auth0-deploy-cli 9.0.0-beta.1 → 9.0.0

package/lib/tools/auth0/handlers/guardianEmailFactorSettings.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
+exports.schema = {
+    type: 'object',
+    properties: {
+        otp_length: {
+            type: 'number',
+            description: 'The length of the OTP code.',
+        },
+        otp_expiration_time: {
+            type: 'number',
+            description: 'The OTP expiration time in seconds.',
+        },
+    },
+    additionalProperties: false,
+};
+class GuardianEmailFactorSettingsHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'guardianEmailFactorSettings',
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const data = await this.client.guardian.factors.email.get();
+            this.existing = data;
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err)) {
+                // Gracefully skip processing this configuration value.
+                return null;
+            }
+            if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                return null;
+            }
+            throw err;
+        }
+        return this.existing;
+    }
+    async processChanges(assets) {
+        // No API to delete or create guardianEmailFactorSettings, we can only update.
+        const { guardianEmailFactorSettings } = assets;
+        // Do nothing if not set
+        if (!guardianEmailFactorSettings) {
+            return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        try {
+            await this.client.guardian.factors.email.set(guardianEmailFactorSettings);
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is unavailable (404) or disabled (403) on this tenant; skip instead of failing
+                // the import. The 403 path logs a warning via isForbiddenFeatureError; the 404 path is silent.
+                return;
+            }
+            throw err;
+        }
+        this.updated += 1;
+        this.didUpdate(guardianEmailFactorSettings);
+    }
+}
+exports.default = GuardianEmailFactorSettingsHandler;

package/lib/tools/auth0/handlers/guardianFactorTemplates.js

@@ -60,11 +60,20 @@ class GuardianFactorTemplatesHandler extends default_1.default {
         await Promise.all(guardianFactorTemplates.map(async (fatorTemplates) => {
             const { name, ...data } = fatorTemplates;
             const params = { name: fatorTemplates.name };
-            if (name === 'sms') {
-                await this.client.guardian.factors.sms.setTemplates(data);
+            try {
+                if (name === 'sms') {
+                    await this.client.guardian.factors.sms.setTemplates(data);
+                }
+                else if (name === 'phone') {
+                    await this.client.guardian.factors.phone.setTemplates(data);
+                }
             }
-            else if (name === 'phone') {
-                await this.client.guardian.factors.phone.setTemplates(data);
+            catch (err) {
+                if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                    // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                    return;
+                }
+                throw err;
             }
             this.didUpdate(params);
             this.updated += 1;

package/lib/tools/auth0/handlers/guardianPhoneFactorMessageTypes.js

@@ -25,14 +25,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'voice_mfa_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneMessageTypesHandler extends default_1.default {
@@ -75,7 +68,16 @@ class GuardianPhoneMessageTypesHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorMessageTypes;
-        await this.client.guardian.factors.phone.setMessageTypes(data);
+        try {
+            await this.client.guardian.factors.phone.setMessageTypes(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorMessageTypes);
     }

package/lib/tools/auth0/handlers/guardianPhoneFactorSelectedProvider.js

@@ -22,14 +22,7 @@ const isFeatureUnavailableError = (err) => {
         // Older Management API version where the endpoint is not available.
         return true;
     }
-    if (err.statusCode === 403 &&
-        err.originalError &&
-        err.originalError.response &&
-        err.originalError.response.body &&
-        err.originalError.response.body.errorCode === 'hooks_not_allowed') {
-        // Recent Management API version, but with feature explicitly disabled.
-        return true;
-    }
+    // 403s (feature explicitly disabled) are handled by isForbiddenFeatureError.
     return false;
 };
 class GuardianPhoneSelectedProviderHandler extends default_1.default {
@@ -72,7 +65,16 @@ class GuardianPhoneSelectedProviderHandler extends default_1.default {
             }
         }
         const data = guardianPhoneFactorSelectedProvider;
-        await this.client.guardian.factors.phone.setProvider(data);
+        try {
+            await this.client.guardian.factors.phone.setProvider(data);
+        }
+        catch (err) {
+            if (isFeatureUnavailableError(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is deprecated/disabled on this tenant; warn and skip instead of failing the import.
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPhoneFactorSelectedProvider);
     }

package/lib/tools/auth0/handlers/guardianPhoneFactorSettings.d.ts

@@ -0,0 +1,22 @@
+import DefaultHandler from './default';
+import { Asset, Assets } from '../../../types';
+export declare const schema: {
+    type: string;
+    properties: {
+        otp_length: {
+            type: string;
+            description: string;
+        };
+        otp_expiration_time: {
+            type: string;
+            description: string;
+        };
+    };
+    additionalProperties: boolean;
+};
+export default class GuardianPhoneFactorSettingsHandler extends DefaultHandler {
+    existing: Asset;
+    constructor(options: any);
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/guardianPhoneFactorSettings.js

