auth0-deploy-cli 8.43.0 → 8.45.0

package/lib/readonly.js

@@ -28,6 +28,11 @@ const readOnlyFields = {
         'config_route',
         'owners',
     ],
+    attackProtection: [
+        // Returned by GET but rejected by PATCH with "Additional properties not allowed"
+        'bruteForceProtection.form_submission_mode',
+        'bruteForceProtection.form_submission_behavior',
+    ],
 };
 function getExcludedFields(config) {
     const strippedFields = { ...readOnlyFields };

package/lib/tools/auth0/handlers/attackProtection.js

@@ -314,7 +314,9 @@ class AttackProtectionHandler extends default_1.default {
             updates.push(this.client.attackProtection.captcha.update(attackProtection.captcha));
         }
         if (attackProtection.bruteForceProtection) {
-            updates.push(this.client.attackProtection.bruteForceProtection.update(attackProtection.bruteForceProtection));
+            // Strip fields returned by GET but rejected by PATCH
+            const { form_submission_mode, form_submission_behavior, ...bruteForcePayload } = attackProtection.bruteForceProtection;
+            updates.push(this.client.attackProtection.bruteForceProtection.update(bruteForcePayload));
         }
         if (attackProtection.suspiciousIpThrottling) {
             updates.push(this.client.attackProtection.suspiciousIpThrottling.update(attackProtection.suspiciousIpThrottling));

package/lib/tools/auth0/handlers/clients.d.ts

@@ -209,6 +209,25 @@ export declare const schema: {
                 type: string;
                 description: string;
             };
+            b2b_integration_configuration: {
+                type: string[];
+                description: string;
+                properties: {
+                    integration_type: {
+                        type: string;
+                        enum: string[];
+                        description: string;
+                    };
+                    sso_profiles: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                        };
+                    };
+                };
+                additionalProperties: boolean;
+            };
             resource_server_identifier: {
                 type: string;
                 description: string;
@@ -254,6 +273,27 @@ export declare const schema: {
                         enum: ("allow" | "allow_if_empty")[];
                         description: string;
                     };
+                    third_party_client_access: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            default_value: {
+                                type: string;
+                                enum: "block"[];
+                                description: string;
+                            };
+                            allowed_values: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    enum: ("allow" | "block")[];
+                                };
+                                uniqueItems: boolean;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                    };
                     invitation_landing_client_id: {
                         type: string;
                         description: string;

