auth0-deploy-cli 9.0.0-beta.2 → 9.0.0

package/lib/tools/auth0/handlers/rateLimitPolicies.js

@@ -0,0 +1,203 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const auth0_1 = require("auth0");
+const default_1 = __importDefault(require("./default"));
+const client_1 = require("../client");
+const utils_1 = require("../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: {
+        type: 'object',
+        properties: {
+            resource: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.RateLimitPolicyResourceEnum),
+            },
+            consumer: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.RateLimitPolicyConsumerEnum),
+            },
+            consumer_selector: {
+                type: 'string',
+            },
+            configuration: {
+                type: 'object',
+                oneOf: [
+                    {
+                        required: ['action'],
+                        properties: {
+                            action: { type: 'string', enum: ['allow'] },
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        required: ['action', 'limit'],
+                        properties: {
+                            action: { type: 'string', enum: ['block', 'log'] },
+                            limit: { type: 'number' },
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        required: ['action', 'limit', 'redirect_uri'],
+                        properties: {
+                            action: { type: 'string', enum: ['redirect'] },
+                            limit: { type: 'number' },
+                            redirect_uri: { type: 'string' },
+                        },
+                        additionalProperties: false,
+                    },
+                ],
+            },
+        },
+        required: ['resource', 'consumer', 'consumer_selector', 'configuration'],
+    },
+};
+class RateLimitPoliciesHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'rateLimitPolicies',
+            id: 'id',
+            identifiers: ['id', 'consumer_selector'],
+            stripCreateFields: ['id', 'created_at', 'updated_at'],
+            stripUpdateFields: [
+                'id',
+                'resource',
+                'consumer',
+                'consumer_selector',
+                'created_at',
+                'updated_at',
+            ],
+        });
+    }
+    objString(policy) {
+        return super.objString({
+            consumer_selector: policy.consumer_selector,
+            resource: policy.resource,
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const rateLimitPolicies = await (0, client_1.paginate)(this.client.rateLimitPolicies.list, { checkpoint: true });
+            this.existing = rateLimitPolicies;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403) {
+                logger_1.default.debug('Rate Limit Policies feature is not enabled for this tenant. Please contact Auth0 support to enable this feature.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async processChanges(assets) {
+        const { rateLimitPolicies } = assets;
+        if (!rateLimitPolicies)
+            return;
+        const { del, update, create } = await this.calcChanges(assets);
+        if ((0, utils_1.isDryRun)(this.config)) {
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        logger_1.default.debug(`Start processChanges for rateLimitPolicies [delete:${del.length}] [update:${update.length}], [create:${create.length}]`);
+        const changes = [{ del }, { create }, { update }];
+        await Promise.all(changes.map(async (change) => {
+            switch (true) {
+                case change.del && change.del.length > 0:
+                    await this.deleteRateLimitPolicies(change.del);
+                    break;
+                case change.create && change.create.length > 0:
+                    await this.createRateLimitPolicies(change.create);
+                    break;
+                case change.update && change.update.length > 0:
+                    await this.updateRateLimitPolicies(change.update);
+                    break;
+                default:
+                    break;
+            }
+        }));
+    }
+    async createRateLimitPolicy(policy) {
+        const created = await this.client.rateLimitPolicies.create(policy);
+        return created;
+    }
+    async createRateLimitPolicies(creates) {
+        await this.client.pool
+            .addEachTask({
+            data: creates || [],
+            generator: (item) => this.createRateLimitPolicy(item)
+                .then((data) => {
+                this.didCreate(data);
+                this.created += 1;
+            })
+                .catch((err) => {
+                throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async updateRateLimitPolicy(policy) {
+        const { id, configuration } = policy;
+        if (!id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(policy)}`);
+        }
+        await this.client.rateLimitPolicies.update(id, { configuration });
+    }
+    async updateRateLimitPolicies(updates) {
+        await this.client.pool
+            .addEachTask({
+            data: updates || [],
+            generator: (item) => this.updateRateLimitPolicy(item)
+                .then(() => {
+                this.didUpdate(item);
+                this.updated += 1;
+            })
+                .catch((err) => {
+                throw new Error(`Problem updating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async deleteRateLimitPolicy(policy) {
+        if (!policy.id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(policy)}`);
+        }
+        await this.client.rateLimitPolicies.delete(policy.id);
+    }
+    async deleteRateLimitPolicies(data) {
+        if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+            this.config('AUTH0_ALLOW_DELETE') === true) {
+            await this.client.pool
+                .addEachTask({
+                data: data || [],
+                generator: (item) => this.deleteRateLimitPolicy(item)
+                    .then(() => {
+                    this.didDelete(item);
+                    this.deleted += 1;
+                })
+                    .catch((err) => {
+                    throw new Error(`Problem deleting ${this.type} ${this.objString(item)}\n${err}`);
+                }),
+            })
+                .promise();
+        }
+        else {
+            logger_1.default.warn(`Detected the following ${this.type} should be deleted. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${data
+                .map((i) => this.objString(i))
+                .join('\n')}`);
+        }
+    }
+}
+exports.default = RateLimitPoliciesHandler;

