auth0-deploy-cli 9.0.0-beta.1 → 9.0.0

package/lib/context/directory/handlers/emailTemplates.js

@@ -34,6 +34,11 @@ function parse(context) {
             logger_1.default.warn(`Skipping email template file ${meta.body} as missing the corresponding '.json' file`);
             return [];
         }
+        if (meta.body !== undefined) {
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedTemplatePath = path_1.default.resolve(templateFilePath);
+            (0, utils_1.assertInsideConfigRoot)(meta.body, resolvedTemplatePath, configRoot);
+        }
         return {
             ...meta,
             body: (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {

package/lib/context/directory/handlers/guardianEmailFactorSettings.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianEmailFactorSettings = ParsedAsset<'guardianEmailFactorSettings', Asset>;
+declare const guardianEmailFactorSettingsHandler: DirectoryHandler<ParsedGuardianEmailFactorSettings>;
+export default guardianEmailFactorSettingsHandler;

package/lib/context/directory/handlers/guardianEmailFactorSettings.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+function parse(context) {
+    const guardianFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(guardianFolder))
+        return { guardianEmailFactorSettings: null }; // Skip
+    const file = path_1.default.join(guardianFolder, 'emailFactorSettings.json');
+    if (!(0, utils_1.isFile)(file)) {
+        return { guardianEmailFactorSettings: null };
+    }
+    return {
+        guardianEmailFactorSettings: (0, utils_1.loadJSON)(file, {
+            mappings: context.mappings,
+            disableKeywordReplacement: context.disableKeywordReplacement,
+        }),
+    };
+}
+async function dump(context) {
+    const { guardianEmailFactorSettings } = context.assets;
+    if (!guardianEmailFactorSettings)
+        return; // Skip, nothing to dump
+    const guardianFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(guardianFolder);
+    const file = path_1.default.join(guardianFolder, 'emailFactorSettings.json');
+    (0, utils_1.dumpJSON)(file, guardianEmailFactorSettings);
+}
+const guardianEmailFactorSettingsHandler = {
+    parse,
+    dump,
+};
+exports.default = guardianEmailFactorSettingsHandler;

package/lib/context/directory/handlers/guardianPhoneFactorSettings.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianPhoneFactorSettings = ParsedAsset<'guardianPhoneFactorSettings', Asset>;
+declare const guardianPhoneFactorSettingsHandler: DirectoryHandler<ParsedGuardianPhoneFactorSettings>;
+export default guardianPhoneFactorSettingsHandler;

package/lib/context/directory/handlers/guardianPhoneFactorSettings.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+function parse(context) {
+    const guardianFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(guardianFolder))
+        return { guardianPhoneFactorSettings: null }; // Skip
+    const file = path_1.default.join(guardianFolder, 'phoneFactorSettings.json');
+    if (!(0, utils_1.isFile)(file)) {
+        return { guardianPhoneFactorSettings: null };
+    }
+    return {
+        guardianPhoneFactorSettings: (0, utils_1.loadJSON)(file, {
+            mappings: context.mappings,
+            disableKeywordReplacement: context.disableKeywordReplacement,
+        }),
+    };
+}
+async function dump(context) {
+    const { guardianPhoneFactorSettings } = context.assets;
+    if (!guardianPhoneFactorSettings)
+        return; // Skip, nothing to dump
+    const guardianFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(guardianFolder);
+    const file = path_1.default.join(guardianFolder, 'phoneFactorSettings.json');
+    (0, utils_1.dumpJSON)(file, guardianPhoneFactorSettings);
+}
+const guardianPhoneFactorSettingsHandler = {
+    parse,
+    dump,
+};
+exports.default = guardianPhoneFactorSettingsHandler;

package/lib/context/directory/handlers/guardianSettings.d.ts

@@ -0,0 +1,5 @@
+import { DirectoryHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianSettings = ParsedAsset<'guardianSettings', Asset>;
+declare const guardianSettingsHandler: DirectoryHandler<ParsedGuardianSettings>;
+export default guardianSettingsHandler;

