auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/tools/auth0/handlers/phoneTemplates.js

@@ -44,6 +44,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.schema = void 0;
 const default_1 = __importStar(require("./default"));
+const utils_1 = require("../../utils");
 const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'array',
@@ -121,25 +122,77 @@ class PhoneTemplatesHandler extends default_1.default {
         if (del.length > 0) {
             await this.deletePhoneTemplates(del);
         }
-        if (create.length > 0) {
-            await this.createPhoneTemplates(create);
+        // On newly created tenants the phone templates returned by the API have no
+        // ID until they are explicitly created. calcChanges matches assets by `type`
+        // and routes them all to `update`, but PATCH requires an ID. Split out the
+        // templates whose existing counterpart has no ID yet and create them instead.
+        const missingId = [];
+        const hasId = [];
+        update.forEach((template) => {
+            const existing = this.existing?.find((t) => t.type === template.type);
+            if (existing?.id) {
+                hasId.push(template);
+            }
+            else {
+                missingId.push(template);
+            }
+        });
+        const toCreate = [...create, ...missingId];
+        if (toCreate.length > 0) {
+            await this.createPhoneTemplates(toCreate);
         }
-        if (update.length > 0) {
-            await this.updatePhoneTemplates(update);
+        if (hasId.length > 0) {
+            await this.updatePhoneTemplates(hasId);
         }
     }
     async createPhoneTemplate(template) {
-        const created = await this.client.branding.phone.templates.create(template);
-        return created;
+        // The create endpoint only accepts type/disabled/content; strip read-only
+        // fields (channel, customizable, tenant) that the API would reject.
+        const createPayload = (0, utils_1.stripFields)(template, this.stripCreateFields);
+        // The API rejects an empty `content.from`, which is what fresh tenants
+        // export. Drop it when blank (cloning `content`, which stripFields only
+        // shallow-copied, so the caller's original asset isn't mutated).
+        if (createPayload.content && !createPayload.content.from) {
+            createPayload.content = { ...createPayload.content };
+            delete createPayload.content.from;
+        }
+        try {
+            const created = await this.client.branding.phone.templates.create(createPayload);
+            return { asset: created, action: 'create' };
+        }
+        catch (err) {
+            // A 409 means the template already exists on the tenant (it was created
+            // between our list call and this create, or the list endpoint didn't
+            // surface its ID). Re-fetch to pick up the ID and fall back to an update.
+            if (err.statusCode === 409) {
+                logger_1.default.debug(`Phone template type '${template.type}' already exists, falling back to update`);
+                // Reassigns the shared `this.existing`; safe under concurrency since
+                // every re-fetch returns the same consistent list. If it still lacks an
+                // ID, updatePhoneTemplate warns and skips.
+                const response = await this.client.branding.phone.templates.list();
+                this.existing = response.templates ?? [];
+                const updated = await this.updatePhoneTemplate(template);
+                return { asset: updated, action: 'update' };
+            }
+            throw err;
+        }
     }
     async createPhoneTemplates(creates) {
         await this.client.pool
             .addEachTask({
             data: creates || [],
             generator: (item) => this.createPhoneTemplate(item)
-                .then((data) => {
-                this.didCreate(data);
-                this.created += 1;
+                .then(({ asset, action }) => {
+                // A 409 fallback actually performed an update; count it as such so
+                // the import summary doesn't report a phantom "create".
+                if (action === 'update') {
+                    this.didUpdate(asset);
+                    this.updated += 1;
+                }
+                else {
+                    this.didCreate(asset);
+                    this.created += 1;
+                }
             })
                 .catch((err) => {
                 throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
@@ -160,7 +213,6 @@ class PhoneTemplatesHandler extends default_1.default {
         logger_1.default.debug(`Stripping ${this.type} create-only fields ${JSON.stringify(stripUpdateFields)}`);
         const updatePayload = {
             content: {
-                from: template.content?.from,
                 body: {
                     text: template.content?.body?.text,
                     voice: template.content?.body?.voice,
@@ -168,6 +220,11 @@ class PhoneTemplatesHandler extends default_1.default {
             },
             disabled: template.disabled,
         };
+        // `content.from` is optional but the API rejects an empty string, which is
+        // what fresh tenants export. Only include it when it has a value.
+        if (template.content?.from) {
+            updatePayload.content.from = template.content.from;
+        }
         const updated = await this.client.branding.phone.templates.update(existing.id, updatePayload);
         return updated;
     }

