auth0-deploy-cli 8.32.0 → 8.33.0

package/lib/tools/auth0/handlers/actions.js

@@ -320,37 +320,40 @@ class ActionHandler extends default_1.default {
         if (!action.modules || action.modules.length === 0) {
             return action;
         }
-        const updatedModules = await this.client.pool
-            .addEachTask({
-            data: action.modules,
-            generator: async (module) => {
-                const foundModule = modules.find((m) => m.name === module.module_name);
-                if (foundModule && foundModule.id) {
-                    // paginate to get all versions of the module
-                    const allModuleVersions = [];
-                    let moduleVersions = await this.client.actions.modules.versions.list(foundModule.id);
-                    // Process first page
+        // Process modules sequentially to avoid a pool deadlock.
+        // This function is called as a task inside the shared pool (via addEachTask in calcChanges).
+        // If we submitted further addEachTask calls on the same pool here, all concurrency slots
+        // could be held by outer action tasks waiting for inner module tasks that can never start
+        // (because no slots are free), causing a hang with 3+ actions that have modules.
+        const updatedModules = [];
+        for (const module of action.modules) {
+            const foundModule = modules.find((m) => m.name === module.module_name);
+            if (foundModule && foundModule.id) {
+                // paginate to get all versions of the module
+                const allModuleVersions = [];
+                let moduleVersions = await this.client.actions.modules.versions.list(foundModule.id);
+                // Process first page
+                allModuleVersions.push(...moduleVersions.data);
+                // Fetch remaining pages
+                while (moduleVersions.hasNextPage()) {
+                    moduleVersions = await moduleVersions.getNextPage();
                     allModuleVersions.push(...moduleVersions.data);
-                    // Fetch remaining pages
-                    while (moduleVersions.hasNextPage()) {
-                        moduleVersions = await moduleVersions.getNextPage();
-                        allModuleVersions.push(...moduleVersions.data);
-                    }
-                    const moduleVersionId = allModuleVersions?.find((v) => v.version_number === module.module_version_number)?.id;
-                    if (!moduleVersionId) {
-                        throw new Error(`Could not find action module version id for module '${module.module_name}' version '${module.module_version_number}'`);
-                    }
-                    return {
-                        module_name: module.module_name,
-                        module_id: foundModule.id,
-                        module_version_number: module.module_version_number,
-                        module_version_id: moduleVersionId,
-                    };
                 }
-                return module;
-            },
-        })
-            .promise();
+                const moduleVersionId = allModuleVersions?.find((v) => v.version_number === module.module_version_number)?.id;
+                if (!moduleVersionId) {
+                    throw new Error(`Could not find action module version id for module '${module.module_name}' version '${module.module_version_number}'`);
+                }
+                updatedModules.push({
+                    module_name: module.module_name,
+                    module_id: foundModule.id,
+                    module_version_number: module.module_version_number,
+                    module_version_id: moduleVersionId,
+                });
+            }
+            else {
+                updatedModules.push(module);
+            }
+        }
         return {
             ...action,
             modules: updatedModules,

package/lib/tools/auth0/handlers/clientGrants.d.ts

@@ -37,6 +37,11 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            default_for: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
         };
         required: string[];
     };

