auth0-deploy-cli 8.41.0 → 8.43.0

package/lib/tools/auth0/handlers/roles.d.ts

@@ -14,6 +14,10 @@ export declare const schema: {
             description: {
                 type: string;
             };
+            type: {
+                type: string;
+                enum: string[];
+            };
             permissions: {
                 type: string;
                 items: {

package/lib/tools/auth0/handlers/roles.js

@@ -56,6 +56,7 @@ exports.schema = {
             name: { type: 'string' },
             id: { type: 'string' },
             description: { type: 'string' },
+            type: { type: 'string', enum: ['tenant', 'organization'] },
             permissions: {
                 type: 'array',
                 items: {
@@ -81,6 +82,9 @@ class RolesHandler extends default_1.default {
     async createRole(data) {
         const role = { ...data };
         delete role.permissions;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; it
+        // defaults to `tenant` on create. This keeps exports (which carry `type`) round-trippable.
+        delete role.type;
         const created = await this.client.roles.create(role);
         if (created.id && typeof data.permissions !== 'undefined' && data.permissions.length > 0) {
             await this.client.roles.permissions.add(created.id, { permissions: data.permissions });
@@ -133,6 +137,9 @@ class RolesHandler extends default_1.default {
         const newPermissions = data.permissions;
         delete data.permissions;
         delete data.id;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; this
+        // lets files that already carry it (from a prior export) be imported cleanly.
+        delete data.type;
         await this.client.roles.update(params.id, data);
         if (typeof existingRole.permissions !== 'undefined' && existingRole.permissions.length > 0) {
             await this.client.roles.permissions.delete(params.id, {
@@ -164,9 +171,12 @@ class RolesHandler extends default_1.default {
             return this.existing;
         }
         try {
+            // Only manage tenant-level roles; exclude org-scoped roles surfaced when
+            // the api2_org_level_roles_ea flag is enabled.
             const roles = await (0, client_1.paginate)(this.client.roles.list, {
                 paginate: true,
                 include_totals: true,
+                type: 'tenant',
             });
             for (let index = 0; index < roles.length; index++) {
                 const allPermission = [];

package/lib/tools/auth0/handlers/rules.js

@@ -9,6 +9,7 @@ const utils_1 = require("../../utils");
 const default_1 = __importDefault(require("./default"));
 const logger_1 = __importDefault(require("../../../logger"));
 const calculateChanges_1 = require("../../calculateChanges");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 const client_1 = require("../client");
 exports.excludeSchema = {
     type: 'array',
@@ -135,13 +136,24 @@ class RulesHandler extends default_1.default {
         };
     }
     async dryRunChanges(assets) {
-        const { del, update, create, conflicts } = await this.calcChanges(assets);
-        return {
-            del,
-            update,
-            create,
-            conflicts,
-        };
+        let { rules } = assets;
+        if (!rules) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const excludedRules = (assets.exclude && assets.exclude.rules) || [];
+        rules = rules.filter((r) => !excludedRules.includes(r.name));
+        let existing = await this.getType();
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        existing = existing.filter((r) => !excludedRules.includes(r.name));
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: rules,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
     }
     async validate(assets) {
         const { rules } = assets;

package/lib/tools/auth0/handlers/tenant.d.ts

@@ -79,6 +79,29 @@ export declare const schema: {
             enum: string[];
             description: string;
         };
+        country_codes: {
+            type: string[];
+            description: string;
+            properties: {
+                list: {
+                    type: string;
+                    description: string;
+                    items: {
+                        type: string;
+                        pattern: string;
+                    };
+                    minItems: number;
+                    uniqueItems: boolean;
+                };
+                mode: {
+                    type: string;
+                    enum: string[];
+                    description: string;
+                };
+            };
+            required: string[];
+            additionalProperties: boolean;
+        };
     };
 };
 export interface Tenant extends Management.GetTenantSettingsResponseContent {

package/lib/tools/auth0/handlers/tenant.js

@@ -106,6 +106,29 @@ exports.schema = {
             enum: ['strict', 'permissive'],
             description: 'Indicates the security mode for new clients created through the Dynamic Client Registration endpoint.',
         },
+        country_codes: {
+            type: ['object', 'null'],
+            description: 'Phone country code configuration for identifier input. Set to `null` to remove filtering (allow all countries). Requires the `tenant_country_codes_filtering` feature flag to be enabled on the tenant.',
+            properties: {
+                list: {
+                    type: 'array',
+                    description: 'ISO 3166-1 alpha-2 country codes (e.g. `US`, `GB`).',
+                    items: {
+                        type: 'string',
+                        pattern: '^[A-Z]{2}$',
+                    },
+                    minItems: 1,
+                    uniqueItems: true,
+                },
+                mode: {
+                    type: 'string',
+                    enum: ['allow', 'deny'],
+                    description: 'Whether the list is an allowlist or denylist.',
+                },
+            },
+            required: ['list', 'mode'],
+            additionalProperties: false,
+        },
     },
 };
 const blockPageKeys = [
@@ -147,6 +170,7 @@ exports.allowedTenantFlags = [
     'require_pushed_authorization_requests',
     'mfa_show_factor_list_on_enrollment',
     'improved_signup_bot_detection_in_classic',
+    'use_scope_descriptions_for_consent',
 ];
 const removeUnallowedTenantFlags = (proposedFlags) => {
     if (proposedFlags === undefined)

