auth0-deploy-cli 8.36.0 → 8.38.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -14,9 +14,9 @@ jobs:
14
14
  runs-on: ubuntu-latest
15
15
 
16
16
  steps:
17
- - uses: actions/checkout@v6
17
+ - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
18
18
 
19
- - uses: actions/setup-node@v6
19
+ - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
20
20
  with:
21
21
  node-version: 22.14.0
22
22
  registry-url: https://registry.npmjs.org
package/CHANGELOG.md CHANGED
@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
7
7
 
8
8
  ## [Unreleased]
9
9
 
10
+ ## [8.38.0] - 2026-06-25
11
+
12
+ ### Added
13
+
14
+ - Add `session_transfer` delegation config support for CTE impersonation on the Client entity. [#1406]
15
+ - Add `fedcm_login` support for Google One Tap / FedCM in Universal Login on the Client entity. [#1407]
16
+ - Add `login-post-identifier` and `signup-post-identifier` as supported action triggers. [#1409]
17
+ - Add `allow_online_access` and `allow_online_access_with_ephemeral_sessions` fields to resource server. [#1398]
18
+
19
+ ### Fixed
20
+
21
+ - Fix keyword placeholder validation to allow lowercase Auth0 template variables (e.g. `@@password@@`). [#1408]
22
+ - Re-apply prompt settings after branding update to prevent Authentication Profile reset. [#1404]
23
+
24
+ ## [8.37.0] - 2026-06-17
25
+
26
+ ### Added
27
+
28
+ - Add `invitation_landing_client_id` support to `my_organization_configuration` on the Client entity, with client ID-to-name resolution on export and name-to-ID resolution on import. [#1400]
29
+
30
+ ### Fixed
31
+
32
+ - Remove `enable_custom_domain_in_emails` from managed tenant flags to prevent import failures on tenants without a ready custom domain. [#1401]
33
+ - Remove incorrect `maximum: 10` constraint on Network ACL `priority` field in schema validation. [#1403]
34
+
10
35
  ## [8.36.0] - 2026-06-05
11
36
 
12
37
  ### Added
@@ -1811,7 +1836,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
1811
1836
  [#1391]: https://github.com/auth0/auth0-deploy-cli/issues/1391
1812
1837
  [#1392]: https://github.com/auth0/auth0-deploy-cli/issues/1392
1813
1838
  [#1396]: https://github.com/auth0/auth0-deploy-cli/issues/1396
1814
- [Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...HEAD
1839
+ [#1398]: https://github.com/auth0/auth0-deploy-cli/issues/1398
1840
+ [#1400]: https://github.com/auth0/auth0-deploy-cli/issues/1400
1841
+ [#1401]: https://github.com/auth0/auth0-deploy-cli/issues/1401
1842
+ [#1403]: https://github.com/auth0/auth0-deploy-cli/issues/1403
1843
+ [#1404]: https://github.com/auth0/auth0-deploy-cli/issues/1404
1844
+ [#1406]: https://github.com/auth0/auth0-deploy-cli/issues/1406
1845
+ [#1407]: https://github.com/auth0/auth0-deploy-cli/issues/1407
1846
+ [#1408]: https://github.com/auth0/auth0-deploy-cli/issues/1408
1847
+ [#1409]: https://github.com/auth0/auth0-deploy-cli/issues/1409
1848
+ [Unreleased]: https://github.com/auth0/auth0-deploy-cli/compare/v8.38.0...HEAD
1849
+ [8.38.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.37.0...v8.38.0
1850
+ [8.37.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.36.0...v8.37.0
1815
1851
  [8.36.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.35.0...v8.36.0
1816
1852
  [8.35.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.34.0...v8.35.0
1817
1853
  [8.34.0]: https://github.com/auth0/auth0-deploy-cli/compare/v8.33.0...v8.34.0
@@ -90,6 +90,12 @@ async function dump(context) {
90
90
  client.my_organization_configuration.connection_profile_id =
91
91
  c?.name || myOrganizationConnectionProfileId;
92
92
  }
93
+ const invitationLandingClientId = client.my_organization_configuration.invitation_landing_client_id;
94
+ if (invitationLandingClientId) {
95