package/lib/tools/auth0/handlers/clients.js

@@ -59,6 +59,27 @@ const myOrganizationConfigurationSchema = {
             enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
             description: 'The deletion behavior for My Organization connections created by this client',
         },
+        third_party_client_access: {
+            type: 'object',
+            description: 'Controls whether third-party clients can access the organization via the My Organization API.',
+            properties: {
+                default_value: {
+                    type: 'string',
+                    enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationThirdPartyClientAccessDefaultValueEnum),
+                    description: 'The default third-party client access value.',
+                },
+                allowed_values: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                        enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationThirdPartyClientAccessAllowedValuesEnum),
+                    },
+                    uniqueItems: true,
+                    description: 'The allowed third-party client access values.',
+                },
+            },
+            required: ['default_value', 'allowed_values'],
+        },
         invitation_landing_client_id: {
             type: 'string',
             description: 'The client ID of the invitation landing client for the My Organization configuration',
@@ -271,6 +292,23 @@ exports.schema = {
                 type: 'string',
                 description: 'The type of application this client represents',
             },
+            b2b_integration_configuration: {
+                type: ['object', 'null'],
+                description: 'B2B integration configuration. Early Access. Required feature flag: enterprise_connect_entitled.',
+                properties: {
+                    integration_type: {
+                        type: 'string',
+                        enum: ['custom_auth_server', 'third_party', 'application'],
+                        description: 'The type of integration used to connect to this B2B integration client.',
+                    },
+                    sso_profiles: {
+                        type: 'array',
+                        description: 'List of SSO profile IDs linked to this B2B integration client. Maximum 1 entry.',
+                        items: { type: 'string' },
+                    },
+                },
+                additionalProperties: false,
+            },
             resource_server_identifier: {
                 type: 'string',
                 description: 'The identifier of a resource server in your tenant. This property links a client to a resource server indicating that the client IS that resource server. Can only be set when app_type=resource_server.',
@@ -563,6 +601,9 @@ class ClientHandler extends default_1.default {
                 'jwks_uri',
                 // third_party_security_mode is immutable after creation; PATCH returns 400
                 'third_party_security_mode',
+                // API-generated timestamps; PATCH returns 400 if present
+                'created_at',
+                'updated_at',
             ],
             functions: {
                 create: (client) => this.createClient(client),
@@ -752,7 +793,23 @@ class ClientHandler extends default_1.default {
     async updateClient(clientId, client) {
         // For non-CIMD clients
         if (!this.isCimdClient(client)) {
-            return this.client.clients.update(clientId, client);
+            const payload = { ...client };
+            // b2b_integration_configuration: PATCH only allowed if client already has the object.
+            // Sending it to a client that lacks it returns 400 invalid_body.
+            // null clears the object — but only for clients that already have it; stripping
+            // null for a client without the field is a safe no-op.
+            if ('b2b_integration_configuration' in payload) {
+                const existing = (this.existing || []).find((c) => c.client_id === (client.client_id || clientId));
+                if (!existing?.b2b_integration_configuration) {
+                    if (payload.b2b_integration_configuration !== null) {
+                        logger_1.default.warn(`b2b_integration_configuration cannot be added to an existing client via PATCH ` +
+                            `(client: ${client.name || clientId}). Skipping field. ` +
+                            `Re-create the client to set this field.`);
+                    }
+                    delete payload.b2b_integration_configuration;
+                }
+            }
+            return this.client.clients.update(clientId, payload);
         }
         const updatePayload = this.getCIMDEditableFields(client);
         const registrationClientId = client.client_id || clientId;

package/lib/tools/auth0/handlers/connectionProfiles.d.ts

@@ -36,6 +36,33 @@ export declare const schema: {
             connection_config: {
                 type: string[];
             };
+            cross_app_access_resource_app: {
+                type: string;
+                description: string;
+                properties: {
+                    status: {
+                        type: string;
+                        properties: {
+                            default_value: {
+                                type: string;
+                                enum: ("enabled" | "disabled")[];
+                                description: string;
+                            };
+                            allowed_values: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    enum: ("enabled" | "disabled")[];
+                                };
+                                uniqueItems: boolean;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                    };
+                };
+                required: string[];
+            };
             strategy_overrides: {
                 type: string[];
                 properties: {

package/lib/tools/auth0/handlers/connectionProfiles.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConnectionProfile = exports.schema = void 0;
+const auth0_1 = require("auth0");
 const default_1 = __importDefault(require("./default"));
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -42,6 +43,35 @@ exports.schema = {
             connection_config: {
                 type: ['object', 'null'],
             },
+            cross_app_access_resource_app: {
+                type: 'object',
+                description: 'Controls whether organization admins may enable Cross App Access (XAA) on their Identity Providers.',
+                properties: {
+                    status: {
+                        type: 'object',
+                        properties: {
+                            default_value: {
+                                type: 'string',
+                                enum: Object.values(auth0_1.Management.ConnectionProfileCrossAppAccessResourceAppStatusDefaultValueEnum),
+                                description: 'The default Cross App Access resource app status.',
+                            },
+                            allowed_values: {
+                                type: 'array',
+                                items: {
+                                    type: 'string',
+                                    enum: Object.values(auth0_1.Management.ConnectionProfileCrossAppAccessResourceAppStatusValueEnum),
+                                },
+                                uniqueItems: true,
+                                description: 'The allowed Cross App Access resource app status values.',
+                            },
+                        },
+                        // allowed_values is optional per the SDK type (unlike the client's
+                        // third_party_client_access, which requires both fields).
+                        required: ['default_value'],
+                    },
+                },
+                required: ['status'],
+            },
             strategy_overrides: {
                 type: ['object', 'null'],
                 properties: {

