auth0-deploy-cli 8.31.0 → 8.32.0

package/lib/tools/auth0/handlers/databases.js

@@ -49,6 +49,7 @@ const constants_1 = __importDefault(require("../../constants"));
 const utils_1 = require("../../utils");
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 const connections_1 = require("./connections");
 exports.schema = {
     type: 'array',
@@ -73,7 +74,8 @@ exports.schema = {
                                 type: 'object',
                                 properties: {
                                     enabled: { type: 'boolean' },
-                                    api_behavior: { type: 'string' },
+                                    api_behavior: { type: 'string', enum: ['required', 'optional'] },
+                                    signup_behavior: { type: 'string', enum: ['allow', 'block'] },
                                 },
                             },
                             email_otp: {
@@ -179,6 +181,54 @@ exports.schema = {
                             action_id: { type: 'string' },
                         },
                     },
+                    password_options: {
+                        type: 'object',
+                        properties: {
+                            complexity: {
+                                type: 'object',
+                                properties: {
+                                    min_length: { type: 'integer', minimum: 1, maximum: 72 },
+                                    character_types: {
+                                        type: 'array',
+                                        items: {
+                                            type: 'string',
+                                            enum: ['uppercase', 'lowercase', 'number', 'special'],
+                                        },
+                                    },
+                                    character_type_rule: { type: 'string', enum: ['all', 'three_of_four'] },
+                                    identical_characters: { type: 'string', enum: ['allow', 'block'] },
+                                    sequential_characters: { type: 'string', enum: ['allow', 'block'] },
+                                    max_length_exceeded: { type: 'string', enum: ['truncate', 'error'] },
+                                },
+                            },
+                            profile_data: {
+                                type: 'object',
+                                properties: {
+                                    active: { type: 'boolean' },
+                                    blocked_fields: {
+                                        type: 'array',
+                                        items: { type: 'string' },
+                                        maxItems: 12,
+                                    },
+                                },
+                            },
+                            history: {
+                                type: 'object',
+                                properties: {
+                                    active: { type: 'boolean' },
+                                    size: { type: 'integer', minimum: 1, maximum: 24 },
+                                },
+                            },
+                            dictionary: {
+                                type: 'object',
+                                properties: {
+                                    active: { type: 'boolean' },
+                                    default: { type: 'string', enum: ['en_10k', 'en_100k'] },
+                                    custom: { type: 'array', items: { type: 'string' } },
+                                },
+                            },
+                        },
+                    },
                 },
             },
         },
@@ -220,10 +270,45 @@ class DatabaseHandler extends default_1.default {
         // Validate each database
         databases.forEach((database) => {
             this.validateEmailUniqueConstraints(database);
-            // this.validatePasswordlessSettings(database); // Enable only the feature is GA PR:#1282
+            this.validatePasswordOptions(database);
+            // this.validatePasswordlessSettings(database); // Enable only when feature is GA PR:#1282
         });
         await super.validate(assets);
     }
+    validatePasswordOptions(payload) {
+        const options = payload?.options;
+        if (!options?.password_options)
+            return;
+        const legacyFields = [
+            'passwordPolicy',
+            'password_complexity_options',
+            'password_history',
+            'password_no_personal_info',
+            'password_dictionary',
+        ];
+        const conflictingField = legacyFields.find((field) => field in options);
+        if (conflictingField) {
+            throw new Error(`Database "${payload.name}": Cannot use both legacy password policy field "${conflictingField}" and "password_options". Please migrate fully to "password_options".`);
+        }
+        const complexity = options.password_options?.complexity;
+        if (complexity?.character_type_rule === 'three_of_four') {
+            const allTypes = ['uppercase', 'lowercase', 'number', 'special'];
+            const hasAllTypes = allTypes.every((t) => complexity?.character_types?.includes(t));
+            if (!hasAllTypes) {
+                throw new Error(`Database "${payload.name}": "character_type_rule" can only be set to "three_of_four" when all four character types (uppercase, lowercase, number, special) are specified in "character_types".`);
+            }
+        }
+        const blockedFields = options.password_options?.profile_data?.blocked_fields;
+        if (blockedFields) {
+            if (blockedFields.length > 12) {
