auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/tools/auth0/handlers/clients.js

@@ -59,13 +59,76 @@ const myOrganizationConfigurationSchema = {
             enum: Object.values(auth0_1.Management.ClientMyOrganizationDeletionBehaviorEnum),
             description: 'The deletion behavior for My Organization connections created by this client',
         },
+        third_party_client_access: {
+            type: 'object',
+            description: 'Controls whether third-party clients can access the organization via the My Organization API.',
+            properties: {
+                default_value: {
+                    type: 'string',
+                    enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationThirdPartyClientAccessDefaultValueEnum),
+                    description: 'The default third-party client access value.',
+                },
+                allowed_values: {
+                    type: 'array',
+                    items: {
+                        type: 'string',
+                        enum: Object.values(auth0_1.Management.ClientMyOrganizationConfigurationThirdPartyClientAccessAllowedValuesEnum),
+                    },
+                    uniqueItems: true,
+                    description: 'The allowed third-party client access values.',
+                },
+            },
+            required: ['default_value', 'allowed_values'],
+        },
         invitation_landing_client_id: {
             type: 'string',
             description: 'The client ID of the invitation landing client for the My Organization configuration',
         },
+        enforce_permission_ceiling: {
+            type: 'boolean',
+            description: 'When true, limits the permissions that organization admins can assign to members to only those held by the admin themselves. Early Access, gated by the my_org_member_management_ea feature flag.',
+        },
+        enforce_self_assignment_restriction: {
+            type: 'boolean',
+            description: 'When true, prevents organization admins from assigning permissions to themselves. Early Access, gated by the my_org_member_management_ea feature flag.',
+        },
     },
     required: ['allowed_strategies', 'connection_deletion_behavior'],
 };
+const tokenVaultPrivilegedAccessSchema = {
+    type: ['object', 'null'],
+    description: 'Settings for Token Vault Privileged Access, hardening a privileged client by restricting the caller IPs, connections, and scopes it may use at runtime. Early Access, gated by the token_vault_subject_type_jwt_ea_rollout feature flag. Export-only: this object is exported for visibility but is not deployed by the Deploy CLI (it is stripped from create/update payloads because the required credentials are tenant-specific ids). Manage it directly on the tenant.',
+    properties: {
+        ip_allowlist: {
+            type: 'array',
+            description: 'IPv4/IPv6 addresses or CIDR ranges permitted to call token exchange on behalf of this privileged client. When the EA flag is on, this is required (non-empty) on create if token_vault_privileged_access is being set.',
+            items: {
+                type: 'string',
+            },
+        },
+        grants: {
+            type: 'array',
+            description: 'Connection/scope pin objects restricting which federated connections and OAuth scopes the privileged client may use at runtime. Maximum 5 connections; maximum 20 scopes in total across all connections.',
+            items: {
+                type: 'object',
+                properties: {
+                    connection: {
+                        type: 'string',
+                        description: 'The connection name (e.g. google-oauth2). Validated at runtime; the connection need not exist at configuration time.',
+                    },
+                    scopes: {
+                        type: 'array',
+                        description: 'The OAuth scopes permitted for that connection.',
+                        items: {
+                            type: 'string',
+                        },
+                    },
+                },
+                required: ['connection', 'scopes'],
+            },
+        },
+    },
+};
 exports.schema = {
     type: 'array',
     items: {
@@ -221,10 +284,51 @@ exports.schema = {
                 },
                 additionalProperties: true,
             },
+            identity_assertion_authorization_grant: {
+                type: 'object',
+                description: 'Settings for Cross App Access (ID-JAG) token exchange. Early Access. Enables the client to request identity assertion authorization grants.',
+                properties: {
+                    active: {
+                        type: 'boolean',
+                        description: 'Indicates whether the client can request an identity assertion authorization grant (ID-JAG) via token exchange.',
+                    },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
