auth0-deploy-cli 8.32.0 → 8.34.0

package/lib/tools/auth0/handlers/actions.js

@@ -320,37 +320,40 @@ class ActionHandler extends default_1.default {
         if (!action.modules || action.modules.length === 0) {
             return action;
         }
-        const updatedModules = await this.client.pool
-            .addEachTask({
-            data: action.modules,
-            generator: async (module) => {
-                const foundModule = modules.find((m) => m.name === module.module_name);
-                if (foundModule && foundModule.id) {
-                    // paginate to get all versions of the module
-                    const allModuleVersions = [];
-                    let moduleVersions = await this.client.actions.modules.versions.list(foundModule.id);
-                    // Process first page
+        // Process modules sequentially to avoid a pool deadlock.
+        // This function is called as a task inside the shared pool (via addEachTask in calcChanges).
+        // If we submitted further addEachTask calls on the same pool here, all concurrency slots
+        // could be held by outer action tasks waiting for inner module tasks that can never start
+        // (because no slots are free), causing a hang with 3+ actions that have modules.
+        const updatedModules = [];
+        for (const module of action.modules) {
+            const foundModule = modules.find((m) => m.name === module.module_name);
+            if (foundModule && foundModule.id) {
+                // paginate to get all versions of the module
+                const allModuleVersions = [];
+                let moduleVersions = await this.client.actions.modules.versions.list(foundModule.id);
+                // Process first page
+                allModuleVersions.push(...moduleVersions.data);
+                // Fetch remaining pages
+                while (moduleVersions.hasNextPage()) {
+                    moduleVersions = await moduleVersions.getNextPage();
                     allModuleVersions.push(...moduleVersions.data);
-                    // Fetch remaining pages
-                    while (moduleVersions.hasNextPage()) {
-                        moduleVersions = await moduleVersions.getNextPage();
-                        allModuleVersions.push(...moduleVersions.data);
-                    }
-                    const moduleVersionId = allModuleVersions?.find((v) => v.version_number === module.module_version_number)?.id;
-                    if (!moduleVersionId) {
-                        throw new Error(`Could not find action module version id for module '${module.module_name}' version '${module.module_version_number}'`);
-                    }
-                    return {
-                        module_name: module.module_name,
-                        module_id: foundModule.id,
-                        module_version_number: module.module_version_number,
-                        module_version_id: moduleVersionId,
-                    };
                 }
-                return module;
-            },
-        })
-            .promise();
+                const moduleVersionId = allModuleVersions?.find((v) => v.version_number === module.module_version_number)?.id;
+                if (!moduleVersionId) {
+                    throw new Error(`Could not find action module version id for module '${module.module_name}' version '${module.module_version_number}'`);
+                }
+                updatedModules.push({
+                    module_name: module.module_name,
+                    module_id: foundModule.id,
+                    module_version_number: module.module_version_number,
+                    module_version_id: moduleVersionId,
+                });
+            }
+            else {
+                updatedModules.push(module);
+            }
+        }
         return {
             ...action,
             modules: updatedModules,

package/lib/tools/auth0/handlers/clientGrants.d.ts

@@ -37,6 +37,11 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            default_for: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
         };
         required: string[];
     };

