auth0-deploy-cli 8.30.0 → 8.32.0

package/lib/tools/calculateDryRunChanges.js

@@ -0,0 +1,492 @@
+"use strict";
+/**
+ * Dry-run change calculation utilities.
+ *
+ * This module handles all logic specific to the --dry-run mode:
+ * - Comparing local vs. remote assets to detect creates, updates, and deletes
+ * - Normalizing asset representations (session durations, client name→ID, profiles)
+ * - Tracking and exporting a structured diff log
+ *
+ * The core deploy-time change calculation lives in calculateChanges.ts.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exportDiffLog = exports.getDiffLog = void 0;
+exports.getObjectDifferences = getObjectDifferences;
+exports.hasObjectDifferences = hasObjectDifferences;
+exports.calculateDryRunChanges = calculateDryRunChanges;
+exports.dryRunFormatAssets = dryRunFormatAssets;
+const chalk_1 = __importDefault(require("chalk"));
+const promises_1 = __importDefault(require("node:fs/promises"));
+const logger_1 = __importDefault(require("../logger"));
+const utils_1 = require("./utils");
+const client_1 = require("./auth0/client");
+const sessionDurationsToMinutes_1 = __importDefault(require("../sessionDurationsToMinutes"));
+const clearTenantFlags = (tenant) => {
+    if (tenant.flags && !Object.keys(tenant.flags).length) {
+        delete tenant.flags;
+    }
+};
+/**
+ * Converts tenant session duration fields from hours to minutes so that
+ * local (hours) and remote (minutes) representations can be compared directly.
+ */
+const normalizeTenantForDryRun = (tenant) => {
+    const normalizedTenant = { ...tenant };
+    clearTenantFlags(normalizedTenant);
+    const sessionDurations = (0, sessionDurationsToMinutes_1.default)({
+        session_lifetime: normalizedTenant.session_lifetime,
+        idle_session_lifetime: normalizedTenant.idle_session_lifetime,
+        ephemeral_session_lifetime: normalizedTenant.ephemeral_session_lifetime,
+        idle_ephemeral_session_lifetime: normalizedTenant.idle_ephemeral_session_lifetime,
+    });
+    if (Object.keys(sessionDurations).length > 0) {
+        delete normalizedTenant.session_lifetime;
+        delete normalizedTenant.idle_session_lifetime;
+        delete normalizedTenant.ephemeral_session_lifetime;
+        delete normalizedTenant.idle_ephemeral_session_lifetime;
+        Object.assign(normalizedTenant, sessionDurations);
+    }
+    return normalizedTenant;
+};
+const decodeBase64ToCertString = (base64Cert) => {
+    try {
+        return Buffer.from(base64Cert, 'base64').toString('utf-8');
+    }
+    catch (e) {
+        return base64Cert;
+    }
+};
+// In-memory store for diff log entries, keyed by resource type name.
+const logStore = {};
+const diffLog = (resourceTypeName, message) => {
+    if (!logStore[resourceTypeName]) {
+        logStore[resourceTypeName] = [];
+    }
+    logStore[resourceTypeName].push(...message);
+};
+const getDiffLog = (resourceTypeName) => resourceTypeName ? logStore[resourceTypeName] || [] : logStore;
+exports.getDiffLog = getDiffLog;
+/**
+ * Returns a human-readable label for an asset used as the keyObjPath prefix in diff messages.
+ * Named resources (those with a `name` field) use the name directly.
+ * Unnamed resources fall back to `${type}-${index + 1}` (1-based)
+ */
+function getAssetLabel(asset, type, index) {
+    return typeof asset.name === 'string' && asset.name.length > 0
+        ? asset.name
+        : `${type}-${index + 1}`;
+}
+function shouldIgnoreDryRunField(currentPath, ignoreDryRunFields) {
+    return ignoreDryRunFields.some((field) => currentPath === field ||
+        currentPath.endsWith(`.${field}`) ||
+        currentPath.endsWith(`[${field}]`));
+}
+/**
+ * Recursively normalizes an array so that order-insensitive comparisons can be
+ * made. Objects within the array have their keys sorted; the array itself is
+ * sorted by the JSON stringification of each element.