package/lib/tools/auth0/handlers/clientGrants.js

@@ -73,8 +73,13 @@ exports.schema = {
                 type: 'boolean',
                 description: 'When enabled, all scopes configured on the resource server are allowed for by this client grant.',
             },
+            default_for: {
+                type: 'string',
+                enum: ['third_party_clients'],
+                description: 'Indicates that a client grant is the default client grant for third party clients.',
+            },
         },
-        required: ['client_id', 'audience'],
+        required: ['audience'],
     },
 };
 class ClientGrantsHandler extends default_1.default {
@@ -83,11 +88,17 @@ class ClientGrantsHandler extends default_1.default {
             ...config,
             type: 'clientGrants',
             id: 'id',
-            // @ts-ignore because not sure why two-dimensional array passed in
-            // Try ['client_id', 'audience', 'subject_type'] first; falls through to
-            // ['client_id', 'audience'] when subject_type is null (falsy).
-            identifiers: ['id', ['client_id', 'audience', 'subject_type'], ['client_id', 'audience']],
-            stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system'],
+            // Nested arrays are not reflected in the type but are supported at runtime.
+            // Try ['client_id', 'audience', 'subject_type'] first, then ['client_id', 'audience']
+            // for regular grants, then ['default_for', 'audience'] for default third-party grants
+            // which have no client_id.
+            identifiers: [
+                'id',
+                ['client_id', 'audience', 'subject_type'],
+                ['client_id', 'audience'],
+                ['default_for', 'audience'],
+            ],
+            stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system', 'default_for'],
             ignoreDryRunFields: ['_clientName'],
         });
     }
@@ -101,6 +112,15 @@ class ClientGrantsHandler extends default_1.default {
             return;
         // Validate each client grant
         clientGrants.forEach((grant) => {
+            // client_id and default_for are mutually exclusive; exactly one must be present
+            const hasClientId = !!grant.client_id;
+            const hasDefaultFor = !!grant.default_for;
+            if (hasClientId && hasDefaultFor) {
+                throw new Error(`Client grant for audience "${grant.audience}": Cannot specify both "client_id" and "default_for". They are mutually exclusive.`);
+            }
+            if (!hasClientId && !hasDefaultFor) {
+                throw new Error(`Client grant for audience "${grant.audience}": One of "client_id" or "default_for" is required.`);
+            }
             // When allow_all_scopes is true, scope should not be present
             if (grant.allow_all_scopes === true && grant.scope && grant.scope.length > 0) {
                 throw new Error(`Client grant for client_id "${grant.client_id}" and audience "${grant.audience}": Cannot specify "scope" when "allow_all_scopes" is set to true. Remove the "scope" property or set "allow_all_scopes" to false.`);
@@ -127,7 +147,8 @@ class ClientGrantsHandler extends default_1.default {
                 is_first_party: true,
             });
             const firstPartyClientIds = new Set(clients.map((c) => c.client_id));
-            this.existing = this.existing.filter((grant) => firstPartyClientIds.has(grant.client_id));
+            // default_for grants have no client_id and are not tied to a specific client; always keep them
+            this.existing = this.existing.filter((grant) => !grant.client_id || firstPartyClientIds.has(grant.client_id));
         }
         return this.existing;
     }
@@ -187,9 +208,9 @@ class ClientGrantsHandler extends default_1.default {
             let filtered = list;
             // Filter out the current client (Auth0 Management API client)
             filtered = filtered.filter((item) => item.client_id !== currentClient);
-            // Filter out excluded clients
+            // Filter out excluded clients; default_for grants have no client_id and are never excluded
             if (excludedClients.length) {
-                filtered = filtered.filter((item) => item.client_id &&
+                filtered = filtered.filter((item) => !item.client_id ||
                     ![...excludedClientsByNames, ...excludedClients].includes(item.client_id));
             }
             // Filter out system grants

package/lib/tools/auth0/handlers/clients.d.ts

@@ -308,6 +308,16 @@ export declare const schema: {
                     };
                 };
             };
+            third_party_security_mode: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            redirection_policy: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
             oidc_logout: {
                 type: string[];
                 description: string;

package/lib/tools/auth0/handlers/clients.js

@@ -312,6 +312,16 @@ exports.schema = {
                     },
                 },
             },
+            third_party_security_mode: {
+                type: 'string',
+                enum: ['strict', 'permissive'],
+                description: 'Indicates the security mode for a Third Party Client, to apply new security semantics and improvements.',
+            },
+            redirection_policy: {
+                type: 'string',
+                enum: ['allow_always', 'open_redirect_protection'],
+                description: 'Determines how OAuth2/OIDC errors are handled when a non-recoverable error happens.',
+            },
             oidc_logout: {
                 type: ['object', 'null'],
                 description: 'Configuration for OIDC backchannel logout',
@@ -436,6 +446,8 @@ class ClientHandler extends default_1.default {
                 'external_metadata_type',
                 'external_metadata_created_by',
                 'jwks_uri',
+                // third_party_security_mode is immutable after creation; PATCH returns 400
+                'third_party_security_mode',
             ],
             functions: {
                 create: (client) => this.createClient(client),

