my_organization_configuration.connection_profile_id;
+            if (myOrganizationConnectionProfileId) {
+                const c = connectionProfiles?.find((cp) => cp.id === myOrganizationConnectionProfileId);
+                client.my_organization_configuration.connection_profile_id =
+                    c?.name || myOrganizationConnectionProfileId;
+            }
+        }
         if (client.app_type === 'express_configuration') {
             // only keep relevant fields for express configuration
             client = {

package/lib/context/directory/handlers/connections.js

@@ -55,6 +55,7 @@ async function dump(context) {
     connections.forEach((connection) => {
         let dumpedConnection = {
             ...connection,
+            ...(0, utils_1.getFormattedOptions)(connection, clientsOrig),
             ...(connection.enabled_clients && {
                 enabled_clients: (0, utils_1.mapClientID2NameSorted)(connection.enabled_clients, clientsOrig || []),
             }),

package/lib/context/directory/handlers/guardianFactors.js

@@ -6,18 +6,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
-const utils_1 = require("../../../utils");
+const utils_1 = require("../../../tools/utils");
+const utils_2 = require("../../../utils");
 function parse(context) {
     const factorsFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY, tools_1.constants.GUARDIAN_FACTORS_DIRECTORY);
-    if (!(0, utils_1.existsMustBeDir)(factorsFolder))
+    if (!(0, utils_2.existsMustBeDir)(factorsFolder))
         return { guardianFactors: null }; // Skip
-    const foundFiles = (0, utils_1.getFiles)(factorsFolder, ['.json']);
-    const guardianFactors = foundFiles
-        .map((f) => (0, utils_1.loadJSON)(f, {
+    const foundFiles = (0, utils_2.getFiles)(factorsFolder, ['.json']);
+    let guardianFactors = foundFiles
+        .map((f) => (0, utils_2.loadJSON)(f, {
         mappings: context.mappings,
         disableKeywordReplacement: context.disableKeywordReplacement,
     }))
         .filter((p) => Object.keys(p).length > 0); // Filter out empty guardianFactors
+    guardianFactors = (0, utils_1.sortGuardianFactors)(guardianFactors);
     return {
         guardianFactors,
     };
@@ -30,7 +32,7 @@ async function dump(context) {
     fs_extra_1.default.ensureDirSync(factorsFolder);
     guardianFactors.forEach((factor) => {
         const factorFile = path_1.default.join(factorsFolder, `${factor.name}.json`);
-        (0, utils_1.dumpJSON)(factorFile, factor);
+        (0, utils_2.dumpJSON)(factorFile, factor);
     });
 }
 const guardianFactorsHandler = {

package/lib/context/directory/handlers/tenant.d.ts

@@ -1,10 +1,5 @@
 import { DirectoryHandler } from '.';
 import { Asset, ParsedAsset } from '../../../types';
-type ParsedTenant = ParsedAsset<'tenant', {
-    session_lifetime: number;
-    idle_session_lifetime: number;
-} & {
-    [key: string]: Asset;
-}>;
+type ParsedTenant = ParsedAsset<'tenant', Asset>;
 declare const tenantHandler: DirectoryHandler<ParsedTenant>;
 export default tenantHandler;

package/lib/context/directory/handlers/tenant.js

@@ -41,7 +41,6 @@ async function dump(context) {
     (0, utils_1.clearTenantFlags)(tenant);
     const tenantFile = path_1.default.join(context.filePath, 'tenant.json');
     (0, utils_1.dumpJSON)(tenantFile, tenant);
-    return;
 }
 const tenantHandler = {
     parse,

package/lib/context/directory/handlers/triggers.js

@@ -7,7 +7,6 @@ const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
 const utils_1 = require("../../../utils");
-const logger_1 = __importDefault(require("../../../logger"));
 function parse(context) {
     const triggersFolder = path_1.default.join(context.filePath, tools_1.constants.TRIGGERS_DIRECTORY);
     if (!(0, utils_1.existsMustBeDir)(triggersFolder))
@@ -29,8 +28,7 @@ async function dump(context) {
     const triggersFolder = path_1.default.join(context.filePath, tools_1.constants.TRIGGERS_DIRECTORY);
     fs_extra_1.default.ensureDirSync(triggersFolder);
     const triggerFile = path_1.default.join(triggersFolder, 'triggers.json');
-    logger_1.default.info(`Writing ${triggerFile}`);
-    fs_extra_1.default.writeFileSync(triggerFile, JSON.stringify(triggers, null, 2));
+    (0, utils_1.dumpJSON)(triggerFile, triggers);
 }
 const triggersHandler = {
     parse,

