auth0-deploy-cli 8.43.0 → 8.45.0

package/lib/tools/auth0/handlers/networkACLKeys.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importStar(require("./default"));
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    description: 'List of Network ACL keys for HMAC signature verification',
+    items: {
+        type: 'object',
+        required: ['name', 'alg'],
+        properties: {
+            id: { type: 'string' },
+            name: { type: 'string', maxLength: 255 },
+            alg: { type: 'string', enum: ['hmac-sha256'] },
+            // value is write-only and never returned by the API.
+            // Provide it at deploy time via keyword replacement (e.g. ##HMAC_KEY_VALUE##).
+            // It is not exported and is omitted from exported configs.
+            value: { type: 'string' },
+            fingerprint: { type: 'string' },
+        },
+        additionalProperties: false,
+    },
+};
+class NetworkACLKeysHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'networkACLKeys',
+            id: 'id',
+            identifiers: ['name'],
+            // value is write-only (never returned by API) and fingerprint/timestamps are
+            // API-generated — ignore all of them when computing dry-run diffs so keys
+            // with a local `value` don't show phantom UPDATEs.
+            ignoreDryRunFields: ['value', 'fingerprint', 'created_at', 'updated_at'],
+        });
+    }
+    objString(key) {
+        return super.objString({ name: key.name, alg: key.alg });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            // Not paginated — tenant cap is 10 keys. Returns { keys: [...] }.
+            const result = await this.client.keys.networkAcls.list();
+            this.existing = result.keys;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403) {
+                logger_1.default.debug('Network ACL key management is not enabled for this tenant. Please verify `scope` or contact Auth0 support.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async processChanges(assets) {
+        const { networkACLKeys } = assets;
+        // Do nothing if not set
+        if (!networkACLKeys)
+            return;
+        const { del, create } = await this.calcChanges(assets);
+        // Keys are immutable after creation — there is no update operation.
+        // A detected "update" (same name, different config) is a no-op: the existing key is kept as-is.
+        logger_1.default.debug(`Start processChanges for networkACLKeys [delete:${del.length}] [create:${create.length}]`);
+        await Promise.all([this.deleteNetworkACLKeys(del), this.createNetworkACLKeys(create)]);
+    }
+    async createNetworkACLKey(key) {
+        if (!key.value) {
+            logger_1.default.warn(`Skipping creation of Network ACL key "${key.name}": ` +
+                `'value' is required to create a key but is not present in the config. ` +
+                `Supply the key material via keyword replacement (e.g. ##HMAC_KEY_VALUE##) or create the key out-of-band.`);
+            return;
+        }
+        await this.client.keys.networkAcls.create({
+            name: key.name,
+            alg: key.alg,
+            value: key.value,
+        });
+        this.didCreate(key);
+        this.created += 1;
+    }
+    async createNetworkACLKeys(creates) {
+        await this.client.pool
+            .addEachTask({
+            data: creates || [],
+            generator: (item) => this.createNetworkACLKey(item).catch((err) => {
+                throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async deleteNetworkACLKey(key) {
+        if (!key.id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(key)}`);
+        }
+        await this.client.keys.networkAcls.delete(key.id);
+    }
+    async deleteNetworkACLKeys(data) {
+        if (!data || data.length === 0)
+            return;
+        if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+            this.config('AUTH0_ALLOW_DELETE') === true) {
+            await this.client.pool
+                .addEachTask({
+                data: data || [],
+                generator: (item) => this.deleteNetworkACLKey(item)
+                    .then(() => {
+                    this.didDelete(item);
+                    this.deleted += 1;
+                })
+                    .catch((err) => {
+                    if (err.statusCode === 409) {
+                        throw new Error(`Cannot delete Network ACL key "${item.name}" — it is still referenced by one or more ACL rules. ` +
+                            `Remove the key reference from all ACL rules first.\n${err}`);
+                    }
+                    throw new Error(`Problem deleting ${this.type} ${this.objString(item)}\n${err}`);
+                }),
+            })
+                .promise();
+        }
+        else {
+            logger_1.default.warn(`Detected the following ${this.type} should be deleted. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config
+      \n${data.map((i) => this.objString(i)).join('\n')}`);
+        }
+    }
+}
+exports.default = NetworkACLKeysHandler;
+__decorate([
+    (0, default_1.order)(60)
+], NetworkACLKeysHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -21,7 +21,7 @@ export declare const schema: {
                 minimum: number;
             };
             rule: {
-                anyOf: {
+                anyOf: ({
                     type: string;
                     required: string[];
                     properties: {
@@ -171,6 +171,29 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                 };
+                                http_message_signature: {
+                                    type: string;
+                                    properties: {
+                                        keys: {
+                                            type: string;
+                                            minItems: number;
+                                            maxItems: number;
+                                            uniqueItems: boolean;
+                                            items: {
+                                                type: string;
+                                                properties: {
+                                                    id: {
+                                                        type: string;
+                                                    };
+                                                };