package/lib/context/directory/handlers/guardianSettings.js

@@ -0,0 +1,38 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+function parse(context) {
+    const guardianFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(guardianFolder))
+        return { guardianSettings: null }; // Skip
+    const file = path_1.default.join(guardianFolder, 'settings.json');
+    if (!(0, utils_1.isFile)(file)) {
+        return { guardianSettings: null };
+    }
+    return {
+        guardianSettings: (0, utils_1.loadJSON)(file, {
+            mappings: context.mappings,
+            disableKeywordReplacement: context.disableKeywordReplacement,
+        }),
+    };
+}
+async function dump(context) {
+    const { guardianSettings } = context.assets;
+    if (!guardianSettings)
+        return; // Skip, nothing to dump
+    const guardianFolder = path_1.default.join(context.filePath, tools_1.constants.GUARDIAN_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(guardianFolder);
+    const file = path_1.default.join(guardianFolder, 'settings.json');
+    (0, utils_1.dumpJSON)(file, guardianSettings);
+}
+const guardianSettingsHandler = {
+    parse,
+    dump,
+};
+exports.default = guardianSettingsHandler;

package/lib/context/directory/handlers/hooks.js

@@ -21,7 +21,14 @@ function parse(context) {
             }),
         };
         if (hook.script) {
-            hook.script = context.loadFile(hook.script, tools_1.constants.HOOKS_DIRECTORY);
+            const normalizedScript = hook.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.HOOKS_DIRECTORY, normalizedScript);
+            (0, utils_1.assertInsideConfigRoot)(hook.script, resolvedPath, configRoot);
+            hook.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         hook.name = hook.name.toLowerCase().replace(/\s/g, '-');
         return hook;

package/lib/context/directory/handlers/index.js

@@ -17,6 +17,9 @@ const guardianFactorProviders_1 = __importDefault(require("./guardianFactorProvi
 const guardianFactorTemplates_1 = __importDefault(require("./guardianFactorTemplates"));
 const guardianPhoneFactorMessageTypes_1 = __importDefault(require("./guardianPhoneFactorMessageTypes"));
 const guardianPhoneFactorSelectedProvider_1 = __importDefault(require("./guardianPhoneFactorSelectedProvider"));
+const guardianPhoneFactorSettings_1 = __importDefault(require("./guardianPhoneFactorSettings"));
+const guardianEmailFactorSettings_1 = __importDefault(require("./guardianEmailFactorSettings"));
+const guardianSettings_1 = __importDefault(require("./guardianSettings"));
 const guardianPolicies_1 = __importDefault(require("./guardianPolicies"));
 const roles_1 = __importDefault(require("./roles"));
 const actions_1 = __importDefault(require("./actions"));
@@ -38,12 +41,15 @@ const rulesConfigs_1 = __importDefault(require("./rulesConfigs"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const directoryHandlers = {
     rules: rules_1.default,
@@ -63,6 +69,9 @@ const directoryHandlers = {
     guardianFactorTemplates: guardianFactorTemplates_1.default,
     guardianPhoneFactorMessageTypes: guardianPhoneFactorMessageTypes_1.default,
     guardianPhoneFactorSelectedProvider: guardianPhoneFactorSelectedProvider_1.default,
+    guardianPhoneFactorSettings: guardianPhoneFactorSettings_1.default,
+    guardianEmailFactorSettings: guardianEmailFactorSettings_1.default,
+    guardianSettings: guardianSettings_1.default,
     guardianPolicies: guardianPolicies_1.default,
     roles: roles_1.default,
     actions: actions_1.default,
@@ -82,11 +91,14 @@ const directoryHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = directoryHandlers;

package/lib/context/directory/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: DirectoryHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/directory/handlers/networkACLKeys.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+function parse(context) {
+    const networkACLKeysDirectory = path_1.default.join(context.filePath, tools_1.constants.NETWORK_ACL_KEYS_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(networkACLKeysDirectory))
+        return { networkACLKeys: null }; // Skip
+    const foundFiles = (0, utils_1.getFiles)(networkACLKeysDirectory, ['.json']);
+    const networkACLKeys = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0); // Filter out empty configs
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return; // Skip, nothing to dump
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return;
+    }
+    const networkACLKeysDirectory = path_1.default.join(context.filePath, tools_1.constants.NETWORK_ACL_KEYS_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(networkACLKeysDirectory);
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys.forEach((networkACLKey) => {
+        const out = { ...networkACLKey };
+        removeKeysFromOutput.forEach((key) => {
+            if (key in out)
+                delete out[key];
+        });
+        const fileName = (0, utils_1.sanitize)(networkACLKey.name);
+        const filePath = path_1.default.join(networkACLKeysDirectory, `${fileName}.json`);
+        (0, utils_1.dumpJSON)(filePath, out);
+    });
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/context/directory/handlers/prompts.js