+                throw new Error(`Database "${payload.name}": "profile_data.blocked_fields" cannot contain more than 12 items.`);
+            }
+            const tooLong = blockedFields.find((f) => f.length > 100);
+            if (tooLong) {
+                throw new Error(`Database "${payload.name}": Each item in "profile_data.blocked_fields" must not exceed 100 characters.`);
+            }
+        }
+    }
     validatePasswordlessSettings(payload) {
         const options = payload?.options;
         if (!options)
@@ -238,6 +323,11 @@ class DatabaseHandler extends default_1.default {
         if (passwordEnabled === true && disableSelfServiceChangePassword === true) {
             throw new Error(`Database "${payload.name}": disable_self_service_change_password must be false when password authentication is enabled.`);
         }
+        const apiBehavior = options?.authentication_methods?.password?.api_behavior;
+        const signupBehavior = options?.authentication_methods?.password?.signup_behavior;
+        if (signupBehavior === 'block' && apiBehavior !== 'optional') {
+            throw new Error(`Database "${payload.name}": When "signup_behavior" is "block", "api_behavior" must be "optional".`);
+        }
     }
     validateEmailUniqueConstraints(payload) {
         const attributes = payload?.options?.attributes;
@@ -288,6 +378,35 @@ class DatabaseHandler extends default_1.default {
                 else if (requiresUsername || validation) {
                     delete connection.options?.attributes;
                 }
+                // When switching between flexible and legacy password policy, strip the conflicting
+                // group from the existing state before merging to avoid a 400 from the API.
+                const payloadHasPasswordOptions = !!payload?.options?.password_options;
+                const payloadHasLegacyPasswordFields = payload?.options?.passwordPolicy ||
+                    payload?.options?.password_complexity_options ||
+                    payload?.options?.password_history ||
+                    payload?.options?.password_no_personal_info ||
+                    payload?.options?.password_dictionary;
+                if (payloadHasPasswordOptions) {
+                    delete connection.options?.passwordPolicy;
+                    delete connection.options?.password_complexity_options;
+                    delete connection.options?.password_history;
+                    delete connection.options?.password_no_personal_info;
+                    delete connection.options?.password_dictionary;
+                }
+                else if (payloadHasLegacyPasswordFields) {
+                    delete connection.options?.password_options;
+                }
+                // If signup_behavior is being set to "block", api_behavior must be "optional".
+                // Check the merged result upfront so the user gets a clear error rather than a
+                // cryptic 400 from the API.
+                const mergedApiBehavior = payload?.options?.authentication_methods?.password?.api_behavior ??
+                    connection.options?.authentication_methods?.password?.api_behavior;
+                const payloadSignupBehavior = payload?.options?.authentication_methods?.password?.signup_behavior;
+                if (payloadSignupBehavior === 'block' && mergedApiBehavior !== 'optional') {
+                    throw new Error(`Database "${payload.name}": Cannot set "signup_behavior" to "block" without "api_behavior" set to "optional". ` +
+                        `The existing tenant value for "api_behavior" is "${mergedApiBehavior ?? 'required (default)'}". ` +
+                        `Please explicitly set "api_behavior" to "optional" in your config.`);
+                }
                 payload.options = { ...connection.options, ...payload.options };
                 if (payload.options && Object.keys(payload.options).length === 0) {
                     delete payload.options;
@@ -388,6 +507,47 @@ class DatabaseHandler extends default_1.default {
         });
         return super.calcChanges({ ...assets, databases: formatted });
     }
+    async dryRunChanges(assets) {
+        const { databases } = assets;
+        if (!databases) {
+            return {
+                del: [],
+                create: [],
+                update: [],
+                conflicts: [],
+            };
+        }
+        const [clients, existingDatabasesConnections, actions] = await Promise.all([
+            (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+            }),
+            (0, client_1.paginate)(this.client.connections.list, {
+                strategy: [auth0_1.Management.ConnectionStrategyEnum.Auth0],
+                checkpoint: true,
+                include_totals: true,
+            }),
+            (0, client_1.paginate)(this.client.actions.list, {
+                paginate: true,
+                include_totals: true,
+            }),
+        ]);
+        const formatted = databases.map((db) => {
+            const { options, ...rest } = db;
+            const formattedOptions = this.getFormattedOptions(options, actions);
+            const formattedDb = { ...rest, options: formattedOptions };
+            if (db.enabled_clients) {
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+            }
+            return formattedDb;
+        });
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: formatted,
+            existing: existingDatabasesConnections,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.ignoreDryRunFields,
+        });
+    }
     // Run after clients are updated so we can convert all the enabled_clients names to id's
     async processChanges(assets) {
         const { databases } = assets;

