auth0-deploy-cli 8.30.0 → 8.32.0

package/lib/tools/auth0/handlers/themes.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const logger_1 = __importDefault(require("../../../logger"));
 const default_1 = __importStar(require("./default"));
+const utils_1 = require("../../utils");
 /**
  * Schema
  */
@@ -480,11 +481,19 @@ class ThemesHandler extends default_1.default {
         if (!themes) {
             return;
         }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update } = await this.calcChanges(assets);
+            if (update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         // Empty array means themes should be deleted
         if (themes.length === 0) {
-            return this.deleteThemes();
+            await this.deleteThemes();
+        }
+        else {
+            await this.updateThemes(themes);
         }
-        return this.updateThemes(themes);
     }
     async deleteThemes() {
         if (!this.config('AUTH0_ALLOW_DELETE')) {

package/lib/tools/auth0/handlers/triggers.js

@@ -122,6 +122,12 @@ class TriggersHandler extends default_1.default {
         // Do nothing if not set
         if (!triggers)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { update } = await this.calcChanges(assets);
+            if (update.length === 0) {
+                return;
+            }
+        }
         await (0, utils_1.sleep)(2000); // Delay to allow newly-deployed actions to register in backend
         await Promise.all(Object.entries(triggers).map(async ([name, data]) => {
             const bindings = data.map((binding) => ({

package/lib/tools/auth0/handlers/userAttributeProfiles.js

@@ -46,7 +46,7 @@ exports.getUserAttributeProfiles = exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
 const logger_1 = __importDefault(require("../../../logger"));
 const client_1 = require("../client");
-const calculateChanges_1 = require("../../calculateChanges");
+const utils_1 = require("../../utils");
 const strategies = ['pingfederate', 'ad', 'adfs', 'waad', 'google-apps', 'okta', 'oidc', 'samlp'];
 const strategyOverrides = {
     type: 'object',
@@ -147,7 +147,6 @@ exports.schema = {
                                     },
                                     scim_mapping: {
                                         type: 'string',
-                                        default: 'externalId',
                                     },
                                 },
                             },
@@ -269,14 +268,21 @@ class UserAttributeProfilesHandler extends default_1.default {
         // Do nothing if not set
         if (!userAttributeProfiles)
             return;
-        const existing = await this.getType();
-        const changes = (0, calculateChanges_1.calculateChanges)({
-            handler: this,
-            assets: userAttributeProfiles,
-            existing,
-            identifiers: this.identifiers,
-            allowDelete: !!this.config('AUTH0_ALLOW_DELETE'),
-        });
+        const { del, update, create, conflicts } = await this.calcChanges(assets);
+        if ((0, utils_1.isDryRun)(this.config)) {
+            if (create.length === 0 &&
+                update.length === 0 &&
+                del.length === 0 &&
+                conflicts.length === 0) {
+                return;
+            }
+        }
+        const changes = {
+            del,
+            update,
+            create,
+            conflicts,
+        };
         logger_1.default.debug(`Start processChanges for userAttributeProfile [delete:${changes.del.length}] [update:${changes.update.length}], [create:${changes.create.length}]`);
         await super.processChanges(assets, changes);
     }

package/lib/tools/auth0/index.d.ts

@@ -12,4 +12,7 @@ export default class Auth0 {
     validate(): Promise<void>;
     loadAssetsFromAuth0(): Promise<void>;
     processChanges(): Promise<void>;
+    dryRun(opts?: {
+        interactive?: boolean;
+    }): Promise<boolean>;
 }