package/lib/context/index.js

@@ -158,6 +158,11 @@ const setupContext = async (config, command) => {
         token: accessToken,
         headers: {
             'User-agent': `deploy-cli/${packageVersion} (node.js/${process.version.replace('v', '')})`,
+            ...((0, utils_1.isTruthy)(config.AUTH0_DRY_RUN)
+                ? {
+                    'X-Auth0-Deploy-Mode': 'dry-run',
+                }
+                : {}),
         },
         maxRetries: config.AUTH0_API_MAX_RETRIES || 10,
     });

package/lib/context/yaml/handlers/clients.js

@@ -58,6 +58,18 @@ async function dump(context) {
             const o = clients?.find((uap) => uap.client_id === oktaOinClientId);
             client.express_configuration.okta_oin_client_id = o?.name || oktaOinClientId;
         }
+        const myOrganizationUserAttributeProfileId = client?.my_organization_configuration?.user_attribute_profile_id;
+        if (client.my_organization_configuration && myOrganizationUserAttributeProfileId) {
+            const p = userAttributeProfiles?.find((uap) => uap.id === myOrganizationUserAttributeProfileId);
+            client.my_organization_configuration.user_attribute_profile_id =
+                p?.name || myOrganizationUserAttributeProfileId;
+        }
+        const myOrganizationConnectionProfileId = client?.my_organization_configuration?.connection_profile_id;
+        if (client.my_organization_configuration && myOrganizationConnectionProfileId) {
+            const c = connectionProfiles?.find((cp) => cp.id === myOrganizationConnectionProfileId);
+            client.my_organization_configuration.connection_profile_id =
+                c?.name || myOrganizationConnectionProfileId;
+        }
         return client;
     });
     return {

package/lib/context/yaml/handlers/connections.js

@@ -33,22 +33,6 @@ async function parse(context) {
         ],
     };
 }
-const getFormattedOptions = (connection, clients) => {
-    try {
-        return {
-            options: {
-                ...connection.options,
-                idpinitiated: {
-                    ...connection.options.idpinitiated,
-                    client_id: (0, utils_1.convertClientIdToName)(connection.options.idpinitiated.client_id, clients),
-                },
-            },
-        };
-    }
-    catch (e) {
-        return {};
-    }
-};
 async function dump(context) {
     let { connections } = context.assets;
     const { clients } = context.assets;
@@ -63,7 +47,7 @@ async function dump(context) {
         connections: connections.map((connection) => {
             let dumpedConnection = {
                 ...connection,
-                ...getFormattedOptions(connection, clients),
+                ...(0, utils_1.getFormattedOptions)(connection, clients),
                 ...(connection.enabled_clients && {
                     enabled_clients: (0, utils_1.mapClientID2NameSorted)(connection.enabled_clients, clients || []),
                 }),

package/lib/context/yaml/handlers/guardianFactors.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../../../tools/utils");
 async function parseAndDump(context) {
-    const { guardianFactors } = context.assets;
+    let { guardianFactors } = context.assets;
     if (!guardianFactors)
         return { guardianFactors: null };
+    guardianFactors = (0, utils_1.sortGuardianFactors)(guardianFactors);
     return {
         guardianFactors,
     };

package/lib/context/yaml/handlers/tenant.js

@@ -22,7 +22,7 @@ async function parse(context) {
     };
 }
 async function dump(context) {
-    const tenant = context.assets.tenant;
+    const { tenant } = context.assets;
     if (!tenant)
         return { tenant: null };
     (0, utils_1.clearTenantFlags)(tenant);

package/lib/context/yaml/index.js

@@ -183,7 +183,8 @@ class YAMLContext {
             cleaned = (0, utils_1.stripIdentifiers)(auth0, cleaned);
         }
         // Write YAML File
-        const raw = js_yaml_1.default.dump(cleaned);
+        const exportOrdered = Boolean(this.config.AUTH0_EXPORT_ORDERED);
+        const raw = js_yaml_1.default.dump(cleaned, { sortKeys: exportOrdered });
         logger_1.default.info(`Writing ${this.configFile}`);
         fs_extra_1.default.writeFileSync(this.configFile, raw);
     }