+ */
+function normalizeArrayValues(values) {
+    const normalizeValue = (value) => {
+        if (Array.isArray(value)) {
+            return normalizeArrayValues(value);
+        }
+        if (typeof value === 'object' && value !== null) {
+            return Object.keys(value)
+                .sort()
+                .reduce((normalized, key) => {
+                normalized[key] = normalizeValue(value[key]);
+                return normalized;
+            }, {});
+        }
+        return value;
+    };
+    return values
+        .map((value) => normalizeValue(value))
+        .sort((left, right) => JSON.stringify(left).localeCompare(JSON.stringify(right)));
+}
+/**
+ * Writes the accumulated diff log to a JSON file on disk.
+ * Useful for CI pipelines that want a machine-readable dry-run report.
+ */
+const exportDiffLog = async (fileName, resourceTypeName) => {
+    const diffLogData = (0, exports.getDiffLog)(resourceTypeName);
+    try {
+        await promises_1.default.writeFile(`./${fileName}`, JSON.stringify(diffLogData, null, 2));
+    }
+    catch (error) {
+        logger_1.default.error(`Failed to export diff log: ${String(error)}`);
+    }
+};
+exports.exportDiffLog = exportDiffLog;
+/**
+ * Compares two objects and returns an array of human-readable difference strings.
+ * Only considers keys present in `localObj` — extra keys in `remoteObj` are ignored.
+ *
+ * @param localObj - Local (desired) state
+ * @param remoteObj - Remote (current) state
+ * @param keyObjPath - Dot-separated JSON path used for nested tracking
+ * @param resourceTypeName - Resource type label used in log output
+ * @param ignoreDryRunFields - Field paths to skip during comparison
+ * @returns Array of difference descriptions, empty if objects are equivalent
+ */
+function getObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceTypeName = '', ignoreDryRunFields = []) {
+    const differences = [];
+    Object.keys(localObj).forEach((key) => {
+        const localValue = localObj[key];
+        const remoteValue = remoteObj[key];
+        const currentPath = keyObjPath ? `${keyObjPath}.${key}` : key;
+        if (shouldIgnoreDryRunField(currentPath, ignoreDryRunFields)) {
+            logger_1.default.debug(`[${chalk_1.default.blue(resourceTypeName)}] Ignoring key ${chalk_1.default.yellow(`"${currentPath}"`)} due to ignoreDryRunFields configuration.`);
+            return;
+        }
+        // Key exists locally but not remotely
+        if (!(key in remoteObj)) {
+            const message = `Key [${currentPath}] found in 'localObj' but not in 'remoteObj'.`;
+            logger_1.default.debug(`[${chalk_1.default.blue(resourceTypeName)}] Key ${chalk_1.default.yellow(`"${currentPath}"`)} found in 'localObj' but not in 'remoteObj'.`);
+            differences.push(message);
+            return;
+        }
+        // Handle arrays — normalize order before comparing
+        if (Array.isArray(localValue) && Array.isArray(remoteValue)) {
+            const normalizedLocalValue = normalizeArrayValues(localValue);
+            // Strip extra keys from remote objects before sorting — extra remote keys shift sort order,
+            // misaligning arrays and causing false "key in local but not in remote" differences.