package/lib/tools/auth0/index.js

@@ -4,9 +4,16 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const ajv_1 = __importDefault(require("ajv/lib/ajv"));
+const lodash_1 = require("lodash");
+const chalk_1 = __importDefault(require("chalk"));
+const prompts_1 = require("@clack/prompts");
+const promise_pool_executor_1 = require("promise-pool-executor");
 const client_1 = __importDefault(require("./client"));
 const schema_1 = __importDefault(require("./schema"));
 const handlers_1 = __importDefault(require("./handlers"));
+const calculateDryRunChanges_1 = require("../calculateDryRunChanges");
+const utils_1 = require("../../utils");
+const utils_2 = require("../utils");
 /**
  * Sorts handlers by their @order decorator metadata for a given stage.
  * Handlers are sorted in ascending order (lower values execute first).
@@ -29,6 +36,30 @@ function sortByOrder(toSort, stage) {
     });
     return sorted;
 }
+function buildTableBorder(left, middle, right, widths) {
+    return `${left}${widths.map((width) => '─'.repeat(width + 2)).join(middle)}${right}`;
+}
+function formatStatusCell(status, width) {
+    let statusColor;
+    const baseStatus = status.replace(' *', '');
+    switch (baseStatus) {
+        case 'CREATE':
+            statusColor = chalk_1.default.green;
+            break;
+        case 'UPDATE':
+            statusColor = chalk_1.default.yellow;
+            break;
+        case 'DELETE':
+            statusColor = chalk_1.default.red;
+            break;
+        default:
+            statusColor = chalk_1.default.white;
+    }
+    if (status.includes(' *')) {
+        return `${statusColor(baseStatus.padEnd(width - 2))}${chalk_1.default.dim(' *')}`;
+    }
+    return statusColor(baseStatus.padEnd(width));
+}
 class Auth0 {
     constructor(client, assets, config) {
         this.client = (0, client_1.default)(client);
@@ -91,5 +122,178 @@ class Auth0 {
     async processChanges() {
         await this.runStage('processChanges');
     }
+    async dryRun(opts = {}) {
+        const isDebug = process.env.AUTH0_DEBUG === 'true';
+        const s = (0, prompts_1.spinner)();
+        if (isDebug) {
+            prompts_1.log.info('Preparing dry run preview...\n');
+        }
+        else {
+            s.start('Preparing dry run preview...');
+        }
+        // Collect changes from all handlers
+        const allChanges = {};
+        const savedAssets = this.assets;
+        this.assets = await (0, calculateDryRunChanges_1.dryRunFormatAssets)((0, lodash_1.cloneDeep)(this.assets), this.client);
+        const dryRunPool = new promise_pool_executor_1.PromisePoolExecutor({
+            concurrencyLimit: 2,
+            frequencyLimit: 8,
+            frequencyWindow: 1000, // 1 sec
+        });
+        await dryRunPool
+            .addEachTask({
+            data: this.handlers,
+            generator: (handler) => (async () => {
+                try {
+                    const detailedChanges = [];
+                    let created = 0;
+                    let updated = 0;
+                    let deleted = 0;
+                    if (isDebug) {
+                        prompts_1.log.info(`Calculating dry run changes for ${handler.type}...`);
+                    }
+                    else {
+                        s.message(`Calculating dry run changes for ${handler.type}...`);
+                    }
+                    const changes = await handler.dryRunChanges(this.assets);
+                    if (changes.create) {
+                        changes.create.forEach((item) => {
+                            detailedChanges.push({
+                                action: 'CREATE',
+                                identifier: handler.getResourceName(item),
+                                details: item,
+                            });
+                        });
+                        created = changes.create.length;
+                    }
+                    if (changes.update) {
+                        changes.update.forEach((item) => {
+                            detailedChanges.push({
+                                action: 'UPDATE',
+                                identifier: handler.getResourceName(item),
+                                details: item,
+                            });
+                        });
+                        updated = changes.update.length;
+                    }
+                    if (changes.del) {
+                        changes.del.forEach((item) => {
+                            detailedChanges.push({
+                                action: 'DELETE',
+                                identifier: handler.getResourceName(item),
+                                details: item,
+                            });
+                        });
+                        deleted = changes.del.length;
+                    }
+                    allChanges[handler.type] = {
+                        created,
+                        updated,
+                        deleted,
+                        changes: detailedChanges,
+                    };
+                }
+                catch (err) {
+                    err.type = handler.type;
+                    err.stage = 'dryRun';
+                    throw err;
+                }