@@ -46,9 +46,13 @@ function parse(context) {
             const screensObject = screensArray[0];
             acc[promptName] = Object.entries(screensObject).reduce((screenAcc, [screenName, items]) => {
                 screenAcc[screenName] = items.reduce((insertionAcc, { name, template }) => {
-                    const templateFilePath = path_1.default.join(promptsDirectory, template);
-                    insertionAcc[name] = (0, utils_1.isFile)(templateFilePath)
-                        ? (0, tools_1.loadFileAndReplaceKeywords)(templateFilePath, {
+                    const configRoot = path_1.default.resolve(context.filePath);
+                    const resolvedTemplatePath = path_1.default.resolve(promptsDirectory, template);
+                    if ((0, utils_1.isFile)(resolvedTemplatePath)) {
+                        (0, utils_1.assertInsideConfigRoot)(template, resolvedTemplatePath, configRoot);
+                    }
+                    insertionAcc[name] = (0, utils_1.isFile)(resolvedTemplatePath)
+                        ? (0, tools_1.loadFileAndReplaceKeywords)(resolvedTemplatePath, {
                             mappings: context.mappings,
                             disableKeywordReplacement: context.disableKeywordReplacement,
                         }).trim()

package/lib/context/directory/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { DirectoryHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: DirectoryHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/directory/handlers/rateLimitPolicies.js

@@ -0,0 +1,53 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = __importDefault(require("path"));
+const fs_extra_1 = __importDefault(require("fs-extra"));
+const tools_1 = require("../../../tools");
+const utils_1 = require("../../../utils");
+function parse(context) {
+    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
+    if (!(0, utils_1.existsMustBeDir)(rateLimitPoliciesDirectory))
+        return { rateLimitPolicies: null }; // Skip
+    const foundFiles = (0, utils_1.getFiles)(rateLimitPoliciesDirectory, ['.json']);
+    const rateLimitPolicies = foundFiles
+        .map((f) => (0, utils_1.loadJSON)(f, {
+        mappings: context.mappings,
+        disableKeywordReplacement: context.disableKeywordReplacement,
+    }))
+        .filter((p) => Object.keys(p).length > 0);
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return; // Skip, nothing to dump
+    const rateLimitPoliciesDirectory = path_1.default.join(context.filePath, tools_1.constants.RATE_LIMIT_POLICIES_DIRECTORY);
+    fs_extra_1.default.ensureDirSync(rateLimitPoliciesDirectory);
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const expectedFiles = new Set();
+    rateLimitPolicies.forEach((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        const fileName = (0, utils_1.sanitize)(policy.consumer_selector);
+        const filePath = path_1.default.join(rateLimitPoliciesDirectory, `${fileName}.json`);
+        expectedFiles.add(`${fileName}.json`);
+        (0, utils_1.dumpJSON)(filePath, policyToWrite);
+    });
+    // Remove files for policies that no longer exist in the tenant
+    for (const existing of fs_extra_1.default.readdirSync(rateLimitPoliciesDirectory)) {
+        const fullPath = path_1.default.join(rateLimitPoliciesDirectory, existing);
+        if (fs_extra_1.default.statSync(fullPath).isFile() && !expectedFiles.has(existing)) {
+            fs_extra_1.default.removeSync(fullPath);
+        }
+    }
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/context/directory/handlers/rules.js

@@ -21,7 +21,14 @@ function parse(context) {
             }),
         };
         if (rule.script) {
-            rule.script = context.loadFile(rule.script, tools_1.constants.RULES_DIRECTORY);
+            const normalizedScript = rule.script.replace(/\\/g, '/');
+            const configRoot = path_1.default.resolve(context.filePath);
+            const resolvedPath = path_1.default.resolve(context.filePath, tools_1.constants.RULES_DIRECTORY, normalizedScript);
+            (0, utils_1.assertInsideConfigRoot)(rule.script, resolvedPath, configRoot);
+            rule.script = (0, tools_1.loadFileAndReplaceKeywords)(resolvedPath, {
+                mappings: context.mappings,
+                disableKeywordReplacement: context.disableKeywordReplacement,
+            });
         }
         return rule;
     });