package/lib/tools/auth0/handlers/clientGrants.js

@@ -73,8 +73,13 @@ exports.schema = {
                 type: 'boolean',
                 description: 'When enabled, all scopes configured on the resource server are allowed for by this client grant.',
             },
+            default_for: {
+                type: 'string',
+                enum: ['third_party_clients'],
+                description: 'Indicates that a client grant is the default client grant for third party clients.',
+            },
         },
-        required: ['client_id', 'audience'],
+        required: ['audience'],
     },
 };
 class ClientGrantsHandler extends default_1.default {
@@ -83,11 +88,17 @@ class ClientGrantsHandler extends default_1.default {
             ...config,
             type: 'clientGrants',
             id: 'id',
-            // @ts-ignore because not sure why two-dimensional array passed in
-            // Try ['client_id', 'audience', 'subject_type'] first; falls through to
-            // ['client_id', 'audience'] when subject_type is null (falsy).
-            identifiers: ['id', ['client_id', 'audience', 'subject_type'], ['client_id', 'audience']],
-            stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system'],
+            // Nested arrays are not reflected in the type but are supported at runtime.
+            // Try ['client_id', 'audience', 'subject_type'] first, then ['client_id', 'audience']
+            // for regular grants, then ['default_for', 'audience'] for default third-party grants
+            // which have no client_id.
+            identifiers: [
+                'id',
+                ['client_id', 'audience', 'subject_type'],
+                ['client_id', 'audience'],
+                ['default_for', 'audience'],
+            ],
+            stripUpdateFields: ['audience', 'client_id', 'subject_type', 'is_system', 'default_for'],
             ignoreDryRunFields: ['_clientName'],
         });
     }
@@ -101,6 +112,15 @@ class ClientGrantsHandler extends default_1.default {
             return;
         // Validate each client grant
         clientGrants.forEach((grant) => {
+            // client_id and default_for are mutually exclusive; exactly one must be present
+            const hasClientId = !!grant.client_id;
+            const hasDefaultFor = !!grant.default_for;
+            if (hasClientId && hasDefaultFor) {
+                throw new Error(`Client grant for audience "${grant.audience}": Cannot specify both "client_id" and "default_for". They are mutually exclusive.`);
+            }
+            if (!hasClientId && !hasDefaultFor) {
+                throw new Error(`Client grant for audience "${grant.audience}": One of "client_id" or "default_for" is required.`);
+            }
             // When allow_all_scopes is true, scope should not be present
             if (grant.allow_all_scopes === true && grant.scope && grant.scope.length > 0) {
                 throw new Error(`Client grant for client_id "${grant.client_id}" and audience "${grant.audience}": Cannot specify "scope" when "allow_all_scopes" is set to true. Remove the "scope" property or set "allow_all_scopes" to false.`);
@@ -127,7 +147,8 @@ class ClientGrantsHandler extends default_1.default {
                 is_first_party: true,
             });
             const firstPartyClientIds = new Set(clients.map((c) => c.client_id));
-            this.existing = this.existing.filter((grant) => firstPartyClientIds.has(grant.client_id));
+            // default_for grants have no client_id and are not tied to a specific client; always keep them
+            this.existing = this.existing.filter((grant) => !grant.client_id || firstPartyClientIds.has(grant.client_id));
         }
         return this.existing;
     }
@@ -187,9 +208,9 @@ class ClientGrantsHandler extends default_1.default {
             let filtered = list;
             // Filter out the current client (Auth0 Management API client)
             filtered = filtered.filter((item) => item.client_id !== currentClient);
-            // Filter out excluded clients
+            // Filter out excluded clients; default_for grants have no client_id and are never excluded
             if (excludedClients.length) {
-                filtered = filtered.filter((item) => item.client_id &&
+                filtered = filtered.filter((item) => !item.client_id ||
                     ![...excludedClientsByNames, ...excludedClients].includes(item.client_id));
             }
             // Filter out system grants

package/lib/tools/auth0/handlers/clients.d.ts

@@ -308,6 +308,16 @@ export declare const schema: {
                     };
                 };
             };
+            third_party_security_mode: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
+            redirection_policy: {
+                type: string;
+                enum: string[];
+                description: string;
+            };
             oidc_logout: {
                 type: string[];
                 description: string;

package/lib/tools/auth0/handlers/clients.js

@@ -312,6 +312,16 @@ exports.schema = {
                     },
                 },
             },
+            third_party_security_mode: {
+                type: 'string',
+                enum: ['strict', 'permissive'],
+                description: 'Indicates the security mode for a Third Party Client, to apply new security semantics and improvements.',
+            },
+            redirection_policy: {
+                type: 'string',
+                enum: ['allow_always', 'open_redirect_protection'],
+                description: 'Determines how OAuth2/OIDC errors are handled when a non-recoverable error happens.',
+            },
             oidc_logout: {
                 type: ['object', 'null'],
                 description: 'Configuration for OIDC backchannel logout',
@@ -436,6 +446,8 @@ class ClientHandler extends default_1.default {
                 'external_metadata_type',
                 'external_metadata_created_by',
                 'jwks_uri',
+                // third_party_security_mode is immutable after creation; PATCH returns 400
+                'third_party_security_mode',
             ],
             functions: {
                 create: (client) => this.createClient(client),

