auth0-deploy-cli 8.31.0 → 8.32.0

package/lib/args.d.ts

@@ -9,8 +9,12 @@ type SharedParams = {
     config?: Partial<Config>;
     experimental_ea?: boolean;
 };
+export type DryRunMode = 'preview';
 type ImportSpecificParams = {
     input_file: string;
+    dry_run?: boolean | '' | DryRunMode;
+    interactive?: boolean;
+    apply?: boolean;
 };
 type ExportSpecificParams = {
     format: 'yaml' | 'directory';

package/lib/args.js

@@ -47,6 +47,21 @@ function getParams() {
             describe: 'The client secret, this allows you to encrypt the secret in your build configuration instead of storing it in a config file',
             type: 'string',
         },
+        dry_run: {
+            alias: 'dry-run',
+            describe: 'Dry-run mode. Show plan without applying changes. Use --interactive for the menu or --apply to show the plan and apply without prompting.',
+            type: 'string',
+        },
+        interactive: {
+            describe: 'Use with --dry-run to enable the interactive menu (apply / export to file / exit). Not available in non-TTY environments.',
+            type: 'boolean',
+            default: false,
+        },
+        apply: {
+            describe: 'Use with --dry-run to show the plan and then apply without prompting.',
+            type: 'boolean',
+            default: false,
+        },
     })
         .command(['export', 'dump'], 'Export Auth0 Tenant Configuration', {
         output_folder: {
@@ -93,6 +108,9 @@ function getParams() {
         .example('$0 export -c config.json -f directory -o path/to/export', 'Dump Auth0 config to folder in directory format')
         .example('$0 import -c config.json -i tenant.yaml', 'Deploy Auth0 via YAML')
         .example('$0 import -c config.json -i path/to/files', 'Deploy Auth0 via Path')
+        .example('$0 import -c config.json -i tenant.yaml --dry-run', 'Preview changes and exit without applying changes')
+        .example('$0 import -c config.json -i tenant.yaml --dry-run --apply', 'Show plan and apply without prompting (CI deployment)')
+        .example('$0 import -c config.json -i tenant.yaml --dry-run --interactive', 'Show plan with interactive menu (apply / export / exit)')
         .example('$0 dump -c config.json -f yaml -o path/to/export', 'Dump Auth0 config to folder in YAML format')
         .example('$0 dump -c config.json -f directory -o path/to/export', 'Dump Auth0 config to folder in directory format')
         .example('$0 deploy -c config.json -i tenant.yaml', 'Deploy Auth0 via YAML')