+            const localKeySet = new Set(localValue.flatMap((item) => typeof item === 'object' && item !== null ? Object.keys(item) : []));
+            const remoteValueFiltered = localKeySet.size > 0
+                ? remoteValue.map((item) => typeof item === 'object' && item !== null
+                    ? Object.fromEntries(Object.entries(item).filter(([k]) => localKeySet.has(k)))
+                    : item)
+                : remoteValue;
+            const normalizedRemoteValue = normalizeArrayValues(remoteValueFiltered);
+            if (normalizedLocalValue.length !== normalizedRemoteValue.length) {
+                const message = `Array length difference for [${currentPath}]: local:${normalizedLocalValue.length} vs remote:${normalizedRemoteValue.length}`;
+                logger_1.default.debug(`[${chalk_1.default.blue(resourceTypeName)}] Array length difference for ${chalk_1.default.yellow(`"${currentPath}"`)}: local:${normalizedLocalValue.length} vs remote:${normalizedRemoteValue.length}`);
+                differences.push(message);
+            }
+            const hasObjects = normalizedLocalValue.some((item) => typeof item === 'object' && item !== null);
+            if (hasObjects) {
+                // Compare object arrays element-by-element (after normalization)
+                normalizedLocalValue.forEach((item, index) => {
+                    if (typeof item === 'object' &&
+                        item !== null &&
+                        typeof normalizedRemoteValue[index] === 'object' &&
+                        normalizedRemoteValue[index] !== null) {
+                        const nestedDifferences = getObjectDifferences(item, normalizedRemoteValue[index], `${currentPath}[${index}]`, resourceTypeName, ignoreDryRunFields);
+                        differences.push(...nestedDifferences);
+                    }
+                    else if (item !== normalizedRemoteValue[index]) {
+                        const message = `Array item difference at [${currentPath}[${index}]]: local:${item} vs remote:${normalizedRemoteValue[index]}`;
+                        differences.push(message);
+                    }
+                });
+            }
+            else {
+                // Primitive arrays: order-insensitive comparison
+                const isDifferent = normalizedLocalValue.some((item, index) => item !== normalizedRemoteValue[index]);
+                if (isDifferent) {
+                    const message = `Array content difference found for key [${currentPath}]`;
+                    logger_1.default.debug(`[${chalk_1.default.blue(resourceTypeName)}] Array content difference found for key ${chalk_1.default.yellow(`"${currentPath}"`)}`);
+                    differences.push(message);
+                }
+            }
+            return;
+        }
+        // Handle nested objects
+        if (typeof localValue === 'object' &&
+            localValue !== null &&
+            typeof remoteValue === 'object' &&
+            remoteValue !== null) {
+            const nestedDifferences = getObjectDifferences(localValue, remoteValue, currentPath, resourceTypeName, ignoreDryRunFields);
+            differences.push(...nestedDifferences);
+            return;
+        }
+        // Compare primitive values — omit array indices from path to reduce log noise
+        if (localValue !== remoteValue) {
+            let arrayPathRegex = new RegExp(/\[\d+\]/g);
+            if (!arrayPathRegex.test(currentPath)) {
+                const message = `Value difference for [${currentPath}]: local:${localValue} vs remote:${remoteValue}`;
+                differences.push(message);
+            }
+        }
+    });
+    return differences;
+}
+/**
+ * Returns true if `localObj` and `remoteObj` differ in any field present in
+ * `localObj`. Side-effect: appends found differences to the diff log.
+ */
+function hasObjectDifferences(localObj, remoteObj, keyObjPath = '', resourceTypeName = '', ignoreDryRunFields = []) {
+    const differences = getObjectDifferences(localObj, remoteObj, keyObjPath, resourceTypeName, ignoreDryRunFields);
+    diffLog(resourceTypeName, differences);
+    return differences.length > 0;
+}
+/**
+ * Calculates the changes required between local and remote asset sets for dry-run operations.
+ *
+ * Unlike `calculateChanges`, this function does not mutate assets for API consumption.
+ * It is purely for reporting: determining which assets would be created, updated, or deleted.