package/lib/tools/auth0/handlers/resourceServers.d.ts

@@ -85,9 +85,53 @@ export declare const schema: {
                             };
                         };
                     };
+                    anonymous_user: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            policy: {
+                                type: string;
+                                enum: ("deny_all" | "require_client_grant")[];
+                            };
+                        };
+                    };
                 };
                 additionalProperties: boolean;
             };
+            token_lifetime_for_anonymous_access_tokens: {
+                type: string;
+                description: string;
+            };
+            access_token: {
+                type: string[];
+                description: string;
+                properties: {
+                    claims_mapping: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            custom_claims: {
+                                type: string;
+                                description: string;
+                                items: {
+                                    type: string;
+                                    properties: {
+                                        name: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        expression: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                };
+            };
             client_id: {
                 type: string;
                 description: string;

package/lib/tools/auth0/handlers/resourceServers.js

@@ -72,9 +72,53 @@ exports.schema = {
                             },
                         },
                     },
+                    anonymous_user: {
+                        type: 'object',
+                        description: 'Access Permissions for anonymous user flows',
+                        properties: {
+                            policy: {
+                                type: 'string',
+                                enum: Object.values(auth0_1.Management.ResourceServerSubjectTypeAuthorizationAnonymousUserPolicyEnum),
+                            },
+                        },
+                    },
                 },
                 additionalProperties: false,
             },
+            token_lifetime_for_anonymous_access_tokens: {
+                type: 'number',
+                description: 'Expiration value (in seconds) for anonymous-session access tokens issued for this API.',
+            },
+            access_token: {
+                type: ['object', 'null'],
+                description: 'Custom configuration for access tokens.',
+                properties: {
+                    claims_mapping: {
+                        type: 'object',
+                        description: 'Custom configuration for claims in access tokens.',
+                        properties: {
+                            custom_claims: {
+                                type: 'array',
+                                description: 'Custom claims to emit in anonymous-session access tokens. Each rule maps a value from the anonymous-session context onto a named access-token claim.',
+                                items: {
+                                    type: 'object',
+                                    properties: {
+                                        name: {
+                                            type: 'string',
+                                            description: 'The access-token claim name to emit.',
+                                        },
+                                        expression: {
+                                            type: 'string',
+                                            description: 'Restricted dot-path expression read from the anonymous-session context.',
+                                        },
+                                    },
+                                    required: ['name', 'expression'],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
             client_id: {
                 type: 'string',
                 description: 'The client ID of the client that this resource server is linked to (readonly)',

package/lib/tools/auth0/handlers/riskAssessment.d.ts

@@ -34,6 +34,6 @@ export type RiskAssessment = {
 export default class RiskAssessmentHandler extends DefaultAPIHandler {
     existing: RiskAssessment;
     constructor(config: DefaultAPIHandler);
-    getType(): Promise<RiskAssessment>;
+    getType(): Promise<RiskAssessment | null>;
     processChanges(assets: Assets): Promise<void>;
 }

package/lib/tools/auth0/handlers/riskAssessment.js

@@ -6,6 +6,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importDefault(require("./default"));
 const auth0_1 = require("auth0");
+const logger_1 = __importDefault(require("../../../logger"));
+const utils_1 = require("../../utils");
 exports.schema = {
     type: 'object',
     properties: {
@@ -50,6 +52,9 @@ class RiskAssessmentHandler extends default_1.default {
                     if (err instanceof auth0_1.ManagementError && err?.statusCode === 404) {
                         return { remember_for: 0 };
                     }
+                    if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                        return { remember_for: 0 };
+                    }
                     throw err;
                 }),
             ]);
@@ -71,6 +76,10 @@ class RiskAssessmentHandler extends default_1.default {
                 this.existing = riskAssessment;
                 return this.existing;
             }
+            if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                logger_1.default.warn('Skipping riskAssessment export: tenant does not have Adaptive MFA entitlement');
+                return null;
+            }
             throw err;
         }
     }
@@ -87,7 +96,16 @@ class RiskAssessmentHandler extends default_1.default {
         if (riskAssessment.new_device) {
             updates.push(this.client.riskAssessments.settings.newDevice.update(riskAssessment.new_device));
         }
-        await Promise.all(updates);
+        try {
+            await Promise.all(updates);
+        }
+        catch (err) {
+            if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                logger_1.default.warn('Skipping riskAssessment deploy: tenant does not have Adaptive MFA entitlement');
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(riskAssessment);
     }

