auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/context/yaml/handlers/guardianPhoneFactorSettings.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianPhoneFactorSettings = ParsedAsset<'guardianPhoneFactorSettings', Asset>;
+declare const guardianPhoneFactorSettingsHandler: YAMLHandler<ParsedGuardianPhoneFactorSettings>;
+export default guardianPhoneFactorSettingsHandler;

package/lib/context/yaml/handlers/guardianPhoneFactorSettings.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parseAndDump(context) {
+    const { guardianPhoneFactorSettings } = context.assets;
+    if (!guardianPhoneFactorSettings)
+        return { guardianPhoneFactorSettings: null };
+    return {
+        guardianPhoneFactorSettings,
+    };
+}
+const guardianPhoneFactorSettingsHandler = {
+    parse: parseAndDump,
+    dump: parseAndDump,
+};
+exports.default = guardianPhoneFactorSettingsHandler;

package/lib/context/yaml/handlers/guardianSettings.d.ts

@@ -0,0 +1,5 @@
+import { YAMLHandler } from '.';
+import { Asset, ParsedAsset } from '../../../types';
+type ParsedGuardianSettings = ParsedAsset<'guardianSettings', Asset>;
+declare const guardianSettingsHandler: YAMLHandler<ParsedGuardianSettings>;
+export default guardianSettingsHandler;

package/lib/context/yaml/handlers/guardianSettings.js

@@ -0,0 +1,15 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parseAndDump(context) {
+    const { guardianSettings } = context.assets;
+    if (!guardianSettings)
+        return { guardianSettings: null };
+    return {
+        guardianSettings,
+    };
+}
+const guardianSettingsHandler = {
+    parse: parseAndDump,
+    dump: parseAndDump,
+};
+exports.default = guardianSettingsHandler;

package/lib/context/yaml/handlers/index.js

@@ -17,6 +17,9 @@ const guardianFactorProviders_1 = __importDefault(require("./guardianFactorProvi
 const guardianFactorTemplates_1 = __importDefault(require("./guardianFactorTemplates"));
 const guardianPhoneFactorMessageTypes_1 = __importDefault(require("./guardianPhoneFactorMessageTypes"));
 const guardianPhoneFactorSelectedProvider_1 = __importDefault(require("./guardianPhoneFactorSelectedProvider"));
+const guardianPhoneFactorSettings_1 = __importDefault(require("./guardianPhoneFactorSettings"));
+const guardianEmailFactorSettings_1 = __importDefault(require("./guardianEmailFactorSettings"));
+const guardianSettings_1 = __importDefault(require("./guardianSettings"));
 const guardianPolicies_1 = __importDefault(require("./guardianPolicies"));
 const roles_1 = __importDefault(require("./roles"));
 const organizations_1 = __importDefault(require("./organizations"));
@@ -38,12 +41,15 @@ const hooks_1 = __importDefault(require("./hooks"));
 const forms_1 = __importDefault(require("./forms"));
 const flows_1 = __importDefault(require("./flows"));
 const flowVaultConnections_1 = __importDefault(require("./flowVaultConnections"));
+const networkACLKeys_1 = __importDefault(require("./networkACLKeys"));
 const networkACLs_1 = __importDefault(require("./networkACLs"));
 const userAttributeProfiles_1 = __importDefault(require("./userAttributeProfiles"));
 const connectionProfiles_1 = __importDefault(require("./connectionProfiles"));
 const tokenExchangeProfiles_1 = __importDefault(require("./tokenExchangeProfiles"));
 const supplementalSignals_1 = __importDefault(require("./supplementalSignals"));
+const rateLimitPolicies_1 = __importDefault(require("./rateLimitPolicies"));
 const eventStreams_1 = __importDefault(require("./eventStreams"));
+const clientAuthCredentials_1 = __importDefault(require("./clientAuthCredentials"));
 const selfServiceProfiles_1 = __importDefault(require("./selfServiceProfiles"));
 const yamlHandlers = {
     rules: rules_1.default,
@@ -64,6 +70,9 @@ const yamlHandlers = {
     roles: roles_1.default,
     guardianPhoneFactorMessageTypes: guardianPhoneFactorMessageTypes_1.default,
     guardianPhoneFactorSelectedProvider: guardianPhoneFactorSelectedProvider_1.default,
+    guardianPhoneFactorSettings: guardianPhoneFactorSettings_1.default,
+    guardianEmailFactorSettings: guardianEmailFactorSettings_1.default,
+    guardianSettings: guardianSettings_1.default,
     guardianPolicies: guardianPolicies_1.default,
     actions: actions_1.default,
     actionModules: actionModules_1.default,
@@ -82,11 +91,14 @@ const yamlHandlers = {
     flows: flows_1.default,
     flowVaultConnections: flowVaultConnections_1.default,
     selfServiceProfiles: selfServiceProfiles_1.default,
+    networkACLKeys: networkACLKeys_1.default,
     networkACLs: networkACLs_1.default,
     userAttributeProfiles: userAttributeProfiles_1.default,
     connectionProfiles: connectionProfiles_1.default,
     tokenExchangeProfiles: tokenExchangeProfiles_1.default,
     supplementalSignals: supplementalSignals_1.default,
+    rateLimitPolicies: rateLimitPolicies_1.default,
     eventStreams: eventStreams_1.default,
+    clientAuthCredentials: clientAuthCredentials_1.default,
 };
 exports.default = yamlHandlers;