@@ -0,0 +1,77 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
+exports.schema = {
+    type: 'object',
+    properties: {
+        otp_length: {
+            type: 'number',
+            description: 'The length of the OTP code.',
+        },
+        otp_expiration_time: {
+            type: 'number',
+            description: 'The OTP expiration time in seconds.',
+        },
+    },
+    additionalProperties: false,
+};
+class GuardianPhoneFactorSettingsHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'guardianPhoneFactorSettings',
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const data = await this.client.guardian.factors.phone.get();
+            this.existing = data;
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err)) {
+                // Gracefully skip processing this configuration value.
+                return null;
+            }
+            if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                return null;
+            }
+            throw err;
+        }
+        return this.existing;
+    }
+    async processChanges(assets) {
+        // No API to delete or create guardianPhoneFactorSettings, we can only update.
+        const { guardianPhoneFactorSettings } = assets;
+        // Do nothing if not set
+        if (!guardianPhoneFactorSettings) {
+            return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        try {
+            await this.client.guardian.factors.phone.set(guardianPhoneFactorSettings);
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is unavailable (404) or disabled (403) on this tenant; skip instead of failing
+                // the import. The 403 path logs a warning via isForbiddenFeatureError; the 404 path is silent.
+                return;
+            }
+            throw err;
+        }
+        this.updated += 1;
+        this.didUpdate(guardianPhoneFactorSettings);
+    }
+}
+exports.default = GuardianPhoneFactorSettingsHandler;

package/lib/tools/auth0/handlers/guardianPolicies.js

@@ -7,6 +7,7 @@ exports.schema = void 0;
 const default_1 = __importDefault(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
 const utils_1 = require("../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'object',
     properties: {
@@ -48,7 +49,16 @@ class GuardianPoliciesHandler extends default_1.default {
             }
         }
         const data = guardianPolicies.policies;
-        await this.client.guardian.policies.set(data);
+        try {
+            await this.client.guardian.policies.set(data);
+        }
+        catch (err) {
+            if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                logger_1.default.warn('Skipping guardianPolicies deploy: tenant does not have Adaptive MFA entitlement (confidence-score requires an Enterprise add-on)');
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPolicies);
     }

package/lib/tools/auth0/handlers/guardianSettings.d.ts

@@ -0,0 +1,30 @@
+import DefaultHandler from './default';
+import { Asset, Assets } from '../../../types';
+export declare const schema: {
+    type: string;
+    properties: {
+        display_remember_me_checkbox: {
+            type: string;
+            description: string;
+        };
+        remember_me_default_value: {
+            type: string;
+            description: string;
+        };
+        mfa_session_inactivity_timeout: {
+            type: string;
+            description: string;
+        };
+        mfa_session_overall_timeout: {
+            type: string;
+            description: string;
+        };
+    };
+    additionalProperties: boolean;
+};
+export default class GuardianSettingsHandler extends DefaultHandler {
+    existing: Asset;
+    constructor(options: any);
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/guardianSettings.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
+exports.schema = {
+    type: 'object',
+    properties: {
+        display_remember_me_checkbox: {
+            type: 'boolean',
+            description: 'Determines whether to display the "Remember Me" checkbox on the MFA prompt in Universal Login.',
+        },
+        remember_me_default_value: {
+            type: 'boolean',
+            description: 'Determines the default state of the "Remember Me" checkbox on the MFA prompt in Universal Login.',
+        },
+        mfa_session_inactivity_timeout: {
+            type: 'number',
+            description: 'Duration of inactivity (seconds) after which the user will be prompted for MFA. Cannot exceed the overall timeout.',
+        },
+        mfa_session_overall_timeout: {
+            type: 'number',
+            description: 'Maximum duration (seconds) after which the user will be prompted for MFA regardless of activity.',
+        },
+    },
+    additionalProperties: false,
+};
+class GuardianSettingsHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'guardianSettings',
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const data = await this.client.guardian.get();
+            this.existing = data;
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err)) {
+                // Gracefully skip processing this configuration value.
+                return null;
+            }
+            if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                return null;
+            }
+            throw err;
+        }
+        return this.existing;
+    }
+    async processChanges(assets) {
+        // No API to delete or create guardianSettings, we can only update.
+        const { guardianSettings } = assets;
+        // Do nothing if not set
+        if (!guardianSettings) {
+            return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        try {
+            await this.client.guardian.set(guardianSettings);
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is unavailable (404) or disabled (403) on this tenant; skip instead of failing
+                // the import. The 403 path logs a warning via isForbiddenFeatureError; the 404 path is silent.
+                return;
+            }
+            throw err;
+        }
+        this.updated += 1;
+        this.didUpdate(guardianSettings);
+    }
+}
+exports.default = GuardianSettingsHandler;