+                                                required: string[];
+                                                additionalProperties: boolean;
+                                            };
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -271,6 +294,29 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                 };
+                                http_message_signature: {
+                                    type: string;
+                                    properties: {
+                                        keys: {
+                                            type: string;
+                                            minItems: number;
+                                            maxItems: number;
+                                            uniqueItems: boolean;
+                                            items: {
+                                                type: string;
+                                                properties: {
+                                                    id: {
+                                                        type: string;
+                                                    };
+                                                };
+                                                required: string[];
+                                                additionalProperties: boolean;
+                                            };
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -278,9 +324,75 @@ export declare const schema: {
                             enum: string[];
                             type: string;
                         };
+                        match_all?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    type: string;
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            anyOf: ({
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    block: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    allow: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    log: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    redirect: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                    redirect_uri: {
+                                        type: string;
+                                        minLength: number;
+                                        maxLength: number;
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            })[];
+                        };
+                        match_all: {
+                            type: string;
+                            enum: boolean[];
+                        };
+                        scope: {
+                            enum: string[];
+                            type: string;
+                        };
+                        match?: undefined;
+                        not_match?: undefined;
                     };
                     additionalProperties: boolean;
-                }[];
+                })[];
             };
         };
         additionalProperties: boolean;

package/lib/tools/auth0/handlers/networkACLs.js

@@ -1,10 +1,49 @@
 "use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
-const default_1 = __importDefault(require("./default"));
+const default_1 = __importStar(require("./default"));
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
 // Define action types
@@ -57,6 +96,15 @@ const RedirectAction = {
     },
     additionalProperties: false,
 };
+// Shared sub-schemas reused across every rule branch below.
+const ActionSchema = {
+    type: 'object',
+    anyOf: [BlockAction, AllowAction, LogAction, RedirectAction],
+};
+const ScopeSchema = {
+    enum: ['management', 'authentication', 'tenant'],
+    type: 'string',
+};
 // Define MatchSchema
 const MatchSchema = {
     type: 'object',
@@ -155,6 +203,27 @@ const MatchSchema = {
             },
             uniqueItems: true,
         },
+        http_message_signature: {
+            type: 'object',
+            properties: {
+                keys: {
+                    type: 'array',
+                    minItems: 1,
+                    maxItems: 10,
+                    uniqueItems: true,
+                    items: {
+                        type: 'object',
+                        properties: {
+                            id: { type: 'string' },
+                        },
+                        required: ['id'],
+                        additionalProperties: false,
+                    },
+                },
+            },
+            required: ['keys'],
+            additionalProperties: false,
+        },
     },
     additionalProperties: false,
 };
@@ -182,16 +251,10 @@ exports.schema = {
                         type: 'object',
                         required: ['action', 'scope', 'match'],
                         properties: {
-                            action: {
-                                type: 'object',
-                                anyOf: [BlockAction, AllowAction, LogAction, RedirectAction],
-                            },
+                            action: ActionSchema,
                             match: MatchSchema,
                             not_match: MatchSchema,
-                            scope: {
-                                enum: ['management', 'authentication', 'tenant'],
-                                type: 'string',
-                            },
+                            scope: ScopeSchema,
                         },
                         additionalProperties: false,
                     },
@@ -199,16 +262,25 @@ exports.schema = {
                         type: 'object',
                         required: ['action', 'scope', 'not_match'],
                         properties: {
-                            action: {
-                                type: 'object',
-                                anyOf: [BlockAction, AllowAction, LogAction, RedirectAction],
-                            },
+                            action: ActionSchema,
                             not_match: MatchSchema,
                             match: MatchSchema,
-                            scope: {
-                                enum: ['management', 'authentication', 'tenant'],
-                                type: 'string',
+                            scope: ScopeSchema,
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        // Unconditional match: `match_all` is mutually exclusive with `match`/`not_match`.