package/lib/tools/auth0/handlers/themes.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets } from '../../../types';
+import { Assets, CalculatedChanges } from '../../../types';
 import DefaultHandler from './default';
 /**
  * Schema
@@ -179,6 +179,41 @@ export declare const schema: {
                 pattern: string;
                 type: string;
             };
+            identifiers: {
+                additionalProperties: boolean;
+                description: string;
+                properties: {
+                    login_display: {
+                        description: string;
+                        enum: string[];
+                        type: string;
+                    };
+                    otp_autocomplete: {
+                        description: string;
+                        type: string;
+                    };
+                    phone_display: {
+                        additionalProperties: boolean;
+                        description: string;
+                        properties: {
+                            formatting: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                            masking: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                        type: string;
+                    };
+                };
+                required: string[];
+                type: string;
+            };
             fonts: {
                 additionalProperties: boolean;
                 properties: {
@@ -375,6 +410,7 @@ export default class ThemesHandler extends DefaultHandler {
     existing: Theme[] | null;
     constructor(options: DefaultHandler);
     objString(theme: Theme): string;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     getType(): Promise<Theme[] | null>;
     processChanges(assets: Assets): Promise<void>;
     deleteThemes(): Promise<void>;

package/lib/tools/auth0/handlers/themes.js

@@ -46,6 +46,7 @@ exports.schema = void 0;
 const logger_1 = __importDefault(require("../../../logger"));
 const default_1 = __importStar(require("./default"));
 const utils_1 = require("../../utils");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 /**
  * Schema
  */
@@ -251,6 +252,41 @@ exports.schema = {
                 pattern: '^[^<>]*$',
                 type: 'string',
             },
+            identifiers: {
+                additionalProperties: false,
+                description: 'Identifier display settings on the theme. Requires the `universal_login_theme_identifiers` feature flag to be enabled on the tenant.',
+                properties: {
+                    login_display: {
+                        description: 'Login display mode',
+                        enum: ['separate', 'unified'],
+                        type: 'string',
+                    },
+                    otp_autocomplete: {
+                        description: 'Whether OTP autocomplete is enabled',
+                        type: 'boolean',
+                    },
+                    phone_display: {
+                        additionalProperties: false,
+                        description: 'Phone number display settings',
+                        properties: {
+                            formatting: {
+                                description: 'Phone number formatting style',
+                                enum: ['international', 'regional'],
+                                type: 'string',
+                            },
+                            masking: {
+                                description: 'Phone number masking strategy',
+                                enum: ['hide_country_code', 'mask_digits', 'show_all'],
+                                type: 'string',
+                            },
+                        },
+                        required: ['formatting', 'masking'],
+                        type: 'object',
+                    },
+                },
+                required: ['login_display', 'otp_autocomplete', 'phone_display'],
+                type: 'object',
+            },
             fonts: {
                 additionalProperties: false,
                 properties: {
@@ -470,6 +506,34 @@ class ThemesHandler extends default_1.default {
     objString(theme) {
         return theme.displayName || JSON.stringify(theme);
     }
+    async dryRunChanges(assets) {
+        const { themes } = assets;
+        if (!themes) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const existing = await this.getType();
+        // getType() returns null when Universal Login customizations are not enabled
+        // on the tenant (the 400 "no-code not enabled" path in getThemes).
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        // Themes are singletons — at most one per tenant. If the local theme has no
+        // themeId (stripped during export when --export_ids is not set), backfill it
+        // from the remote so the matcher can find a match without requiring --export_ids.
+        const normalizedThemes = themes.map((theme) => {
+            if (!theme.themeId && existing.length > 0 && existing[0].themeId) {
+                return { ...theme, themeId: existing[0].themeId };
+            }
+            return theme;
+        });
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: normalizedThemes,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
+    }
     async getType() {
         if (!this.existing) {
             this.existing = await this.getThemes();

package/lib/tools/auth0/index.js

@@ -14,6 +14,7 @@ const handlers_1 = __importDefault(require("./handlers"));
 const calculateDryRunChanges_1 = require("../calculateDryRunChanges");
 const utils_1 = require("../../utils");
 const utils_2 = require("../utils");
+const logger_1 = __importDefault(require("../../logger"));
 /**
  * Sorts handlers by their @order decorator metadata for a given stage.
  * Handlers are sorted in ascending order (lower values execute first).
@@ -145,6 +146,14 @@ class Auth0 {
             data: this.handlers,
             generator: (handler) => (async () => {
                 try {
+                    // Every handler in the dry-run loop is expected to implement dryRunChanges.
+                    // Guard against non-conforming handlers (e.g. deploy-only handlers that don't
+                    // extend the base APIHandler) so a missing method skips the handler instead of
+                    // crashing the whole dry run. Logged loudly so an omitted preview is visible.
+                    if (typeof handler.dryRunChanges !== 'function') {
+                        logger_1.default.warn(`Handler "${handler.type}" does not implement dryRunChanges; skipping it in the dry-run preview. Changes for this resource will still be applied during a real import.`);
+                        return;
+                    }
                     const detailedChanges = [];
                     let created = 0;
                     let updated = 0;