+ const c = clients?.find((cl) => cl.client_id === invitationLandingClientId);
96
+ client.my_organization_configuration.invitation_landing_client_id =
97
+ c?.name || invitationLandingClientId;
98
+ }
93
99
  }
94
100
  if (client.app_type === 'express_configuration') {
95
101
  // only keep relevant fields for express configuration
@@ -70,6 +70,12 @@ async function dump(context) {
70
70
  client.my_organization_configuration.connection_profile_id =
71
71
  c?.name || myOrganizationConnectionProfileId;
72
72
  }
73
+ const invitationLandingClientId = client?.my_organization_configuration?.invitation_landing_client_id;
74
+ if (client.my_organization_configuration && invitationLandingClientId) {
75
+ const c = clients?.find((cl) => cl.client_id === invitationLandingClientId);
76
+ client.my_organization_configuration.invitation_landing_client_id =
77
+ c?.name || invitationLandingClientId;
78
+ }
73
79
  return client;
74
80
  });
75
81
  return {
@@ -130,7 +130,12 @@ class BrandingHandler extends default_1.default {
130
130
  delete brandingSettings.logo_url;
131
131
  }
132
132
  if (brandingSettings && Object.keys(brandingSettings).length) {
133
+ // Save prompt settings, update branding, then restore prompt settings to avoid mgmt API overwriting prompt settings
134
+ const promptSettings = await this.client.prompts.getSettings().catch(() => null);
133
135
  await this.client.branding.update(brandingSettings);
136
+ if (promptSettings) {
137
+ await this.client.prompts.updateSettings(promptSettings);
138
+ }
134
139
  this.updated += 1;
135
140
  this.didUpdate(brandingSettings);
136
141
  }
@@ -174,6 +174,22 @@ export declare const schema: {
174
174
  description: string;
175
175
  default: boolean;
176
176
  };
177
+ delegation: {
178
+ type: string;
179
+ description: string;
180
+ properties: {
181
+ allow_delegated_access: {
182
+ type: string;
183
+ description: string;
184
+ };
185
+ enforce_device_binding: {
186
+ type: string;
187
+ description: string;
188
+ enum: string[];
189
+ };
190
+ };
191
+ additionalProperties: boolean;
192
+ };
177
193
  };
178
194
  additionalProperties: boolean;
179
195
  };
@@ -226,6 +242,10 @@ export declare const schema: {
226
242
  enum: ("allow" | "allow_if_empty")[];
227
243
  description: string;
228
244
  };
245
+ invitation_landing_client_id: {
246
+ type: string;
247
+ description: string;
248
+ };
229
249
  };
230
250
  required: string[];
231
251
  };
@@ -361,6 +381,22 @@ export declare const schema: {
361
381
  };
362
382
  };
363
383
  };
384
+ fedcm_login: {
385
+ type: string[];
386
+ description: string;
387
+ properties: {
388
+ google: {
389
+ type: string;
390
+ properties: {
391
+ is_enabled: {
392
+ type: string;
393
+ };
394
+ };
395
+ required: string[];
396
+ };
397
+ };
398
+ required: string[];
399
+ };
364
400
  };
365
401
  required: string[];
366
402
  };
@@ -59,6 +59,10 @@ const myOrganizationConfigurationSchema = {
59
59
  enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
60
60
  description: 'The deletion behavior for My Organization connections created by this client',
61
61
  },
62
+ invitation_landing_client_id: {
63
+ type: 'string',
64
+ description: 'The client ID of the invitation landing client for the My Organization configuration',
65
+ },
62
66
  },
63
67
  required: ['allowed_strategies', 'connection_deletion_behavior'],
64
68
  };
@@ -198,6 +202,22 @@ exports.schema = {
198
202
  description: "Indicates whether Refresh Tokens created during a native-to-web session are tied to that session's lifetime. This determines if such refresh tokens should be automatically revoked when their corresponding sessions are. Usually configured in the web application.",
199
203
  default: true,
200
204
  },
205
+ delegation: {
206
+ type: 'object',
