auth0-deploy-cli 8.31.0 → 8.33.0

package/lib/tools/auth0/handlers/clientGrants.js

@@ -73,8 +73,13 @@ exports.schema = {
                 type: 'boolean',
                 description: 'When enabled, all scopes configured on the resource server are allowed for by this client grant.',
             },
+            default_for: {
+                type: 'string',
+                enum: ['third_party_clients'],
+                description: 'Indicates that a client grant is the default client grant for third party clients.',
+            },
         },
-        required: ['client_id', 'audience'],
+        required: ['audience'],
     },
 };
 class ClientGrantsHandler extends default_1.default {
@@ -83,11 +88,18 @@ class ClientGrantsHandler extends default_1.default {
             ...config,
             type: 'clientGrants',
             id: 'id',
-            // @ts-ignore because not sure why two-dimensional array passed in
-            // Try ['client_id', 'audience', 'subject_type'] first; falls through to
-            // ['client_id', 'audience'] when subject_type is null (falsy).
-            identifiers: ['id', ['client_id', 'audience', 'subject_type'], ['client_id', 'audience']],
-            stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system'],
+            // Nested arrays are not reflected in the type but are supported at runtime.
+            // Try ['client_id', 'audience', 'subject_type'] first, then ['client_id', 'audience']
+            // for regular grants, then ['default_for', 'audience'] for default third-party grants
+            // which have no client_id.
+            identifiers: [
+                'id',
+                ['client_id', 'audience', 'subject_type'],
+                ['client_id', 'audience'],
+                ['default_for', 'audience'],
+            ],
+            stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system', 'default_for'],
+            ignoreDryRunFields: ['_clientName'],
         });
     }
     objString(item) {
@@ -100,6 +112,15 @@ class ClientGrantsHandler extends default_1.default {
             return;
         // Validate each client grant
         clientGrants.forEach((grant) => {
+            // client_id and default_for are mutually exclusive; exactly one must be present
+            const hasClientId = !!grant.client_id;
+            const hasDefaultFor = !!grant.default_for;
+            if (hasClientId && hasDefaultFor) {
+                throw new Error(`Client grant for audience "${grant.audience}": Cannot specify both "client_id" and "default_for". They are mutually exclusive.`);
+            }
+            if (!hasClientId && !hasDefaultFor) {
+                throw new Error(`Client grant for audience "${grant.audience}": One of "client_id" or "default_for" is required.`);
+            }
             // When allow_all_scopes is true, scope should not be present
             if (grant.allow_all_scopes === true && grant.scope && grant.scope.length > 0) {
                 throw new Error(`Client grant for client_id "${grant.client_id}" and audience "${grant.audience}": Cannot specify "scope" when "allow_all_scopes" is set to true. Remove the "scope" property or set "allow_all_scopes" to false.`);
@@ -126,7 +147,8 @@ class ClientGrantsHandler extends default_1.default {
                 is_first_party: true,
             });
             const firstPartyClientIds = new Set(clients.map((c) => c.client_id));
-            this.existing = this.existing.filter((grant) => firstPartyClientIds.has(grant.client_id));
+            // default_for grants have no client_id and are not tied to a specific client; always keep them
+            this.existing = this.existing.filter((grant) => !grant.client_id || firstPartyClientIds.has(grant.client_id));
         }
         return this.existing;
     }
@@ -186,9 +208,9 @@ class ClientGrantsHandler extends default_1.default {
             let filtered = list;
             // Filter out the current client (Auth0 Management API client)
             filtered = filtered.filter((item) => item.client_id !== currentClient);
-            // Filter out excluded clients
+            // Filter out excluded clients; default_for grants have no client_id and are never excluded
             if (excludedClients.length) {
-                filtered = filtered.filter((item) => item.client_id &&
+                filtered = filtered.filter((item) => !item.client_id ||
                     ![...excludedClientsByNames, ...excludedClients].includes(item.client_id));
             }
             // Filter out system grants

package/lib/tools/auth0/handlers/clients.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets, Auth0APIClient } from '../../../types';
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import DefaultAPIHandler from './default';
 export declare const schema: {
     type: string;
@@ -11,6 +11,22 @@ export declare const schema: {
