auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/tools/auth0/handlers/clientAuthCredentials.js

@@ -0,0 +1,234 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+const CREDENTIAL_TYPE_TO_METHOD = {
+    public_key: 'private_key_jwt',
+    x509_cert: 'self_signed_tls_client_auth',
+    cert_subject_dn: 'tls_client_auth',
+};
+class ClientAuthCredentialsHandler {
+    constructor({ client, config }) {
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        logger_1.default.info(`Retrieving ${this.type} data from Auth0`);
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    // Credentials are per-client sub-resources with no top-level asset list, so they are not
+    // modeled in the dry-run diff. Return empty changes so the dry-run loop (which calls
+    // dryRunChanges on every handler) does not crash. Credential changes are still applied
+    // during a real import via processChanges.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // Only process clients that have client_authentication_methods in config.
+        // Full deletion (absent field) is handled by ClientAuthCredentialsPreHandler at order 40,
+        // before clients.ts runs. This handler only manages create and partial delete.
+        const clientsWithCam = clients.filter((c) => c.client_authentication_methods !== undefined);
+        if (clientsWithCam.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names for PKI clients only.
+        const needsNameResolution = clientsWithCam.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of clientsWithCam) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            client.client_id = clientId;
+            const clientName = client.name || clientId;
+            // Collect all desired credentials across all auth methods (only pem-bearing entries)
+            const desired = [];
+            if (client.client_authentication_methods) {
+                for (const [methodKey, methodVal] of Object.entries(client.client_authentication_methods)) {
+                    const credentials = methodVal?.credentials || [];
+                    for (const cred of credentials) {
+                        if (!cred.pem)
+                            continue;
+                        desired.push({
+                            name: cred.name,
+                            pem: cred.pem,
+                            credential_type: cred.credential_type || this.inferCredentialType(methodKey),
+                            method: methodKey,
+                            kid: cred.kid,
+                            alg: cred.alg,
+                            expires_at: cred.expires_at,
+                            parse_expiry_from_cert: cred.parse_expiry_from_cert,
+                        });
+                    }
+                }
+            }
+            // pem is the opt-in signal: present field with no pem = skip (safe export→deploy);
+            // absent field = fall through to delete path (intentional removal).
+            if (desired.length === 0 && client.client_authentication_methods)
+                continue;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            // No credentials in Auth0 and none desired — nothing to do.
+            if (existing.length === 0 && desired.length === 0)
+                continue;
+            // Warn if duplicate names exist in Auth0 — we can't match safely
+            const existingNames = existing.map((c) => c.name);
+            const duplicateNames = existingNames.filter((n, i) => existingNames.indexOf(n) !== i);
+            if (duplicateNames.length > 0) {
+                logger_1.default.warn(`clientAuthCredentials: client "${clientName}" has duplicate credential names in Auth0 [${duplicateNames.join(', ')}] — skipping credential reconciliation for this client`);
+                continue;
+            }
+            const existingByName = new Map(existing.map((c) => [c.name, c]));
+            const desiredNames = new Set(desired.map((d) => d.name));
+            const toCreate = desired.filter((d) => !existingByName.has(d.name));
+            const toDelete = existing.filter((e) => !desiredNames.has(e.name));
+            // Creates first — Auth0 allows max 2 credentials; both must exist simultaneously during rotation
+            // Track name→id so we can correctly attribute each created credential to its method later.
+            const createdIdByName = new Map();
+            for (const cred of toCreate) {
+                try {
+                    // Forward all API-accepted fields. `!= null` drops unset (undefined) and empty
+                    // (YAML `kid:` → null) values the API rejects, while keeping an explicit `false`.
+                    const createPayload = Object.fromEntries(Object.entries({
+                        name: cred.name,
+                        pem: cred.pem,
+                        credential_type: cred.credential_type,
+                        kid: cred.kid,
+                        alg: cred.alg,
+                        expires_at: cred.expires_at,
+                        parse_expiry_from_cert: cred.parse_expiry_from_cert,
+                    }).filter(([, v]) => v != null));
+                    const created = await this.client.clients.credentials.create(clientId, createPayload);
+                    logger_1.default.info(`clientAuthCredentials: created credential "${cred.name}" on client "${clientName}"`);
+                    createdIdByName.set(cred.name, created.id);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to create credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+            // Re-wire client_authentication_methods with final IDs (kept + newly created).