207
+ description: 'Settings for impersonation via session transfer. Required to accept Session Transfer Tokens that contain an Actor.',
208
+ properties: {
209
+ allow_delegated_access: {
210
+ type: 'boolean',
211
+ description: 'Allows clients to access an impersonated session via SSO by accepting STTs that contain an Actor.',
212
+ },
213
+ enforce_device_binding: {
214
+ type: 'string',
215
+ description: "Enforces device binding for impersonation sessions. Defaults to 'ip' when omitted.",
216
+ enum: ['ip', 'asn'],
217
+ },
218
+ },
219
+ additionalProperties: false,
220
+ },
201
221
  },
202
222
  additionalProperties: true,
203
223
  },
@@ -375,6 +395,20 @@ exports.schema = {
375
395
  },
376
396
  },
377
397
  },
398
+ fedcm_login: {
399
+ type: ['object', 'null'],
400
+ description: 'Configuration for FedCM (Federated Credential Management) login',
401
+ properties: {
402
+ google: {
403
+ type: 'object',
404
+ properties: {
405
+ is_enabled: { type: 'boolean' },
406
+ },
407
+ required: ['is_enabled'],
408
+ },
409
+ },
410
+ required: ['google'],
411
+ },
378
412
  },
379
413
  required: ['name'],
380
414
  },
@@ -651,6 +685,14 @@ class ClientHandler extends default_1.default {
651
685
  client.my_organization_configuration.connection_profile_id = connectionProfile.id;
652
686
  }
653
687
  }
688
+ const invitationLandingClientName = client.my_organization_configuration.invitation_landing_client_id;
689
+ if (invitationLandingClientName) {
690
+ const invitationLandingClient = clientData?.find((c) => c.name === invitationLandingClientName);
691
+ if (invitationLandingClient?.client_id) {
692
+ client.my_organization_configuration.invitation_landing_client_id =
693
+ invitationLandingClient.client_id;
694
+ }
695
+ }
654
696
  return client;
655
697
  });
656
698
  }
@@ -19,7 +19,6 @@ export declare const schema: {
19
19
  priority: {
20
20
  type: string;
21
21
  minimum: number;
22
- maximum: number;
23
22
  };
24
23
  rule: {
25
24
  anyOf: {
@@ -85,7 +84,6 @@ export declare const schema: {
85
84
  };
86
85
  uniqueItems: boolean;
87
86
  minItems: number;
88
- maxItems: number;
89
87
  };
90
88
  geo_country_codes: {
91
89
  type: string;
@@ -94,7 +92,6 @@ export declare const schema: {
94
92
  };
95
93
  uniqueItems: boolean;
96
94
  minItems: number;
97
- maxItems: number;
98
95
  };
99
96
  geo_subdivision_codes: {
100
97
  type: string;
@@ -103,7 +100,6 @@ export declare const schema: {
103
100
  };
104
101
  uniqueItems: boolean;
105
102
  minItems: number;
106
- maxItems: number;
107
103
  };
108
104
  ipv4_cidrs: {
109
105
  type: string;
@@ -112,7 +108,6 @@ export declare const schema: {
112
108
  };
113
109
  uniqueItems: boolean;
114
110
  minItems: number;
115
- maxItems: number;
116
111
  };
117
112
  ipv6_cidrs: {
118
113
  type: string;
@@ -121,7 +116,6 @@ export declare const schema: {
121
116
  };
122
117
  uniqueItems: boolean;
123
118
  minItems: number;
124
- maxItems: number;
125
119
  };
126
120
  ja3_fingerprints: {
127
121
  type: string;
@@ -130,7 +124,6 @@ export declare const schema: {
130
124
  };
131
125
  uniqueItems: boolean;
132
126
  minItems: number;
133
- maxItems: number;
134
127
  };
135
128
  ja4_fingerprints: {
136
129
  type: string;
@@ -139,7 +132,6 @@ export declare const schema: {
139
132
  };
140
133
  uniqueItems: boolean;
141
134
  minItems: number;
142
- maxItems: number;
143
135
  };
144
136
  user_agents: {
145
137
  type: string;
@@ -148,7 +140,6 @@ export declare const schema: {
148
140
  };
149
141
  uniqueItems: boolean;
150
142
  minItems: number;
151
- maxItems: number;
152
143
  };
153
144
  hostnames: {
154
145
  type: string;
@@ -184,7 +175,6 @@ export declare const schema: {
184
175
  };
185
176
  uniqueItems: boolean;