package/lib/context/yaml/handlers/networkACLKeys.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { NetworkAclKey } from '../../../tools/auth0/handlers/networkACLKeys';
+type ParsedNetworkACLKeys = ParsedAsset<'networkACLKeys', NetworkAclKey[]>;
+declare const networkACLKeysHandler: YAMLHandler<ParsedNetworkACLKeys>;
+export default networkACLKeysHandler;

package/lib/context/yaml/handlers/networkACLKeys.js

@@ -0,0 +1,42 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const logger_1 = __importDefault(require("../../../logger"));
+async function parse(context) {
+    const { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    return {
+        networkACLKeys,
+    };
+}
+async function dump(context) {
+    let { networkACLKeys } = context.assets;
+    if (!networkACLKeys)
+        return { networkACLKeys: null };
+    if (Array.isArray(networkACLKeys) && networkACLKeys.length === 0) {
+        logger_1.default.info('No network ACL keys available, skipping dump');
+        return { networkACLKeys: null };
+    }
+    // value is write-only — never returned by the API and must not be exported.
+    // created_at and updated_at are API-generated metadata; not needed in config.
+    const removeKeysFromOutput = ['value', 'created_at', 'updated_at'];
+    networkACLKeys = networkACLKeys.map((key) => {
+        const out = { ...key };
+        removeKeysFromOutput.forEach((k) => {
+            if (k in out)
+                delete out[k];
+        });
+        return out;
+    });
+    return {
+        networkACLKeys,
+    };
+}
+const networkACLKeysHandler = {
+    parse,
+    dump,
+};
+exports.default = networkACLKeysHandler;

package/lib/context/yaml/handlers/prompts.js

@@ -18,8 +18,10 @@ const loadScreenRenderers = (context, screenRenderArray) => {
         const screens = promptEntry[prompt];
         Object.entries(screens).forEach(([, fileName]) => {
             const filePath = fileName;
+            const configRoot = path_1.default.resolve(context.basePath);
+            const rendererFile = path_1.default.resolve(context.basePath, filePath);
+            (0, utils_1.assertInsideConfigRoot)(filePath, rendererFile, configRoot);
             try {
-                const rendererFile = path_1.default.join(context.basePath, filePath);
                 const rendererData = (0, utils_1.loadJSON)(rendererFile, {
                     mappings: context.mappings,
                     disableKeywordReplacement: context.disableKeywordReplacement,

package/lib/context/yaml/handlers/rateLimitPolicies.d.ts

@@ -0,0 +1,6 @@
+import { YAMLHandler } from '.';
+import { ParsedAsset } from '../../../types';
+import { RateLimitPolicy } from '../../../tools/auth0/handlers/rateLimitPolicies';
+type ParsedRateLimitPolicies = ParsedAsset<'rateLimitPolicies', RateLimitPolicy[]>;
+declare const rateLimitPoliciesHandler: YAMLHandler<ParsedRateLimitPolicies>;
+export default rateLimitPoliciesHandler;

package/lib/context/yaml/handlers/rateLimitPolicies.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+async function parse(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    return { rateLimitPolicies };
+}
+async function dump(context) {
+    const { rateLimitPolicies } = context.assets;
+    if (!rateLimitPolicies)
+        return { rateLimitPolicies: null };
+    const removeKeysFromOutput = ['id', 'created_at', 'updated_at'];
+    const cleaned = rateLimitPolicies.map((policy) => {
+        const policyToWrite = { ...policy };
+        removeKeysFromOutput.forEach((key) => {
+            delete policyToWrite[key];
+        });
+        return policyToWrite;
+    });
+    return { rateLimitPolicies: cleaned };
+}
+const rateLimitPoliciesHandler = {
+    parse,
+    dump,
+};
+exports.default = rateLimitPoliciesHandler;