package/lib/context/directory/index.js

@@ -68,13 +68,10 @@ class DirectoryContext {
         };
     }
     loadFile(f, folder) {
-        const resolvedBase = path.resolve(this.filePath);
-        const inSubfolder = path.resolve(this.filePath, folder, f);
-        const inRoot = path.resolve(this.filePath, f);
-        const toLoad = (0, utils_1.isFile)(inSubfolder) ? inSubfolder : inRoot;
-        if (!toLoad.startsWith(resolvedBase + path.sep)) {
-            throw new Error(`File reference "${f}" must be relative to the config directory. Absolute paths and paths outside the config root are not supported.`);
-        }
+        const configRoot = path.resolve(this.filePath);
+        const basePath = path.resolve(this.filePath, folder);
+        const toLoad = path.resolve(basePath, f.replace(/\\/g, '/'));
+        (0, utils_1.assertInsideConfigRoot)(f, toLoad, configRoot);
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,

package/lib/context/index.js

@@ -118,44 +118,44 @@ const setupContext = async (config, command) => {
             logger_1.default.info('To enable experimental early access features use --experimental_ea flag or set AUTH0_EXPERIMENTAL_EA=true in configuration JSON.');
         }
     })(config);
-    const accessToken = await (async () => {
-        const { AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_ACCESS_TOKEN, AUTH0_CLIENT_SECRET, AUTH0_CLIENT_SIGNING_KEY_PATH, AUTH0_CLIENT_SIGNING_ALGORITHM, } = config;
+    const { AUTH0_DOMAIN, AUTH0_CLIENT_ID, AUTH0_ACCESS_TOKEN, AUTH0_CLIENT_SECRET, AUTH0_CLIENT_SIGNING_KEY_PATH, AUTH0_CLIENT_SIGNING_ALGORITHM, } = config;
+    if (!AUTH0_ACCESS_TOKEN && !AUTH0_CLIENT_SECRET && !AUTH0_CLIENT_SIGNING_KEY_PATH) {
+        throw new Error('need to supply either `AUTH0_ACCESS_TOKEN`, `AUTH0_CLIENT_SECRET` or `AUTH0_CLIENT_SIGNING_KEY_PATH`');
+    }
+    // node-auth0 v7 removed the AuthenticationClient. `createManagementAuth`
+    // performs the client-credentials grant on our behalf and caches/refreshes
+    // the resulting token. We resolve a token supplier here so the
+    // ManagementClient auto-refreshes during long-running operations, and eagerly
+    // call it once below to preserve the previous fail-fast behaviour (a bad
+    // secret/signing key surfaces at startup, not mid-operation).
+    const tokenSupplier = await (async () => {
         if (!!AUTH0_ACCESS_TOKEN)
             return AUTH0_ACCESS_TOKEN;
-        if (!AUTH0_CLIENT_SECRET && !AUTH0_CLIENT_SIGNING_KEY_PATH) {
-            throw new Error('need to supply either `AUTH0_ACCESS_TOKEN`, `AUTH0_CLIENT_SECRET` or `AUTH0_CLIENT_SIGNING_KEY_PATH`');
-        }
-        const authClient = (() => {
-            if (!!AUTH0_CLIENT_SECRET) {
-                return new auth0_1.AuthenticationClient({
-                    domain: AUTH0_DOMAIN,
-                    clientId: AUTH0_CLIENT_ID,
-                    clientSecret: AUTH0_CLIENT_SECRET,
-                });
+        const audience = config.AUTH0_AUDIENCE
+            ? config.AUTH0_AUDIENCE
+            : `https://${AUTH0_DOMAIN}/api/v2/`;
+        const credentials = !!AUTH0_CLIENT_SECRET
+            ? {
+                clientId: AUTH0_CLIENT_ID,
+                clientSecret: AUTH0_CLIENT_SECRET,
+                audience,
             }
-            return new auth0_1.AuthenticationClient({
-                domain: AUTH0_DOMAIN,
+            : {
                 clientId: AUTH0_CLIENT_ID,
                 clientAssertionSigningKey: (0, fs_1.readFileSync)(AUTH0_CLIENT_SIGNING_KEY_PATH, 'utf8'),
-                clientAssertionSigningAlg: !!AUTH0_CLIENT_SIGNING_ALGORITHM
-                    ? AUTH0_CLIENT_SIGNING_ALGORITHM
-                    : undefined,
-            });
-        })();
-        const clientCredentials = await authClient.oauth.clientCredentialsGrant({
-            audience: config.AUTH0_AUDIENCE
-                ? config.AUTH0_AUDIENCE
-                : `https://${config.AUTH0_DOMAIN}/api/v2/`,
-        });
-        const clientAccessToken = clientCredentials.data?.access_token;
-        if (!clientAccessToken) {
-            throw new Error('Failed to retrieve access token.');
-        }
-        return clientAccessToken;
+                ...(!!AUTH0_CLIENT_SIGNING_ALGORITHM
+                    ? { clientAssertionSigningAlg: AUTH0_CLIENT_SIGNING_ALGORITHM }
+                    : {}),
+                audience,
+            };
+        const auth = (0, auth0_1.createManagementAuth)({ domain: AUTH0_DOMAIN, ...credentials });
+        // Fail fast: validates credentials (and the signing key) up-front.
+        await auth.getToken();
+        return () => auth.getToken();
     })();
     const mgmtClient = new auth0_1.ManagementClient({
-        domain: config.AUTH0_DOMAIN,
-        token: accessToken,
+        domain: AUTH0_DOMAIN,
+        token: tokenSupplier,
         headers: {
             'User-agent': `deploy-cli/${packageVersion} (node.js/${process.version.replace('v', '')})`,
             ...((0, utils_1.isTruthy)(config.AUTH0_DRY_RUN)