+            anonymous_sessions: {
+                type: 'object',
+                description: 'Configuration for anonymous sessions for this client.',
+                properties: {
+                    active: {
+                        type: 'boolean',
+                        description: 'Whether anonymous sessions are enabled for this client.',
+                    },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
             app_type: {
                 type: 'string',
                 description: 'The type of application this client represents',
             },
+            b2b_integration_configuration: {
+                type: ['object', 'null'],
+                description: 'B2B integration configuration. Early Access. Required feature flag: enterprise_connect_entitled.',
+                properties: {
+                    integration_type: {
+                        type: 'string',
+                        enum: ['custom_auth_server', 'third_party', 'application'],
+                        description: 'The type of integration used to connect to this B2B integration client.',
+                    },
+                    sso_profiles: {
+                        type: 'array',
+                        description: 'List of SSO profile IDs linked to this B2B integration client. Maximum 1 entry.',
+                        items: { type: 'string' },
+                    },
+                },
+                additionalProperties: false,
+            },
             resource_server_identifier: {
                 type: 'string',
                 description: 'The identifier of a resource server in your tenant. This property links a client to a resource server indicating that the client IS that resource server. Can only be set when app_type=resource_server.',
@@ -250,7 +354,7 @@ exports.schema = {
                 description: 'An ordered array of notification channels enabled for CIBA (Client-Initiated Backchannel Authentication) requests. Channels are evaluated in the order specified.',
                 items: {
                     type: 'string',
-                    enum: ['guardian-push', 'email'],
+                    enum: ['guardian-push', 'email', 'my-account'],
                 },
             },
             skip_non_verifiable_callback_uri_confirmation_prompt: {
@@ -332,6 +436,7 @@ exports.schema = {
                     },
                 },
             },
+            token_vault_privileged_access: tokenVaultPrivilegedAccessSchema,
             third_party_security_mode: {
                 type: 'string',
                 enum: ['strict', 'permissive'],
@@ -460,6 +565,40 @@ const createClientSanitizer = (clients) => {
         },
     };
 };
+/**
+ * On export, remove `credentials` from `token_vault_privileged_access`.
+ *
+ * Auth0 returns these as tenant-specific credential references (`{ id }`) — never
+ * names or key material — so they are not portable across tenants and must never be
+ * written to disk. `ip_allowlist` and `grants` are kept for visibility. Mutates and
+ * returns the same client.
+ */
+const stripTokenVaultCredentialsOnExport = (client) => {
+    const tvpa = client
+        .token_vault_privileged_access;
+    if (tvpa && 'credentials' in tvpa) {
+        delete tvpa.credentials;
+    }
+    return client;
+};
+/**
+ * On write (create/update), remove the entire `token_vault_privileged_access` object.
+ *
+ * The Management API requires `credentials` whenever `token_vault_privileged_access`
+ * is present in the payload, but those credentials are tenant-specific ids that the
+ * Deploy CLI intentionally never persists (see stripTokenVaultCredentialsOnExport).
+ * Sending the object without `credentials` fails validation ("Missing required
+ * property: credentials"); sending it with exported ids would re-send stale ids on a
+ * cross-tenant deploy. The Deploy CLI therefore does not manage this field — it is
+ * export-only. Manage `token_vault_privileged_access` directly on the tenant.
+ * Mutates and returns the same client.
+ */
+const stripTokenVaultPrivilegedAccessOnWrite = (client) => {
+    if ('token_vault_privileged_access' in client) {
+        delete client.token_vault_privileged_access;
+    }
+    return client;
+};
 class ClientHandler extends default_1.default {
     constructor(config) {
         super({
@@ -482,6 +621,9 @@ class ClientHandler extends default_1.default {
                 'jwks_uri',
                 // third_party_security_mode is immutable after creation; PATCH returns 400
                 'third_party_security_mode',
+                // API-generated timestamps; PATCH returns 400 if present
+                'created_at',
+                'updated_at',
             ],
             functions: {
                 create: (client) => this.createClient(client),
@@ -566,6 +708,21 @@ class ClientHandler extends default_1.default {
                         delete item.refresh_token;