package/lib/commands/import.js

@@ -9,8 +9,29 @@ const configFactory_1 = require("../configFactory");
 const tools_1 = require("../tools");
 const logger_1 = __importDefault(require("../logger"));
 const context_1 = require("../context");
+const utils_1 = require("../utils");
 async function importCMD(params) {
-    const { input_file: inputFile, base_path: basePath, config_file: configFile, config: configObj, env: shouldInheritEnv = false, secret: clientSecret, experimental_ea: experimentalEA, } = params;
+    const { input_file: inputFile, base_path: basePath, config_file: configFile, config: configObj, env: shouldInheritEnv = false, secret: clientSecret, experimental_ea: experimentalEA, dry_run: dryRun, interactive = false, apply = false, } = params;
+    const normalizedDryRun = dryRun === true || dryRun === '' ? 'preview' : dryRun;
+    let effectiveDryRun;
+    if (!normalizedDryRun) {
+        effectiveDryRun = undefined;
+    }
+    else if (normalizedDryRun !== 'preview') {
+        throw new Error(`Invalid value for --dry-run: ${normalizedDryRun}. Use --dry-run or --dry-run=preview.`);
+    }
+    else {
+        effectiveDryRun = normalizedDryRun;
+    }
+    if (apply && !effectiveDryRun) {
+        throw new Error('--apply must be used with --dry-run.');
+    }
+    if (interactive && !effectiveDryRun) {
+        throw new Error('--interactive must be used with --dry-run.');
+    }
+    if (interactive && apply) {
+        throw new Error('--interactive and --apply cannot be used together.');
+    }
     if (shouldInheritEnv) {
         nconf_1.default.env().use('memory');
         const mappings = nconf_1.default.get('AUTH0_KEYWORD_REPLACE_MAPPINGS') || {};
@@ -36,13 +57,29 @@ async function importCMD(params) {
         // nconf.overrides() sometimes doesn't work, so we need to set it manually to ensure it's set
         nconf_1.default.set('AUTH0_EXPERIMENTAL_EA', experimentalEA);
     }
+    // Override AUTH0_DRY_RUN if dry_run passed in command line
+    if (effectiveDryRun) {
+        overrides.AUTH0_DRY_RUN = effectiveDryRun;
+        nconf_1.default.set('AUTH0_DRY_RUN', effectiveDryRun);
+    }
+    if (interactive) {
+        overrides.AUTH0_DRY_RUN_INTERACTIVE = interactive;
+        nconf_1.default.set('AUTH0_DRY_RUN_INTERACTIVE', interactive);
+    }
+    const existingDryRunApply = nconf_1.default.get('AUTH0_DRY_RUN_APPLY');
+    if (apply || (0, utils_1.isTruthy)(existingDryRunApply)) {
+        overrides.AUTH0_DRY_RUN_APPLY = true;
+        nconf_1.default.set('AUTH0_DRY_RUN_APPLY', true);
+    }
     nconf_1.default.overrides(overrides);
     // Setup context and load
     const context = await (0, context_1.setupContext)(nconf_1.default.get(), 'import');
     await context.loadAssetsFromLocal();
     const config = (0, configFactory_1.configFactory)();
     config.setProvider((key) => nconf_1.default.get(key));
-    //@ts-ignore because context and assets still need to be typed TODO: type assets and type context
+    // @ts-ignore because context and assets still need to be typed TODO: type assets and type context
     await (0, tools_1.deploy)(context.assets, context.mgmtClient, config);
-    logger_1.default.info('Import Successful');
+    if (!effectiveDryRun) {
+        logger_1.default.info('Import Successful');
+    }
 }

package/lib/context/directory/handlers/clients.js

@@ -77,6 +77,20 @@ async function dump(context) {
                 client.express_configuration.okta_oin_client_id = o?.name || oktaOinClientId;
             }
         }
+        if (client.my_organization_configuration) {
+            const myOrganizationUserAttributeProfileId = client.my_organization_configuration.user_attribute_profile_id;
+            if (myOrganizationUserAttributeProfileId) {
+                const p = userAttributeProfiles?.find((uap) => uap.id === myOrganizationUserAttributeProfileId);
+                client.my_organization_configuration.user_attribute_profile_id =
+                    p?.name || myOrganizationUserAttributeProfileId;
+            }
+            const myOrganizationConnectionProfileId = client.my_organization_configuration.connection_profile_id;
+            if (myOrganizationConnectionProfileId) {
+                const c = connectionProfiles?.find((cp) => cp.id === myOrganizationConnectionProfileId);
+                client.my_organization_configuration.connection_profile_id =
+                    c?.name || myOrganizationConnectionProfileId;
+            }
+        }
         if (client.app_type === 'express_configuration') {
             // only keep relevant fields for express configuration
             client = {

package/lib/context/directory/handlers/connections.js

@@ -55,6 +55,7 @@ async function dump(context) {
     connections.forEach((connection) => {
         let dumpedConnection = {
             ...connection,
+            ...(0, utils_1.getFormattedOptions)(connection, clientsOrig),
             ...(connection.enabled_clients && {
                 enabled_clients: (0, utils_1.mapClientID2NameSorted)(connection.enabled_clients, clientsOrig || []),
             }),