package/lib/tools/auth0/handlers/default.d.ts

@@ -23,6 +23,7 @@ export default class APIHandler {
         create: ApiMethodOverride;
         delete: ApiMethodOverride;
     };
+    ignoreDryRunFields: string[];
     constructor(options: {
         id?: APIHandler['id'];
         config: ConfigFunction;
@@ -39,17 +40,20 @@ export default class APIHandler {
             create?: ApiMethodOverride;
             delete?: ApiMethodOverride;
         };
+        ignoreDryRunFields: APIHandler['ignoreDryRunFields'];
     });
     getClientFN(fn: ApiMethodOverride): Function;
     didDelete(item: Asset): void;
     didCreate(item: Asset): void;
     didUpdate(item: Asset): void;
     objString(item: Asset): string;
+    getResourceName(item: Asset): string;
     getType(): Promise<Asset | Asset[] | null>;
     load(): Promise<{
         [key: string]: Asset | Asset[] | null;
     }>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     validate(assets: Assets): Promise<void>;
     processChanges(assets: Assets, changes: CalculatedChanges): Promise<void>;
 }

package/lib/tools/auth0/handlers/default.js

@@ -9,6 +9,7 @@ const validationError_1 = __importDefault(require("../../validationError"));
 const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 const calculateChanges_1 = require("../../calculateChanges");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 function order(value) {
     return function decorator(t, n, descriptor) {
         const numericValue = Number(value);
@@ -75,6 +76,7 @@ class APIHandler {
         this.stripUpdateFields = [...(options.stripUpdateFields || []), this.id];
         this.sensitiveFieldsToObfuscate = options.sensitiveFieldsToObfuscate || [];
         this.stripCreateFields = options.stripCreateFields || [];
+        this.ignoreDryRunFields = [...(options.ignoreDryRunFields || [])].filter((field, index, allFields) => allFields.indexOf(field) === index);
         this.functions = {
             list: 'list',
             create: 'create',
@@ -115,6 +117,44 @@ class APIHandler {
     objString(item) {
         return (0, utils_1.convertJsonToString)(item);
     }
+    getResourceName(item) {
+        // Get a human-readable identifier for the resource
+        if (item.name)
+            return item.name;
+        if (item.display_name)
+            return item.display_name;
+        if (item.template)
+            return item.template;
+        if (item.email)
+            return item.email;
+        // For some resources, create a descriptive name
+        if (this.type === 'clientGrants') {
+            const clientLabel = item._clientName || item.client_id;
+            return `${clientLabel} -> ${item.audience}`;
+        }
+        if (this.type === 'guardianFactors') {
+            return item.name || item.type || 'unknown factor';
+        }
+        if (this.type === 'emailTemplates') {
+            return item.template || 'unknown template';
+        }
+        if (this.type === 'networkACLs') {
+            return item.description || `priority:${item.priority}`;
+        }
+        if (this.type === 'customDomains') {
+            return item.domain || 'unnamed custom domain';
+        }
+        if (this.type === 'tenant' ||
+            this.type === 'attackProtection' ||
+            this.type === 'branding' ||
+            this.type === 'emailProvider' ||
+            this.type === 'guardianPhoneFactorSelectedProvider' ||
+            this.type === 'guardianPolicies' ||
+            this.type === 'riskAssessment') {
+            return `${this.type} settings`;
+        }
+        return 'unnamed resource';
+    }
     async getType() {
         // Each type to impl how to get the existing as its not consistent across the mgnt api.
         throw new Error(`Must implement getType for type ${this.type}`);
@@ -145,14 +185,49 @@ class APIHandler {
             };
         }
         const existing = await this.getType();
+        // if we are in dry run mode, calculate the changes
+        // Figure out what needs to be updated vs created
+        if (this.config('AUTH0_DRY_RUN') === true || this.config('AUTH0_DRY_RUN') === 'true') {
+            return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+                type: this.type,
+                assets: typeAssets,
+                // @ts-ignore TODO: investigate what happens when `existing` is null
+                existing,
+                identifiers: this.identifiers,
+                ignoreDryRunFields: this.ignoreDryRunFields,
+            });
+        }
+        // if we are not in dry run mode, calculate the changes
         // Figure out what needs to be updated vs created
         return (0, calculateChanges_1.calculateChanges)({
             handler: this,
             assets: typeAssets,
             allowDelete: !!this.config('AUTH0_ALLOW_DELETE'),
-            //@ts-ignore TODO: investigate what happens when `existing` is null
+            // @ts-ignore TODO: investigate what happens when `existing` is null
+            existing,
+            identifiers: this.identifiers,
+        });
+    }
+    async dryRunChanges(assets) {
+        const typeAssets = assets[this.type];
+        // Do nothing if not set
+        if (!typeAssets) {
+            return {
+                del: [],
+                create: [],
+                conflicts: [],
+                update: [],
+            };
+        }
+        const existing = await this.getType();
+        // Figure out what needs to be created, updated or deleted
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: typeAssets,
+            // @ts-ignore TODO: investigate what happens when `existing` is null
             existing,
             identifiers: this.identifiers,
+            ignoreDryRunFields: this.ignoreDryRunFields,
         });
     }
     async validate(assets) {
@@ -234,7 +309,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    return (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)
@@ -252,7 +328,8 @@ class APIHandler {
                 const createFunction = this.getClientFN(this.functions.create);
                 const createPayload = (() => {
                     const strippedPayload = (0, utils_1.stripFields)(createItem, this.stripCreateFields);
-                    return (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
+                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(strippedPayload, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(createItem));
                 })();
                 return createFunction(createPayload);
             }, retryConfig)
@@ -273,7 +350,8 @@ class APIHandler {
                 const updateFN = this.getClientFN(this.functions.update);
                 const updatePayload = (() => {
                     const data = (0, utils_1.stripFields)({ ...updateItem }, this.stripUpdateFields);
-                    return (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    const stripped = (0, utils_1.stripObfuscatedFieldsFromPayload)(data, this.sensitiveFieldsToObfuscate);
+                    return (0, utils_1.validateNoUnresolvedPlaceholders)(stripped, this.type, this.objString(updateItem));
                 })();
                 return updateFN(updateItem[this.id], updatePayload);
             }, retryConfig)