package/lib/tools/auth0/handlers/connections.js

@@ -380,12 +380,15 @@ class ConnectionsHandler extends default_1.default {
     }
     getFormattedOptions(connection, clients) {
         try {
+            const { idpinitiated } = connection.options;
             return {
                 options: {
                     ...connection.options,
                     idpinitiated: {
-                        ...connection.options.idpinitiated,
-                        client_id: (0, utils_1.convertClientNameToId)(connection.options.idpinitiated.client_id, clients),
+                        ...idpinitiated,
+                        ...(idpinitiated.client_id && {
+                            client_id: (0, utils_1.convertClientNameToId)(idpinitiated.client_id, clients),
+                        }),
                     },
                 },
             };
@@ -744,7 +747,11 @@ class ConnectionsHandler extends default_1.default {
                 ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
             };
         });
-        const proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        let proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        const includedConnections = (assets.include && assets.include.connections) || [];
+        const excludedConnections = (assets.exclude && assets.exclude.connections) || [];
+        proposedChanges = (0, utils_1.filterExcluded)(proposedChanges, excludedConnections);
+        proposedChanges = (0, utils_1.filterIncluded)(proposedChanges, includedConnections);
         return (0, exports.addExcludedConnectionPropertiesToChanges)({
             proposedChanges,
             existingConnections,

package/lib/tools/auth0/handlers/databases.d.ts

@@ -195,6 +195,33 @@ export declare const schema: {
                             };
                         };
                     };
+                    otp_settings: {
+                        type: string;
+                        properties: {
+                            email: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            phone: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                        };
+                    };
                     password_options: {
                         type: string;
                         properties: {
@@ -295,6 +322,7 @@ export default class DatabaseHandler extends DefaultAPIHandler {
     private validatePasswordlessSettings;
     private validateEmailUniqueConstraints;
     getClientFN(fn: 'create' | 'delete' | 'getAll' | 'update'): Function;
+    private enrichConnectionsWithEnabledClients;
     getType(): Promise<Connection[]>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
     dryRunChanges(assets: Assets): Promise<CalculatedChanges>;

package/lib/tools/auth0/handlers/databases.js

@@ -181,6 +181,25 @@ exports.schema = {
                             action_id: { type: 'string' },
                         },
                     },
+                    otp_settings: {
+                        type: 'object',
+                        properties: {
+                            email: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                            phone: {
+                                type: 'object',
+                                properties: {
+                                    otp_length: { type: 'integer' },
+                                    otp_expiry: { type: 'integer' },
+                                },
+                            },
+                        },
+                    },
                     password_options: {
                         type: 'object',
                         properties: {
@@ -419,6 +438,22 @@ class DatabaseHandler extends default_1.default {
         }
         return this.client.connections[fn].bind(this.client.connections);
     }
+    // `enabled_clients` is no longer returned by connections.list; it must be fetched from the
+    // dedicated enabled-clients endpoint. Enriching the remote connections keeps the diff and the
+    // excluded-client preservation in `getEnabledClients` correct. Without it the dry-run diff
+    // reports a false "found in localObj but not in remoteObj" and a real import can silently
+    // disable an excluded-but-enabled client.
+    async enrichConnectionsWithEnabledClients(connections) {
+        return Promise.all(connections.map(async (con) => {
+            if (!con?.id)
+                return con;
+            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
+            if (enabledClients?.length) {
+                return { ...con, enabled_clients: enabledClients };
+            }
+            return con;
+        }));
+    }
     async getType() {
         if (this.existing)
             return this.existing;
@@ -433,16 +468,7 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
-        const dbConnectionsWithEnabledClients = await Promise.all(connections.map(async (con) => {
-            if (!con?.id)
-                return con;
-            const enabledClients = await (0, connections_1.getConnectionEnabledClients)(this.client, con.id);
-            const connection = { ...con };
-            if (enabledClients && enabledClients?.length) {
-                connection.enabled_clients = enabledClients;
-            }
-            return connection;
-        }));
+        const dbConnectionsWithEnabledClients = await this.enrichConnectionsWithEnabledClients(connections);
         // Convert action ID back to action name for export
         const dbConnectionsWithActionNames = dbConnectionsWithEnabledClients.map((connection) => {
             if (connection.options && 'custom_password_hash' in connection.options) {
@@ -489,28 +515,26 @@ class DatabaseHandler extends default_1.default {
                 update: [],
                 conflicts: [],
             };
-        // Convert enabled_clients by name to the id
-        // Fetch clients, connections, and actions concurrently
-        const [clients, existingDatabasesConnections, actions] = await Promise.all([
+        // Convert enabled_clients by name to the id. `getType()` fetches and enriches the existing
+        // connections with `enabled_clients` and caches the result in `this.existing`, so the
+        // `super.calcChanges()` call below reuses it instead of fetching again.
+        const [clients, actions, existingWithEnabledClients] = await Promise.all([
             (0, client_1.paginate)(this.client.clients.list, {
                 paginate: true,
             }),
-            (0, client_1.paginate)(this.client.connections.list, {
-                strategy: [auth0_1.Management.ConnectionStrategyEnum.Auth0],
-                checkpoint: true,
-                include_totals: true,
-            }),
             (0, client_1.paginate)(this.client.actions.list, {
                 paginate: true,
                 include_totals: true,
             }),
+            this.getType(),
         ]);
+        const existingConnections = existingWithEnabledClients || [];
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingConnections, clients);
             }
             return formattedDb;
         });
@@ -540,21 +564,22 @@ class DatabaseHandler extends default_1.default {
                 include_totals: true,
             }),
         ]);
+        const existingWithEnabledClients = await this.enrichConnectionsWithEnabledClients(existingDatabasesConnections);
         const formatted = databases.map((db) => {
             const { options, ...rest } = db;
             const formattedOptions = this.getFormattedOptions(options, actions);
             const formattedDb = { ...rest, options: formattedOptions };
             if (db.enabled_clients) {
-                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingDatabasesConnections, clients);
+                formattedDb.enabled_clients = (0, utils_1.getEnabledClients)(assets, db, existingWithEnabledClients, clients);
             }
             return formattedDb;
         });
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: formatted,
-            existing: existingDatabasesConnections,
+            existing: existingWithEnabledClients,
             identifiers: this.identifiers,
-            ignoreDryRunFields: this.ignoreDryRunFields,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
         });
     }
     // Run after clients are updated so we can convert all the enabled_clients names to id's