package/lib/tools/utils.d.ts

@@ -27,6 +27,7 @@ export declare function areArraysEquals(x: any[], y: any[]): boolean;
 export declare const obfuscateSensitiveValues: (data: Asset | Asset[] | null, sensitiveFieldsToObfuscate: string[]) => Asset | Asset[] | null;
 export declare const validateNoUnresolvedPlaceholders: (data: Asset | null, resourceType: string, resourceName: string) => Asset | null;
 export declare const stripObfuscatedFieldsFromPayload: (data: Asset | Asset[] | null, obfuscatedFields: string[]) => Asset | Asset[] | null;
+export declare const stripUnresolvedPlaceholders: (data: Asset | null, resourceType: string, resourceName: string) => Asset | null;
 export declare const detectInsufficientScopeError: <T>(fn: Function) => Promise<{
     hadSufficientScopes: true;
     data: T;

package/lib/tools/utils.js

@@ -36,7 +36,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
+exports.shouldExcludeThirdPartyClients = exports.isForbiddenFeatureError = exports.isDeprecatedError = exports.detectInsufficientScopeError = exports.stripUnresolvedPlaceholders = exports.stripObfuscatedFieldsFromPayload = exports.validateNoUnresolvedPlaceholders = exports.obfuscateSensitiveValues = exports.keywordReplaceStringRegExp = exports.keywordReplaceArrayRegExp = void 0;
 exports.keywordArrayReplace = keywordArrayReplace;
 exports.keywordStringReplace = keywordStringReplace;
 exports.keywordReplace = keywordReplace;
@@ -309,6 +309,24 @@ const stripObfuscatedFieldsFromPayload = (data, obfuscatedFields) => {
     return newAsset;
 };
 exports.stripObfuscatedFieldsFromPayload = stripObfuscatedFieldsFromPayload;
+// Strips unresolved ##...## / @@...@@ placeholders before sending to Auth0.
+// Keyword replacement runs first; any remaining placeholder means no mapping was
+// provided. The field is dropped so Auth0 preserves its existing value.
+const stripUnresolvedPlaceholders = (data, resourceType, resourceName) => {
+    if (data === null)
+        return data;
+    const unresolved = collectUnresolvedPlaceholders(data);
+    if (unresolved.length === 0)
+        return data;
+    const newAsset = { ...data };
+    unresolved.forEach(({ path, value }) => {
+        logger_1.default.warn(`Stripping unresolved placeholder for ${resourceType} "${resourceName}" field "${path}": ${value}. ` +
+            `To use this value, define ${value.replace(/^##|##$|^@@|@@$/g, '')} in AUTH0_KEYWORD_REPLACE_MAPPINGS. The existing value on Auth0 will be preserved.`);
+        dot_prop_1.default.delete(newAsset, path);
+    });
+    return newAsset;
+};
+exports.stripUnresolvedPlaceholders = stripUnresolvedPlaceholders;
 const detectInsufficientScopeError = async (fn) => {
     try {
         const data = await fn();
@@ -342,7 +360,12 @@ const isDeprecatedError = (err) => {
 exports.isDeprecatedError = isDeprecatedError;
 const isForbiddenFeatureError = (err, type) => {
     if (err.statusCode === 403) {
-        logger_1.default.warn(`${err.message};${err.errorCode ?? ''} - Skipping ${type}`);
+        // The SDK error's top-level `message` is the full serialized response body; the clean,
+        // human-readable message and errorCode live on the response body itself.
+        const body = err.originalError?.response?.body ?? {};
+        const message = body.message ?? err.message;
+        const errorCode = body.errorCode ?? err.errorCode ?? '';
+        logger_1.default.warn(`${message}${errorCode ? ` (${errorCode})` : ''} - Skipping ${type}`);
         return true;
     }
     return false;

package/lib/types.d.ts

@@ -31,6 +31,7 @@ type SharedPaginationParams = {
     include_totals?: boolean;
     id?: string;
     strategy?: Management.ConnectionStrategyEnum[];
+    type?: Management.RoleTypeEnum;
 };
 export type CheckpointPaginationParams = SharedPaginationParams & {
     from?: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "auth0-deploy-cli",
-  "version": "8.41.0",
+  "version": "8.43.0",
   "description": "A command line tool for deploying updates to your Auth0 tenant",
   "main": "lib/index.js",
   "bin": {
@@ -35,7 +35,7 @@
   "dependencies": {
     "@clack/prompts": "1.4.0",
     "ajv": "^6.12.6",
-    "auth0": "^6.0.0",
+    "auth0": "^6.2.0",
     "chalk": "5.6.2",
     "dot-prop": "^5.3.0",
     "fs-extra": "^10.1.0",