+ *
+ * @param params.type - Resource type label used for logging
+ * @param params.assets - Local assets to be deployed
+ * @param params.existing - Remote assets currently on the tenant, or null
+ * @param params.identifiers - Fields used to match local↔remote assets (default: ['id', 'name'])
+ * @param params.ignoreDryRunFields - Fields to exclude from diff comparisons
+ */
+function calculateDryRunChanges({ type, assets, existing, identifiers = ['id', 'name'], ignoreDryRunFields = [], }) {
+    const update = [];
+    const del = [];
+    const create = [];
+    const conflicts = [];
+    const localAssets = (Array.isArray(assets) ? [...assets] : [assets]).map((asset) => type === 'tenant' ? normalizeTenantForDryRun(asset) : asset);
+    const remoteAssets = (Array.isArray(existing) ? [...existing] : [existing]).map((asset) => (type === 'tenant' ? normalizeTenantForDryRun(asset) : asset));
+    // Helper: returns true if a local and remote asset share at least one identifier value
+    const assetsMatch = (localAsset, remoteAsset) => identifiers.some((id) => {
+        if (Array.isArray(id)) {
+            const localValues = id.map((i) => localAsset[i]);
+            const remoteValues = id.map((i) => remoteAsset[i]);
+            return (localValues.every((v) => v) &&
+                remoteValues.every((v) => v) &&
+                localValues.join('-') === remoteValues.join('-'));
+        }
+        return localAsset[id] === remoteAsset[id];
+    });
+    // Identify created: local assets with no matching remote asset
+    const createdAssets = localAssets.filter((localAsset) => !remoteAssets.some((remoteAsset) => assetsMatch(localAsset, remoteAsset)));
+    create.push(...createdAssets);
+    // Identify updated: local assets that match a remote asset and have differences
+    const updatedAssets = localAssets.filter((localAsset, localAssetIndex) => {
+        const matchingRemoteAsset = remoteAssets.find((remoteAsset) => {
+            // Detect singleton resources (e.g. tenant) that carry none of the identifier fields on either
+            // side.  For these, fall back to the lenient assetsMatch() used for CREATE/DELETE detection
+            // so that value-only changes (e.g. a flag flip) are still surfaced as UPDATE.
+            const isSingleton = identifiers.every((id) => {
+                if (Array.isArray(id)) {
+                    return id.every((i) => localAsset[i] === undefined && remoteAsset[i] === undefined);
+                }
+                return localAsset[id] === undefined && remoteAsset[id] === undefined;
+            });
+            if (isSingleton) {
+                return assetsMatch(localAsset, remoteAsset);
+            }
+            // Stricter match check: identifier values must be non-null on both sides
+            return identifiers.some((id) => {
+                if (Array.isArray(id)) {
+                    const localValues = id.map((i) => localAsset[i]);
+                    const remoteValues = id.map((i) => remoteAsset[i]);
+                    return (localValues.every((v) => v !== undefined && v !== null) &&
+                        remoteValues.every((v) => v !== undefined && v !== null) &&
+                        localValues.join('-') === remoteValues.join('-'));
+                }
+                return (localAsset[id] !== undefined &&
+                    remoteAsset[id] !== undefined &&
+                    localAsset[id] === remoteAsset[id]);
+            });
+        });
+        if (matchingRemoteAsset) {
+            // Backfill any identifier fields missing from the local asset (e.g. remote-assigned IDs)
+            identifiers.forEach((id) => {
+                if (Array.isArray(id)) {
+                    id.forEach((idPart) => {
+                        if (!localAsset[idPart] && matchingRemoteAsset[idPart]) {
+                            localAsset[idPart] = matchingRemoteAsset[idPart];
+                        }
+                    });
+                }
+                else if (!localAsset[id] && matchingRemoteAsset[id]) {
+                    localAsset[id] = matchingRemoteAsset[id];
+                }
+            });
+            return hasObjectDifferences(localAsset, matchingRemoteAsset, getAssetLabel(localAsset, type, localAssetIndex), type, ignoreDryRunFields);
+        }
+        return false;
+    });
+    update.push(...updatedAssets);
+    // Identify deleted: remote assets with no matching local asset
+    const deletedAssets = remoteAssets
+        .filter((remoteAsset) => !localAssets.some((localAsset) => assetsMatch(localAsset, remoteAsset)))
+        .map((remoteAsset) => {
+        // Ensure all identifier fields are present on the returned asset for tracking
+        const assetWithIdentifiers = { ...remoteAsset };
+        identifiers.forEach((id) => {
+            if (Array.isArray(id)) {
+                id.forEach((idPart) => {
+                    if (remoteAsset[idPart]) {
+                        assetWithIdentifiers[idPart] = remoteAsset[idPart];
+                    }
+                });
+            }
+            else if (remoteAsset[id]) {
+                assetWithIdentifiers[id] = remoteAsset[id];
+            }
+        });
+        return assetWithIdentifiers;
+    });
+    del.push(...deletedAssets);
+    const hasChanges = del.length > 0 || create.length > 0 || conflicts.length > 0 || update.length > 0;
+    if (hasChanges) {
+        logger_1.default.debug(`[DryRun] calculated changes for [${type}]:${JSON.stringify({
+            create: create.length,
+            update: update.length,
+            del: del.length,
+            conflicts: conflicts.length,
+        })}`);
+    }
+    return { del, create, conflicts, update };
+}
+/**
+ * Normalizes local assets so they can be accurately compared against remote assets.