+            })(),
+        })
+            .promise();
+        // Restore original assets so processChanges() works correctly after dryRun()
+        this.assets = savedAssets;
+        if (!isDebug) {
+            (0, utils_2.printCLIMessage)('');
+            s.stop('Done\n');
+        }
+        // Build formatted table output
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === 'true' || this.config('AUTH0_ALLOW_DELETE') === true;
+        const tenantDomain = this.config('AUTH0_DOMAIN');
+        const inputPath = this.config('AUTH0_INPUT_FILE') || './tenant-config-directory/';
+        let output = '\n';
+        output += chalk_1.default.bold('Auth0 Deploy CLI - Dry Run Preview\n\n');
+        output += chalk_1.default.bold('Tenant:') + ` ${tenantDomain}\n`;
+        output += chalk_1.default.bold('Input:') + ` ${inputPath}\n\n`;
+        output += 'Simulating deployment... The following changes are proposed:\n\n';
+        const tableData = [];
+        const resourceTypes = Object.keys(allChanges).sort();
+        resourceTypes.forEach((type) => {
+            const typeChanges = allChanges[type];
+            if (typeChanges.changes.length > 0) {
+                const typeName = type.charAt(0).toUpperCase() + type.slice(1);
+                typeChanges.changes.forEach((change, index) => {
+                    const deleteNote = change.action === 'DELETE' && !allowDelete ? ' *' : '';
+                    tableData.push({
+                        resource: index === 0 ? typeName : '',
+                        status: change.action + deleteNote,
+                        name: change.identifier,
+                    });
+                });
+            }
+        });
+        if (tableData.length > 0) {
+            const resourceWidth = Math.max(10, ...tableData.map((d) => d.resource.length));
+            const statusWidth = Math.max(8, ...tableData.map((d) => d.status.length));
+            const nameWidth = Math.max(25, ...tableData.map((d) => d.name.length));
+            const widths = [resourceWidth, statusWidth, nameWidth];
+            const topBorder = buildTableBorder('┌', '┬', '┐', widths);
+            const headerSeparator = buildTableBorder('├', '┼', '┤', widths);
+            const bottomBorder = buildTableBorder('└', '┴', '┘', widths);
+            output += `${topBorder}\n`;
+            output += `│ ${chalk_1.default.bold('Resource'.padEnd(resourceWidth))} │ ${chalk_1.default.bold('Status'.padEnd(statusWidth))} │ ${chalk_1.default.bold('Name / Identifier'.padEnd(nameWidth))} │\n`;
+            output += `${headerSeparator}\n`;
+            tableData.forEach((row) => {
+                output += `│ ${row.resource.padEnd(resourceWidth)} │ ${formatStatusCell(row.status, statusWidth)} │ ${row.name.padEnd(nameWidth)} │\n`;
+            });
+            output += `${bottomBorder}\n`;
+            if (!allowDelete && tableData.some((d) => d.status.includes('*'))) {
+                output += '\n' + chalk_1.default.dim('* Requires AUTH0_ALLOW_DELETE to be enabled');
+            }
+        }
+        else {
+            output += chalk_1.default.dim('No changes detected.');
+        }
+        output += '\n\n';
+        output += chalk_1.default.green('Dry Run completed successfully.') + '\n';
+        (0, utils_2.printCLIMessage)(output);
+        const hasChanges = tableData.length > 0;
+        const shouldApplyAfterPreview = (0, utils_1.isTruthy)(this.config('AUTH0_DRY_RUN_APPLY'));
+        if (opts.interactive && process.stdout.isTTY && !shouldApplyAfterPreview && hasChanges) {
+            (0, prompts_1.intro)(chalk_1.default.inverse(' dry-run '));
+            const selectedType = await (0, prompts_1.select)({
+                message: 'What would you like to do?',
+                options: [
+                    { value: 'dry-run-apply', label: 'Apply changes' },
+                    {
+                        value: 'dry-run-export',
+                        label: 'Export changes in a file',
+                        hint: 'No Apply',
+                    },
+                    { value: 'dry-run-exit', label: 'Exit', hint: '' },
+                ],
+            });
+            switch (selectedType) {
+                case 'dry-run-apply':
+                    (0, utils_2.printCLIMessage)('\n' + chalk_1.default.green('Applying changes...') + '\n');
+                    await this.processChanges();
+                    break;
+                case 'dry-run-export': {
+                    const fileName = 'dry-run-diff-log.json';
+                    await (0, calculateDryRunChanges_1.exportDiffLog)(fileName);
+                    (0, utils_2.printCLIMessage)('\n' + chalk_1.default.cyan(`Exported on ./${fileName}`) + '\n');
+                    break;
+                }
+                case 'dry-run-exit':
+                    (0, utils_2.printCLIMessage)('\n' + chalk_1.default.yellow('Deployment cancelled. No changes were made.') + '\n');
+                    process.exit(0);
+                    break;
+                default:
+                    (0, utils_2.printCLIMessage)(chalk_1.default.red('Invalid option selected.'));
+                    process.exit(1);
+            }
+        }
+        return hasChanges;
+    }
 }
 exports.default = Auth0;