package/lib/tools/auth0/handlers/emailProvider.js

@@ -41,6 +41,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const lodash_1 = require("lodash");
+const utils_1 = require("../../utils");
 const default_1 = __importStar(require("./default"));
 exports.schema = { type: 'object' };
 // The Management API requires the fields to be specified
@@ -50,6 +51,7 @@ class EmailProviderHandler extends default_1.default {
         super({
             ...options,
             type: 'emailProvider',
+            ignoreDryRunFields: ['smtp.credentials.smtp_pass', 'mandrill.credentials.api_key'],
         });
     }
     async getType() {
@@ -73,6 +75,12 @@ class EmailProviderHandler extends default_1.default {
         const { emailProvider } = assets;
         if (!emailProvider)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         const existing = await this.getType();
         // HTTP DELETE on emails/provider is not supported, as this is not part of our vNext SDK.
         if (Object.keys(emailProvider).length === 0) {

package/lib/tools/auth0/handlers/emailTemplates.js

@@ -45,6 +45,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = exports.supportedTemplates = void 0;
 const default_1 = __importStar(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
+const utils_1 = require("../../utils");
 exports.supportedTemplates = constants_1.default.EMAIL_TEMPLATES_NAMES.filter((p) => p.includes('.json')).map((p) => p.replace('.json', ''));
 exports.schema = {
     type: 'array',
@@ -122,6 +123,12 @@ class EmailTemplateHandler extends default_1.default {
         // Do nothing if not set
         if (!emailTemplates || !emailTemplates.length)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0) {
+                return;
+            }
+        }
         await Promise.all(emailTemplates.map(async (emailTemplate) => {
             await this.updateOrCreate(emailTemplate);
         }));