186
177
  minItems: number;
187
- maxItems: number;
188
178
  };
189
179
  geo_country_codes: {
190
180
  type: string;
@@ -193,7 +183,6 @@ export declare const schema: {
193
183
  };
194
184
  uniqueItems: boolean;
195
185
  minItems: number;
196
- maxItems: number;
197
186
  };
198
187
  geo_subdivision_codes: {
199
188
  type: string;
@@ -202,7 +191,6 @@ export declare const schema: {
202
191
  };
203
192
  uniqueItems: boolean;
204
193
  minItems: number;
205
- maxItems: number;
206
194
  };
207
195
  ipv4_cidrs: {
208
196
  type: string;
@@ -211,7 +199,6 @@ export declare const schema: {
211
199
  };
212
200
  uniqueItems: boolean;
213
201
  minItems: number;
214
- maxItems: number;
215
202
  };
216
203
  ipv6_cidrs: {
217
204
  type: string;
@@ -220,7 +207,6 @@ export declare const schema: {
220
207
  };
221
208
  uniqueItems: boolean;
222
209
  minItems: number;
223
- maxItems: number;
224
210
  };
225
211
  ja3_fingerprints: {
226
212
  type: string;
@@ -229,7 +215,6 @@ export declare const schema: {
229
215
  };
230
216
  uniqueItems: boolean;
231
217
  minItems: number;
232
- maxItems: number;
233
218
  };
234
219
  ja4_fingerprints: {
235
220
  type: string;
@@ -238,7 +223,6 @@ export declare const schema: {
238
223
  };
239
224
  uniqueItems: boolean;
240
225
  minItems: number;
241
- maxItems: number;
242
226
  };
243
227
  user_agents: {
244
228
  type: string;
@@ -247,7 +231,6 @@ export declare const schema: {
247
231
  };
248
232
  uniqueItems: boolean;
249
233
  minItems: number;
250
- maxItems: number;
251
234
  };
252
235
  hostnames: {
253
236
  type: string;
@@ -68,7 +68,6 @@ const MatchSchema = {
68
68
  },
69
69
  uniqueItems: true,
70
70
  minItems: 1,
71
- maxItems: 10,
72
71
  },
73
72
  geo_country_codes: {
74
73
  type: 'array',
@@ -77,7 +76,6 @@ const MatchSchema = {
77
76
  },
78
77
  uniqueItems: true,
79
78
  minItems: 1,
80
- maxItems: 10,
81
79
  },
82
80
  geo_subdivision_codes: {
83
81
  type: 'array',
@@ -86,7 +84,6 @@ const MatchSchema = {
86
84
  },
87
85
  uniqueItems: true,
88
86
  minItems: 1,
89
- maxItems: 10,
90
87
  },
91
88
  ipv4_cidrs: {
92
89
  type: 'array',
@@ -95,7 +92,6 @@ const MatchSchema = {
95
92
  },
96
93
  uniqueItems: true,
97
94
  minItems: 1,
98
- maxItems: 10,
99
95
  },
100
96
  ipv6_cidrs: {
101
97
  type: 'array',
@@ -104,7 +100,6 @@ const MatchSchema = {
104
100
  },
105
101
  uniqueItems: true,
106
102
  minItems: 1,
107
- maxItems: 10,
108
103
  },
109
104
  ja3_fingerprints: {
110
105
  type: 'array',
@@ -113,7 +108,6 @@ const MatchSchema = {
113
108
  },
114
109
  uniqueItems: true,
115
110
  minItems: 1,
116
- maxItems: 10,
117
111
  },
118
112
  ja4_fingerprints: {
119
113
  type: 'array',
@@ -122,7 +116,6 @@ const MatchSchema = {
122
116
  },
123
117
  uniqueItems: true,
124
118
  minItems: 1,
125
- maxItems: 10,
126
119
  },
127
120
  user_agents: {
128
121
  type: 'array',
@@ -131,7 +124,6 @@ const MatchSchema = {
131
124
  },
132
125
  uniqueItems: true,
133
126
  minItems: 1,
134
- maxItems: 10,
135
127
  },
136
128
  hostnames: {
137
129
  type: 'array',
@@ -174,7 +166,6 @@ exports.schema = {
174
166
  priority: {
175
167
  type: 'number',
176
168
  minimum: 1,
177
- maximum: 10,
178
169
  },
179
170
  rule: {
180
171
  anyOf: [
@@ -33,6 +33,12 @@ export declare const schema: {
33
33
  };
34
34
  };
35
35
  };
36
+ allow_online_access: {
37
+ type: string;
38
+ };
39
+ allow_online_access_with_ephemeral_sessions: {
40
+ type: string;
41
+ };
36
42
  enforce_policies: {
37
43
  type: string;
38
44
  };
@@ -30,6 +30,8 @@ exports.schema = {
30
30
  },
31
31
  },
32
32
  },
33
+ allow_online_access: { type: 'boolean' },
34
+ allow_online_access_with_ephemeral_sessions: { type: 'boolean' },
33
35
  enforce_policies: { type: 'boolean' },
