auth0-deploy-cli 8.30.0 → 8.32.0

package/lib/tools/auth0/handlers/clients.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import DefaultAPIHandler from './default';
 export declare const schema: {
     type: string;
@@ -11,6 +11,22 @@ export declare const schema: {
                 minLength: number;
                 pattern: string;
             };
+            external_client_id: {
+                type: string;
+                description: string;
+            };
+            external_metadata_type: {
+                type: string;
+                description: string;
+            };
+            external_metadata_created_by: {
+                type: string;
+                description: string;
+            };
+            jwks_uri: {
+                type: string;
+                description: string;
+            };
             mobile: {
                 type: string;
                 properties: {
@@ -184,6 +200,35 @@ export declare const schema: {
                     enum: string[];
                 };
             };
+            my_organization_configuration: {
+                type: string[];
+                description: string;
+                properties: {
+                    connection_profile_id: {
+                        type: string;
+                        description: string;
+                    };
+                    user_attribute_profile_id: {
+                        type: string;
+                        description: string;
+                    };
+                    allowed_strategies: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            enum: ("samlp" | "pingfederate" | "adfs" | "waad" | "google-apps" | "okta" | "oidc")[];
+                        };
+                        uniqueItems: boolean;
+                    };
+                    connection_deletion_behavior: {
+                        type: string;
+                        enum: ("allow" | "allow_if_empty")[];
+                        description: string;
+                    };
+                };
+                required: string[];
+            };
             async_approval_notification_channels: {
                 type: string[];
                 description: string;
@@ -315,7 +360,12 @@ export default class ClientHandler extends DefaultAPIHandler {
     existing: Client[];
     constructor(config: DefaultAPIHandler);
     objString(item: any): string;
+    calcChanges(assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
     getType(): Promise<Management.Client[]>;
-    sanitizeMapExpressConfiguration(auth0Client: Auth0APIClient, clientList: Client[]): Promise<Client[]>;
+    private isCimdClient;
+    private createClient;
+    private getCIMDEditableFields;
+    private updateClient;
+    sanitizeMapClientReferences(auth0Client: Auth0APIClient, clientList: Client[]): Promise<Client[]>;
 }