package/lib/tools/auth0/handlers/prompts.d.ts

@@ -47,7 +47,18 @@ export declare const schema: {
             type: string;
         };
         customText: {
+            $id: string;
             type: string;
+            definitions: {
+                promptType: {
+                    type: string;
+                    properties: {};
+                };
+                language: {
+                    type: string;
+                    properties: {};
+                };
+            };
             properties: {};
         };
         partials: {
@@ -87,6 +98,12 @@ export default class PromptsHandler extends DefaultHandler {
     constructor(options: DefaultHandler);
     objString({ customText, screenRenderers }: Prompts): string;
     getType(): Promise<Prompts | null>;
+    /**
+     * Narrows the tenant's enabled languages to those listed in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES.
+     * Custom text is fetched with one rate-limited request per language and prompt type, so
+     * limiting languages is the only way to shorten this step on tenants with many languages.
+     */
+    getCustomTextLanguages<T extends string>(enabledLanguages: T[]): T[];
     getCustomTextSettings(): Promise<AllPromptsByLanguage>;
     /**
      * Error handler wrapper.

package/lib/tools/auth0/handlers/prompts.js

@@ -199,25 +199,35 @@ exports.schema = {
         identifier_first: {
             type: 'boolean',
         },
+        // Every language/prompt shares the same shape, so the per-prompt and per-language schemas are
+        // defined once and referenced. Inlining them multiplies the schema by
+        // languages x promptTypes x screenTypes (~184k subschemas), which costs ~1 GB and ~2.5s of
+        // Ajv compile time on every `deploy`. The `$id` scopes the `#/definitions/...` refs to this
+        // subschema so they resolve wherever it is embedded.
         customText: {
+            $id: 'prompts-custom-text',
             type: 'object',
-            properties: types_1.languages.reduce((acc, language) => ({
-                ...acc,
-                [language]: {
+            definitions: {
+                promptType: {
                     type: 'object',
-                    properties: promptTypes.reduce((promptAcc, promptType) => ({
-                        ...promptAcc,
-                        [promptType]: {
+                    properties: screenTypes.reduce((screenAcc, screenType) => ({
+                        ...screenAcc,
+                        [screenType]: {
                             type: 'object',
-                            properties: screenTypes.reduce((screenAcc, screenType) => ({
-                                ...screenAcc,
-                                [screenType]: {
-                                    type: 'object',
-                                },
-                            }), {}),
                         },
                     }), {}),
                 },
+                language: {
+                    type: 'object',
+                    properties: promptTypes.reduce((promptAcc, promptType) => ({
+                        ...promptAcc,
+                        [promptType]: { $ref: '#/definitions/promptType' },
+                    }), {}),
+                },
+            },
+            properties: types_1.languages.reduce((acc, language) => ({
+                ...acc,
+                [language]: { $ref: '#/definitions/language' },
             }), {}),
         },
         partials: {
@@ -306,12 +316,35 @@ class PromptsHandler extends default_1.default {
         }
         return prompts;
     }
+    /**
+     * Narrows the tenant's enabled languages to those listed in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES.
+     * Custom text is fetched with one rate-limited request per language and prompt type, so
+     * limiting languages is the only way to shorten this step on tenants with many languages.
+     */
+    getCustomTextLanguages(enabledLanguages) {
+        const configuredLanguages = this.config('AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES');
+        if (configuredLanguages === undefined)
+            return enabledLanguages;
+        if (!Array.isArray(configuredLanguages) ||
+            !configuredLanguages.every((language) => typeof language === 'string')) {
+            throw new Error('AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES must be an array of language codes, e.g. ["en", "fr"].');
+        }
+        const notEnabledLanguages = configuredLanguages.filter((language) => !enabledLanguages.includes(language));
+        if (notEnabledLanguages.length > 0) {
+            logger_1.default.warn(`Skipping custom text for languages listed in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES that are not enabled on the tenant: ${notEnabledLanguages.join(', ')}`);
+        }
+        const languages = enabledLanguages.filter((language) => configuredLanguages.includes(language));
+        logger_1.default.info(`Retrieving prompts custom text only for languages in AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES: ${languages.join(', ') || '(none)'}`);
+        return languages;
+    }
     async getCustomTextSettings() {
-        const supportedLanguages = await this.client.tenants.settings.get().then((res) => {
+        const enabledLanguages = await this.client.tenants.settings.get().then((res) => {
             if (res.enabled_locales === undefined)
                 return []; // In rare cases, private cloud tenants may not have `enabled_locales` defined
             return res.enabled_locales;
         });
+        const supportedLanguages = this.getCustomTextLanguages(enabledLanguages);
+        logger_1.default.debug(`Fetching prompts custom text for ${supportedLanguages.length} language(s) x ${promptTypes.length} prompt type(s) (${supportedLanguages.length * promptTypes.length} requests). This endpoint is rate-limited by Auth0, so this may take a while on tenants with many languages enabled; set AUTH0_EXPORT_CUSTOM_TEXT_LANGUAGES to limit which languages are fetched.`);
         return this.client.pool
             .addEachTask({
             data: supportedLanguages
@@ -496,7 +529,7 @@ class PromptsHandler extends default_1.default {
             updatePayload = {
                 ...updatePrams,
                 rendering_mode: auth0_1.Management.AculRenderingModeEnum.Advanced,
-                default_head_tags_disabled: screenRenderer.default_head_tags_disabled || undefined,
+                default_head_tags_disabled: screenRenderer.default_head_tags_disabled ?? undefined,
                 head_tags: screenRenderer.head_tags,
             };
         }