package/lib/context/directory/handlers/guardianFactors.js

@@ -6,18 +6,20 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const path_1 = __importDefault(require("path"));
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const tools_1 = require("../../../tools");
-const utils_1 = require("../../../utils");
+const utils_1 = require("../../../tools/utils");
+const utils_2 = require("../../../utils");
 function parse(context) {
     const factorsFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY, tools_1.constants.GUARDIAN_FACTORS_DIRECTORY);
-    if (!(0, utils_1.existsMustBeDir)(factorsFolder))
+    if (!(0, utils_2.existsMustBeDir)(factorsFolder))
         return { guardianFactors: null }; // Skip
-    const foundFiles = (0, utils_1.getFiles)(factorsFolder, ['.json']);
-    const guardianFactors = foundFiles
-        .map((f) => (0, utils_1.loadJSON)(f, {
+    const foundFiles = (0, utils_2.getFiles)(factorsFolder, ['.json']);
+    let guardianFactors = foundFiles
+        .map((f) => (0, utils_2.loadJSON)(f, {
         mappings: context.mappings,
         disableKeywordReplacement: context.disableKeywordReplacement,
     }))
         .filter((p) => Object.keys(p).length > 0); // Filter out empty guardianFactors
+    guardianFactors = (0, utils_1.sortGuardianFactors)(guardianFactors);
     return {
         guardianFactors,
     };
@@ -30,7 +32,7 @@ async function dump(context) {
     fs_extra_1.default.ensureDirSync(factorsFolder);
     guardianFactors.forEach((factor) => {
         const factorFile = path_1.default.join(factorsFolder, `${factor.name}.json`);
-        (0, utils_1.dumpJSON)(factorFile, factor);
+        (0, utils_2.dumpJSON)(factorFile, factor);
     });
 }
 const guardianFactorsHandler = {

package/lib/context/directory/handlers/tenant.d.ts

@@ -1,10 +1,5 @@
 import { DirectoryHandler } from '.';
 import { Asset, ParsedAsset } from '../../../types';
-type ParsedTenant = ParsedAsset<'tenant', {
-    session_lifetime: number;
-    idle_session_lifetime: number;
-} & {
-    [key: string]: Asset;
-}>;
+type ParsedTenant = ParsedAsset<'tenant', Asset>;
 declare const tenantHandler: DirectoryHandler<ParsedTenant>;
 export default tenantHandler;

package/lib/context/directory/handlers/tenant.js

@@ -41,7 +41,6 @@ async function dump(context) {
     (0, utils_1.clearTenantFlags)(tenant);
     const tenantFile = path_1.default.join(context.filePath, 'tenant.json');
     (0, utils_1.dumpJSON)(tenantFile, tenant);
-    return;
 }
 const tenantHandler = {
     parse,

package/lib/context/index.js

@@ -158,6 +158,11 @@ const setupContext = async (config, command) => {
         token: accessToken,
         headers: {
             'User-agent': `deploy-cli/${packageVersion} (node.js/${process.version.replace('v', '')})`,
+            ...((0, utils_1.isTruthy)(config.AUTH0_DRY_RUN)
+                ? {
+                    'X-Auth0-Deploy-Mode': 'dry-run',
+                }
+                : {}),
         },
         maxRetries: config.AUTH0_API_MAX_RETRIES || 10,
     });