package/lib/sessionDurationsToMinutes.d.ts

@@ -1,11 +1,13 @@
-export declare const sessionDurationsToMinutes: ({ session_lifetime, idle_session_lifetime, idle_ephemeral_session_lifetime, ephemeral_session_lifetime, }: {
-    session_lifetime?: number;
-    idle_session_lifetime?: number;
-    idle_ephemeral_session_lifetime?: number;
-    ephemeral_session_lifetime?: number;
-}) => {
+type SessionDurations = {
     session_lifetime_in_minutes?: number;
     idle_session_lifetime_in_minutes?: number;
-    idle_ephemeral_session_lifetime_in_minutes?: number;
     ephemeral_session_lifetime_in_minutes?: number;
+    idle_ephemeral_session_lifetime_in_minutes?: number;
 };
+export declare function sessionDurationsToMinutes({ session_lifetime, idle_session_lifetime, ephemeral_session_lifetime, idle_ephemeral_session_lifetime, }?: {
+    session_lifetime?: number;
+    idle_session_lifetime?: number;
+    ephemeral_session_lifetime?: number;
+    idle_ephemeral_session_lifetime?: number;
+}): SessionDurations;
+export default sessionDurationsToMinutes;

package/lib/sessionDurationsToMinutes.js

@@ -1,19 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionDurationsToMinutes = void 0;
+exports.sessionDurationsToMinutes = sessionDurationsToMinutes;
+/* eslint-disable camelcase */
 function hoursToMinutes(hours) {
-    return Math.round(hours * 60);
+    return parseFloat(Math.round(hours * 60).toFixed(4));
 }
-const sessionDurationsToMinutes = ({ session_lifetime, idle_session_lifetime, idle_ephemeral_session_lifetime, ephemeral_session_lifetime, }) => {
+function sessionDurationsToMinutes({ session_lifetime, idle_session_lifetime, ephemeral_session_lifetime, idle_ephemeral_session_lifetime, } = {}) {
     const sessionDurations = {};
-    if (!!session_lifetime)
+    if (session_lifetime !== undefined)
         sessionDurations.session_lifetime_in_minutes = hoursToMinutes(session_lifetime);
-    if (!!idle_session_lifetime)
+    if (idle_session_lifetime !== undefined)
         sessionDurations.idle_session_lifetime_in_minutes = hoursToMinutes(idle_session_lifetime);
-    if (!!idle_ephemeral_session_lifetime)
-        sessionDurations.idle_ephemeral_session_lifetime_in_minutes = hoursToMinutes(idle_ephemeral_session_lifetime);
-    if (!!ephemeral_session_lifetime)
+    if (ephemeral_session_lifetime !== undefined)
         sessionDurations.ephemeral_session_lifetime_in_minutes = hoursToMinutes(ephemeral_session_lifetime);
+    if (idle_ephemeral_session_lifetime !== undefined)
+        sessionDurations.idle_ephemeral_session_lifetime_in_minutes = hoursToMinutes(idle_ephemeral_session_lifetime);
     return sessionDurations;
-};
-exports.sessionDurationsToMinutes = sessionDurationsToMinutes;
+}
+exports.default = sessionDurationsToMinutes;

package/lib/tools/auth0/handlers/actions.d.ts

@@ -118,6 +118,7 @@ export default class ActionHandler extends DefaultAPIHandler {
     actionChanges(action: any, found: any): Promise<Asset>;
     getType(): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     enrichActionWithModuleIds(action: Action, modules: ActionModule[]): Promise<Action>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/actions.js

@@ -280,6 +280,42 @@ class ActionHandler extends default_1.default {
         }
         return super.calcChanges({ ...assets, actions });
     }
+    async dryRunChanges(assets) {
+        let { actions, actionModules } = assets;
+        if (!actions) {
+            return {
+                del: [],
+                create: [],
+                update: [],
+                conflicts: [],
+            };
+        }
+        let modules = null;
+        if (actionModules && actionModules.length > 0) {
+            modules = actionModules;
+        }
+        else {
+            try {
+                modules = await (0, client_1.paginate)(this.client.actions.modules.list, {
+                    paginate: true,
+                });
+            }
+            catch {
+                logger_1.default.debug('Skipping actions modules enrichment because action modules could not be retrieved.');
+                modules = null;
+            }
+        }
+        if (modules != null) {
+            const processedActions = await this.client.pool
+                .addEachTask({
+                data: actions || [],
+                generator: (action) => this.enrichActionWithModuleIds(action, modules),
+            })
+                .promise();
+            actions = processedActions;
+        }
+        return super.dryRunChanges({ ...assets, actions });
+    }
     async enrichActionWithModuleIds(action, modules) {
         if (!action.modules || action.modules.length === 0) {
             return action;