+                        type: 'object',
+                        required: ['action', 'scope', 'match_all'],
+                        properties: {
+                            action: ActionSchema,
+                            match_all: {
+                                // Schema only permits `true`; omit the property instead of sending `false`.
+                                type: 'boolean',
+                                enum: [true],
                             },
+                            scope: ScopeSchema,
                         },
                         additionalProperties: false,
                     },
@@ -355,3 +427,6 @@ class NetworkACLsHandler extends default_1.default {
     }
 }
 exports.default = NetworkACLsHandler;
+__decorate([
+    (0, default_1.order)(65)
+], NetworkACLsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/organizations.d.ts

@@ -147,7 +147,7 @@ export default class OrganizationsHandler extends DefaultHandler {
     createOrganizations(creates: CalculatedChanges['create']): Promise<void>;
     updateOrganization(org: any, organizations: any): Promise<{
         id: any;
-    }>;
+    } | null>;
     getClientGrantIDByClientName(clientsName: string): string;
     getClientIdByClientName(clientName: string): string;
     getFormattedClientGrants(): Promise<FormattedClientGrants[]>;

package/lib/tools/auth0/handlers/organizations.js

@@ -51,6 +51,12 @@ const logger_1 = __importDefault(require("../../../logger"));
 const client_1 = require("../client");
 const utils_1 = require("../../../utils");
 const utils_2 = require("../../utils");
+// Org sub-resources are skipped when the tenant can't read them: the EA feature is off
+// (feature_not_enabled, returned as 400 or 403) or the token lacks scope (403). The SDK
+// puts the API code on `err.body.errorCode`, not `err.errorCode`.
+function isOrgSubresourceUnavailable(err) {
+    return err?.statusCode === 403 || err?.body?.errorCode === 'feature_not_enabled';
+}
 exports.schema = {
     type: 'array',
     items: {
@@ -194,8 +200,9 @@ class OrganizationsHandler extends default_1.default {
             throw new Error(`Organization "${organization.name}" was created but the response did not include an ID. Skipping connection/grant association.`);
         }
         const createdId = created.id;
+        const retryConfig = this.getRetryConfig();
         if (typeof org.connections !== 'undefined' && org.connections.length > 0) {
-            await Promise.all(org.connections.map((conn) => this.client.organizations.connections.create(createdId, conn)));
+            await Promise.all(org.connections.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.create(createdId, conn), retryConfig)));
         }
         if (typeof org.client_grants !== 'undefined' && org.client_grants.length > 0) {
             await Promise.all(org.client_grants.map((organizationClientGrants) => this.createOrganizationClientGrants(createdId, this.getClientGrantIDByClientName(organizationClientGrants.client_id))));
@@ -240,7 +247,8 @@ class OrganizationsHandler extends default_1.default {
             .promise();
     }
     async updateOrganization(org, organizations) {
-        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = await organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const existingOrg = organizations.find((orgToUpdate) => orgToUpdate.name === org.name);
+        const { connections: existingConnections, client_grants: existingClientGrants, discovery_domains: existingDiscoveryDomains, clients: existingOrgClients = [], } = existingOrg;
         const params = { id: org.id };
         const { connections, client_grants: organizationClientGrants, discovery_domains: organizationDiscoveryDomains, clients: organizationClients, } = org;
         delete org.connections;
@@ -249,7 +257,14 @@ class OrganizationsHandler extends default_1.default {
         delete org.client_grants;
         delete org.discovery_domains;
         delete org.clients;
-        await this.client.organizations.update(params.id, org);
+        // Only PATCH if top-level properties actually differ from the existing state.