package/lib/context/yaml/handlers/clients.js

@@ -58,6 +58,18 @@ async function dump(context) {
             const o = clients?.find((uap) => uap.client_id === oktaOinClientId);
             client.express_configuration.okta_oin_client_id = o?.name || oktaOinClientId;
         }
+        const myOrganizationUserAttributeProfileId = client?.my_organization_configuration?.user_attribute_profile_id;
+        if (client.my_organization_configuration && myOrganizationUserAttributeProfileId) {
+            const p = userAttributeProfiles?.find((uap) => uap.id === myOrganizationUserAttributeProfileId);
+            client.my_organization_configuration.user_attribute_profile_id =
+                p?.name || myOrganizationUserAttributeProfileId;
+        }
+        const myOrganizationConnectionProfileId = client?.my_organization_configuration?.connection_profile_id;
+        if (client.my_organization_configuration && myOrganizationConnectionProfileId) {
+            const c = connectionProfiles?.find((cp) => cp.id === myOrganizationConnectionProfileId);
+            client.my_organization_configuration.connection_profile_id =
+                c?.name || myOrganizationConnectionProfileId;
+        }
         return client;
     });
     return {

package/lib/context/yaml/handlers/connections.js

@@ -33,22 +33,6 @@ async function parse(context) {
         ],
     };
 }
-const getFormattedOptions = (connection, clients) => {
-    try {
-        return {
-            options: {
-                ...connection.options,
-                idpinitiated: {
-                    ...connection.options.idpinitiated,
-                    client_id: (0, utils_1.convertClientIdToName)(connection.options.idpinitiated.client_id, clients),
-                },
-            },
-        };
-    }
-    catch (e) {
-        return {};
-    }
-};
 async function dump(context) {
     let { connections } = context.assets;
     const { clients } = context.assets;
@@ -63,7 +47,7 @@ async function dump(context) {
         connections: connections.map((connection) => {
             let dumpedConnection = {
                 ...connection,
-                ...getFormattedOptions(connection, clients),
+                ...(0, utils_1.getFormattedOptions)(connection, clients),
                 ...(connection.enabled_clients && {
                     enabled_clients: (0, utils_1.mapClientID2NameSorted)(connection.enabled_clients, clients || []),
                 }),

package/lib/context/yaml/handlers/guardianFactors.js

@@ -1,9 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+const utils_1 = require("../../../tools/utils");
 async function parseAndDump(context) {
-    const { guardianFactors } = context.assets;
+    let { guardianFactors } = context.assets;
     if (!guardianFactors)
         return { guardianFactors: null };
+    guardianFactors = (0, utils_1.sortGuardianFactors)(guardianFactors);
     return {
         guardianFactors,
     };

package/lib/context/yaml/handlers/tenant.js

@@ -22,7 +22,7 @@ async function parse(context) {
     };
 }
 async function dump(context) {
-    const tenant = context.assets.tenant;
+    const { tenant } = context.assets;
     if (!tenant)
         return { tenant: null };
     (0, utils_1.clearTenantFlags)(tenant);

package/lib/sessionDurationsToMinutes.d.ts

@@ -1,11 +1,13 @@
-export declare const sessionDurationsToMinutes: ({ session_lifetime, idle_session_lifetime, idle_ephemeral_session_lifetime, ephemeral_session_lifetime, }: {
-    session_lifetime?: number;
-    idle_session_lifetime?: number;
-    idle_ephemeral_session_lifetime?: number;
-    ephemeral_session_lifetime?: number;
-}) => {
+type SessionDurations = {
     session_lifetime_in_minutes?: number;
     idle_session_lifetime_in_minutes?: number;
-    idle_ephemeral_session_lifetime_in_minutes?: number;
     ephemeral_session_lifetime_in_minutes?: number;
+    idle_ephemeral_session_lifetime_in_minutes?: number;
 };
+export declare function sessionDurationsToMinutes({ session_lifetime, idle_session_lifetime, ephemeral_session_lifetime, idle_ephemeral_session_lifetime, }?: {
+    session_lifetime?: number;
+    idle_session_lifetime?: number;
+    ephemeral_session_lifetime?: number;
+    idle_ephemeral_session_lifetime?: number;
+}): SessionDurations;
+export default sessionDurationsToMinutes;