package/lib/tools/auth0/handlers/roles.d.ts

@@ -14,6 +14,10 @@ export declare const schema: {
             description: {
                 type: string;
             };
+            type: {
+                type: string;
+                enum: string[];
+            };
             permissions: {
                 type: string;
                 items: {

package/lib/tools/auth0/handlers/roles.js

@@ -56,6 +56,7 @@ exports.schema = {
             name: { type: 'string' },
             id: { type: 'string' },
             description: { type: 'string' },
+            type: { type: 'string', enum: ['tenant', 'organization'] },
             permissions: {
                 type: 'array',
                 items: {
@@ -81,6 +82,9 @@ class RolesHandler extends default_1.default {
     async createRole(data) {
         const role = { ...data };
         delete role.permissions;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; it
+        // defaults to `tenant` on create. This keeps exports (which carry `type`) round-trippable.
+        delete role.type;
         const created = await this.client.roles.create(role);
         if (created.id && typeof data.permissions !== 'undefined' && data.permissions.length > 0) {
             await this.client.roles.permissions.add(created.id, { permissions: data.permissions });
@@ -133,6 +137,9 @@ class RolesHandler extends default_1.default {
         const newPermissions = data.permissions;
         delete data.permissions;
         delete data.id;
+        // deploy-cli only manages tenant-level roles, so `type` is stripped on write; this
+        // lets files that already carry it (from a prior export) be imported cleanly.
+        delete data.type;
         await this.client.roles.update(params.id, data);
         if (typeof existingRole.permissions !== 'undefined' && existingRole.permissions.length > 0) {
             await this.client.roles.permissions.delete(params.id, {
@@ -164,9 +171,12 @@ class RolesHandler extends default_1.default {
             return this.existing;
         }
         try {
+            // Only manage tenant-level roles; exclude org-scoped roles surfaced when
+            // the api2_org_level_roles_ea flag is enabled.
             const roles = await (0, client_1.paginate)(this.client.roles.list, {
                 paginate: true,
                 include_totals: true,
+                type: 'tenant',
             });
             for (let index = 0; index < roles.length; index++) {
                 const allPermission = [];

package/lib/tools/auth0/handlers/rules.js

@@ -9,6 +9,7 @@ const utils_1 = require("../../utils");
 const default_1 = __importDefault(require("./default"));
 const logger_1 = __importDefault(require("../../../logger"));
 const calculateChanges_1 = require("../../calculateChanges");
+const calculateDryRunChanges_1 = require("../../calculateDryRunChanges");
 const client_1 = require("../client");
 exports.excludeSchema = {
     type: 'array',
@@ -135,13 +136,24 @@ class RulesHandler extends default_1.default {
         };
     }
     async dryRunChanges(assets) {
-        const { del, update, create, conflicts } = await this.calcChanges(assets);
-        return {
-            del,
-            update,
-            create,
-            conflicts,
-        };
+        let { rules } = assets;
+        if (!rules) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        const excludedRules = (assets.exclude && assets.exclude.rules) || [];
+        rules = rules.filter((r) => !excludedRules.includes(r.name));
+        let existing = await this.getType();
+        if (existing === null) {
+            return { del: [], create: [], conflicts: [], update: [] };
+        }
+        existing = existing.filter((r) => !excludedRules.includes(r.name));
+        return (0, calculateDryRunChanges_1.calculateDryRunChanges)({
+            type: this.type,
+            assets: rules,
+            existing,
+            identifiers: this.identifiers,
+            ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
+        });
     }
     async validate(assets) {
         const { rules } = assets;