+        // Compare only the keys present in the desired config against those same keys
+        // on the remote org, so that fields the user didn't specify are not considered.
+        let changed = false;
+        if (!(0, lodash_1.isEqual)(org, (0, lodash_1.pick)(existingOrg, Object.keys(org)))) {
+            await this.client.organizations.update(params.id, org);
+            changed = true;
+        }
         // organization connections
         const connectionsToRemove = existingConnections.filter((c) => !connections.find((x) => x.connection_id === c.connection_id));
         const connectionsToAdd = connections.filter((c) => !existingConnections.find((x) => x.connection_id === c.connection_id));
@@ -260,27 +275,27 @@ class OrganizationsHandler extends default_1.default {
                 x.organization_access_level !== c.organization_access_level ||
                 x.organization_connection_name !== c.organization_connection_name ||
                 x.is_enabled !== (c.is_enabled ?? true))));
+        if (connectionsToUpdate.length > 0 ||
+            connectionsToAdd.length > 0 ||
+            connectionsToRemove.length > 0) {
+            changed = true;
+        }
+        const retryConfig = this.getRetryConfig();
         // Handle updates first
-        await Promise.all(connectionsToUpdate.map((conn) => this.client.organizations.connections
-            .update(params.id, conn.connection_id, {
+        await Promise.all(connectionsToUpdate.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.update(params.id, conn.connection_id, {
             organization_connection_name: conn.organization_connection_name,
             assign_membership_on_login: conn.assign_membership_on_login,
             show_as_button: conn.show_as_button,
             is_signup_enabled: conn.is_signup_enabled,
             is_enabled: conn.is_enabled,
             organization_access_level: conn.organization_access_level,
-        })
-            .catch(() => {
+        }), retryConfig).catch(() => {
             throw new Error(`Problem updating Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
-        await Promise.all(connectionsToAdd.map((conn) => this.client.organizations.connections
-            .create(params.id, (0, lodash_1.omit)(conn, 'connection'))
-            .catch(() => {
+        await Promise.all(connectionsToAdd.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.create(params.id, (0, lodash_1.omit)(conn, 'connection')), retryConfig).catch(() => {
             throw new Error(`Problem adding Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
-        await Promise.all(connectionsToRemove.map((conn) => this.client.organizations.connections
-            .delete(params.id, conn.connection_id)
-            .catch(() => {
+        await Promise.all(connectionsToRemove.map((conn) => (0, default_1.retryWithExponentialBackoff)(() => this.client.organizations.connections.delete(params.id, conn.connection_id), retryConfig).catch(() => {
             throw new Error(`Problem removing Enabled Connection ${conn.connection_id} for organizations ${params.id}`);
         })));
         // organization client_grants
@@ -294,6 +309,9 @@ class OrganizationsHandler extends default_1.default {
             ?.map((clientGrant) => ({
             grant_id: this.getClientGrantIDByClientName(clientGrant.client_id),
         })) || [];
+        if (orgClientGrantsToAdd.length > 0 || orgClientGrantsToRemove.length > 0) {
+            changed = true;
+        }
         // Handle updates first
         await Promise.all(orgClientGrantsToAdd.map((orgClientGrant) => this.createOrganizationClientGrants(params.id, orgClientGrant.grant_id).catch(() => {
             throw new Error(`Problem adding organization clientGrant ${orgClientGrant.grant_id} for organizations ${params.id}`);
@@ -315,6 +333,9 @@ class OrganizationsHandler extends default_1.default {
             };
         })
             .filter(Boolean) || [];
+        if (orgDiscoveryDomainsToUpdate.length > 0 || orgDiscoveryDomainsToAdd.length > 0) {
+            changed = true;
+        }
         for (const { id, domain, ...updateParams } of orgDiscoveryDomainsToUpdate) {
             try {
                 await this.updateOrganizationDiscoveryDomain(params.id, id, domain, updateParams);