package/lib/tools/auth0/handlers/flowVaultConnections.js

@@ -47,6 +47,7 @@ const lodash_1 = require("lodash");
 const default_1 = __importStar(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
 const logger_1 = __importDefault(require("../../../logger"));
+const utils_1 = require("../../utils");
 exports.schema = {
     type: 'array',
     items: {
@@ -102,7 +103,11 @@ class FlowVaultHandler extends default_1.default {
         if (!flowVaultConnections)
             return;
         const { del, update, create } = await this.calcChanges(assets);
-        logger_1.default.debug(`Start processChanges for flow vault connections [delete:${del.length}] [update:${update.length}], [create:${create.length}]`);
+        if ((0, utils_1.isDryRun)(this.config)) {
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         if (del.length > 0) {
             await this.deleteVaultConnections(del);
         }

package/lib/tools/auth0/handlers/flows.js

@@ -48,7 +48,8 @@ const dot_prop_1 = __importDefault(require("dot-prop"));
 const default_1 = __importStar(require("./default"));
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
-const utils_1 = require("../../../utils");
+const utils_1 = require("../../utils");
+const utils_2 = require("../../../utils");
 const flowVaultConnections_1 = require("./flowVaultConnections");
 exports.schema = {
     type: 'array',
@@ -113,6 +114,15 @@ class FlowHandler extends default_1.default {
         // Do nothing if not set
         if (!flows)
             return;
+        const { del, update, create, conflicts } = await this.calcChanges(assets);
+        if ((0, utils_1.isDryRun)(this.config)) {
+            if (create.length === 0 &&
+                update.length === 0 &&
+                del.length === 0 &&
+                conflicts.length === 0) {
+                return;
+            }
+        }
         const allFlowConnections = await (0, flowVaultConnections_1.getAllFlowConnections)(this.client);
         // create a map for name to id from allFlowConnections
         const connectionNameMap = {};
@@ -120,7 +130,6 @@ class FlowHandler extends default_1.default {
             connectionNameMap[c.name] = c.id;
         });
         assets.flows = await this.pargeFlowConnectionName(flows, connectionNameMap);
-        const { del, update, create, conflicts } = await this.calcChanges(assets);
         const changes = {
             del: del,
             update: update,
@@ -134,7 +143,7 @@ class FlowHandler extends default_1.default {
     async formateFlowConnectionId(flows, connectionIdMap) {
         // replace connection_id with flow connection names
         await Promise.all(flows.map(async (flow) => {
-            const flowConnetions = (0, utils_1.findKeyPathWithValue)(flow, 'connection_id');
+            const flowConnetions = (0, utils_2.findKeyPathWithValue)(flow, 'connection_id');
             await Promise.all(flowConnetions.map(async (f) => {
                 const connectionId = (dot_prop_1.default.get(flow, f.path) || '');
                 const flowConnectionName = connectionIdMap[connectionId];
@@ -152,7 +161,7 @@ class FlowHandler extends default_1.default {
     async pargeFlowConnectionName(flows, connectionNameMap) {
         // replace connection_id with flow connection names
         const parsedFlows = await Promise.all(flows.map(async (flow) => {
-            const flowConnetions = (0, utils_1.findKeyPathWithValue)(flow, 'connection_id');
+            const flowConnetions = (0, utils_2.findKeyPathWithValue)(flow, 'connection_id');
             await Promise.all(flowConnetions.map(async (f) => {
                 const connectionName = (dot_prop_1.default.get(flow, f.path) || '');
                 const flowConnectionId = connectionNameMap[connectionName];

package/lib/tools/auth0/handlers/forms.js

@@ -49,6 +49,7 @@ const default_1 = __importStar(require("./default"));
 const logger_1 = __importDefault(require("../../../logger"));
 const client_1 = require("../client");
 const utils_1 = require("../../../utils");
+const utils_2 = require("../../utils");
 exports.schema = {
     type: 'array',
     items: {
@@ -150,6 +151,15 @@ class FormsHandler extends default_1.default {
         // Do nothing if not set
         if (!forms)
             return;
+        const { del, update, create, conflicts } = await this.calcChanges(assets);
+        if ((0, utils_2.isDryRun)(this.config)) {
+            if (create.length === 0 &&
+                update.length === 0 &&
+                del.length === 0 &&
+                conflicts.length === 0) {
+                return;
+            }
+        }
         const flows = await (0, client_1.paginate)(this.client.flows.list, {
             paginate: true,
             include_totals: true,
@@ -160,7 +170,6 @@ class FormsHandler extends default_1.default {
             flowNamMap[f.name] = f.id;
         });
         assets.forms = await this.pargeFormFlowName(forms, flowNamMap);
-        const { del, update, create, conflicts } = await this.calcChanges(assets);
         const changes = {
             del: del,
             update: update,