+ *
+ * Transformations applied:
+ * - Converts client name references to client IDs (clientGrants, databases, connections, resourceServers)
+ * - Resolves connection profile and user attribute profile names to IDs (express_configuration)
+ * - Decodes base64-encoded SAML certificates to PEM strings
+ * - Resolves organization connection names to connection IDs
+ * - Normalizes tenant session duration fields
+ * - Removes empty branding templates (avoids false diff against remote)
+ *
+ * @param localAssets - Local assets object (will be mutated)
+ * @param authAPIclient - Auth0 management API client for fetching remote reference data
+ * @returns The mutated assets object with normalized values
+ */
+async function dryRunFormatAssets(localAssets, authAPIclient) {
+    const clientsRemoteData = await (0, client_1.paginate)(authAPIclient.clients.list, {
+        paginate: true,
+        include_totals: true,
+    });
+    if (localAssets.clientGrants) {
+        const { clientGrants } = localAssets;
+        localAssets.clientGrants = clientGrants.map((clientGrant) => {
+            if (clientGrant.client_id) {
+                const originalName = clientGrant.client_id;
+                const resolvedId = (0, utils_1.convertClientNameToId)(originalName, clientsRemoteData);
+                if (resolvedId !== originalName) {
+                    clientGrant._clientName = originalName;
+                }
+                clientGrant.client_id = resolvedId;
+            }
+            return clientGrant;
+        });
+    }
+    if (localAssets.resourceServers) {
+        localAssets.resourceServers = localAssets.resourceServers.map((resourceServer) => {
+            if (resourceServer.client_id) {
+                resourceServer.client_id = (0, utils_1.convertClientNameToId)(resourceServer.client_id, clientsRemoteData);
+            }
+            return resourceServer;
+        });
+    }
+    if (localAssets.databases && localAssets.clients) {
+        const { databases } = localAssets;
+        localAssets.databases = databases.map((db) => {
+            if (db.enabled_clients && db.enabled_clients.length > 0) {
+                db.enabled_clients = db.enabled_clients.map((enabledClientName) => (0, utils_1.convertClientNameToId)(enabledClientName, clientsRemoteData));
+            }
+            return db;
+        });
+    }
+    if (localAssets.clients?.some((client) => client.express_configuration)) {
+        const [connectionProfiles, userAttributeProfiles] = await Promise.all([
+            (0, client_1.paginate)(authAPIclient.connectionProfiles.list, {
+                checkpoint: true,
+                take: 10,
+            }),
+            (0, client_1.paginate)(authAPIclient.userAttributeProfiles.list, {
+                checkpoint: true,
+                include_totals: true,
+                is_global: false,
+                take: 10,
+            }),
+        ]);
+        localAssets.clients = localAssets.clients.map((client) => {
+            if (!client.express_configuration)
+                return client;
+            const userAttributeProfileName = client.express_configuration.user_attribute_profile_id;
+            if (userAttributeProfileName) {
+                const userAttributeProfile = userAttributeProfiles.find((profile) => profile.name === userAttributeProfileName);
+                if (userAttributeProfile?.id) {
+                    client.express_configuration.user_attribute_profile_id = userAttributeProfile.id;
+                }
+            }
+            const connectionProfileName = client.express_configuration.connection_profile_id;
+            if (connectionProfileName) {
+                const connectionProfile = connectionProfiles.find((profile) => profile.name === connectionProfileName);
+                if (connectionProfile?.id) {
+                    client.express_configuration.connection_profile_id = connectionProfile.id;
+                }
+            }