package/lib/tools/auth0/handlers/default.d.ts

@@ -1,6 +1,20 @@
 import { Asset, Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
 import { ConfigFunction } from '../../../configFactory';
 export declare function order(value: any): (t: any, n: any, descriptor: any) => any;
+export interface RetryOptions {
+    maxRetries?: number;
+    initialDelay?: number;
+    maxDelay?: number;
+    onRetry?: (error: any, attempt: number, delay: number) => void;
+}
+/**
+ * Executes a function with exponential backoff retry logic for rate limit errors (429).
+ *
+ * @param fn - The function to execute with retry logic
+ * @param options - Configuration options for retry behavior
+ * @returns Promise that resolves with the function result or rejects after max retries
+ */
+export declare function retryWithExponentialBackoff<T>(fn: () => Promise<T>, options?: RetryOptions): Promise<T>;
 type ApiMethodOverride = string | Function;
 export default class APIHandler {
     config: ConfigFunction;
@@ -50,6 +64,15 @@ export default class APIHandler {
      */
     getEffectiveIgnoreDryRunFields(): string[];
     getClientFN(fn: ApiMethodOverride): Function;
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig(): RetryOptions;
     didDelete(item: Asset): void;
     didCreate(item: Asset): void;
     didUpdate(item: Asset): void;