package/lib/tools/auth0/handlers/connections.d.ts

@@ -16,10 +16,29 @@ export declare const schema: {
             };
             options: {
                 type: string;
+                additionalProperties: boolean;
                 properties: {
+                    api_enable_groups: {
+                        type: string;
+                    };
                     dpop_signing_alg: {
                         type: string;
                     };
+                    token_endpoint_auth_signing_alg: {
+                        type: string;
+                        enum: ("RS256" | "RS512" | "PS256" | "ES256" | "ES384" | "PS384" | "RS384")[];
+                    };
+                    id_token_signed_response_algs: {
+                        type: string;
+                        items: {
+                            type: string;
+                            enum: ("RS256" | "RS512" | "PS256" | "ES256" | "ES384" | "PS384" | "RS384")[];
+                        };
+                    };
+                    token_endpoint_jwtca_aud_format: {
+                        type: string;
+                        enum: ("issuer" | "token_endpoint")[];
+                    };
                 };
             };
             enabled_clients: {
@@ -106,6 +125,22 @@ export declare const schema: {
                         type: string;
                         description: string;
                     };
+                    synchronize_groups: {
+                        type: string;
+                        enum: ("all" | "off" | "selected")[];
+                    };
+                    synchronized_groups: {
+                        type: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                id: {
+                                    type: string;
+                                };
+                            };
+                            required: string[];
+                        };
+                    };
                 };
             };
         };
@@ -115,7 +150,11 @@ export declare const schema: {
 type DirectoryProvisioningConfig = Management.DirectoryProvisioning;
 export type Connection = Management.ConnectionForList & {
     enabled_clients?: string[];
-    directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically'>;
+    directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically' | 'synchronize_groups'> & {
+        synchronized_groups?: Array<{
+            id: string;
+        }>;
+    };
 };
 export declare const addExcludedConnectionPropertiesToChanges: ({ proposedChanges, existingConnections, config, }: {
     proposedChanges: CalculatedChanges;
@@ -169,6 +208,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     } | {
         options?: undefined;
     };
+    validate(assets: Assets): Promise<void>;
     /**
      * Retrieves all directory provisioning configurations for all connections.
      * @returns A promise that resolves to the configurations object, or null if not configured/supported
@@ -186,6 +226,16 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
      * Deletes directory provisioning configuration for a connection.
      */
     private deleteConnectionDirectoryProvisioning;
+    /**
+     * Retrieves all synchronized groups for a connection using checkpoint pagination.
+     */
+    getConnectionSynchronizedGroups(connectionId: string): Promise<Array<{
+        id: string;
+    }> | null>;
+    /**
+     * Replaces the synchronized groups for a connection (PUT replace-all semantics).
+     */
+    private updateConnectionSynchronizedGroups;
     /**
      * This function processes directory provisioning for create, update, and conflict operations.
      * Directory provisioning is only supported for google-apps strategy connections.