package/lib/context/yaml/index.js

@@ -6,6 +6,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const fs_extra_1 = __importDefault(require("fs-extra"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const path_1 = __importDefault(require("path"));
+const lodash_1 = require("lodash");
 const tools_1 = require("../../tools");
 const client_1 = __importDefault(require("../../tools/auth0/client"));
 const logger_1 = __importDefault(require("../../logger"));
@@ -14,6 +15,83 @@ const handlers_1 = __importDefault(require("./handlers"));
 const readonly_1 = __importDefault(require("../../readonly"));
 const __1 = require("..");
 const keywordPreservation_1 = require("../../keywordPreservation");
+// Symbol marker so a literal `__include` key in user YAML isn't read as a directive
+const INCLUDE = Symbol('include');
+// Custom YAML type for file includes
+const includeType = new js_yaml_1.default.Type('!include', {
+    kind: 'scalar',
+    resolve: (data) => typeof data === 'string',
+    construct: (data) => {
+        // This will be handled during the actual loading process
+        return { [INCLUDE]: data };
+    },
+});
+const schema = js_yaml_1.default.DEFAULT_SCHEMA.extend([includeType]);
+function prepareYamlContent(content, mappings, disableKeywordReplacement) {
+    return disableKeywordReplacement
+        ? (0, tools_1.wrapArrayReplaceMarkersInQuotes)(content, mappings)
+        : (0, tools_1.keywordReplace)(content, mappings);
+}
+function parseYaml(content) {
+    return js_yaml_1.default.load(content, { schema });
+}
+// Resolves !include directives. Keyword handling is applied by the caller before parse.
+// configRoot is threaded unchanged so chained `../` includes can't escape it.
+function resolveIncludes(obj, basePath, configRoot, loadIncludedYaml, visitedFiles = new Set()) {
+    if (Array.isArray(obj)) {
+        return obj.map((item) => resolveIncludes(item, basePath, configRoot, loadIncludedYaml, visitedFiles));
+    }
+    if (obj && typeof obj === 'object') {
+        const includePath = obj[INCLUDE];
+        if (includePath !== undefined) {
+            const filePath = path_1.default.resolve(basePath, includePath);
+            (0, utils_1.assertInsideConfigRoot)(includePath, filePath, configRoot);
+            if (visitedFiles.has(filePath)) {
+                throw new Error(`Circular include detected: ${filePath}`);
+            }
+            let stat;
+            try {
+                stat = fs_extra_1.default.statSync(filePath);
+            }
+            catch (err) {
+                if (err.code === 'ENOENT') {
+                    throw new Error(`Include file not found: ${filePath}`);
+                }
+                throw err;
+            }
+            if (stat.isDirectory()) {
+                throw new Error(`Include path is a directory, expected a file: ${filePath}`);
+            }
+            // visitedFiles backtracks (add before, delete after), so one shared set is enough
+            visitedFiles.add(filePath);
+            const result = resolveIncludes(loadIncludedYaml(filePath), path_1.default.dirname(filePath), configRoot, loadIncludedYaml, visitedFiles);
+            visitedFiles.delete(filePath);
+            return result;
+        }
+        // Only rebuild plain objects; pass others (e.g. a Date from a YAML timestamp) through untouched
+        if (!(0, lodash_1.isPlainObject)(obj)) {
+            return obj;
+        }
+        const result = {};
+        for (const [key, value] of Object.entries(obj)) {
+            const resolved = resolveIncludes(value, basePath, configRoot, loadIncludedYaml, visitedFiles);
+            // Define `__proto__` as an own property so an included file can't pollute the prototype
+            if (key === '__proto__') {
+                Object.defineProperty(result, key, {
+                    value: resolved,
+                    enumerable: true,
+                    writable: true,
+                    configurable: true,
+                });
+            }
+            else {
+                result[key] = resolved;
+            }
+        }
+        return result;
+    }
+    return obj;
+}
 class YAMLContext {
     constructor(config, mgmtClient) {
         this.configFile = config.AUTH0_INPUT_FILE;
@@ -45,10 +123,7 @@ class YAMLContext {
     loadFile(f) {
         const configRoot = path_1.default.resolve(this.basePath);
         const toLoad = path_1.default.resolve(this.basePath, f.replace(/\\/g, '/'));
-        if (!toLoad.startsWith(configRoot + path_1.default.sep)) {
-            throw new Error(`Path "${f}" resolves to "${toLoad}" which is outside the config directory "${configRoot}". ` +
-                `Move the file inside your config directory.`);
-        }
+        (0, utils_1.assertInsideConfigRoot)(f, toLoad, configRoot);
         return (0, tools_1.loadFileAndReplaceKeywords)(toLoad, {
             mappings: this.mappings,
             disableKeywordReplacement: this.disableKeywordReplacement,
@@ -64,9 +139,12 @@ class YAMLContext {
             try {
                 const fPath = path_1.default.resolve(this.configFile);
                 logger_1.default.debug(`Loading YAML from ${fPath}`);
-                Object.assign(this.assets, js_yaml_1.default.load(opts.disableKeywordReplacement
-                    ? (0, tools_1.wrapArrayReplaceMarkersInQuotes)(fs_extra_1.default.readFileSync(fPath, 'utf8'), this.mappings)
-                    : (0, tools_1.keywordReplace)(fs_extra_1.default.readFileSync(fPath, 'utf8'), this.mappings)) || {});
+                const prepareContent = (content) => prepareYamlContent(content, this.mappings, opts.disableKeywordReplacement);
+                const loadIncludedYaml = (filePath) => parseYaml(prepareContent(fs_extra_1.default.readFileSync(filePath, 'utf8')));
+                const parsed = parseYaml(prepareContent(fs_extra_1.default.readFileSync(fPath, 'utf8')));
+                // Bound includes by the same config root loadFile() enforces
+                const configRoot = path_1.default.resolve(this.basePath);
+                Object.assign(this.assets, resolveIncludes(parsed, path_1.default.dirname(fPath), configRoot, loadIncludedYaml) || {});
             }
             catch (err) {
                 logger_1.default.debug(err.stack);