package/lib/sessionDurationsToMinutes.js

@@ -1,19 +1,20 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.sessionDurationsToMinutes = void 0;
+exports.sessionDurationsToMinutes = sessionDurationsToMinutes;
+/* eslint-disable camelcase */
 function hoursToMinutes(hours) {
-    return Math.round(hours * 60);
+    return parseFloat(Math.round(hours * 60).toFixed(4));
 }
-const sessionDurationsToMinutes = ({ session_lifetime, idle_session_lifetime, idle_ephemeral_session_lifetime, ephemeral_session_lifetime, }) => {
+function sessionDurationsToMinutes({ session_lifetime, idle_session_lifetime, ephemeral_session_lifetime, idle_ephemeral_session_lifetime, } = {}) {
     const sessionDurations = {};
-    if (!!session_lifetime)
+    if (session_lifetime !== undefined)
         sessionDurations.session_lifetime_in_minutes = hoursToMinutes(session_lifetime);
-    if (!!idle_session_lifetime)
+    if (idle_session_lifetime !== undefined)
         sessionDurations.idle_session_lifetime_in_minutes = hoursToMinutes(idle_session_lifetime);
-    if (!!idle_ephemeral_session_lifetime)
-        sessionDurations.idle_ephemeral_session_lifetime_in_minutes = hoursToMinutes(idle_ephemeral_session_lifetime);
-    if (!!ephemeral_session_lifetime)
+    if (ephemeral_session_lifetime !== undefined)
         sessionDurations.ephemeral_session_lifetime_in_minutes = hoursToMinutes(ephemeral_session_lifetime);
+    if (idle_ephemeral_session_lifetime !== undefined)
+        sessionDurations.idle_ephemeral_session_lifetime_in_minutes = hoursToMinutes(idle_ephemeral_session_lifetime);
     return sessionDurations;
-};
-exports.sessionDurationsToMinutes = sessionDurationsToMinutes;
+}
+exports.default = sessionDurationsToMinutes;

package/lib/tools/auth0/handlers/actions.d.ts

@@ -118,6 +118,7 @@ export default class ActionHandler extends DefaultAPIHandler {
     actionChanges(action: any, found: any): Promise<Asset>;
     getType(): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     enrichActionWithModuleIds(action: Action, modules: ActionModule[]): Promise<Action>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/actions.js

@@ -280,6 +280,42 @@ class ActionHandler extends default_1.default {
         }
         return super.calcChanges({ ...assets, actions });
     }
+    async dryRunChanges(assets) {
+        let { actions, actionModules } = assets;
+        if (!actions) {
+            return {
+                del: [],
+                create: [],
+                update: [],
+                conflicts: [],
+            };
+        }
+        let modules = null;
+        if (actionModules && actionModules.length > 0) {
+            modules = actionModules;
+        }
+        else {
+            try {
+                modules = await (0, client_1.paginate)(this.client.actions.modules.list, {
+                    paginate: true,
+                });
+            }
+            catch {
+                logger_1.default.debug('Skipping actions modules enrichment because action modules could not be retrieved.');
+                modules = null;
+            }
+        }
+        if (modules != null) {
+            const processedActions = await this.client.pool
+                .addEachTask({
+                data: actions || [],
+                generator: (action) => this.enrichActionWithModuleIds(action, modules),
+            })
+                .promise();
+            actions = processedActions;
+        }
+        return super.dryRunChanges({ ...assets, actions });
+    }
     async enrichActionWithModuleIds(action, modules) {
         if (!action.modules || action.modules.length === 0) {
             return action;