+            // This must happen BEFORE deletes — Auth0 rejects deleting a credential that
+            // is still referenced in client_authentication_methods.
+            const keptIds = existing.filter((e) => desiredNames.has(e.name)).map((e) => e.id);
+            const createdIds = [...createdIdByName.values()];
+            const finalIds = [...keptIds, ...createdIds];
+            let updatedAuthMethods = null;
+            if (finalIds.length > 0) {
+                // Build method→ids map. For kept credentials use Auth0's stored type to infer method;
+                // for created credentials use the method from the user's config entry (by name).
+                const methodToIds = {};
+                for (const id of finalIds) {
+                    const fromExisting = existing.find((e) => e.id === id);
+                    const createdName = [...createdIdByName.entries()].find(([, cid]) => cid === id)?.[0];
+                    const fromDesired = createdName ? desired.find((d) => d.name === createdName) : undefined;
+                    const methodKey = (fromExisting && this.inferMethodFromType(fromExisting.credential_type)) ||
+                        (fromDesired && fromDesired.method) ||
+                        Object.keys(client.client_authentication_methods)[0];
+                    if (!methodToIds[methodKey])
+                        methodToIds[methodKey] = [];
+                    methodToIds[methodKey].push(id);
+                }
+                updatedAuthMethods = {};
+                for (const [methodKey, ids] of Object.entries(methodToIds)) {
+                    updatedAuthMethods[methodKey] = { credentials: ids.map((id) => ({ id })) };
+                }
+            }
+            // Always update client_authentication_methods before deletes:
+            // - When finalIds > 0: re-wire to the remaining credentials
+            // - When finalIds === 0 but toDelete > 0: set to null so Auth0 de-references them first
+            if (finalIds.length > 0 || toDelete.length > 0) {
+                try {
+                    const payload = {
+                        client_authentication_methods: updatedAuthMethods ?? null,
+                    };
+                    // Auth0 requires token_endpoint_auth_method: null when setting client_authentication_methods,
+                    // and a non-null value when clearing it.
+                    if (updatedAuthMethods) {
+                        payload.token_endpoint_auth_method = null;
+                    }
+                    else {
+                        payload.token_endpoint_auth_method =
+                            client.token_endpoint_auth_method || 'client_secret_post';
+                    }
+                    await this.client.clients.update(clientId, payload);
+                    logger_1.default.info(`clientAuthCredentials: updated client_authentication_methods on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to update client_authentication_methods on client "${clientName}": ${err}`);
+                }
+            }
+            // Deletes last — after client_authentication_methods no longer references them
+            if (toDelete.length > 0) {
+                if (!allowDelete) {
+                    logger_1.default.warn(`clientAuthCredentials: the following credentials on client "${clientName}" would be deleted but AUTH0_ALLOW_DELETE is not set:\n${toDelete
+                        .map((c) => `  ${c.name} (${c.id})`)
+                        .join('\n')}`);
+                }
+                else {
+                    for (const cred of toDelete) {
+                        try {
+                            await this.client.clients.credentials.delete(clientId, cred.id);
+                            logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                        }
+                        catch (err) {
+                            logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                        }
+                    }
+                }
+            }
+        }
+    }
+    inferCredentialType(methodKey) {
+        const map = {
+            private_key_jwt: 'public_key',
+            self_signed_tls_client_auth: 'x509_cert',
+            tls_client_auth: 'cert_subject_dn',
+        };
+        return map[methodKey] || 'public_key';
+    }
+    inferMethodFromType(credentialType) {
+        return CREDENTIAL_TYPE_TO_METHOD[credentialType] || 'private_key_jwt';
+    }
+}
+exports.default = ClientAuthCredentialsHandler;
+__decorate([
+    (0, default_1.order)('70')
+], ClientAuthCredentialsHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.d.ts

@@ -0,0 +1,38 @@
+import { Assets, Auth0APIClient, CalculatedChanges } from '../../../types';
+import { ConfigFunction } from '../../../configFactory';
+export declare const schema: {
+    type: string;
+    items: {
+        type: string;
+    };
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+export default class ClientAuthCredentialsPreHandler {
+    client: Auth0APIClient;
+    config: ConfigFunction;
+    type: string;
+    existing: null;
+    constructor({ client, config }: {
+        client: Auth0APIClient;
+        config: ConfigFunction;
+    });
+    getType(): Promise<null>;
+    load(): Promise<{
+        [x: string]: null;
+    }>;
+    validate(): Promise<null>;
+    dryRunChanges(_assets: Assets): Promise<CalculatedChanges>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/clientAuthCredentialsPre.js

@@ -0,0 +1,123 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = require("./default");
+const client_1 = require("../client");
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    items: { type: 'object' },
+};
+/**
+ * Handles full credential deletion BEFORE clients.ts (order 50) patches the client.