34
36
  token_dialect: { type: 'string' },
35
37
  proof_of_possession: {
@@ -127,7 +127,6 @@ exports.allowedTenantFlags = [
127
127
  'enable_apis_section',
128
128
  'enable_pipeline2',
129
129
  'enable_dynamic_client_registration',
130
- 'enable_custom_domain_in_emails',
131
130
  'allow_legacy_tokeninfo_endpoint',
132
131
  'enable_legacy_profile',
133
132
  'enable_idtoken_api2',
@@ -206,7 +205,7 @@ class TenantHandler extends default_1.default {
206
205
  }
207
206
  // Run after other updates so objected can be referenced such as default directory
208
207
  async processChanges(assets) {
209
- const { tenant } = assets;
208
+ let { tenant } = assets;
210
209
  // Do nothing if not set
211
210
  if (!tenant)
212
211
  return;
@@ -216,6 +215,15 @@ class TenantHandler extends default_1.default {
216
215
  return;
217
216
  }
218
217
  }
218
+ if (tenant.flags?.enable_custom_domain_in_emails !== undefined) {
219
+ logger_1.default.warn('The "enable_custom_domain_in_emails" tenant flag is deprecated and has been removed from management. ' +
220
+ 'It will not be applied during import. ' +
221
+ 'Use the "is_default" field on customDomains to configure the default domain instead.');
222
+ tenant = {
223
+ ...tenant,
224
+ flags: (0, lodash_1.omit)(tenant.flags, 'enable_custom_domain_in_emails'),
225
+ };
226
+ }
219
227
  const updatedTenant = {
220
228
  ...tenant,
221
229
  flags: tenant.flags
@@ -227,11 +235,6 @@ class TenantHandler extends default_1.default {
227
235
  delete updatedTenant.flags;
228
236
  }
229
237
  }
230
- if (tenant.flags?.enable_custom_domain_in_emails !== undefined) {
231
- logger_1.default.warn('The "enable_custom_domain_in_emails" tenant flag is deprecated. ' +
232
- 'Use the "is_default" field on customDomains to configure the default domain instead. ' +
233
- 'The flag will still be applied for now but will be removed in a future release.');
234
- }
235
238
  if (updatedTenant && Object.keys(updatedTenant).length > 0) {
236
239
  const sessionDurations = (0, sessionDurationsToMinutes_1.default)({
237
240
  session_lifetime: updatedTenant?.session_lifetime,
@@ -66,6 +66,8 @@ const constants = {
66
66
  'send-phone-message',
67
67
  'password-reset-post-challenge',
68
68
  'custom-token-exchange',
69
+ 'login-post-identifier',
70
+ 'signup-post-identifier',
69
71
  ],
70
72
  EMAIL_TEMPLATES_DIRECTORY: 'emails',
71
73
  EMAIL_VERIFY,
@@ -259,7 +259,8 @@ const obfuscateSensitiveValues = (data, sensitiveFieldsToObfuscate) => {
259
259
  return newAsset;
260
260
  };
261
261
  exports.obfuscateSensitiveValues = obfuscateSensitiveValues;
262
- const UNRESOLVED_PLACEHOLDER_REGEX = /^(##.+##|@@.+@@)$/;
262
+ // Uppercase-only to avoid false positives on lowercase Auth0 template variables like @@password@@
263
+ const UNRESOLVED_PLACEHOLDER_REGEX = /^(##[A-Z0-9_]+##|@@[A-Z0-9_]+@@)$/;
263
264
  // Recursively collects all fields in an asset that still contain an unresolved
264
265
  // ##...## (string) or @@...@@ (array) keyword placeholder.
265
266
  const collectUnresolvedPlaceholders = (data, parentPath = '') => {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "auth0-deploy-cli",
3
- "version": "8.36.0",
3
+ "version": "8.38.0",
4
4
  "description": "A command line tool for deploying updates to your Auth0 tenant",
5
5
  "main": "lib/index.js",
6
6
  "bin": {
@@ -33,10 +33,10 @@
33
33
  "readme": "README.md",
34
34
  "homepage": "https://github.com/auth0/auth0-deploy-cli#readme",
35
35
  "dependencies": {
36
- "@clack/prompts": "1.3.0",
36
+ "@clack/prompts": "1.4.0",
37
37
  "ajv": "^6.12.6",
38
+ "auth0": "^5.13.0",
38
39
  "chalk": "5.6.2",
39
- "auth0": "^5.9.0",
40
40
  "dot-prop": "^5.3.0",
41
41
  "fs-extra": "^10.1.0",
42
42
  "js-yaml": "^4.1.1",