package/lib/tools/auth0/handlers/clients.js

@@ -4,9 +4,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
+const auth0_1 = require("auth0");
 const lodash_1 = require("lodash");
 const client_1 = require("../client");
 const default_1 = __importDefault(require("./default"));
+const calculateChanges_1 = require("../../calculateChanges");
 const connectionProfiles_1 = require("./connectionProfiles");
 const userAttributeProfiles_1 = require("./userAttributeProfiles");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -31,12 +33,57 @@ const multiResourceRefreshTokenPoliciesSchema = {
         required: ['audience', 'scope'],
     },
 };
+const myOrganizationConfigurationSchema = {
+    type: ['object', 'null'],
+    description: 'Configuration related to the My Organization API for the client.',
+    properties: {
+        connection_profile_id: {
+            type: 'string',
+            description: 'The name of the connection profile to use for this application',
+        },
+        user_attribute_profile_id: {
+            type: 'string',
+            description: 'The name of the user attribute profile to use for this application',
+        },
+        allowed_strategies: {
+            type: 'array',
+            description: 'The allowed connection strategies for the My Organization configuration',
+            items: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum),
+            },
+            uniqueItems: true,
+        },
+        connection_deletion_behavior: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
+            description: 'The deletion behavior for My Organization connections created by this client',
+        },
+    },
+    required: ['allowed_strategies', 'connection_deletion_behavior'],
+};
 exports.schema = {
     type: 'array',
     items: {
         type: 'object',
         properties: {
             name: { type: 'string', minLength: 1, pattern: '[^<>]+' },
+            external_client_id: {
+                type: 'string',
+                description: 'Alternative identifier for the client. For CIMD clients, this is the HTTPS URL to the OAuth 2.0 Client ID Metadata Document. Client name should match the client_name value in the metadata document.',
+            },
+            external_metadata_type: {
+                type: 'string',
+                description: 'Type of external client registration metadata.',
+            },
+            external_metadata_created_by: {
+                type: 'string',
+                description: 'Indicates who created the external metadata client: admin for Management API, client for dynamic registration.',
+            },
+            jwks_uri: {
+                type: 'string',
+                description: 'JSON Web Key Set endpoint associated with the client.',
+            },
             mobile: {
                 type: 'object',
                 properties: {
@@ -177,6 +224,7 @@ exports.schema = {
                     enum: ['email', 'organization_name'],
                 },
             },
+            my_organization_configuration: myOrganizationConfigurationSchema,
             async_approval_notification_channels: {
                 type: ['array', 'null'],
                 description: 'An ordered array of notification channels enabled for CIBA (Client-Initiated Backchannel Authentication) requests. Channels are evaluated in the order specified.',
@@ -259,7 +307,7 @@ exports.schema = {
                         description: 'List of enabled token exchange profile types for this client',
                         items: {
                             type: 'string',
-                            enum: ['custom_authentication'],
+                            enum: ['custom_authentication', 'on_behalf_of_token_exchange'],
                         },
                     },
                 },
@@ -376,6 +424,7 @@ class ClientHandler extends default_1.default {
             id: 'client_id',
             identifiers: ['client_id', 'name'],
             objectFields: ['client_metadata'],
+            stripCreateFields: ['external_metadata_type', 'external_metadata_created_by', 'jwks_uri'],
             stripUpdateFields: [
                 // Fields not allowed during updates
                 'callback_url_template',
@@ -384,18 +433,60 @@ class ClientHandler extends default_1.default {
                 'tenant',
                 'jwt_configuration.secret_encoded',
                 'resource_server_identifier',
+                'external_metadata_type',
+                'external_metadata_created_by',
+                'jwks_uri',
             ],
+            functions: {
+                create: (client) => this.createClient(client),
+                update: (clientId, client) => this.updateClient(clientId, client),
+            },
         });
     }
     objString(item) {
         return super.objString({ name: item.name, client_id: item.client_id });
     }
+    async calcChanges(assets) {
+        const clients = assets[this.type];
+        if (!clients) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const existing = await this.getType();
+        const allowDelete = !!this.config('AUTH0_ALLOW_DELETE');
+        const cimdClients = clients.filter((c) => this.isCimdClient(c));
+        const existingCimd = (existing || []).filter((c) => this.isCimdClient(c));
+        const regularClients = clients.filter((c) => !this.isCimdClient(c));
+        const existingRegular = (existing || []).filter((c) => !this.isCimdClient(c));
+        const regularChanges = (0, calculateChanges_1.calculateChanges)({
+            handler: this,
+            assets: regularClients,
+            existing: existingRegular,
+            identifiers: ['client_id', 'name'],
+            allowDelete,
+        });
+        // CIMD clients:
+        // If external_client_id changes (and no client_id match), old client is deleted
+        // and new registration is created with the new external_client_id.
+        const cimdChanges = (0, calculateChanges_1.calculateChanges)({
+            handler: this,
+            assets: cimdClients,
+            existing: existingCimd,
+            identifiers: ['client_id', 'external_client_id'],
+            allowDelete,
+        });
+        return {
+            del: [...regularChanges.del, ...cimdChanges.del],
+            update: [...regularChanges.update, ...cimdChanges.update],
+            create: [...regularChanges.create, ...cimdChanges.create],
+            conflicts: [...regularChanges.conflicts, ...cimdChanges.conflicts],
+        };
+    }
     async processChanges(assets) {
         const { clients } = assets;
         // Do nothing if not set
         if (!clients)
             return;
-        assets.clients = await this.sanitizeMapExpressConfiguration(this.client, clients);
+        assets.clients = await this.sanitizeMapClientReferences(this.client, clients);