package/lib/tools/auth0/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,81 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+export type RateLimitPolicyConfiguration = Management.RateLimitPolicyConfiguration;
+export type RateLimitPolicy = Management.RateLimitPolicy;
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+        properties: {
+            resource: {
+                type: string;
+                enum: "oauth_authentication_api"[];
+            };
+            consumer: {
+                type: string;
+                enum: "client"[];
+            };
+            consumer_selector: {
+                type: string;
+            };
+            configuration: {
+                type: string;
+                oneOf: ({
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            enum: string[];
+                        };
+                        limit?: undefined;
+                        redirect_uri?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            enum: string[];
+                        };
+                        limit: {
+                            type: string;
+                        };
+                        redirect_uri?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            enum: string[];
+                        };
+                        limit: {
+                            type: string;
+                        };
+                        redirect_uri: {
+                            type: string;
+                        };
+                    };
+                    additionalProperties: boolean;
+                })[];
+            };
+        };
+        required: string[];
+    };
+};
+export default class RateLimitPoliciesHandler extends DefaultAPIHandler {
+    existing: RateLimitPolicy[] | null;
+    constructor(config: DefaultAPIHandler);
+    objString(policy: RateLimitPolicy): string;
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+    createRateLimitPolicy(policy: RateLimitPolicy): Promise<RateLimitPolicy>;
+    createRateLimitPolicies(creates: CalculatedChanges['create']): Promise<void>;
+    updateRateLimitPolicy(policy: RateLimitPolicy): Promise<void>;
+    updateRateLimitPolicies(updates: CalculatedChanges['update']): Promise<void>;
+    deleteRateLimitPolicy(policy: RateLimitPolicy): Promise<void>;
+    deleteRateLimitPolicies(data: Asset[]): Promise<void>;
+}