package/lib/tools/auth0/handlers/attackProtection.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.CAPTCHA_PROVIDERS = void 0;
 const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 exports.CAPTCHA_PROVIDERS = [
     'arkose',
@@ -187,6 +188,14 @@ class AttackProtectionHandler extends default_1.default {
         super({
             ...config,
             type: 'attackProtection',
+            ignoreDryRunFields: [
+                'captcha.arkose.secret',
+                'captcha.friendly_captcha.secret',
+                'captcha.hcaptcha.secret',
+                'captcha.recaptcha_enterprise.api_key',
+                'captcha.recaptcha_enterprise.project_id',
+                'captcha.recaptcha_v2.secret',
+            ],
         });
     }
     objString(item) {
@@ -263,6 +272,12 @@ class AttackProtectionHandler extends default_1.default {
         if (!attackProtection || !Object.keys(attackProtection).length) {
             return;
         }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         const updates = [];
         if (attackProtection.botDetection && Object.keys(attackProtection.botDetection).length) {
             updates.push(this.client.attackProtection.botDetection.update(attackProtection.botDetection));

package/lib/tools/auth0/handlers/branding.js

@@ -46,6 +46,7 @@ exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
 const logger_1 = __importDefault(require("../../../logger"));
+const utils_1 = require("../../utils");
 exports.schema = {
     type: 'object',
     properties: {
@@ -117,6 +118,12 @@ class BrandingHandler extends default_1.default {
     async processChanges(assets) {
         if (!assets.branding)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (del.length === 0 && update.length === 0 && create.length === 0) {
+                return;
+            }
+        }
         const { templates, ...brandingSettings } = assets.branding;
         if (brandingSettings.logo_url === '') {
             // Sometimes blank logo_url returned by API but is invalid on import. See: DXCDT-240

package/lib/tools/auth0/handlers/clientGrants.js

@@ -84,8 +84,11 @@ class ClientGrantsHandler extends default_1.default {
             type: 'clientGrants',
             id: 'id',
             // @ts-ignore because not sure why two-dimensional array passed in
-            identifiers: ['id', ['client_id', 'audience']],
+            // Try ['client_id', 'audience', 'subject_type'] first; falls through to
+            // ['client_id', 'audience'] when subject_type is null (falsy).
+            identifiers: ['id', ['client_id', 'audience', 'subject_type'], ['client_id', 'audience']],
             stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system'],
+            ignoreDryRunFields: ['_clientName'],
         });
     }
     objString(item) {
@@ -155,6 +158,31 @@ class ClientGrantsHandler extends default_1.default {
             ...assets,
             clientGrants: formatted,
         });
+        // subject_type is immutable (in stripUpdateFields). Grants matched via the
+        // ['client_id', 'audience'] fallback with a mismatched subject_type must become
+        // DELETE + CREATE, not UPDATE, so the tenant converges to the desired state.
+        const subjectTypeMismatches = update.filter((localGrant) => {
+            // Only flag when local explicitly specifies subject_type (backward compat).
+            if (localGrant.subject_type === undefined)
+                return false;
+            const remoteGrant = (this.existing || []).find((e) => e.id === localGrant.id);
+            return (remoteGrant && (remoteGrant.subject_type ?? null) !== (localGrant.subject_type ?? null));
+        });
+        const adjustedUpdate = update.filter((u) => !subjectTypeMismatches.includes(u));
+        const adjustedDel = [
+            ...del,
+            ...subjectTypeMismatches
+                .map((u) => (this.existing || []).find((e) => e.id === u.id))
+                .filter((e) => e !== undefined),
+        ];
+        const adjustedCreate = [
+            ...create,
+            ...subjectTypeMismatches
+                .map((u) => formatted.find((f) => f.client_id === u.client_id &&
+                f.audience === u.audience &&
+                (f.subject_type ?? null) === (u.subject_type ?? null)))
+                .filter((g) => g !== undefined),
+        ];
         const filterGrants = (list) => {
             let filtered = list;
             // Filter out the current client (Auth0 Management API client)
@@ -174,11 +202,11 @@ class ClientGrantsHandler extends default_1.default {
         };
         const changes = {
             // @ts-ignore because this expects `client_id` and that's not yet typed on Asset
-            del: filterGrants(del),
+            del: filterGrants(adjustedDel),
             // @ts-ignore because this expects `client_id` and that's not yet typed on Asset
-            update: filterGrants(update),
+            update: filterGrants(adjustedUpdate),
             // @ts-ignore because this expects `client_id` and that's not yet typed on Asset
-            create: filterGrants(create),
+            create: filterGrants(adjustedCreate),
             // @ts-ignore because this expects `client_id` and that's not yet typed on Asset
             conflicts: filterGrants(conflicts),
         };