package/lib/tools/auth0/handlers/connections.js

@@ -51,14 +51,40 @@ const utils_1 = require("../../utils");
 const client_1 = require("../client");
 const scimHandler_1 = __importDefault(require("./scimHandler"));
 const logger_1 = __importDefault(require("../../../logger"));
+const validationError_1 = __importDefault(require("../../validationError"));
 const connectionOptionsSchema = {
     type: 'object',
+    additionalProperties: true,
     properties: {
+        api_enable_groups: {
+            type: 'boolean',
+        },
         dpop_signing_alg: {
             type: 'string',
         },
+        token_endpoint_auth_signing_alg: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ConnectionTokenEndpointAuthSigningAlgEnum),
+        },
+        id_token_signed_response_algs: {
+            type: 'array',
+            items: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.ConnectionIdTokenSignedResponseAlgEnum),
+            },
+        },
+        token_endpoint_jwtca_aud_format: {
+            type: 'string',
+            enum: Object.values(auth0_1.Management.ConnectionTokenEndpointJwtcaAudFormatEnumOidc),
+        },
     },
 };
+const oidcOktaStrategies = new Set(['oidc', 'okta']);
+const oidcOktaOnlyConnectionOptionFields = [
+    'token_endpoint_auth_signing_alg',
+    'id_token_signed_response_algs',
+    'token_endpoint_jwtca_aud_format',
+];
 exports.schema = {
     type: 'array',
     items: {
@@ -118,6 +144,20 @@ exports.schema = {
                         type: 'boolean',
                         description: 'The field whether periodic automatic synchronization is enabled',
                     },
+                    synchronize_groups: {
+                        type: 'string',
+                        enum: Object.values(auth0_1.Management.SynchronizeGroupsEnum),
+                    },
+                    synchronized_groups: {
+                        type: 'array',
+                        items: {
+                            type: 'object',
+                            properties: {
+                                id: { type: 'string' },
+                            },
+                            required: ['id'],
+                        },
+                    },
                 },
             },
         },
@@ -333,6 +373,27 @@ class ConnectionsHandler extends default_1.default {
             return {};
         }
     }
+    async validate(assets) {
+        const { connections } = assets;
+        if (!connections) {
+            await super.validate(assets);
+            return;
+        }
+        connections.forEach((connection) => {
+            if (!connection?.options)
+                return;
+            const strategy = connection?.strategy ?? 'unknown';
+            if (oidcOktaStrategies.has(strategy))
+                return;
+            const unsupportedFields = oidcOktaOnlyConnectionOptionFields.filter((field) => field in connection.options);
+            if (unsupportedFields.length > 0) {
+                throw new validationError_1.default(`Connection "${connection.name}": option(s) ${unsupportedFields
+                    .map((field) => `"${field}"`)
+                    .join(', ')} are only supported for strategies "oidc" and "okta". Found strategy "${strategy}".`);
+            }
+        });
+        await super.validate(assets);
+    }
     /**
      * Retrieves all directory provisioning configurations for all connections.
      * @returns A promise that resolves to the configurations object, or null if not configured/supported
@@ -367,6 +428,7 @@ class ConnectionsHandler extends default_1.default {
         const createPayload = {
             mapping: payload.mapping,
             synchronize_automatically: payload.synchronize_automatically,
+            ...(payload.synchronize_groups && { synchronize_groups: payload.synchronize_groups }),
         };
         await this.client.connections.directoryProvisioning.create(connectionId, createPayload);
         logger_1.default.debug(`Created directory provisioning for connection '${connectionId}'`);
@@ -381,6 +443,7 @@ class ConnectionsHandler extends default_1.default {
         const updatePayload = {
             mapping: payload.mapping,
             synchronize_automatically: payload.synchronize_automatically,
+            ...(payload.synchronize_groups && { synchronize_groups: payload.synchronize_groups }),
         };
         await this.client.connections.directoryProvisioning.update(connectionId, updatePayload);
         logger_1.default.debug(`Updated directory provisioning for connection '${connectionId}'`);
@@ -395,6 +458,40 @@ class ConnectionsHandler extends default_1.default {
         await this.client.connections.directoryProvisioning.delete(connectionId);
         logger_1.default.debug(`Deleted directory provisioning for connection '${connectionId}'`);
     }
+    /**
+     * Retrieves all synchronized groups for a connection using checkpoint pagination.
+     */
+    async getConnectionSynchronizedGroups(connectionId) {
+        try {
+            const groups = [];
+            let page = await this.client.connections.directoryProvisioning.listSynchronizedGroups(connectionId, {});
+            for (const g of page.data ?? [])
+                groups.push({ id: g.id });
+            while (page.hasNextPage?.()) {
+                page = await page.getNextPage();
+                for (const g of page.data ?? [])
+                    groups.push({ id: g.id });
+            }
+            return groups;
+        }
+        catch (error) {
+            const errLog = `Unable to fetch synchronized groups for connection '${connectionId}'. `;
+            const statusCode = error?.statusCode;
+            if (statusCode != null && [403, 404, 501].includes(statusCode)) {
+                const bodyMessage = error instanceof auth0_1.ManagementError ? error.body?.message : error.message;
+                logger_1.default.warn(errLog + bodyMessage);
+                return null;
+            }
+            throw error;
+        }
+    }
+    /**
+     * Replaces the synchronized groups for a connection (PUT replace-all semantics).
+     */
+    async updateConnectionSynchronizedGroups(connectionId, groups) {
+        await this.client.connections.directoryProvisioning.set(connectionId, { groups });
+        logger_1.default.debug(`Updated synchronized groups for connection '${connectionId}'`);
+    }
     /**
      * This function processes directory provisioning for create, update, and conflict operations.
      * Directory provisioning is only supported for google-apps strategy connections.
@@ -469,6 +566,20 @@ class ConnectionsHandler extends default_1.default {
                 .map((i) => this.objString(i))
                 .join('\n')}`);
         }
+        // Process synchronized groups for connections where synchronize_groups === 'selected'
+        const connectionsToSyncGroups = [
+            ...directoryConnectionsToCreate,
+            ...directoryConnectionsToUpdate,
+        ].filter((conn) => conn.directory_provisioning_configuration?.synchronize_groups === 'selected' &&
+            conn.directory_provisioning_configuration?.synchronized_groups !== undefined);
+        await this.client.pool
+            .addEachTask({
+            data: connectionsToSyncGroups,
+            generator: (conn) => this.updateConnectionSynchronizedGroups(conn.id, conn.directory_provisioning_configuration.synchronized_groups).catch((err) => {
+                throw new Error(`Failed to update synchronized groups for connection '${conn.id}':\n${err}`);
+            }),
+        })
+            .promise();
     }
     async getType() {
         if (this.existing)
@@ -508,7 +619,17 @@ class ConnectionsHandler extends default_1.default {
                         connection.directory_provisioning_configuration = {
                             mapping: dirProvConfig.mapping,
                             synchronize_automatically: dirProvConfig.synchronize_automatically,
+                            ...(dirProvConfig.synchronize_groups && {
+                                synchronize_groups: dirProvConfig.synchronize_groups,
+                            }),
                         };
+                        if (dirProvConfig.synchronize_groups === 'selected') {
+                            const syncedGroups = await this.getConnectionSynchronizedGroups(con.id);
+                            if (syncedGroups?.length) {
+                                connection.directory_provisioning_configuration.synchronized_groups =
+                                    syncedGroups;
+                            }
+                        }
                     }
                 }
                 return { index, connection };