package/lib/keywordPreservation.d.ts

@@ -10,6 +10,6 @@ export declare const preserveKeywords: ({ localAssets, remoteAssets, keywordMapp
     remoteAssets: object;
     keywordMappings: KeywordMappings;
     auth0Handlers: (Pick<APIHandler, "id" | "type"> & {
-        identifiers: (string | string[])[];
+        identifiers?: (string | string[])[];
     })[];
 }) => object;

package/lib/keywordPreservation.js

@@ -164,7 +164,8 @@ const preserveKeywords = ({ localAssets, remoteAssets, keywordMappings, auth0Han
     if (Object.keys(keywordMappings).length === 0)
         return remoteAssets;
     const resourceSpecificIdentifiers = auth0Handlers.reduce((acc, handler) => {
-        acc[handler.type] = handler.identifiers.flat();
+        // Standalone handlers (e.g. clientAuthCredentials) don't extend APIHandler and have no identifiers.
+        acc[handler.type] = (handler.identifiers ?? []).flat();
         return acc;
     }, {});
     const addresses = (0, exports.getPreservableFieldsFromAssets)(localAssets, keywordMappings, resourceSpecificIdentifiers, '');

package/lib/readonly.js

@@ -28,6 +28,11 @@ const readOnlyFields = {
         'config_route',
         'owners',
     ],
+    attackProtection: [
+        // Returned by GET but rejected by PATCH with "Additional properties not allowed"
+        'bruteForceProtection.form_submission_mode',
+        'bruteForceProtection.form_submission_behavior',
+    ],
 };
 function getExcludedFields(config) {
     const strippedFields = { ...readOnlyFields };

package/lib/tools/auth0/handlers/attackProtection.d.ts

@@ -165,6 +165,17 @@ export declare const schema: {
         suspiciousIpThrottling: {
             type: string;
         };
+        phoneProviderProtection: {
+            type: string;
+            properties: {
+                type: {
+                    type: string;
+                    enum: string[];
+                    description: string;
+                };
+            };
+            required: string[];
+        };
     };
     additionalProperties: boolean;
 };
@@ -174,6 +185,7 @@ export type AttackProtection = {
     bruteForceProtection: Asset;
     captcha?: Asset | null;
     suspiciousIpThrottling: Asset;
+    phoneProviderProtection?: Asset | null;
 };
 export default class AttackProtectionHandler extends DefaultAPIHandler {
     existing: AttackProtection | null;