package/lib/tools/auth0/handlers/default.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.order = order;
+exports.retryWithExponentialBackoff = retryWithExponentialBackoff;
 const auth0_1 = require("auth0");
 const validationError_1 = __importDefault(require("../../validationError"));
 const utils_1 = require("../../utils");
@@ -114,6 +115,25 @@ class APIHandler {
         }
         return fn;
     }
+    /**
+     * Builds the exponential-backoff retry configuration for this handler from the
+     * shared `AUTH0_MAX_RETRIES` / `AUTH0_RETRY_INITIAL_DELAY_MS` /
+     * `AUTH0_RETRY_MAX_DELAY_MS` config keys. Exposed so that handlers which issue
+     * writes outside the default `processChanges` flow (e.g. organizations, which
+     * writes nested connections/grants directly) can wrap those calls in the same
+     * 429 backoff behaviour as the base handler.
+     */
+    getRetryConfig() {
+        const retryConfig = {
+            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
+            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
+            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
+            onRetry: (error, attempt, delay) => {
+                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
+            },
+        };
+        return retryConfig;
+    }
     didDelete(item) {
         logger_1.default.info(`Deleted [${this.type}]: ${this.objString(item)}`);
     }
@@ -210,7 +230,6 @@ class APIHandler {
             return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
                 type: this.type,
                 assets: typeAssets,
-                // @ts-ignore TODO: investigate what happens when `existing` is null
                 existing,
                 identifiers: this.identifiers,
                 ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -243,7 +262,6 @@ class APIHandler {
         return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
             type: this.type,
             assets: typeAssets,
-            // @ts-ignore TODO: investigate what happens when `existing` is null
             existing,
             identifiers: this.identifiers,
             ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
@@ -282,14 +300,7 @@ class APIHandler {
         const conflicts = changes.conflicts || [];
         logger_1.default.debug(`Start processChanges for ${this.type} [delete:${del.length}] [update:${update.length}], [create:${create.length}], [conflicts:${conflicts.length}]`);
         // Set retry configuration from config
-        const retryConfig = {
-            maxRetries: this.config('AUTH0_MAX_RETRIES') || DEFAULT_MAX_RETRIES,
-            initialDelay: this.config('AUTH0_RETRY_INITIAL_DELAY_MS') || DEFAULT_INITIAL_DELAY_MS,
-            maxDelay: this.config('AUTH0_RETRY_MAX_DELAY_MS') || DEFAULT_MAX_DELAY_MS,
-            onRetry: (error, attempt, delay) => {
-                logger_1.default.warn(`Rate limit hit for [${this.type}]. Retrying attempt ${attempt}/${retryConfig.maxRetries} after ${Math.round(delay / 1000)}s...`);
-            },
-        };
+        const retryConfig = this.getRetryConfig();
         // Process Deleted
         if (del.length > 0) {
             const allowDelete = this.config('AUTH0_ALLOW_DELETE') === 'true' || this.config('AUTH0_ALLOW_DELETE') === true;

package/lib/tools/auth0/handlers/index.js

@@ -69,6 +69,7 @@ const forms = __importStar(require("./forms"));
 const flows = __importStar(require("./flows"));
 const flowVaultConnections = __importStar(require("./flowVaultConnections"));
 const selfServiceProfiles = __importStar(require("./selfServiceProfiles"));
+const networkACLKeys = __importStar(require("./networkACLKeys"));
 const networkACLs = __importStar(require("./networkACLs"));
 const userAttributeProfiles = __importStar(require("./userAttributeProfiles"));
 const connectionProfiles = __importStar(require("./connectionProfiles"));
@@ -116,6 +117,7 @@ const auth0ApiHandlers = {
     flows,
     flowVaultConnections,
     selfServiceProfiles,
+    networkACLKeys,
     networkACLs,
     userAttributeProfiles,
     connectionProfiles,

package/lib/tools/auth0/handlers/networkACLKeys.d.ts

@@ -0,0 +1,45 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+export type NetworkAclKey = Management.NetworkAclKey & {
+    value?: string;
+};
+export declare const schema: {
+    type: string;
+    description: string;
+    items: {
+        type: string;
+        required: string[];
+        properties: {
+            id: {
+                type: string;
+            };
+            name: {
+                type: string;
+                maxLength: number;
+            };
+            alg: {
+                type: string;
+                enum: string[];
+            };
+            value: {
+                type: string;
+            };
+            fingerprint: {
+                type: string;
+            };
+        };
+        additionalProperties: boolean;
+    };
+};
+export default class NetworkACLKeysHandler extends DefaultAPIHandler {
+    existing: NetworkAclKey[] | null;
+    constructor(config: DefaultAPIHandler);
+    objString(key: NetworkAclKey): string;
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+    createNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    createNetworkACLKeys(creates: CalculatedChanges['create']): Promise<void>;
+    deleteNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    deleteNetworkACLKeys(data: Asset[]): Promise<void>;
+}