package/lib/tools/calculateChanges.d.ts

@@ -1,4 +1,4 @@
-import APIHandler from '../tools/auth0/handlers/default';
+import APIHandler from './auth0/handlers/default';
 import { Asset, CalculatedChanges } from '../types';
 /**
  * @template T
@@ -20,7 +20,7 @@ export declare function processChangedObjectFields({ handler, desiredAssetState,
 export declare function calculateChanges({ handler, assets, existing, identifiers, allowDelete, }: {
     handler: APIHandler;
     assets: Asset[];
-    existing: Asset[] | null;
+    existing: Asset[] | Asset | null;
     identifiers: string[];
     allowDelete: boolean;
 }): CalculatedChanges;

package/lib/tools/calculateChanges.js

@@ -67,8 +67,14 @@ function processChangedObjectFields({ handler, desiredAssetState, currentAssetSt
 function calculateChanges({ handler, assets, existing, identifiers = ['id', 'name'], allowDelete, }) {
     // Calculate the changes required between two sets of assets.
     const update = [];
-    let del = [...(existing || [])];
-    let create = [...assets];
+    let del = [];
+    if (existing) {
+        del = Array.isArray(existing) ? [...existing] : [existing];
+    }
+    let create = [];
+    if (assets) {
+        create = Array.isArray(assets) ? [...assets] : [assets];
+    }
     const conflicts = [];
     const findByKeyValue = (key, value, arr) => arr.find((e) => {
         if (Array.isArray(key)) {
@@ -124,10 +130,9 @@ function calculateChanges({ handler, assets, existing, identifiers = ['id', 'nam
     // Loop through identifiers (in order) to try match assets to existing
     // If existing then update if not create
     // The remainder will be deleted
-    for (const id of identifiers) {
-        // eslint-disable-line
+    identifiers.forEach((id) => {
         processAssets(id, [...create]);
-    }
+    });
     // Check if there are assets with names that will conflict with existing names during the update process
     // This will rename those assets to a temp random name first
     // This assumes the first identifiers is the unique identifier
@@ -138,7 +143,17 @@ function calculateChanges({ handler, assets, existing, identifiers = ['id', 'nam
             // If the conflicting item is going to be deleted then skip
             const inDeleted = del.filter((e) => e.name === a.name && e[uniqueID] !== a[uniqueID])[0];
             if (!inDeleted) {
-                const conflict = (existing || []).filter((e) => e.name === a.name && e[uniqueID] !== a[uniqueID])[0];
+                let existingArray;
+                if (Array.isArray(existing)) {
+                    existingArray = existing;
+                }
+                else if (existing) {
+                    existingArray = [existing];
+                }
+                else {
+                    existingArray = [];
+                }
+                const conflict = existingArray.filter((e) => e.name === a.name && e[uniqueID] !== a[uniqueID])[0];
                 if (conflict) {
                     const temp = Math.random().toString(36).substr(2, 5);
                     conflicts.push({