+ *
+ * Auth0 rejects a client PATCH containing token_endpoint_auth_method while that client still
+ * has active credentials. By running at order 40, this handler clears credentials (and
+ * client_authentication_methods) for any client where the field is absent from config, so
+ * that clients.ts can safely include token_endpoint_auth_method in its PATCH.
+ *
+ * Partial deletion (some credentials removed, others kept) is handled by
+ * ClientAuthCredentialsHandler at order 70, because those clients still have
+ * client_authentication_methods present in config and clients.ts strips token_endpoint_auth_method
+ * for them anyway.
+ */
+class ClientAuthCredentialsPreHandler {
+    constructor({ client, config }) {
+        // Same type as ClientAuthCredentialsHandler so AUTH0_EXCLUDED / AUTH0_INCLUDED_ONLY
+        // applies to both handlers together without needing a separate AssetTypes entry.
+        this.type = 'clientAuthCredentials';
+        this.existing = null;
+        this.client = client;
+        this.config = config;
+    }
+    async getType() {
+        return null;
+    }
+    async load() {
+        return { [this.type]: null };
+    }
+    async validate() {
+        return null;
+    }
+    // Deploy-only pre-pass handler with no dry-run representation. Return empty changes so the
+    // dry-run loop (which calls dryRunChanges on every registered handler) does not crash.
+    async dryRunChanges(_assets) {
+        return { del: [], create: [], conflicts: [], update: [] };
+    }
+    async processChanges(assets) {
+        const { clients } = assets;
+        if (!clients)
+            return;
+        const allowDelete = this.config('AUTH0_ALLOW_DELETE') === true || this.config('AUTH0_ALLOW_DELETE') === 'true';
+        // When allowDelete is false no deletion will happen — skip entirely to avoid
+        // unnecessary GET /credentials calls for every client.
+        if (!allowDelete)
+            return;
+        // Only act on clients where client_authentication_methods is absent from config.
+        // Absent = intentional full deletion. Clients with the field present (including partial
+        // deletion) are fully handled by ClientAuthCredentialsHandler at order 70.
+        const deletionCandidates = clients.filter((c) => c.client_authentication_methods === undefined);
+        if (deletionCandidates.length === 0)
+            return;
+        // In directory mode client_id is stripped. Resolve names once for all candidates.
+        const needsNameResolution = deletionCandidates.some((c) => !c.client_id);
+        let clientIdByName = new Map();
+        if (needsNameResolution) {
+            const existingClients = await (0, client_1.paginate)(this.client.clients.list, {
+                paginate: true,
+                is_global: false,
+            });
+            clientIdByName = new Map(existingClients.map((c) => [c.name, c.client_id]));
+        }
+        for (const client of deletionCandidates) {
+            const clientId = client.client_id || (client.name && clientIdByName.get(client.name));
+            if (!clientId)
+                continue;
+            const clientName = client.name || clientId;
+            let existing = [];
+            try {
+                existing = (await this.client.clients.credentials.list(clientId));
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to list credentials for client "${clientName}": ${err}`);
+                continue;
+            }
+            if (existing.length === 0)
+                continue;
+            // De-reference credentials from client_authentication_methods before deleting them —
+            // Auth0 rejects deleting a credential that is still referenced.