package/lib/tools/auth0/handlers/attackProtection.js

@@ -5,6 +5,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.CAPTCHA_PROVIDERS = void 0;
 const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 exports.CAPTCHA_PROVIDERS = [
     'arkose',
@@ -187,6 +188,14 @@ class AttackProtectionHandler extends default_1.default {
         super({
             ...config,
             type: 'attackProtection',
+            ignoreDryRunFields: [
+                'captcha.arkose.secret',
+                'captcha.friendly_captcha.secret',
+                'captcha.hcaptcha.secret',
+                'captcha.recaptcha_enterprise.api_key',
+                'captcha.recaptcha_enterprise.project_id',
+                'captcha.recaptcha_v2.secret',
+            ],
         });
     }
     objString(item) {
@@ -263,6 +272,12 @@ class AttackProtectionHandler extends default_1.default {
         if (!attackProtection || !Object.keys(attackProtection).length) {
             return;
         }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         const updates = [];
         if (attackProtection.botDetection && Object.keys(attackProtection.botDetection).length) {
             updates.push(this.client.attackProtection.botDetection.update(attackProtection.botDetection));

package/lib/tools/auth0/handlers/branding.js

@@ -46,6 +46,7 @@ exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
 const logger_1 = __importDefault(require("../../../logger"));
+const utils_1 = require("../../utils");
 exports.schema = {
     type: 'object',
     properties: {
@@ -117,6 +118,12 @@ class BrandingHandler extends default_1.default {
     async processChanges(assets) {
         if (!assets.branding)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (del.length === 0 && update.length === 0 && create.length === 0) {
+                return;
+            }
+        }
         const { templates, ...brandingSettings } = assets.branding;
         if (brandingSettings.logo_url === '') {
             // Sometimes blank logo_url returned by API but is invalid on import. See: DXCDT-240

package/lib/tools/auth0/handlers/clientGrants.js

@@ -88,6 +88,7 @@ class ClientGrantsHandler extends default_1.default {
             // ['client_id', 'audience'] when subject_type is null (falsy).
             identifiers: ['id', ['client_id', 'audience', 'subject_type'], ['client_id', 'audience']],
             stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system'],
+            ignoreDryRunFields: ['_clientName'],
         });
     }
     objString(item) {

package/lib/tools/auth0/handlers/clients.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import DefaultAPIHandler from './default';
 export declare const schema: {
     type: string;
@@ -11,6 +11,22 @@ export declare const schema: {
                 minLength: number;
                 pattern: string;
             };
+            external_client_id: {
+                type: string;
+                description: string;
+            };
+            external_metadata_type: {
+                type: string;
+                description: string;
+            };
+            external_metadata_created_by: {
+                type: string;
+                description: string;
+            };
+            jwks_uri: {
+                type: string;
+                description: string;
+            };
             mobile: {
                 type: string;
                 properties: {
@@ -184,6 +200,35 @@ export declare const schema: {
                     enum: string[];
                 };
             };
+            my_organization_configuration: {
+                type: string[];
+                description: string;
+                properties: {
+                    connection_profile_id: {
+                        type: string;
+                        description: string;
+                    };
+                    user_attribute_profile_id: {
+                        type: string;
+                        description: string;
+                    };
+                    allowed_strategies: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            enum: ("samlp" | "pingfederate" | "adfs" | "waad" | "google-apps" | "okta" | "oidc")[];
+                        };
+                        uniqueItems: boolean;
+                    };
+                    connection_deletion_behavior: {
+                        type: string;
+                        enum: ("allow" | "allow_if_empty")[];
+                        description: string;
+                    };
+                };
+                required: string[];
+            };
             async_approval_notification_channels: {
                 type: string[];
                 description: string;
@@ -315,7 +360,12 @@ export default class ClientHandler extends DefaultAPIHandler {
     existing: Client[];
     constructor(config: DefaultAPIHandler);
     objString(item: any): string;
+    calcChanges(assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
     getType(): Promise<Management.Client[]>;
-    sanitizeMapExpressConfiguration(auth0Client: Auth0APIClient, clientList: Client[]): Promise<Client[]>;
+    private isCimdClient;
+    private createClient;
+    private getCIMDEditableFields;
+    private updateClient;
+    sanitizeMapClientReferences(auth0Client: Auth0APIClient, clientList: Client[]): Promise<Client[]>;
 }