package/lib/tools/auth0/handlers/connections.d.ts

@@ -16,10 +16,26 @@ export declare const schema: {
             };
             options: {
                 type: string;
+                additionalProperties: boolean;
                 properties: {
                     dpop_signing_alg: {
                         type: string;
                     };
+                    token_endpoint_auth_signing_alg: {
+                        type: string;
+                        enum: ("RS256" | "RS512" | "PS256" | "ES256" | "ES384" | "PS384" | "RS384")[];
+                    };
+                    id_token_signed_response_algs: {
+                        type: string;
+                        items: {
+                            type: string;
+                            enum: ("RS256" | "RS512" | "PS256" | "ES256" | "ES384" | "PS384" | "RS384")[];
+                        };
+                    };
+                    token_endpoint_jwtca_aud_format: {
+                        type: string;
+                        enum: ("issuer" | "token_endpoint")[];
+                    };
                 };
             };
             enabled_clients: {
@@ -169,6 +185,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     } | {
         options?: undefined;
     };
+    validate(assets: Assets): Promise<void>;
     /**
      * Retrieves all directory provisioning configurations for all connections.
      * @returns A promise that resolves to the configurations object, or null if not configured/supported

package/lib/tools/auth0/handlers/connections.js

@@ -51,14 +51,37 @@ const utils_1 = require("../../utils");
 const client_1 = require("../client");
 const scimHandler_1 = __importDefault(require("./scimHandler"));
 const logger_1 = __importDefault(require("../../../logger"));
+const validationError_1 = __importDefault(require("../../validationError"));
 const connectionOptionsSchema = {
     type: 'object',
+    additionalProperties: true,
     properties: {
         dpop_signing_alg: {
             type: 'string',
         },
+        token_endpoint_auth_signing_alg: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ConnectionTokenEndpointAuthSigningAlgEnum),
+        },
+        id_token_signed_response_algs: {
+            type: 'array',
+            items: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.ConnectionIdTokenSignedResponseAlgEnum),
+            },
+        },
+        token_endpoint_jwtca_aud_format: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc),
+        },
     },
 };
+const oidcOktaStrategies = new Set(['oidc', 'okta']);
+const oidcOktaOnlyConnectionOptionFields = [
+    'token_endpoint_auth_signing_alg',
+    'id_token_signed_response_algs',
+    'token_endpoint_jwtca_aud_format',
+];
 exports.schema = {
     type: 'array',
     items: {
@@ -333,6 +356,27 @@ class ConnectionsHandler extends default_1.default {
             return {};
         }
     }
+    async validate(assets) {
+        const { connections } = assets;
+        if (!connections) {
+            await super.validate(assets);
+            return;
+        }
+        connections.forEach((connection) => {
+            if (!connection?.options)
+                return;
+            const strategy = connection?.strategy ?? 'unknown';
+            if (oidcOktaStrategies.has(strategy))
+                return;
+            const unsupportedFields = oidcOktaOnlyConnectionOptionFields.filter((field) => field in connection.options);
+            if (unsupportedFields.length > 0) {
+                throw new validationError_1.default(`Connection "${connection.name}": option(s) ${unsupportedFields
+                    .map((field) => `"${field}"`)
+                    .join(', ')} are only supported for strategies "oidc" and "okta". Found strategy "${strategy}".`);
+            }
+        });
+        await super.validate(assets);
+    }
     /**
      * Retrieves all directory provisioning configurations for all connections.
      * @returns A promise that resolves to the configurations object, or null if not configured/supported

package/lib/tools/auth0/handlers/tenant.d.ts

@@ -74,6 +74,11 @@ export declare const schema: {
             enum: string[];
             description: string;
         };
+        dynamic_client_registration_security_mode: {
+            type: string;
+            enum: string[];
+            description: string;
+        };
     };
 };
 export interface Tenant extends Management.GetTenantSettingsResponseContent {

package/lib/tools/auth0/handlers/tenant.js

@@ -101,6 +101,11 @@ exports.schema = {
             enum: ['audience', 'compatibility'],
             description: 'OAuth resource parameter compatibility mode for specifying the protected resource.',
         },
+        dynamic_client_registration_security_mode: {
+            type: 'string',
+            enum: ['strict', 'permissive'],
+            description: 'Indicates the security mode for new clients created through the Dynamic Client Registration endpoint.',
+        },
     },
 };
 const blockPageKeys = [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.32.0",
+  "version": "8.33.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -36,7 +36,7 @@
     "@clack/prompts": "1.2.0",
     "ajv": "^6.12.6",
     "chalk": "5.6.2",
-    "auth0": "^5.8.0",
+    "auth0": "^5.9.0",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",
     "js-yaml": "^4.1.1",