package/lib/tools/auth0/handlers/tenant.d.ts

@@ -79,6 +79,51 @@ export declare const schema: {
             enum: string[];
             description: string;
         };
+        country_codes: {
+            type: string[];
+            description: string;
+            properties: {
+                list: {
+                    type: string;
+                    description: string;
+                    items: {
+                        type: string;
+                        pattern: string;
+                    };
+                    minItems: number;
+                    uniqueItems: boolean;
+                };
+                mode: {
+                    type: string;
+                    enum: string[];
+                    description: string;
+                };
+            };
+            required: string[];
+            additionalProperties: boolean;
+        };
+        sessions: {
+            type: string;
+            description: string;
+            properties: {
+                anonymous: {
+                    type: string;
+                    description: string;
+                    properties: {
+                        lifetime_in_minutes: {
+                            type: string;
+                            description: string;
+                        };
+                        activate_cookie: {
+                            type: string;
+                            description: string;
+                        };
+                    };
+                    additionalProperties: boolean;
+                };
+            };
+            additionalProperties: boolean;
+        };
     };
 };
 export interface Tenant extends Management.GetTenantSettingsResponseContent {

package/lib/tools/auth0/handlers/tenant.js

@@ -106,6 +106,53 @@ exports.schema = {
             enum: ['strict', 'permissive'],
             description: 'Indicates the security mode for new clients created through the Dynamic Client Registration endpoint.',
         },
+        country_codes: {
+            type: ['object', 'null'],
+            description: 'Phone country code configuration for identifier input. Set to `null` to remove filtering (allow all countries). Requires the `tenant_country_codes_filtering` feature flag to be enabled on the tenant.',
+            properties: {
+                list: {
+                    type: 'array',
+                    description: 'ISO 3166-1 alpha-2 country codes (e.g. `US`, `GB`).',
+                    items: {
+                        type: 'string',
+                        pattern: '^[A-Z]{2}$',
+                    },
+                    minItems: 1,
+                    uniqueItems: true,
+                },
+                mode: {
+                    type: 'string',
+                    enum: ['allow', 'deny'],
+                    description: 'Whether the list is an allowlist or denylist.',
+                },
+            },
+            required: ['list', 'mode'],
+            additionalProperties: false,
+        },
+        sessions: {
+            type: 'object',
+            description: 'Sessions related settings for the tenant.',
+            properties: {
+                anonymous: {
+                    type: 'object',
+                    description: 'Anonymous session settings for the tenant.',
+                    properties: {
+                        lifetime_in_minutes: {
+                            type: 'integer',
+                            description: 'The lifetime of an anonymous session, in minutes.',
+                        },
+                        activate_cookie: {
+                            type: 'boolean',
+                            description: 'Whether to activate the anonymous session cookie.',
+                        },
+                    },
+                    // Permissive to match the parent `sessions` object so new Management API
+                    // session fields round-trip through export/import without validation failure.
+                    additionalProperties: true,
+                },
+            },
+            additionalProperties: true,
+        },
     },
 };
 const blockPageKeys = [
@@ -147,6 +194,7 @@ exports.allowedTenantFlags = [
     'require_pushed_authorization_requests',
     'mfa_show_factor_list_on_enrollment',
     'improved_signup_bot_detection_in_classic',
+    'use_scope_descriptions_for_consent',
 ];
 const removeUnallowedTenantFlags = (proposedFlags) => {
     if (proposedFlags === undefined)

package/lib/tools/auth0/handlers/themes.d.ts

@@ -1,5 +1,5 @@
 import { Management } from 'auth0';
-import { Assets } from '../../../types';
+import { Assets, CalculatedChanges } from '../../../types';
 import DefaultHandler from './default';
 /**
  * Schema
@@ -179,6 +179,41 @@ export declare const schema: {
                 pattern: string;
                 type: string;
             };
+            identifiers: {
+                additionalProperties: boolean;
+                description: string;
+                properties: {
+                    login_display: {
+                        description: string;
+                        enum: string[];
+                        type: string;
+                    };
+                    otp_autocomplete: {
+                        description: string;
+                        type: string;
+                    };
+                    phone_display: {
+                        additionalProperties: boolean;
+                        description: string;
+                        properties: {
+                            formatting: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                            masking: {
+                                description: string;
+                                enum: string[];
+                                type: string;
+                            };
+                        };
+                        required: string[];
+                        type: string;
+                    };
+                };
+                required: string[];
+                type: string;
+            };
             fonts: {
                 additionalProperties: boolean;
                 properties: {
@@ -375,6 +410,7 @@ export default class ThemesHandler extends DefaultHandler {
     existing: Theme[] | null;
     constructor(options: DefaultHandler);
     objString(theme: Theme): string;
+    dryRunChanges(assets: Assets): Promise<CalculatedChanges>;
     getType(): Promise<Theme[] | null>;
     processChanges(assets: Assets): Promise<void>;
     deleteThemes(): Promise<void>;