package/lib/context/yaml/handlers/attackProtection.js

@@ -27,7 +27,7 @@ async function dump(context) {
     }
     const maskedAttackProtection = (0, defaults_1.attackProtectionDefaults)(attackProtectionConfig, context.config);
     return {
-        attackProtection: maskedAttackProtection,
+        attackProtection: (0, defaults_1.sortAttackProtectionArrays)(maskedAttackProtection),
     };
 }
 const attackProtectionHandler = {

package/lib/context/yaml/handlers/branding.js

@@ -18,9 +18,12 @@ async function parse(context) {
     const parsedTemplates = templates.map((templateDefinition) => {
         const normalizedPathArray = (0, utils_1.nomalizedYAMLPath)(templateDefinition.body);
         const markupFile = path_1.default.join(context.basePath, ...normalizedPathArray);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedMarkupFile = path_1.default.resolve(markupFile);
+        (0, utils_1.assertInsideConfigRoot)(templateDefinition.body, resolvedMarkupFile, configRoot);
         return {
             template: templateDefinition.template,
-            body: (0, tools_1.loadFileAndReplaceKeywords)(markupFile, {
+            body: (0, tools_1.loadFileAndReplaceKeywords)(resolvedMarkupFile, {
                 mappings: context.mappings,
                 disableKeywordReplacement: context.disableKeywordReplacement,
             }),

package/lib/context/yaml/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+type ParsedClientAuthCredentials = ParsedAsset<'clientAuthCredentials', null>;
+declare const clientAuthCredentialsHandler: YAMLHandler<ParsedClientAuthCredentials>;
+export default clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clientAuthCredentials.js

@@ -0,0 +1,13 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(_context) {
+    return { clientAuthCredentials: null };
+}
+async function dump(_context) {
+    return { clientAuthCredentials: null };
+}
+const clientAuthCredentialsHandler = {
+    parse,
+    dump,
+};
+exports.default = clientAuthCredentialsHandler;