package/lib/tools/auth0/handlers/resourceServers.js

@@ -117,6 +117,7 @@ class ResourceServersHandler extends default_1.default {
                     'identifier',
                     'id',
                     'is_system',
+                    'authorization_policy',
                 ];
                 const sanitized = {};
                 allowedKeys.forEach((key) => {
@@ -168,6 +169,7 @@ class ResourceServersHandler extends default_1.default {
                 proof_of_possession: update.proof_of_possession,
                 skip_consent_for_verifiable_first_party_clients: update.skip_consent_for_verifiable_first_party_clients,
                 subject_type_authorization: update.subject_type_authorization,
+                authorization_policy: update.authorization_policy,
             };
             return this.client.resourceServers.update(id, updateFields);
         }

package/lib/tools/auth0/handlers/tenant.d.ts

@@ -74,6 +74,11 @@ export declare const schema: {
             enum: string[];
             description: string;
         };
+        dynamic_client_registration_security_mode: {
+            type: string;
+            enum: string[];
+            description: string;
+        };
     };
 };
 export interface Tenant extends Management.GetTenantSettingsResponseContent {

package/lib/tools/auth0/handlers/tenant.js

@@ -101,6 +101,11 @@ exports.schema = {
             enum: ['audience', 'compatibility'],
             description: 'OAuth resource parameter compatibility mode for specifying the protected resource.',
         },
+        dynamic_client_registration_security_mode: {
+            type: 'string',
+            enum: ['strict', 'permissive'],
+            description: 'Indicates the security mode for new clients created through the Dynamic Client Registration endpoint.',
+        },
     },
 };
 const blockPageKeys = [

package/lib/tools/auth0/handlers/themes.js

@@ -464,6 +464,7 @@ class ThemesHandler extends default_1.default {
             ...options,
             type: 'themes',
             id: 'themeId',
+            identifiers: ['themeId'],
         });
     }
     objString(theme) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.32.0",
+  "version": "8.34.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -33,10 +33,10 @@
   "readme": "README.md",
   "homepage": "https://github.com/auth0/auth0-deploy-cli#readme",
   "dependencies": {
-    "@clack/prompts": "1.2.0",
+    "@clack/prompts": "1.3.0",
     "ajv": "^6.12.6",
     "chalk": "5.6.2",
-    "auth0": "^5.8.0",
+    "auth0": "^5.9.0",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",
     "js-yaml": "^4.1.1",