+            const oktaOinClientName = client.express_configuration.okta_oin_client_id;
+            if (oktaOinClientName) {
+                const oktaOinClient = clientsRemoteData.find((remoteClient) => remoteClient.name === oktaOinClientName);
+                if (oktaOinClient?.client_id) {
+                    client.express_configuration.okta_oin_client_id = oktaOinClient.client_id;
+                }
+            }
+            return client;
+        });
+    }
+    if (localAssets.actions) {
+        const { actions } = localAssets;
+        localAssets.actions = actions.map((action) => {
+            if ('deployed' in action) {
+                action.all_changes_deployed = action.deployed;
+                delete action.deployed;
+            }
+            return action;
+        });
+    }
+    if (localAssets.connections) {
+        const { connections } = localAssets;
+        localAssets.connections = connections.map((connection) => {
+            if (connection.strategy === 'samlp' && connection.options) {
+                if ('cert' in connection.options) {
+                    connection.options.cert = decodeBase64ToCertString(connection.options.cert);
+                }
+            }
+            if (connection.options?.idpinitiated?.client_id) {
+                connection.options.idpinitiated.client_id = (0, utils_1.convertClientNameToId)(connection.options.idpinitiated.client_id, clientsRemoteData);
+            }
+            if (connection.enabled_clients) {
+                connection.enabled_clients = connection.enabled_clients.map((clientName) => (0, utils_1.convertClientNameToId)(clientName, clientsRemoteData));
+            }
+            return connection;
+        });
+    }
+    if (localAssets.organizations?.some((organization) => organization.connections?.length)) {
+        const existingConnections = await (0, client_1.paginate)(authAPIclient.connections.list, {
+            checkpoint: true,
+        });
+        localAssets.organizations = localAssets.organizations.map((organization) => {
+            if (!organization.connections?.length) {
+                return organization;
+            }
+            organization.connections = organization.connections
+                .map((connection) => {
+                const formattedConnection = { ...connection };
+                const connectionName = formattedConnection.name;
+                if (connectionName) {
+                    formattedConnection.connection_id = existingConnections.find((existingConnection) => existingConnection.name === connectionName)?.id;
+                    delete formattedConnection.name;
+                }
+                return formattedConnection;
+            })
+                .filter((connection) => !!connection.connection_id);
+            return organization;
+        });
+    }
+    if (localAssets.tenant) {
+        localAssets.tenant = normalizeTenantForDryRun(localAssets.tenant);
+    }
+    if (localAssets.branding) {
+        const { branding } = localAssets;
+        // Empty templates array signals "no templates" — skip remote comparison to avoid false diffs
+        if (branding.templates && branding.templates.length === 0) {
+            delete branding.templates;
+        }
+        localAssets.branding = branding;
+    }
+    return localAssets;
+}

package/lib/tools/deploy.js

@@ -6,13 +6,37 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.default = deploy;
 const auth0_1 = __importDefault(require("./auth0"));
 const logger_1 = __importDefault(require("../logger"));
+const utils_1 = require("../utils");
+function zeroChangeSummary(auth0) {
+    return auth0.handlers.reduce((accum, h) => {
+        accum[h.type] = { deleted: 0, created: 0, updated: 0 };
+        return accum;
+    }, {});
+}
 async function deploy(assets, client, config) {
     // Setup log level
-    logger_1.default.level = process.env.AUTH0_DEBUG === 'true' ? 'debug' : 'info';
+    const isDebug = process.env.AUTH0_DEBUG === 'true';