                 minLength: number;
                 pattern: string;
             };
+            external_client_id: {
+                type: string;
+                description: string;
+            };
+            external_metadata_type: {
+                type: string;
+                description: string;
+            };
+            external_metadata_created_by: {
+                type: string;
+                description: string;
+            };
+            jwks_uri: {
+                type: string;
+                description: string;
+            };
             mobile: {
                 type: string;
                 properties: {
@@ -184,6 +200,35 @@ export declare const schema: {
                     enum: string[];
                 };
             };
+            my_organization_configuration: {
+                type: string[];
+                description: string;
+                properties: {
+                    connection_profile_id: {
+                        type: string;
+                        description: string;
+                    };
+                    user_attribute_profile_id: {
+                        type: string;
+                        description: string;
+                    };
+                    allowed_strategies: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            enum: ("samlp" | "pingfederate" | "adfs" | "waad" | "google-apps" | "okta" | "oidc")[];
+                        };
+                        uniqueItems: boolean;
+                    };
+                    connection_deletion_behavior: {
+                        type: string;
+                        enum: ("allow" | "allow_if_empty")[];
+                        description: string;
+                    };
+                };
+                required: string[];
+            };
             async_approval_notification_channels: {
                 type: string[];
                 description: string;
@@ -263,6 +308,16 @@ export declare const schema: {
                     };
                 };
             };
+            third_party_security_mode: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            redirection_policy: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
             oidc_logout: {
                 type: string[];
                 description: string;
@@ -315,7 +370,12 @@ export default class ClientHandler extends DefaultAPIHandler {
     existing: Client[];
     constructor(config: DefaultAPIHandler);
     objString(item: any): string;
+    calcChanges(assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
     getType(): Promise<Management.Client[]>;
-    sanitizeMapExpressConfiguration(auth0Client: Auth0APIClient, clientList: Client[]): Promise<Client[]>;
+    private isCimdClient;
+    private createClient;
+    private getCIMDEditableFields;
+    private updateClient;
+    sanitizeMapClientReferences(auth0Client: Auth0APIClient, clientList: Client[]): Promise<Client[]>;
 }

package/lib/tools/auth0/handlers/clients.js

@@ -4,9 +4,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
+const auth0_1 = require("auth0");
 const lodash_1 = require("lodash");
 const client_1 = require("../client");
 const default_1 = __importDefault(require("./default"));
+const calculateChanges_1 = require("../../calculateChanges");
 const connectionProfiles_1 = require("./connectionProfiles");
 const userAttributeProfiles_1 = require("./userAttributeProfiles");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -31,12 +33,57 @@ const multiResourceRefreshTokenPoliciesSchema = {
         required: ['audience', 'scope'],
     },
 };
+const myOrganizationConfigurationSchema = {
+    type: ['object', 'null'],
+    description: 'Configuration related to the My Organization API for the client.',
+    properties: {
+        connection_profile_id: {
+            type: 'string',
+            description: 'The name of the connection profile to use for this application',
+        },
+        user_attribute_profile_id: {
+            type: 'string',
+            description: 'The name of the user attribute profile to use for this application',
+        },
+        allowed_strategies: {
+            type: 'array',
+            description: 'The allowed connection strategies for the My Organization configuration',
+            items: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationAllowedStrategiesEnum),
+            },
+            uniqueItems: true,
+        },
+        connection_deletion_behavior: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
+            description: 'The deletion behavior for My Organization connections created by this client',
+        },
+    },
+    required: ['allowed_strategies', 'connection_deletion_behavior'],
+};
 exports.schema = {
     type: 'array',
     items: {
         type: 'object',
         properties: {
             name: { type: 'string', minLength: 1, pattern: '[^<>]+' },