                     }
                 }
+                // Strip client_authentication_methods — the clientAuthCredentials handler (order 70)
+                // owns this field entirely. Auth0 rejects credential objects with name/credential_type in PATCH.
+                // Strip token_endpoint_auth_method only when client_authentication_methods is present in config:
+                // Auth0 rejects it in PATCH while a client has active credentials. For these clients the
+                // clientAuthCredentials handler (order 70) owns token_endpoint_auth_method too.
+                // For clients without client_authentication_methods, credentials were already cleared by
+                // clientAuthCredentialsPre (order 40), so token_endpoint_auth_method passes through safely.
+                if (item.client_authentication_methods) {
+                    delete item.token_endpoint_auth_method;
+                }
+                delete item.client_authentication_methods;
+                // token_vault_privileged_access requires tenant-specific credential ids that
+                // the Deploy CLI never persists. Strip the whole object on write so we neither
+                // re-send stale ids nor fail validation for the missing credentials property.
+                stripTokenVaultPrivilegedAccessOnWrite(item);
                 return item;
             });
         };
@@ -587,7 +744,38 @@ class ClientHandler extends default_1.default {
             is_global: false,
             ...((0, utils_1.shouldExcludeThirdPartyClients)(this.config) && { is_first_party: true }),
         });
-        this.existing = createClientSanitizer(clients).sanitizeCrossOriginAuth(false).get();
+        const sanitized = createClientSanitizer(clients)
+            .sanitizeCrossOriginAuth(false)
+            .get()
+            // token_vault_privileged_access.credentials are returned as tenant-specific
+            // ids — strip them so they are never exported to disk.
+            .map(stripTokenVaultCredentialsOnExport);
+        // Enrich credential stubs with name and credential_type for export.
+        // Auth0 does not return pem on read — it is never exported.
+        await Promise.all(sanitized.map(async (client) => {
+            if (!client.client_authentication_methods)
+                return;
+            try {
+                const creds = await this.client.clients.credentials.list(client.client_id);
+                const credMap = new Map(creds.map((c) => [c.id, c]));
+                Object.values(client.client_authentication_methods).forEach((method) => {
+                    if (method?.credentials) {
+                        method.credentials = method.credentials
+                            .map((stub) => {
+                            const full = credMap.get(stub.id);
+                            if (!full?.name)
+                                return null;
+                            return { name: full.name, credential_type: full.credential_type };
+                        })
+                            .filter(Boolean);
+                    }
+                });
+            }
+            catch (_) {
+                // leave stubs as-is if the credentials API call fails
+            }
+        }));
+        this.existing = sanitized;
         return this.existing;
     }
     isCimdClient(client) {
@@ -625,7 +813,23 @@ class ClientHandler extends default_1.default {
     async updateClient(clientId, client) {
         // For non-CIMD clients
         if (!this.isCimdClient(client)) {
-            return this.client.clients.update(clientId, client);
+            const payload = { ...client };
+            // b2b_integration_configuration: PATCH only allowed if client already has the object.
+            // Sending it to a client that lacks it returns 400 invalid_body.
+            // null clears the object — but only for clients that already have it; stripping
+            // null for a client without the field is a safe no-op.
+            if ('b2b_integration_configuration' in payload) {
+                const existing = (this.existing || []).find((c) => c.client_id === (client.client_id || clientId));
+                if (!existing?.b2b_integration_configuration) {
+                    if (payload.b2b_integration_configuration !== null) {
+                        logger_1.default.warn(`b2b_integration_configuration cannot be added to an existing client via PATCH ` +
+                            `(client: ${client.name || clientId}). Skipping field. ` +
+                            `Re-create the client to set this field.`);
+                    }
+                    delete payload.b2b_integration_configuration;
+                }
+            }
+            return this.client.clients.update(clientId, payload);
         }
         const updatePayload = this.getCIMDEditableFields(client);
         const registrationClientId = client.client_id || clientId;