package/lib/tools/auth0/handlers/hooks.js

@@ -151,7 +151,7 @@ class HooksHandler extends default_1.default {
                 .get(hook.id)
                 .then((hookWithCode) => this.client.hooks.secrets
                 .get(hook.id)
-                .then(({ data: secrets }) => ({ ...hookWithCode, secrets })))));
+                .then((secrets) => ({ ...hookWithCode, secrets })))));
             return this.existing;
         }
         catch (err) {

package/lib/tools/auth0/handlers/index.js

@@ -51,6 +51,9 @@ const guardianFactorTemplates = __importStar(require("./guardianFactorTemplates"
 const guardianPolicies = __importStar(require("./guardianPolicies"));
 const guardianPhoneFactorSelectedProvider = __importStar(require("./guardianPhoneFactorSelectedProvider"));
 const guardianPhoneFactorMessageTypes = __importStar(require("./guardianPhoneFactorMessageTypes"));
+const guardianPhoneFactorSettings = __importStar(require("./guardianPhoneFactorSettings"));
+const guardianEmailFactorSettings = __importStar(require("./guardianEmailFactorSettings"));
+const guardianSettings = __importStar(require("./guardianSettings"));
 const roles = __importStar(require("./roles"));
 const branding = __importStar(require("./branding"));
 const phoneProviders = __importStar(require("./phoneProvider"));
@@ -69,12 +72,16 @@ const forms = __importStar(require("./forms"));
 const flows = __importStar(require("./flows"));
 const flowVaultConnections = __importStar(require("./flowVaultConnections"));
 const selfServiceProfiles = __importStar(require("./selfServiceProfiles"));
+const networkACLKeys = __importStar(require("./networkACLKeys"));
 const networkACLs = __importStar(require("./networkACLs"));
 const userAttributeProfiles = __importStar(require("./userAttributeProfiles"));
 const connectionProfiles = __importStar(require("./connectionProfiles"));
 const tokenExchangeProfiles = __importStar(require("./tokenExchangeProfiles"));
 const supplementalSignals = __importStar(require("./supplementalSignals"));
+const rateLimitPolicies = __importStar(require("./rateLimitPolicies"));
 const eventStreams = __importStar(require("./eventStreams"));
+const clientAuthCredentials = __importStar(require("./clientAuthCredentials"));
+const clientAuthCredentialsPre = __importStar(require("./clientAuthCredentialsPre"));
 const auth0ApiHandlers = {
     rules,
     rulesConfigs,
@@ -94,6 +101,9 @@ const auth0ApiHandlers = {
     guardianPolicies,
     guardianPhoneFactorSelectedProvider,
     guardianPhoneFactorMessageTypes,
+    guardianPhoneFactorSettings,
+    guardianEmailFactorSettings,
+    guardianSettings,
     roles,
     branding,
     phoneProviders,
@@ -113,11 +123,17 @@ const auth0ApiHandlers = {
     flows,
     flowVaultConnections,
     selfServiceProfiles,
+    networkACLKeys,
     networkACLs,
     userAttributeProfiles,
     connectionProfiles,
     tokenExchangeProfiles,
     supplementalSignals,
+    rateLimitPolicies,
     eventStreams,
+    clientAuthCredentials,
+    // clientAuthCredentialsPre is a deploy-only pre-pass handler (order 40) — not a user-facing
+    // asset type so it is not in AssetTypes, but must be registered here to run during deploy.
+    ...{ clientAuthCredentialsPre },
 };
 exports.default = auth0ApiHandlers; // TODO: apply stronger types to schema properties

package/lib/tools/auth0/handlers/networkACLKeys.d.ts

@@ -0,0 +1,45 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+export type NetworkAclKey = Management.NetworkAclKey & {
+    value?: string;
+};
+export declare const schema: {
+    type: string;
+    description: string;
+    items: {
+        type: string;
+        required: string[];
+        properties: {
+            id: {
+                type: string;
+            };
+            name: {
+                type: string;
+                maxLength: number;
+            };
+            alg: {
+                type: string;
+                enum: string[];
+            };
+            value: {
+                type: string;
+            };
+            fingerprint: {
+                type: string;
+            };
+        };
+        additionalProperties: boolean;
+    };
+};
+export default class NetworkACLKeysHandler extends DefaultAPIHandler {
+    existing: NetworkAclKey[] | null;
+    constructor(config: DefaultAPIHandler);
+    objString(key: NetworkAclKey): string;
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+    createNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    createNetworkACLKeys(creates: CalculatedChanges['create']): Promise<void>;
+    deleteNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    deleteNetworkACLKeys(data: Asset[]): Promise<void>;
+}