package/lib/tools/auth0/handlers/rateLimitPolicies.js

@@ -0,0 +1,203 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const auth0_1 = require("auth0");
+const default_1 = __importDefault(require("./default"));
+const client_1 = require("../client");
+const utils_1 = require("../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: {
+        type: 'object',
+        properties: {
+            resource: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.RateLimitPolicyResourceEnum),
+            },
+            consumer: {
+                type: 'string',
+                enum: Object.values(auth0_1.Management.RateLimitPolicyConsumerEnum),
+            },
+            consumer_selector: {
+                type: 'string',
+            },
+            configuration: {
+                type: 'object',
+                oneOf: [
+                    {
+                        required: ['action'],
+                        properties: {
+                            action: { type: 'string', enum: ['allow'] },
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        required: ['action', 'limit'],
+                        properties: {
+                            action: { type: 'string', enum: ['block', 'log'] },
+                            limit: { type: 'number' },
+                        },
+                        additionalProperties: false,
+                    },
+                    {
+                        required: ['action', 'limit', 'redirect_uri'],
+                        properties: {
+                            action: { type: 'string', enum: ['redirect'] },
+                            limit: { type: 'number' },
+                            redirect_uri: { type: 'string' },
+                        },
+                        additionalProperties: false,
+                    },
+                ],
+            },
+        },
+        required: ['resource', 'consumer', 'consumer_selector', 'configuration'],
+    },
+};
+class RateLimitPoliciesHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'rateLimitPolicies',
+            id: 'id',
+            identifiers: ['id', 'consumer_selector'],
+            stripCreateFields: ['id', 'created_at', 'updated_at'],
+            stripUpdateFields: [
+                'id',
+                'resource',
+                'consumer',
+                'consumer_selector',
+                'created_at',
+                'updated_at',
+            ],
+        });
+    }
+    objString(policy) {
+        return super.objString({
+            consumer_selector: policy.consumer_selector,
+            resource: policy.resource,
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const rateLimitPolicies = await (0, client_1.paginate)(this.client.rateLimitPolicies.list, { checkpoint: true });
+            this.existing = rateLimitPolicies;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403) {
+                logger_1.default.debug('Rate Limit Policies feature is not enabled for this tenant. Please contact Auth0 support to enable this feature.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async processChanges(assets) {
+        const { rateLimitPolicies } = assets;
+        if (!rateLimitPolicies)
+            return;
+        const { del, update, create } = await this.calcChanges(assets);
+        if ((0, utils_1.isDryRun)(this.config)) {
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        logger_1.default.debug(`Start processChanges for rateLimitPolicies [delete:${del.length}] [update:${update.length}], [create:${create.length}]`);
+        const changes = [{ del }, { create }, { update }];
+        await Promise.all(changes.map(async (change) => {
+            switch (true) {
+                case change.del && change.del.length > 0:
+                    await this.deleteRateLimitPolicies(change.del);
+                    break;
+                case change.create && change.create.length > 0:
+                    await this.createRateLimitPolicies(change.create);
+                    break;
+                case change.update && change.update.length > 0:
+                    await this.updateRateLimitPolicies(change.update);
+                    break;
+                default:
+                    break;
+            }
+        }));
+    }
+    async createRateLimitPolicy(policy) {
+        const created = await this.client.rateLimitPolicies.create(policy);
+        return created;
+    }
+    async createRateLimitPolicies(creates) {
+        await this.client.pool
+            .addEachTask({
+            data: creates || [],
+            generator: (item) => this.createRateLimitPolicy(item)
+                .then((data) => {
+                this.didCreate(data);
+                this.created += 1;
+            })
+                .catch((err) => {
+                throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async updateRateLimitPolicy(policy) {
+        const { id, configuration } = policy;
+        if (!id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(policy)}`);
+        }
+        await this.client.rateLimitPolicies.update(id, { configuration });
+    }
+    async updateRateLimitPolicies(updates) {
+        await this.client.pool
+            .addEachTask({
+            data: updates || [],
+            generator: (item) => this.updateRateLimitPolicy(item)
+                .then(() => {
+                this.didUpdate(item);
+                this.updated += 1;
+            })
+                .catch((err) => {
+                throw new Error(`Problem updating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async deleteRateLimitPolicy(policy) {
+        if (!policy.id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(policy)}`);
+        }
+        await this.client.rateLimitPolicies.delete(policy.id);
+    }
+    async deleteRateLimitPolicies(data) {
+        if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+            this.config('AUTH0_ALLOW_DELETE') === true) {
+            await this.client.pool
+                .addEachTask({
+                data: data || [],
+                generator: (item) => this.deleteRateLimitPolicy(item)
+                    .then(() => {
+                    this.didDelete(item);
+                    this.deleted += 1;
+                })
+                    .catch((err) => {
+                    throw new Error(`Problem deleting ${this.type} ${this.objString(item)}\n${err}`);
+                }),
+            })
+                .promise();
+        }
+        else {
+            logger_1.default.warn(`Detected the following ${this.type} should be deleted. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config\n${data
+                .map((i) => this.objString(i))
+                .join('\n')}`);
+        }
+    }
+}
+exports.default = RateLimitPoliciesHandler;