package/lib/tools/auth0/handlers/connectionProfiles.d.ts

@@ -36,6 +36,33 @@ export declare const schema: {
             connection_config: {
                 type: string[];
             };
+            cross_app_access_resource_app: {
+                type: string;
+                description: string;
+                properties: {
+                    status: {
+                        type: string;
+                        properties: {
+                            default_value: {
+                                type: string;
+                                enum: ("enabled" | "disabled")[];
+                                description: string;
+                            };
+                            allowed_values: {
+                                type: string;
+                                items: {
+                                    type: string;
+                                    enum: ("enabled" | "disabled")[];
+                                };
+                                uniqueItems: boolean;
+                                description: string;
+                            };
+                        };
+                        required: string[];
+                    };
+                };
+                required: string[];
+            };
             strategy_overrides: {
                 type: string[];
                 properties: {

package/lib/tools/auth0/handlers/connectionProfiles.js

@@ -4,6 +4,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getConnectionProfile = exports.schema = void 0;
+const auth0_1 = require("auth0");
 const default_1 = __importDefault(require("./default"));
 const client_1 = require("../client");
 const logger_1 = __importDefault(require("../../../logger"));
@@ -42,6 +43,35 @@ exports.schema = {
             connection_config: {
                 type: ['object', 'null'],
             },
+            cross_app_access_resource_app: {
+                type: 'object',
+                description: 'Controls whether organization admins may enable Cross App Access (XAA) on their Identity Providers.',
+                properties: {
+                    status: {
+                        type: 'object',
+                        properties: {
+                            default_value: {
+                                type: 'string',
+                                enum: Object.values(auth0_1.Management.ConnectionProfileCrossAppAccessResourceAppStatusDefaultValueEnum),
+                                description: 'The default Cross App Access resource app status.',
+                            },
+                            allowed_values: {
+                                type: 'array',
+                                items: {
+                                    type: 'string',
+                                    enum: Object.values(auth0_1.Management.ConnectionProfileCrossAppAccessResourceAppStatusValueEnum),
+                                },
+                                uniqueItems: true,
+                                description: 'The allowed Cross App Access resource app status values.',
+                            },
+                        },
+                        // allowed_values is optional per the SDK type (unlike the client's
+                        // third_party_client_access, which requires both fields).
+                        required: ['default_value'],
+                    },
+                },
+                required: ['status'],
+            },
             strategy_overrides: {
                 type: ['object', 'null'],
                 properties: {

package/lib/tools/auth0/handlers/connections.d.ts

@@ -103,6 +103,27 @@ export declare const schema: {
                 required: string[];
                 additionalProperties: boolean;
             };
+            cross_app_access_requesting_app: {
+                type: string;
+                properties: {
+                    active: {
+                        type: string;
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
+            cross_app_access_resource_app: {
+                type: string;
+                properties: {
+                    status: {
+                        type: string;
+                        enum: string[];
+                    };
+                };
+                required: string[];
+                additionalProperties: boolean;
+            };
             directory_provisioning_configuration: {
                 type: string;
                 properties: {
@@ -138,6 +159,15 @@ export declare const schema: {
                                 id: {
                                     type: string;
                                 };
+                                name: {
+                                    type: string;
+                                };
+                                email: {
+                                    type: string;
+                                };
+                                direct_members_count: {
+                                    type: string;
+                                };
                             };
                             required: string[];
                         };
@@ -152,9 +182,7 @@ type DirectoryProvisioningConfig = Management.DirectoryProvisioning;
 export type Connection = Management.ConnectionForList & {
     enabled_clients?: string[];
     directory_provisioning_configuration?: Pick<DirectoryProvisioningConfig, 'mapping' | 'synchronize_automatically' | 'synchronize_groups'> & {
-        synchronized_groups?: Array<{
-            id: string;
-        }>;
+        synchronized_groups?: Management.SynchronizedGroupPayload[];
     };
 };
 export declare const addExcludedConnectionPropertiesToChanges: ({ proposedChanges, existingConnections, config, }: {
@@ -202,6 +230,7 @@ export declare const processConnectionEnabledClients: (auth0Client: Auth0APIClie
 export default class ConnectionsHandler extends DefaultAPIHandler {
     existing: Connection[] | null;
     scimHandler: ScimHandler;
+    private enabledClientsEnrichmentFilter;
     constructor(config: DefaultAPIHandler);
     objString(connection: any): string;
     getFormattedOptions(connection: any, clients: any): {
@@ -230,9 +259,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
     /**
      * Retrieves all synchronized groups for a connection using checkpoint pagination.
      */
-    getConnectionSynchronizedGroups(connectionId: string): Promise<Array<{
-        id: string;
-    }> | null>;
+    getConnectionSynchronizedGroups(connectionId: string): Promise<Management.SynchronizedGroupPayload[] | null>;
     /**
      * Replaces the synchronized groups for a connection (PUT replace-all semantics).
      */
@@ -244,6 +271,7 @@ export default class ConnectionsHandler extends DefaultAPIHandler {
      * @param changes - Object containing arrays of connections to create, update, and resolve conflicts for
      */
     processConnectionDirectoryProvisioning(changes: CalculatedChanges): Promise<void>;
+    private setEnabledClientsEnrichmentFilter;
     getType(): Promise<Asset[] | null>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
     dryRunChanges(assets: Assets): Promise<CalculatedChanges>;