@@ -338,6 +359,7 @@ class OrganizationsHandler extends default_1.default {
         if (orgDiscoveryDomainsToRemove.length > 0) {
             if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
                 this.config('AUTH0_ALLOW_DELETE') === true) {
+                changed = true;
                 for (const domain of orgDiscoveryDomainsToRemove) {
                     try {
                         await this.deleteOrganizationDiscoveryDomain(params.id, domain.domain, domain.id);
@@ -375,6 +397,7 @@ class OrganizationsHandler extends default_1.default {
         }))
             .filter((oc) => !!oc.client_id);
         if (orgClientsToAdd.length > 0) {
+            changed = true;
             await this.createOrganizationClients(params.id, orgClientsToAdd).catch((err) => {
                 throw new Error(`Problem adding org clients for organization ${params.id}\n${err}`);
             });
@@ -382,6 +405,7 @@ class OrganizationsHandler extends default_1.default {
         if (orgClientsToRemove.length > 0) {
             if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
                 this.config('AUTH0_ALLOW_DELETE') === true) {
+                changed = true;
                 await this.deleteOrganizationClients(params.id, orgClientsToRemove).catch((err) => {
                     throw new Error(`Problem removing org clients for organization ${params.id}\n${err}`);
                 });
@@ -390,6 +414,9 @@ class OrganizationsHandler extends default_1.default {
                 logger_1.default.warn(`Detected the following organization client associations should be removed. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${orgClientsToRemove.join('\n')}`);
             }
         }
+        if (orgClientsToUpdate.length > 0) {
+            changed = true;
+        }
         await Promise.all(orgClientsToUpdate.map((oc) => this.client.organizations.clients
             .update(params.id, oc.client_id, {
             use_for_member_access: oc.use_for_member_access,
@@ -397,7 +424,7 @@ class OrganizationsHandler extends default_1.default {
             .catch((err) => {
             throw new Error(`Problem updating org client ${oc.client_id} for organization ${params.id}\n${err}`);
         })));
-        return params;
+        return changed ? params : null;
     }
     getClientGrantIDByClientName(clientsName) {
         const found = this.formattedClientGrants.find((c) => c.client_id === clientsName);
@@ -435,8 +462,10 @@ class OrganizationsHandler extends default_1.default {
             data: updates || [],
             generator: (item) => this.updateOrganization(item, orgs)
                 .then((data) => {
-                this.didUpdate(data);
-                this.updated += 1;
+                if (data) {
+                    this.didUpdate(data);
+                    this.updated += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem updating ${this.type} ${this.objString(item)}\n${err}`);
@@ -595,8 +624,8 @@ class OrganizationsHandler extends default_1.default {
             if (err.statusCode === 404 || err.statusCode === 501) {
                 return null;
             }
-            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
-                logger_1.default.debug('Organization Discovery domains are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
+            if (isOrgSubresourceUnavailable(err)) {
+                logger_1.default.debug(`Skipping organization discovery domains (${err?.body?.errorCode ?? err.statusCode}).`);
                 return null;
             }
             throw err;
@@ -641,8 +670,8 @@ class OrganizationsHandler extends default_1.default {
             if (err.statusCode === 404 || err.statusCode === 501) {
                 return null;
             }
-            if (err.statusCode === 403 || err.errorCode === 'feature_not_enabled') {
-                logger_1.default.debug('Org-to-app entitlement is not enabled for this tenant. Skipping org-client associations.');
+            if (isOrgSubresourceUnavailable(err)) {
+                logger_1.default.debug(`Skipping org-client associations (${err?.body?.errorCode ?? err.statusCode}).`);
                 return null;
             }
             throw err;