+            external_client_id: {
+                type: 'string',
+                description: 'Alternative identifier for the client. For CIMD clients, this is the HTTPS URL to the OAuth 2.0 Client ID Metadata Document. Client name should match the client_name value in the metadata document.',
+            },
+            external_metadata_type: {
+                type: 'string',
+                description: 'Type of external client registration metadata.',
+            },
+            external_metadata_created_by: {
+                type: 'string',
+                description: 'Indicates who created the external metadata client: admin for Management API, client for dynamic registration.',
+            },
+            jwks_uri: {
+                type: 'string',
+                description: 'JSON Web Key Set endpoint associated with the client.',
+            },
             mobile: {
                 type: 'object',
                 properties: {
@@ -177,6 +224,7 @@ exports.schema = {
                     enum: ['email', 'organization_name'],
                 },
             },
+            my_organization_configuration: myOrganizationConfigurationSchema,
             async_approval_notification_channels: {
                 type: ['array', 'null'],
                 description: 'An ordered array of notification channels enabled for CIBA (Client-Initiated Backchannel Authentication) requests. Channels are evaluated in the order specified.',
@@ -259,11 +307,21 @@ exports.schema = {
                         description: 'List of enabled token exchange profile types for this client',
                         items: {
                             type: 'string',
-                            enum: ['custom_authentication'],
+                            enum: ['custom_authentication', 'on_behalf_of_token_exchange'],
                         },
                     },
                 },
             },
+            third_party_security_mode: {
+                type: 'string',
+                enum: ['strict', 'permissive'],
+                description: 'Indicates the security mode for a Third Party Client, to apply new security semantics and improvements.',
+            },
+            redirection_policy: {
+                type: 'string',
+                enum: ['allow_always', 'open_redirect_protection'],
+                description: 'Determines how OAuth2/OIDC errors are handled when a non-recoverable error happens.',
+            },
             oidc_logout: {
                 type: ['object', 'null'],
                 description: 'Configuration for OIDC backchannel logout',
@@ -376,6 +434,7 @@ class ClientHandler extends default_1.default {
             id: 'client_id',
             identifiers: ['client_id', 'name'],
             objectFields: ['client_metadata'],
+            stripCreateFields: ['external_metadata_type', 'external_metadata_created_by', 'jwks_uri'],
             stripUpdateFields: [
                 // Fields not allowed during updates
                 'callback_url_template',
@@ -384,18 +443,62 @@ class ClientHandler extends default_1.default {
                 'tenant',
                 'jwt_configuration.secret_encoded',
                 'resource_server_identifier',
+                'external_metadata_type',
+                'external_metadata_created_by',
+                'jwks_uri',
+                // third_party_security_mode is immutable after creation; PATCH returns 400
+                'third_party_security_mode',
             ],
+            functions: {
+                create: (client) => this.createClient(client),
+                update: (clientId, client) => this.updateClient(clientId, client),
+            },
         });
     }
     objString(item) {
         return super.objString({ name: item.name, client_id: item.client_id });
     }
+    async calcChanges(assets) {
+        const clients = assets[this.type];
+        if (!clients) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const existing = await this.getType();
+        const allowDelete = !!this.config('AUTH0_ALLOW_DELETE');
+        const cimdClients = clients.filter((c) => this.isCimdClient(c));
+        const existingCimd = (existing || []).filter((c) => this.isCimdClient(c));
+        const regularClients = clients.filter((c) => !this.isCimdClient(c));
+        const existingRegular = (existing || []).filter((c) => !this.isCimdClient(c));
+        const regularChanges = (0, calculateChanges_1.calculateChanges)({
+            handler: this,
+            assets: regularClients,
+            existing: existingRegular,
+            identifiers: ['client_id', 'name'],
+            allowDelete,
+        });
+        // CIMD clients:
+        // If external_client_id changes (and no client_id match), old client is deleted
+        // and new registration is created with the new external_client_id.