+            try {
+                await this.client.clients.update(clientId, {
+                    client_authentication_methods: null,
+                    token_endpoint_auth_method: client.token_endpoint_auth_method || 'client_secret_post',
+                });
+            }
+            catch (err) {
+                logger_1.default.warn(`clientAuthCredentials: failed to clear client_authentication_methods on client "${clientName}": ${err}`);
+                continue;
+            }
+            for (const cred of existing) {
+                try {
+                    await this.client.clients.credentials.delete(clientId, cred.id);
+                    logger_1.default.info(`clientAuthCredentials: deleted credential "${cred.name}" on client "${clientName}"`);
+                }
+                catch (err) {
+                    logger_1.default.warn(`clientAuthCredentials: failed to delete credential "${cred.name}" on client "${clientName}": ${err}`);
+                }
+            }
+        }
+    }
+}
+exports.default = ClientAuthCredentialsPreHandler;
+__decorate([
+    (0, default_1.order)('40')
+], ClientAuthCredentialsPreHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/clientGrants.d.ts

@@ -22,7 +22,7 @@ export declare const schema: {
             };
             subject_type: {
                 type: string;
-                enum: ("client" | "user")[];
+                enum: ("client" | "user" | "anonymous_user")[];
                 description: string;
             };
             authorization_details_types: {

package/lib/tools/auth0/handlers/clients.d.ts

@@ -193,10 +193,53 @@ export declare const schema: {
                 };
                 additionalProperties: boolean;
             };
+            identity_assertion_authorization_grant: {
+                type: string;
+                description: string;
+                properties: {
+                    active: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+            anonymous_sessions: {
+                type: string;
+                description: string;
+                properties: {
+                    active: {
+                        type: string;
+                        description: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             app_type: {
                 type: string;
                 description: string;
             };
+            b2b_integration_configuration: {
+                type: string[];
+                description: string;
+                properties: {
+                    integration_type: {
+                        type: string;
+                        enum: string[];
+                        description: string;
+                    };
+                    sso_profiles: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                        };
+                    };
+                };
+                additionalProperties: boolean;
+            };
             resource_server_identifier: {
                 type: string;
                 description: string;
@@ -242,10 +285,39 @@ export declare const schema: {
                         enum: ("allow" | "allow_if_empty")[];
                         description: string;
                     };
+                    third_party_client_access: {
+                        type: string;
+                        description: string;
+                        properties: {
+                            default_value: {
+                                type: string;
+                                enum: "block"[];
+                                description: string;
+                            };
+                            allowed_values: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    enum: ("allow" | "block")[];
+                                };
+                                uniqueItems: boolean;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                    };
                     invitation_landing_client_id: {
                         type: string;
                         description: string;
                     };
+                    enforce_permission_ceiling: {
+                        type: string;
+                        description: string;
+                    };
+                    enforce_self_assignment_restriction: {
+                        type: string;
+                        description: string;
+                    };
                 };
                 required: string[];
             };
@@ -328,6 +400,40 @@ export declare const schema: {
                     };
                 };
             };
+            token_vault_privileged_access: {
+                type: string[];
+                description: string;
+                properties: {
+                    ip_allowlist: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                        };
+                    };
+                    grants: {
+                        type: string;
+                        description: string;
+                        items: {
+                            type: string;
+                            properties: {
+                                connection: {
+                                    type: string;
+                                    description: string;
+                                };
+                                scopes: {
+                                    type: string;
+                                    description: string;
+                                    items: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            required: string[];
+                        };
+                    };
+                };
+            };
             third_party_security_mode: {
                 type: string;
                 enum: string[];