         const excludedClients = (assets.exclude && assets.exclude.clients) || [];
         const { del, update, create, conflicts } = await this.calcChanges(assets);
         // Always filter out the client we are using to access Auth0 Management API
@@ -453,37 +544,99 @@ class ClientHandler extends default_1.default {
         this.existing = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
         return this.existing;
     }
-    // convert names back to IDs for express configuration
-    async sanitizeMapExpressConfiguration(auth0Client, clientList) {
-        // if no clients have express configuration, return early
-        if (!clientList.some((p) => p.express_configuration)) {
+    isCimdClient(client) {
+        return !!client.external_client_id;
+    }
+    async createClient(client) {
+        if (!this.isCimdClient(client)) {
+            return this.client.clients.create(client);
+        }
+        const externalClientId = client.external_client_id;
+        const registration = await this.client.clients.registerCimdClient({
+            external_client_id: externalClientId,
+        });
+        return registration;
+    }
+    getCIMDEditableFields(client) {
+        // Only a subset of fields are editable for CIMD clients.
+        return (0, lodash_1.pick)(client, [
+            'description',
+            'app_type',
+            'allowed_origins',
+            'web_origins',
+            'grant_types',
+            'oidc_conformant',
+            'organization_discovery_methods',
+            'client_metadata',
+            'default_organization',
+            'require_proof_of_possession',
+            'token_quota',
+            'skip_non_verifiable_callback_uri_confirmation_prompt',
+            'jwt_configuration',
+            'refresh_token',
+        ]);
+    }
+    async updateClient(clientId, client) {
+        // For non-CIMD clients
+        if (!this.isCimdClient(client)) {
+            return this.client.clients.update(clientId, client);
+        }
+        const updatePayload = this.getCIMDEditableFields(client);
+        const registrationClientId = client.client_id || clientId;
+        if (registrationClientId && Object.keys(updatePayload).length > 0) {
+            return this.client.clients.update(registrationClientId, updatePayload);
+        }
+        return client;
+    }
+    // convert names back to IDs for client reference-based configuration
+    async sanitizeMapClientReferences(auth0Client, clientList) {
+        const hasExpressConfiguration = clientList.some((client) => client.express_configuration);
+        const hasMyOrganizationConfiguration = clientList.some((client) => client.my_organization_configuration);
+        if (!hasExpressConfiguration && !hasMyOrganizationConfiguration) {
             return clientList;
         }
         const clientData = await this.getType();
         const connectionProfiles = await (0, connectionProfiles_1.getConnectionProfile)(auth0Client);
         const userAttributeProfiles = await (0, userAttributeProfiles_1.getUserAttributeProfiles)(auth0Client);
         return clientList.map((client) => {
-            if (!client.express_configuration)
+            if (client.express_configuration) {
+                const userAttributeProfileName = client.express_configuration.user_attribute_profile_id;
+                if (userAttributeProfileName) {
+                    const userAttributeProfile = userAttributeProfiles?.find((uap) => uap.name === userAttributeProfileName);
+                    if (userAttributeProfile?.id) {
+                        client.express_configuration.user_attribute_profile_id = userAttributeProfile.id;
+                    }
+                }
+                const connectionProfileName = client.express_configuration.connection_profile_id;
+                if (connectionProfileName) {
+                    const connectionProfile = connectionProfiles?.find((cp) => cp.name === connectionProfileName);
+                    if (connectionProfile?.id) {
+                        client.express_configuration.connection_profile_id = connectionProfile.id;
+                    }
+                }
+                const oktaOinClientName = client.express_configuration.okta_oin_client_id;
+                if (oktaOinClientName) {
+                    const oktaOinClient = clientData?.find((c) => c.name === oktaOinClientName);
+                    if (oktaOinClient?.client_id) {
+                        client.express_configuration.okta_oin_client_id = oktaOinClient.client_id;
+                    }
+                }
+            }
+            if (!client.my_organization_configuration) {
                 return client;
-            const userAttributeProfileName = client.express_configuration?.user_attribute_profile_id;
-            if (userAttributeProfileName) {
-                const userAttributeProfile = userAttributeProfiles?.find((uap) => uap.name === userAttributeProfileName);
+            }
+            const myOrganizationUserAttributeProfileName = client.my_organization_configuration.user_attribute_profile_id;
+            if (myOrganizationUserAttributeProfileName) {
+                const userAttributeProfile = userAttributeProfiles?.find((uap) => uap.name === myOrganizationUserAttributeProfileName);
                 if (userAttributeProfile?.id) {
-                    client.express_configuration.user_attribute_profile_id = userAttributeProfile.id;
+                    client.my_organization_configuration.user_attribute_profile_id = userAttributeProfile.id;
                 }
             }
-            const connectionProfileName = client.express_configuration.connection_profile_id;
-            if (connectionProfileName) {
-                const connectionProfile = connectionProfiles?.find((cp) => cp.name === connectionProfileName);
+            const myOrganizationConnectionProfileName = client.my_organization_configuration.connection_profile_id;
+            if (myOrganizationConnectionProfileName) {
+                const connectionProfile = connectionProfiles?.find((cp) => cp.name === myOrganizationConnectionProfileName);
                 if (connectionProfile?.id) {
-                    client.express_configuration.connection_profile_id = connectionProfile.id;
-                }
-            }
-            const oktaOinClientName = client.express_configuration.okta_oin_client_id;
-            if (oktaOinClientName) {
-                const oktaOinClient = clientData?.find((c) => c.name === oktaOinClientName);
-                if (oktaOinClient?.client_id) {
-                    client.express_configuration.okta_oin_client_id = oktaOinClient.client_id;
+                    client.my_organization_configuration.connection_profile_id = connectionProfile.id;
                 }
             }
             return client;