+        const cimdChanges = (0, calculateChanges_1.calculateChanges)({
+            handler: this,
+            assets: cimdClients,
+            existing: existingCimd,
+            identifiers: ['client_id', 'external_client_id'],
+            allowDelete,
+        });
+        return {
+            del: [...regularChanges.del, ...cimdChanges.del],
+            update: [...regularChanges.update, ...cimdChanges.update],
+            create: [...regularChanges.create, ...cimdChanges.create],
+            conflicts: [...regularChanges.conflicts, ...cimdChanges.conflicts],
+        };
+    }
     async processChanges(assets) {
         const { clients } = assets;
         // Do nothing if not set
         if (!clients)
             return;
-        assets.clients = await this.sanitizeMapExpressConfiguration(this.client, clients);
+        assets.clients = await this.sanitizeMapClientReferences(this.client, clients);
         const excludedClients = (assets.exclude && assets.exclude.clients) || [];
         const { del, update, create, conflicts } = await this.calcChanges(assets);
         // Always filter out the client we are using to access Auth0 Management API
@@ -453,37 +556,99 @@ class ClientHandler extends default_1.default {
         this.existing = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
         return this.existing;
     }
-    // convert names back to IDs for express configuration
-    async sanitizeMapExpressConfiguration(auth0Client, clientList) {
-        // if no clients have express configuration, return early
-        if (!clientList.some((p) => p.express_configuration)) {
+    isCimdClient(client) {
+        return !!client.external_client_id;
+    }
+    async createClient(client) {
+        if (!this.isCimdClient(client)) {
+            return this.client.clients.create(client);
+        }
+        const externalClientId = client.external_client_id;
+        const registration = await this.client.clients.registerCimdClient({
+            external_client_id: externalClientId,
+        });
+        return registration;
+    }
+    getCIMDEditableFields(client) {
+        // Only a subset of fields are editable for CIMD clients.
+        return (0, lodash_1.pick)(client, [
+            'description',
+            'app_type',
+            'allowed_origins',
+            'web_origins',
+            'grant_types',
+            'oidc_conformant',
+            'organization_discovery_methods',
+            'client_metadata',
+            'default_organization',
+            'require_proof_of_possession',
+            'token_quota',
+            'skip_non_verifiable_callback_uri_confirmation_prompt',
+            'jwt_configuration',
+            'refresh_token',
+        ]);
+    }
+    async updateClient(clientId, client) {
+        // For non-CIMD clients
+        if (!this.isCimdClient(client)) {
+            return this.client.clients.update(clientId, client);
+        }
+        const updatePayload = this.getCIMDEditableFields(client);
+        const registrationClientId = client.client_id || clientId;
+        if (registrationClientId && Object.keys(updatePayload).length > 0) {
+            return this.client.clients.update(registrationClientId, updatePayload);
+        }
+        return client;
+    }
+    // convert names back to IDs for client reference-based configuration
+    async sanitizeMapClientReferences(auth0Client, clientList) {
+        const hasExpressConfiguration = clientList.some((client) => client.express_configuration);
+        const hasMyOrganizationConfiguration = clientList.some((client) => client.my_organization_configuration);
+        if (!hasExpressConfiguration && !hasMyOrganizationConfiguration) {
             return clientList;
         }
         const clientData = await this.getType();
         const connectionProfiles = await (0, connectionProfiles_1.getConnectionProfile)(auth0Client);
         const userAttributeProfiles = await (0, userAttributeProfiles_1.getUserAttributeProfiles)(auth0Client);
         return clientList.map((client) => {
-            if (!client.express_configuration)
+            if (client.express_configuration) {
+                const userAttributeProfileName = client.express_configuration.user_attribute_profile_id;
+                if (userAttributeProfileName) {
+                    const userAttributeProfile = userAttributeProfiles?.find((uap) => uap.name === userAttributeProfileName);
+                    if (userAttributeProfile?.id) {
+                        client.express_configuration.user_attribute_profile_id = userAttributeProfile.id;