package/lib/context/yaml/handlers/clients.js

@@ -21,7 +21,10 @@ async function parse(context) {
                 if (client.custom_login_page) {
                     const htmlFileName = path_1.default.join(clientsFolder, client.custom_login_page);
                     if ((0, utils_1.isFile)(htmlFileName)) {
-                        client.custom_login_page = context.loadFile(htmlFileName);
+                        // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                        // Passing htmlFileName (which already includes basePath) would cause double resolution
+                        // when basePath is a relative path (e.g. when AUTH0_INPUT_FILE is a relative path).
+                        client.custom_login_page = context.loadFile(path_1.default.join(tools_1.constants.CLIENTS_DIRECTORY, client.custom_login_page));
                     }
                 }
                 return client;
@@ -99,6 +102,21 @@ async function dump(context) {
                         organization_require_behavior: client.organization_require_behavior,
                     };
                 }
+                else {
+                    // strip id-only credentials and remove client_authentication_methods entirely
+                    // if no named credentials remain — an absent field is treated as deletion on deploy
+                    if (client.client_authentication_methods) {
+                        Object.values(client.client_authentication_methods).forEach((method) => {
+                            if (method?.credentials) {
+                                method.credentials = method.credentials.filter((c) => c.name);
+                            }
+                        });
+                        const hasAnyCredentials = Object.values(client.client_authentication_methods).some((method) => method?.credentials?.length > 0);
+                        if (!hasAnyCredentials) {
+                            delete client.client_authentication_methods;
+                        }
+                    }
+                }
                 return (0, utils_1.clearClientArrays)(client);
             }),
         ],

package/lib/context/yaml/handlers/connections.js

@@ -26,7 +26,9 @@ async function parse(context) {
                         logger_1.default.error(missingTemplateErrorMessage);
                         throw new Error(missingTemplateErrorMessage);
                     }
-                    connection.options.email.body = context.loadFile(htmlFileName);
+                    // Pass a path relative to basePath so context.loadFile() resolves it correctly.
+                    // Passing htmlFileName (which already includes basePath) would cause double resolution.
+                    connection.options.email.body = context.loadFile(path_1.default.join(tools_1.constants.CONNECTIONS_DIRECTORY, connection.options.email.body));
                 }
                 return connection;
             }),
@@ -43,6 +45,11 @@ async function dump(context) {
     if (excludedConnections.length) {
         connections = connections.filter((connection) => !excludedConnections.includes(connection.name));
     }
+    // Filter to included connections
+    const includedConnections = (context.assets.include && context.assets.include.connections) || [];
+    if (includedConnections.length) {
+        connections = connections.filter((connection) => includedConnections.includes(connection.name));
+    }
     return {
         connections: connections.map((connection) => {
             let dumpedConnection = {

package/lib/context/yaml/handlers/flows.js

@@ -14,6 +14,9 @@ async function parse(context) {
         return { flows: null };
     const parsedFlows = flows.map((flow) => {
         const flowFile = path_1.default.join(context.basePath, flow.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFlowFile = path_1.default.resolve(flowFile);
+        (0, utils_1.assertInsideConfigRoot)(flow.body, resolvedFlowFile, configRoot);
         const parsedFlowBody = (0, utils_1.loadJSON)(flowFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/forms.js

@@ -14,6 +14,9 @@ async function parse(context) {
         return { forms: null };
     const parsedForms = forms.map((form) => {
         const formFile = path_1.default.join(context.basePath, form.body);
+        const configRoot = path_1.default.resolve(context.basePath);
+        const resolvedFormFile = path_1.default.resolve(formFile);
+        (0, utils_1.assertInsideConfigRoot)(form.body, resolvedFormFile, configRoot);
         const parsedFormBody = (0, utils_1.loadJSON)(formFile, {
             mappings: context.mappings,
             disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/guardianEmailFactorSettings.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianEmailFactorSettings = ParsedAsset<'guardianEmailFactorSettings', Asset>;
+declare const guardianEmailFactorSettingsHandler: YAMLHandler<ParsedGuardianEmailFactorSettings>;
+export default guardianEmailFactorSettingsHandler;

package/lib/context/yaml/handlers/guardianEmailFactorSettings.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parseAndDump(context) {
+    const { guardianEmailFactorSettings } = context.assets;
+    if (!guardianEmailFactorSettings)
+        return { guardianEmailFactorSettings: null };
+    return {
+        guardianEmailFactorSettings,
+    };
+}
+const guardianEmailFactorSettingsHandler = {
+    parse: parseAndDump,
+    dump: parseAndDump,
+};
+exports.default = guardianEmailFactorSettingsHandler;

package/lib/context/yaml/handlers/guardianPhoneFactorSettings.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianPhoneFactorSettings = ParsedAsset<'guardianPhoneFactorSettings', Asset>;
+declare const guardianPhoneFactorSettingsHandler: YAMLHandler<ParsedGuardianPhoneFactorSettings>;
+export default guardianPhoneFactorSettingsHandler;