package/lib/tools/auth0/handlers/connections.d.ts

@@ -19,7 +19,6 @@ export declare const schema: {
                 properties: {
                     dpop_signing_alg: {
                         type: string;
-                        enum: ("ES256" | "Ed25519")[];
                     };
                 };
             };
@@ -196,6 +195,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     processConnectionDirectoryProvisioning(changes: CalculatedChanges): Promise<void>;
     getType(): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
 }
 export {};

package/lib/tools/auth0/handlers/connections.js

@@ -56,7 +56,6 @@ const connectionOptionsSchema = {
     properties: {
         dpop_signing_alg: {
             type: 'string',
-            enum: Object.values(auth0_1.Management.ConnectionDpopSigningAlgEnum),
         },
     },
 };
@@ -544,11 +543,14 @@ class ConnectionsHandler extends default_1.default {
         });
         // Prepare an id map. We'll use this map later to get the `strategy` and SCIM enable status of the connections.
         await this.scimHandler.createIdMap(existingConnections);
-        const formatted = connections.map((connection) => ({
-            ...connection,
-            ...this.getFormattedOptions(connection, clients),
-            enabled_clients: (0, utils_1.getEnabledClients)(assets, connection, existingConnections, clients),
-        }));
+        const formatted = connections.map((connection) => {
+            const enabledClients = (0, utils_1.getEnabledClients)(assets, connection, existingConnections, clients);
+            return {
+                ...connection,
+                ...this.getFormattedOptions(connection, clients),
+                ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
+            };
+        });
         const proposedChanges = await super.calcChanges({ ...assets, connections: formatted });
         const proposedChangesWithExcludedProperties = (0, exports.addExcludedConnectionPropertiesToChanges)({
             proposedChanges,
@@ -557,6 +559,40 @@ class ConnectionsHandler extends default_1.default {
         });
         return proposedChangesWithExcludedProperties;
     }
+    async dryRunChanges(assets) {
+        const { connections } = assets;
+        if (!connections) {
+            return {
+                del: [],
+                create: [],
+                update: [],
+                conflicts: [],
+            };
+        }
+        const clients = await (0, client_1.paginate)(this.client.clients.list, {
+            paginate: true,
+            include_totals: true,
+        });
+        const existingConnections = await (0, client_1.paginate)(this.client.connections.list, {
+            checkpoint: true,
+            include_totals: true,
+        });
+        await this.scimHandler.createIdMap(existingConnections);
+        const formatted = connections.map((connection) => {
+            const enabledClients = (0, utils_1.getEnabledClients)(assets, connection, existingConnections, clients);
+            return {
+                ...connection,
+                ...this.getFormattedOptions(connection, clients),
+                ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
+            };
+        });
+        const proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        return (0, exports.addExcludedConnectionPropertiesToChanges)({
+            proposedChanges,
+            existingConnections,
+            config: this.config,
+        });
+    }
     // Run after clients are updated so we can convert all the enabled_clients names to id's
     async processChanges(assets) {
         const { connections } = assets;

package/lib/tools/auth0/handlers/customDomains.d.ts

@@ -50,6 +50,10 @@ export declare const schema: {
                 type: string[];
                 description: string;
             };
+            is_default: {
+                type: string;
+                description: string;
+            };
         };
         required: string[];
     };
@@ -60,6 +64,7 @@ export default class CustomDomainsHadnler extends DefaultAPIHandler {
     constructor(config: DefaultAPIHandler);
     objString(item: Asset): string;
     getType(): Promise<Asset | null>;
+    validate(assets: Assets): Promise<void>;
     processChanges(assets: Assets): Promise<void>;
 }
 export {};