package/lib/tools/auth0/handlers/attackProtection.js

@@ -180,6 +180,17 @@ exports.schema = {
         suspiciousIpThrottling: {
             type: 'object',
         },
+        phoneProviderProtection: {
+            type: 'object',
+            properties: {
+                type: {
+                    type: 'string',
+                    enum: ['exponential', 'default'],
+                    description: 'The backoff strategy applied to Send SMS during MFA enrollment. Gated by the sms_exponential_backoff feature flag; when the flag is disabled the API returns 403 and this setting is skipped on export.',
+                },
+            },
+            required: ['type'],
+        },
     },
     additionalProperties: false,
 };
@@ -227,6 +238,11 @@ class AttackProtectionHandler extends default_1.default {
                     enabled: item.suspiciousIpThrottling.enabled,
                 };
             }
+            if (item.phoneProviderProtection?.type) {
+                obj['phone-provider-protection'] = {
+                    type: item.phoneProviderProtection.type,
+                };
+            }
             return obj;
         })();
         return super.objString(objectString);
@@ -242,15 +258,38 @@ class AttackProtectionHandler extends default_1.default {
         ]);
         let botDetection = null;
         let captcha = null;
+        let phoneProviderProtection = null;
+        try {
+            botDetection = await this.client.attackProtection.botDetection.get();
+        }
+        catch (err) {
+            if (err.statusCode === 403) {
+                logger_1.default.warn("Bot detection is not available on this tenant's current plan. Skipping bot detection settings.");
+            }
+            else {
+                throw err;
+            }
+        }
         try {
-            [botDetection, captcha] = await Promise.all([
-                this.client.attackProtection.botDetection.get(),
-                this.client.attackProtection.captcha.get(),
-            ]);
+            captcha = await this.client.attackProtection.captcha.get();
         }
         catch (err) {
             if (err.statusCode === 403) {
-                logger_1.default.warn('Bot Detection API are not enabled for this tenant. Please verify `scope` or contact Auth0 support to enable this feature.');
+                logger_1.default.warn("Captcha is not available on this tenant's current plan. Skipping captcha settings.");
+            }
+            else {
+                throw err;
+            }
+        }
+        try {
+            phoneProviderProtection = await this.client.attackProtection.phoneProviderProtection.get();
+        }
+        catch (err) {
+            if (err.statusCode === 403) {
+                logger_1.default.warn('Phone provider protection is not enabled for this tenant (sms_exponential_backoff feature flag). Skipping phone provider protection settings.');
+            }
+            else {
+                throw err;
             }
         }
         const attackProtection = {
@@ -264,6 +303,9 @@ class AttackProtectionHandler extends default_1.default {
         if (captcha) {
             attackProtection.captcha = captcha;
         }
+        if (phoneProviderProtection) {
+            attackProtection.phoneProviderProtection = phoneProviderProtection;
+        }
         this.existing = attackProtection;
         return this.existing;
     }
@@ -303,11 +345,29 @@ class AttackProtectionHandler extends default_1.default {
             updates.push(this.client.attackProtection.captcha.update(attackProtection.captcha));
         }
         if (attackProtection.bruteForceProtection) {
-            updates.push(this.client.attackProtection.bruteForceProtection.update(attackProtection.bruteForceProtection));
+            // Strip fields returned by GET but rejected by PATCH
+            const { form_submission_mode, form_submission_behavior, ...bruteForcePayload } = attackProtection.bruteForceProtection;
+            updates.push(this.client.attackProtection.bruteForceProtection.update(bruteForcePayload));
         }
         if (attackProtection.suspiciousIpThrottling) {
             updates.push(this.client.attackProtection.suspiciousIpThrottling.update(attackProtection.suspiciousIpThrottling));
         }
+        // Phone provider protection uses PATCH (not update) and requires `type` on every request.
+        // Guard the 403 (sms_exponential_backoff flag off) per-promise so a flag-off tenant does
+        // not fail the whole attackProtection stage — mirrors the 403-skip in getType().
+        if (attackProtection.phoneProviderProtection?.type) {
+            updates.push(this.client.attackProtection.phoneProviderProtection
+                .patch({
+                type: attackProtection.phoneProviderProtection.type,
+            })
+                .catch((err) => {
+                if (err.statusCode === 403) {
+                    logger_1.default.warn('Phone provider protection is not enabled for this tenant (sms_exponential_backoff feature flag). Skipping phone provider protection update.');
+                    return;
+                }
+                throw err;
+            }));
+        }
         if (!updates.length) {
             return;
         }

package/lib/tools/auth0/handlers/clientAuthCredentials.d.ts

@@ -0,0 +1,27 @@
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+export default class ClientAuthCredentialsHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
+    processChanges(assets: Assets): Promise<void>;
+    private inferCredentialType;
+    private inferMethodFromType;
+}