package/lib/tools/calculateDryRunChanges.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Dry-run change calculation utilities.
+ *
+ * This module handles all logic specific to the --dry-run mode:
+ * - Comparing local vs. remote assets to detect creates, updates, and deletes
+ * - Normalizing asset representations (session durations, client name→ID, profiles)
+ * - Tracking and exporting a structured diff log
+ *
+ * The core deploy-time change calculation lives in calculateChanges.ts.
+ */
+import { Asset, Assets, Auth0APIClient, CalculatedChanges } from '../types';
+export declare const getDiffLog: (resourceTypeName?: string) => string[] | {
+    [key: string]: string[];
+};
+/**
+ * Writes the accumulated diff log to a JSON file on disk.
+ * Useful for CI pipelines that want a machine-readable dry-run report.
+ */
+export declare const exportDiffLog: (fileName: string, resourceTypeName?: string) => Promise<void>;
+/**
+ * Compares two objects and returns an array of human-readable difference strings.
+ * Only considers keys present in `localObj` — extra keys in `remoteObj` are ignored.
+ *
+ * @param localObj - Local (desired) state
+ * @param remoteObj - Remote (current) state
+ * @param keyObjPath - Dot-separated JSON path used for nested tracking
+ * @param resourceTypeName - Resource type label used in log output
+ * @param ignoreDryRunFields - Field paths to skip during comparison
+ * @returns Array of difference descriptions, empty if objects are equivalent
+ */
+export declare function getObjectDifferences(localObj: Record<string, any>, remoteObj: Record<string, any>, keyObjPath?: string, resourceTypeName?: string, ignoreDryRunFields?: string[]): string[];
+/**
+ * Returns true if `localObj` and `remoteObj` differ in any field present in
+ * `localObj`. Side-effect: appends found differences to the diff log.
+ */
+export declare function hasObjectDifferences(localObj: Record<string, any>, remoteObj: Record<string, any>, keyObjPath?: string, resourceTypeName?: string, ignoreDryRunFields?: string[]): boolean;
+/**
+ * Calculates the changes required between local and remote asset sets for dry-run operations.
+ *
+ * Unlike `calculateChanges`, this function does not mutate assets for API consumption.
+ * It is purely for reporting: determining which assets would be created, updated, or deleted.
+ *
+ * @param params.type - Resource type label used for logging
+ * @param params.assets - Local assets to be deployed
+ * @param params.existing - Remote assets currently on the tenant, or null
+ * @param params.identifiers - Fields used to match local↔remote assets (default: ['id', 'name'])
+ * @param params.ignoreDryRunFields - Fields to exclude from diff comparisons
+ */
+export declare function calculateDryRunChanges({ type, assets, existing, identifiers, ignoreDryRunFields, }: {
+    type: string;
+    assets: Asset[] | Asset;
+    existing: Asset[] | Asset | null;
+    identifiers: string[];
+    ignoreDryRunFields: string[];
+}): CalculatedChanges;
+/**
+ * Normalizes local assets so they can be accurately compared against remote assets.
+ *
+ * Transformations applied:
+ * - Converts client name references to client IDs (clientGrants, databases, connections, resourceServers)
+ * - Resolves connection profile and user attribute profile names to IDs (express_configuration)
+ * - Decodes base64-encoded SAML certificates to PEM strings
+ * - Resolves organization connection names to connection IDs
+ * - Normalizes tenant session duration fields
+ * - Removes empty branding templates (avoids false diff against remote)
+ *
+ * @param localAssets - Local assets object (will be mutated)
+ * @param authAPIclient - Auth0 management API client for fetching remote reference data
+ * @returns The mutated assets object with normalized values
+ */
+export declare function dryRunFormatAssets(localAssets: Assets, authAPIclient: Auth0APIClient): Promise<Assets>;