+                    }
+                }
+                const connectionProfileName = client.express_configuration.connection_profile_id;
+                if (connectionProfileName) {
+                    const connectionProfile = connectionProfiles?.find((cp) => cp.name === connectionProfileName);
+                    if (connectionProfile?.id) {
+                        client.express_configuration.connection_profile_id = connectionProfile.id;
+                    }
+                }
+                const oktaOinClientName = client.express_configuration.okta_oin_client_id;
+                if (oktaOinClientName) {
+                    const oktaOinClient = clientData?.find((c) => c.name === oktaOinClientName);
+                    if (oktaOinClient?.client_id) {
+                        client.express_configuration.okta_oin_client_id = oktaOinClient.client_id;
+                    }
+                }
+            }
+            if (!client.my_organization_configuration) {
                 return client;
-            const userAttributeProfileName = client.express_configuration?.user_attribute_profile_id;
-            if (userAttributeProfileName) {
-                const userAttributeProfile = userAttributeProfiles?.find((uap) => uap.name === userAttributeProfileName);
+            }
+            const myOrganizationUserAttributeProfileName = client.my_organization_configuration.user_attribute_profile_id;
+            if (myOrganizationUserAttributeProfileName) {
+                const userAttributeProfile = userAttributeProfiles?.find((uap) => uap.name === myOrganizationUserAttributeProfileName);
                 if (userAttributeProfile?.id) {
-                    client.express_configuration.user_attribute_profile_id = userAttributeProfile.id;
+                    client.my_organization_configuration.user_attribute_profile_id = userAttributeProfile.id;
                 }
             }
-            const connectionProfileName = client.express_configuration.connection_profile_id;
-            if (connectionProfileName) {
-                const connectionProfile = connectionProfiles?.find((cp) => cp.name === connectionProfileName);
+            const myOrganizationConnectionProfileName = client.my_organization_configuration.connection_profile_id;
+            if (myOrganizationConnectionProfileName) {
+                const connectionProfile = connectionProfiles?.find((cp) => cp.name === myOrganizationConnectionProfileName);
                 if (connectionProfile?.id) {
-                    client.express_configuration.connection_profile_id = connectionProfile.id;
-                }
-            }
-            const oktaOinClientName = client.express_configuration.okta_oin_client_id;
-            if (oktaOinClientName) {
-                const oktaOinClient = clientData?.find((c) => c.name === oktaOinClientName);
-                if (oktaOinClient?.client_id) {
-                    client.express_configuration.okta_oin_client_id = oktaOinClient.client_id;
+                    client.my_organization_configuration.connection_profile_id = connectionProfile.id;
                 }
             }
             return client;

package/lib/tools/auth0/handlers/connections.d.ts

@@ -16,10 +16,26 @@ export declare const schema: {
             };
             options: {
                 type: string;
+                additionalProperties: boolean;
                 properties: {
                     dpop_signing_alg: {
                         type: string;
                     };
+                    token_endpoint_auth_signing_alg: {
+                        type: string;
+                        enum: ("RS256" | "RS512" | "PS256" | "ES256" | "ES384" | "PS384" | "RS384")[];
+                    };
+                    id_token_signed_response_algs: {
+                        type: string;
+                        items: {
+                            type: string;
+                            enum: ("RS256" | "RS512" | "PS256" | "ES256" | "ES384" | "PS384" | "RS384")[];
+                        };
+                    };
+                    token_endpoint_jwtca_aud_format: {
+                        type: string;
+                        enum: ("issuer" | "token_endpoint")[];
+                    };
                 };
             };
             enabled_clients: {
@@ -169,6 +185,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     } | {
         options?: undefined;
     };
+    validate(assets: Assets): Promise<void>;
     /**
      * Retrieves all directory provisioning configurations for all connections.