package/lib/tools/auth0/handlers/customDomains.js

@@ -44,6 +44,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
+const validationError_1 = __importDefault(require("../../validationError"));
 const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
@@ -81,6 +82,10 @@ exports.schema = {
                 type: ['string'],
                 description: 'Relying Party ID (rpId) to be used for Passkeys on this custom domain. If not provided or set to null, the full domain will be used.',
             },
+            is_default: {
+                type: 'boolean',
+                description: 'Whether this custom domain is the default domain used for email notifications.',
+            },
         },
         required: ['domain', 'type'],
     },
@@ -136,6 +141,16 @@ class CustomDomainsHadnler extends default_1.default {
             throw err;
         }
     }
+    async validate(assets) {
+        await super.validate(assets);
+        const { customDomains } = assets;
+        if (!customDomains)
+            return;
+        const defaultDomains = customDomains.filter((d) => d.is_default === true);
+        if (defaultDomains.length > 1) {
+            throw new validationError_1.default(`Only one custom domain can be set as default (is_default: true), but found ${defaultDomains.length}: ${defaultDomains.map((d) => d.domain).join(', ')}`);
+        }
+    }
     async processChanges(assets) {
         const { customDomains } = assets;
         if (!customDomains)
@@ -149,6 +164,17 @@ class CustomDomainsHadnler extends default_1.default {
         }
         const changes = await this.calcChanges(assets);
         await super.processChanges(assets, changes);
+        // If a domain is marked as is_default, set it as the tenant's default custom domain.
+        const defaultDomain = customDomains.find((d) => d.is_default === true);
+        if (defaultDomain) {
+            try {
+                await this.client.customDomains.setDefault({ domain: defaultDomain.domain });
+                logger_1.default.info(`Set default custom domain: ${defaultDomain.domain}`);
+            }
+            catch (err) {
+                throw new Error(`Problem setting default custom domain ${defaultDomain.domain}\n${err}`);
+            }
+        }
     }
 }
 exports.default = CustomDomainsHadnler;

package/lib/tools/auth0/handlers/databases.d.ts

@@ -37,6 +37,11 @@ export declare const schema: {
                                     };
                                     api_behavior: {
                                         type: string;
+                                        enum: string[];
+                                    };
+                                    signup_behavior: {
+                                        type: string;
+                                        enum: string[];
                                     };
                                 };
                             };
@@ -190,6 +195,90 @@ export declare const schema: {
                             };
                         };
                     };
+                    password_options: {
+                        type: string;
+                        properties: {
+                            complexity: {
+                                type: string;
+                                properties: {
+                                    min_length: {
+                                        type: string;
+                                        minimum: number;
+                                        maximum: number;
+                                    };
+                                    character_types: {
+                                        type: string;
+                                        items: {
+                                            type: string;
+                                            enum: string[];
+                                        };
+                                    };
+                                    character_type_rule: {
+                                        type: string;
+                                        enum: string[];
+                                    };
+                                    identical_characters: {
+                                        type: string;
+                                        enum: string[];
+                                    };
+                                    sequential_characters: {
+                                        type: string;
+                                        enum: string[];
+                                    };
+                                    max_length_exceeded: {
+                                        type: string;
+                                        enum: string[];
+                                    };
+                                };
+                            };
+                            profile_data: {
+                                type: string;
+                                properties: {
+                                    active: {
+                                        type: string;
+                                    };
+                                    blocked_fields: {
+                                        type: string;
+                                        items: {
+                                            type: string;
+                                        };
+                                        maxItems: number;
+                                    };
+                                };
+                            };
+                            history: {
+                                type: string;
+                                properties: {
+                                    active: {
+                                        type: string;
+                                    };
+                                    size: {
+                                        type: string;
+                                        minimum: number;
+                                        maximum: number;
+                                    };
+                                };
+                            };
+                            dictionary: {
+                                type: string;
+                                properties: {
+                                    active: {
+                                        type: string;
+                                    };
+                                    default: {
+                                        type: string;
+                                        enum: string[];
+                                    };
+                                    custom: {
+                                        type: string;
+                                        items: {
+                                            type: string;
+                                        };
+                                    };
+                                };
+                            };
+                        };
+                    };
                 };
             };
         };
@@ -202,10 +291,12 @@ export default class DatabaseHandler extends DefaultAPIHandler {
     objString(db: any): string;
     getFormattedOptions(options: any, actions?: Action[]): any;
     validate(assets: Assets): Promise<void>;
+    private validatePasswordOptions;
     private validatePasswordlessSettings;
     private validateEmailUniqueConstraints;
     getClientFN(fn: 'create' | 'delete' | 'getAll' | 'update'): Function;
     getType(): Promise<Connection[]>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
 }