+    logger_1.default.level = isDebug ? 'debug' : 'info';
+    const dryRunMode = config('AUTH0_DRY_RUN');
+    // Normalize boolean true (EA compat) → 'preview'
+    const effectiveMode = dryRunMode === true || dryRunMode === 'true' ? 'preview' : dryRunMode;
+    if (dryRunMode && effectiveMode !== 'preview') {
+        throw new Error(`Invalid AUTH0_DRY_RUN value: ${dryRunMode}. Use true or 'preview'.`);
+    }
+    const isInteractive = !!config('AUTH0_DRY_RUN_INTERACTIVE');
+    const shouldApplyAfterPreview = (0, utils_1.isTruthy)(config('AUTH0_DRY_RUN_APPLY'));
     logger_1.default.info(`Getting access token for ${config('AUTH0_CLIENT_ID') !== undefined ? `${config('AUTH0_CLIENT_ID')}/` : ''}${config('AUTH0_DOMAIN')}`);
     const auth0 = new auth0_1.default(client, assets, config);
     // Validate Assets
     await auth0.validate();
+    if (effectiveMode === 'preview') {
+        const hasChanges = await auth0.dryRun({
+            interactive: isInteractive && !shouldApplyAfterPreview,
+        });
+        if (!shouldApplyAfterPreview || !hasChanges) {
+            return zeroChangeSummary(auth0);
+        }
+    }
     // Process changes
     await auth0.processChanges();
     return auth0.handlers.reduce((accum, h) => {

package/lib/tools/utils.d.ts

@@ -1,4 +1,5 @@
 import { Asset, Assets, CalculatedChanges, KeywordMappings } from '../types';
+import { ConfigFunction } from '../configFactory';
 export declare const keywordReplaceArrayRegExp: (key: any) => RegExp;
 export declare const keywordReplaceStringRegExp: (key: any) => RegExp;
 export declare function keywordArrayReplace(input: string, mappings: KeywordMappings): string;
@@ -24,6 +25,7 @@ export declare function filterExcluded(changes: CalculatedChanges, exclude: stri
 export declare function filterIncluded(changes: CalculatedChanges, include: string[]): CalculatedChanges;
 export declare function areArraysEquals(x: any[], y: any[]): boolean;
 export declare const obfuscateSensitiveValues: (data: Asset | Asset[] | null, sensitiveFieldsToObfuscate: string[]) => Asset | Asset[] | null;
+export declare const validateNoUnresolvedPlaceholders: (data: Asset | null, resourceType: string, resourceName: string) => Asset | null;
 export declare const stripObfuscatedFieldsFromPayload: (data: Asset | Asset[] | null, obfuscatedFields: string[]) => Asset | Asset[] | null;
 export declare const detectInsufficientScopeError: <T>(fn: Function) => Promise<{
     hadSufficientScopes: true;
@@ -55,3 +57,6 @@ export declare function maskSecretAtPath({ resourceTypeName, maskedKeyName, mask
  * @returns True if third-party clients should be excluded, false otherwise.
  */
 export declare const shouldExcludeThirdPartyClients: (configFn: (key: string) => any) => boolean;
+export declare function sortGuardianFactors(factors: Asset[]): Asset[];
+export declare function isDryRun(config: ConfigFunction): boolean;
+export declare function printCLIMessage(message: string): void;

package/lib/tools/utils.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripObfuscatedFieldsFromPayload = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
+exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
 exports.keywordArrayReplace = keywordArrayReplace;
 exports.keywordStringReplace = keywordStringReplace;
 exports.keywordReplace = keywordReplace;
@@ -56,6 +56,9 @@ exports.filterIncluded = filterIncluded;
 exports.areArraysEquals = areArraysEquals;
 exports.sleep = sleep;
 exports.maskSecretAtPath = maskSecretAtPath;
+exports.sortGuardianFactors = sortGuardianFactors;
+exports.isDryRun = isDryRun;
+exports.printCLIMessage = printCLIMessage;
 const path_1 = __importDefault(require("path"));
 const fs_1 = __importStar(require("fs"));
 const dot_prop_1 = __importDefault(require("dot-prop"));
@@ -182,15 +185,16 @@ function getEnabledClients(assets, connection, existing, clients) {
         return undefined; // If no enabled clients passed in, explicitly ignore from management, preventing unintentional disabling of connection.