      * @returns A promise that resolves to the configurations object, or null if not configured/supported
@@ -195,6 +212,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     processConnectionDirectoryProvisioning(changes: CalculatedChanges): Promise<void>;
     getType(): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     processChanges(assets: Assets): Promise<void>;
 }
 export {};

package/lib/tools/auth0/handlers/connections.js

@@ -51,14 +51,37 @@ const utils_1 = require("../../utils");
 const client_1 = require("../client");
 const scimHandler_1 = __importDefault(require("./scimHandler"));
 const logger_1 = __importDefault(require("../../../logger"));
+const validationError_1 = __importDefault(require("../../validationError"));
 const connectionOptionsSchema = {
     type: 'object',
+    additionalProperties: true,
     properties: {
         dpop_signing_alg: {
             type: 'string',
         },
+        token_endpoint_auth_signing_alg: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ConnectionTokenEndpointAuthSigningAlgEnum),
+        },
+        id_token_signed_response_algs: {
+            type: 'array',
+            items: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.ConnectionIdTokenSignedResponseAlgEnum),
+            },
+        },
+        token_endpoint_jwtca_aud_format: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc),
+        },
     },
 };
+const oidcOktaStrategies = new Set(['oidc', 'okta']);
+const oidcOktaOnlyConnectionOptionFields = [
+    'token_endpoint_auth_signing_alg',
+    'id_token_signed_response_algs',
+    'token_endpoint_jwtca_aud_format',
+];
 exports.schema = {
     type: 'array',
     items: {
@@ -333,6 +356,27 @@ class ConnectionsHandler extends default_1.default {
             return {};
         }
     }
+    async validate(assets) {
+        const { connections } = assets;
+        if (!connections) {
+            await super.validate(assets);
+            return;
+        }
+        connections.forEach((connection) => {
+            if (!connection?.options)
+                return;
+            const strategy = connection?.strategy ?? 'unknown';
+            if (oidcOktaStrategies.has(strategy))
+                return;
+            const unsupportedFields = oidcOktaOnlyConnectionOptionFields.filter((field) => field in connection.options);
+            if (unsupportedFields.length > 0) {
+                throw new validationError_1.default(`Connection "${connection.name}": option(s) ${unsupportedFields
+                    .map((field) => `"${field}"`)
+                    .join(', ')} are only supported for strategies "oidc" and "okta". Found strategy "${strategy}".`);
+            }
+        });
+        await super.validate(assets);
+    }
     /**
      * Retrieves all directory provisioning configurations for all connections.
      * @returns A promise that resolves to the configurations object, or null if not configured/supported
@@ -543,11 +587,14 @@ class ConnectionsHandler extends default_1.default {
         });
         // Prepare an id map. We'll use this map later to get the `strategy` and SCIM enable status of the connections.
         await this.scimHandler.createIdMap(existingConnections);
-        const formatted = connections.map((connection) => ({
-            ...connection,
-            ...this.getFormattedOptions(connection, clients),
-            enabled_clients: (0, utils_1.getEnabledClients)(assets, connection, existingConnections, clients),
-        }));
+        const formatted = connections.map((connection) => {
+            const enabledClients = (0, utils_1.getEnabledClients)(assets, connection, existingConnections, clients);
+            return {
+                ...connection,
+                ...this.getFormattedOptions(connection, clients),
+                ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
+            };
+        });
         const proposedChanges = await super.calcChanges({ ...assets, connections: formatted });
         const proposedChangesWithExcludedProperties = (0, exports.addExcludedConnectionPropertiesToChanges)({
             proposedChanges,
@@ -556,6 +603,40 @@ class ConnectionsHandler extends default_1.default {
         });
         return proposedChangesWithExcludedProperties;
     }
+    async dryRunChanges(assets) {
+        const { connections } = assets;
+        if (!connections) {
+            return {
+                del: [],
+                create: [],
+                update: [],
+                conflicts: [],
+            };
+        }
+        const clients = await (0, client_1.paginate)(this.client.clients.list, {
+            paginate: true,
+            include_totals: true,
+        });
+        const existingConnections = await (0, client_1.paginate)(this.client.connections.list, {
+            checkpoint: true,
+            include_totals: true,
+        });
+        await this.scimHandler.createIdMap(existingConnections);
+        const formatted = connections.map((connection) => {
+            const enabledClients = (0, utils_1.getEnabledClients)(assets, connection, existingConnections, clients);
+            return {
+                ...connection,
+                ...this.getFormattedOptions(connection, clients),
+                ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
+            };
+        });
+        const proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        return (0, exports.addExcludedConnectionPropertiesToChanges)({
+            proposedChanges,
+            existingConnections,
+            config: this.config,
+        });
+    }
     // Run after clients are updated so we can convert all the enabled_clients names to id's
     async processChanges(assets) {
         const { connections } = assets;