package/lib/tools/auth0/handlers/guardianFactors.js

@@ -30,7 +30,7 @@ class GuardianFactorsHandler extends default_1.default {
             return this.existing;
         try {
             const factors = await this.client.guardian.factors.list();
-            this.existing = factors;
+            this.existing = (0, utils_1.sortGuardianFactors)(factors);
             return this.existing;
         }
         catch (err) {
@@ -49,6 +49,12 @@ class GuardianFactorsHandler extends default_1.default {
         // Do nothing if not set
         if (!guardianFactors || !guardianFactors.length)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         // Process each factor
         await Promise.all(guardianFactors.map(async (factor) => {
             const data = { ...factor };

package/lib/tools/auth0/handlers/guardianPhoneFactorMessageTypes.js

@@ -65,8 +65,15 @@ class GuardianPhoneMessageTypesHandler extends default_1.default {
         // No API to delete or create guardianPhoneFactorMessageTypes, we can only update.
         const { guardianPhoneFactorMessageTypes } = assets;
         // Do nothing if not set
-        if (!guardianPhoneFactorMessageTypes || !guardianPhoneFactorMessageTypes.message_types)
+        if (!guardianPhoneFactorMessageTypes || !guardianPhoneFactorMessageTypes.message_types) {
             return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         const data = guardianPhoneFactorMessageTypes;
         await this.client.guardian.factors.phone.setMessageTypes(data);
         this.updated += 1;

package/lib/tools/auth0/handlers/guardianPhoneFactorSelectedProvider.js

@@ -62,8 +62,15 @@ class GuardianPhoneSelectedProviderHandler extends default_1.default {
         // No API to delete or create guardianPhoneFactorSelectedProvider, we can only update.
         const { guardianPhoneFactorSelectedProvider } = assets;
         // Do nothing if not set
-        if (!guardianPhoneFactorSelectedProvider || !guardianPhoneFactorSelectedProvider.provider)
+        if (!guardianPhoneFactorSelectedProvider || !guardianPhoneFactorSelectedProvider.provider) {
             return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         const data = guardianPhoneFactorSelectedProvider;
         await this.client.guardian.factors.phone.setProvider(data);
         this.updated += 1;

package/lib/tools/auth0/handlers/guardianPolicies.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importDefault(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
+const utils_1 = require("../../utils");
 exports.schema = {
     type: 'object',
     properties: {
@@ -40,6 +41,12 @@ class GuardianPoliciesHandler extends default_1.default {
         // Do nothing if not set
         if (!guardianPolicies || !guardianPolicies.policies)
             return;
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
         const data = guardianPolicies.policies;
         await this.client.guardian.policies.set(data);
         this.updated += 1;

package/lib/tools/auth0/handlers/hooks.d.ts

@@ -53,6 +53,7 @@ export default class HooksHandler extends DefaultHandler {
     processSecrets(hooks: any): Promise<void>;
     getType(reload: boolean): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     validate(assets: any): Promise<void>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/hooks.js

@@ -175,6 +175,16 @@ class HooksHandler extends default_1.default {
             conflicts: stripSecrets(conflicts),
         };
     }
+    async dryRunChanges(assets) {
+        const { del, update, create, conflicts } = await super.dryRunChanges(assets);
+        const stripSecrets = (list) => list.map((item) => ({ ...item, secrets: undefined }));
+        return {
+            del,
+            update: stripSecrets(update),
+            create: stripSecrets(create),
+            conflicts: stripSecrets(conflicts),
+        };
+    }
     async validate(assets) {
         const { hooks } = assets;
         // Do nothing if not set