     const excludedClientsByNames = (assets.exclude && assets.exclude.clients) || [];
     const excludedClients = convertClientNamesToIds(excludedClientsByNames, clients);
+    const allExcluded = [...excludedClientsByNames, ...excludedClients];
     const enabledClients = [
-        ...convertClientNamesToIds(connection.enabled_clients || [], clients).filter((item) => ![...excludedClientsByNames, ...excludedClients].includes(item)),
+        ...convertClientNamesToIds(connection.enabled_clients || [], clients).filter((item) => !allExcluded.includes(item)),
     ];
     // If client is excluded and in the existing connection this client is enabled, it should keep enabled
     // If client is excluded and in the existing connection this client is disabled, it should keep disabled
     existing.forEach((conn) => {
         if (conn.name === connection.name) {
             excludedClients.forEach((excludedClient) => {
-                if (conn.enabled_clients.includes(excludedClient)) {
+                if (conn.enabled_clients?.includes(excludedClient)) {
                     enabledClients.push(excludedClient);
                 }
             });
@@ -255,6 +259,38 @@ const obfuscateSensitiveValues = (data, sensitiveFieldsToObfuscate) => {
     return newAsset;
 };
 exports.obfuscateSensitiveValues = obfuscateSensitiveValues;
+const UNRESOLVED_PLACEHOLDER_REGEX = /^(##.+##|@@.+@@)$/;
+// Recursively collects all fields in an asset that still contain an unresolved
+// ##...## (string) or @@...@@ (array) keyword placeholder.
+const collectUnresolvedPlaceholders = (data, parentPath = '') => {
+    if (data === null || typeof data !== 'object')
+        return [];
+    const found = [];
+    Object.keys(data).forEach((key) => {
+        const fullPath = parentPath ? `${parentPath}.${key}` : key;
+        const value = data[key];
+        if (typeof value === 'string' && UNRESOLVED_PLACEHOLDER_REGEX.test(value)) {
+            found.push({ path: fullPath, value });
+        }
+        else if (value !== null && typeof value === 'object' && !Array.isArray(value)) {
+            found.push(...collectUnresolvedPlaceholders(value, fullPath));
+        }
+    });
+    return found;
+};
+// Throws an error if any field in the asset contains an unresolved ##...## or @@...@@ placeholder,
+// listing all offending fields so the user can fix them before deploying.
+const validateNoUnresolvedPlaceholders = (data, resourceType, resourceName) => {
+    if (data === null)
+        return data;
+    const unresolved = collectUnresolvedPlaceholders(data);
+    if (unresolved.length > 0) {
+        const fields = unresolved.map(({ path, value }) => `  - "${path}": ${value}`).join('\n');
+        throw new Error(`Unresolved placeholder(s) found in ${resourceType} "${resourceName}":\n${fields}\nPlease ensure all keyword mappings are defined before deploying.`);
+    }
+    return data;
+};
+exports.validateNoUnresolvedPlaceholders = validateNoUnresolvedPlaceholders;
 // The reverse of `obfuscateSensitiveValues()`, preventing an obfuscated value from being passed to the API
 const stripObfuscatedFieldsFromPayload = (data, obfuscatedFields) => {
     if (data === null)
@@ -334,3 +370,28 @@ const shouldExcludeThirdPartyClients = (configFn) => {
     return value === 'true' || value === true;
 };
 exports.shouldExcludeThirdPartyClients = shouldExcludeThirdPartyClients;
+// Sort guardian factors by name
+function sortGuardianFactors(factors) {
+    // if no factors, return empty array
+    if (!factors || factors.length === 0)
+        return [];
+    return factors.sort((a, b) => {
+        const nameA = a.name || '';
+        const nameB = b.name || '';
+        if (nameA < nameB)
+            return -1;
+        if (nameA > nameB)
+            return 1;
+        return 0;
+    });
+}
+// Check if dry-run flag is enabled
+function isDryRun(config) {
+    if (typeof config !== 'function')
+        return false;
+    return config('AUTH0_DRY_RUN') === true || config('AUTH0_DRY_RUN') === 'true';
+}
+// Print a message to the CLI message console
+function printCLIMessage(message) {
+    process.stdout.write(message + '\n');
+}