package/lib/tools/auth0/handlers/resourceServers.d.ts

@@ -85,14 +85,62 @@ export declare const schema: {
                             };
                         };
                     };
+                    anonymous_user: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            policy: {
+                                type: string;
+                                enum: ("deny_all" | "require_client_grant")[];
+                            };
+                        };
+                    };
                 };
                 additionalProperties: boolean;
             };
+            token_lifetime_for_anonymous_access_tokens: {
+                type: string;
+                description: string;
+            };
+            access_token: {
+                type: string[];
+                description: string;
+                properties: {
+                    claims_mapping: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            custom_claims: {
+                                type: string;
+                                description: string;
+                                items: {
+                                    type: string;
+                                    properties: {
+                                        name: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                        expression: {
+                                            type: string;
+                                            description: string;
+                                        };
+                                    };
+                                    required: string[];
+                                };
+                            };
+                        };
+                    };
+                };
+            };
             client_id: {
                 type: string;
                 description: string;
                 readOnly: boolean;
             };
+            require_consent_non_repudiation: {
+                type: string;
+                description: string;
+            };
         };
         required: string[];
     };

package/lib/tools/auth0/handlers/resourceServers.js

@@ -72,14 +72,62 @@ exports.schema = {
                             },
                         },
                     },
+                    anonymous_user: {
+                        type: 'object',
+                        description: 'Access Permissions for anonymous user flows',
+                        properties: {
+                            policy: {
+                                type: 'string',
+                                enum: Object.values(auth0_1.Management.ResourceServerSubjectTypeAuthorizationAnonymousUserPolicyEnum),
+                            },
+                        },
+                    },
                 },
                 additionalProperties: false,
             },
+            token_lifetime_for_anonymous_access_tokens: {
+                type: 'number',
+                description: 'Expiration value (in seconds) for anonymous-session access tokens issued for this API.',
+            },
+            access_token: {
+                type: ['object', 'null'],
+                description: 'Custom configuration for access tokens.',
+                properties: {
+                    claims_mapping: {
+                        type: 'object',
+                        description: 'Custom configuration for claims in access tokens.',
+                        properties: {
+                            custom_claims: {
+                                type: 'array',
+                                description: 'Custom claims to emit in anonymous-session access tokens. Each rule maps a value from the anonymous-session context onto a named access-token claim.',
+                                items: {
+                                    type: 'object',
+                                    properties: {
+                                        name: {
+                                            type: 'string',
+                                            description: 'The access-token claim name to emit.',
+                                        },
+                                        expression: {
+                                            type: 'string',
+                                            description: 'Restricted dot-path expression read from the anonymous-session context.',
+                                        },
+                                    },
+                                    required: ['name', 'expression'],
+                                },
+                            },
+                        },
+                    },
+                },
+            },
             client_id: {
                 type: 'string',
                 description: 'The client ID of the client that this resource server is linked to (readonly)',
                 readOnly: true,
             },
+            require_consent_non_repudiation: {
+                type: 'boolean',
+                description: 'When true, the authorization server rejects consent decisions that do not include a valid signature and kid. Requires the my_account_consents entitlement.',
+            },
         },
         required: ['name', 'identifier'],
     },
@@ -120,6 +168,7 @@ class ResourceServersHandler extends default_1.default {
                     'id',
                     'is_system',
                     'authorization_policy',
+                    'require_consent_non_repudiation',
                 ];
                 const sanitized = {};
                 allowedKeys.forEach((key) => {
@@ -164,14 +213,19 @@ class ResourceServersHandler extends default_1.default {
         });
     }
     async updateResourceServer(id, update) {
-        // Exclude name from update as it cannot be modified for system resource servers like Auth0 My Account API
-        if (update.is_system === true || update.name === 'Auth0 My Account API') {
+        // Exclude name from update as it cannot be modified for system resource servers like the
+        // Auth0 My Account API or the Auth0 My Organization API. `is_system` is listed in
+        // `stripUpdateFields`, so it has already been removed from `update` by the time this runs -
+        // read it off the existing resource server instead, which `getType()` retains it on.
+        const existing = this.existing?.find((resourceServer) => resourceServer.id === id);
+        if (existing?.is_system === true) {
             const updateFields = {
                 token_lifetime: update.token_lifetime,
                 proof_of_possession: update.proof_of_possession,
                 skip_consent_for_verifiable_first_party_clients: update.skip_consent_for_verifiable_first_party_clients,
                 subject_type_authorization: update.subject_type_authorization,
                 authorization_policy: update.authorization_policy,
+                require_consent_non_repudiation: update.require_consent_non_repudiation,
             };
             return this.client.resourceServers.update(id, updateFields);
         }