package/lib/tools/auth0/handlers/connections.js

@@ -129,6 +129,22 @@ exports.schema = {
                 required: ['active'],
                 additionalProperties: false,
             },
+            cross_app_access_requesting_app: {
+                type: 'object',
+                properties: {
+                    active: { type: 'boolean' },
+                },
+                required: ['active'],
+                additionalProperties: false,
+            },
+            cross_app_access_resource_app: {
+                type: 'object',
+                properties: {
+                    status: { type: 'string', enum: ['enabled', 'disabled'] },
+                },
+                required: ['status'],
+                additionalProperties: false,
+            },
             directory_provisioning_configuration: {
                 type: 'object',
                 properties: {
@@ -156,6 +172,9 @@ exports.schema = {
                             type: 'object',
                             properties: {
                                 id: { type: 'string' },
+                                name: { type: 'string' },
+                                email: { type: 'string' },
+                                direct_members_count: { type: 'number' },
                             },
                             required: ['id'],
                         },
@@ -353,6 +372,10 @@ class ConnectionsHandler extends default_1.default {
                 create: async (bodyParams) => this.scimHandler.createOverride(bodyParams),
             },
         });
+        // On import, limits getType()'s enabled_clients enrichment to connections in
+        // the local config, skipping an API call per remote-only connection on large
+        // tenants. Null on export, where every connection is enriched.
+        this.enabledClientsEnrichmentFilter = null;
         // @ts-ignore
         this.scimHandler = new scimHandler_1.default(this.config, this.client.connections, this.client.pool);
     }
@@ -361,12 +384,15 @@ class ConnectionsHandler extends default_1.default {
     }
     getFormattedOptions(connection, clients) {
         try {
+            const { idpinitiated } = connection.options;
             return {
                 options: {
                     ...connection.options,
                     idpinitiated: {
-                        ...connection.options.idpinitiated,
-                        client_id: (0, utils_1.convertClientNameToId)(connection.options.idpinitiated.client_id, clients),
+                        ...idpinitiated,
+                        ...(idpinitiated.client_id && {
+                            client_id: (0, utils_1.convertClientNameToId)(idpinitiated.client_id, clients),
+                        }),
                     },
                 },
             };
@@ -467,12 +493,28 @@ class ConnectionsHandler extends default_1.default {
         try {
             const groups = [];
             let page = await this.client.connections.directoryProvisioning.listSynchronizedGroups(connectionId, {});
-            for (const g of page.data ?? [])
-                groups.push({ id: g.id });
+            for (const g of page.data ?? []) {
+                groups.push({
+                    id: g.id,
+                    ...(g.name !== undefined && { name: g.name }),
+                    ...(g.email !== undefined && { email: g.email }),
+                    ...(g.direct_members_count !== undefined && {
+                        direct_members_count: g.direct_members_count,
+                    }),
+                });
+            }
             while (page.hasNextPage?.()) {
                 page = await page.getNextPage();
-                for (const g of page.data ?? [])
-                    groups.push({ id: g.id });
+                for (const g of page.data ?? []) {
+                    groups.push({
+                        id: g.id,
+                        ...(g.name !== undefined && { name: g.name }),
+                        ...(g.email !== undefined && { email: g.email }),
+                        ...(g.direct_members_count !== undefined && {
+                            direct_members_count: g.direct_members_count,
+                        }),
+                    });
+                }
             }
             return groups;
         }
@@ -583,9 +625,19 @@ class ConnectionsHandler extends default_1.default {
         })
             .promise();
     }
+    // Scopes getType()'s enabled_clients enrichment to the local config's
+    // connection names. Called on import; export leaves it unset (enrich all).
+    setEnabledClientsEnrichmentFilter(connections) {
+        this.enabledClientsEnrichmentFilter = new Set(connections
+            .map((connection) => connection.name)
+            .filter((name) => typeof name === 'string'));
+    }
     async getType() {
         if (this.existing)
             return this.existing;
+        // Consume the import filter and reset it so it can't leak into a later call.
+        const enrichmentFilter = this.enabledClientsEnrichmentFilter;
+        this.enabledClientsEnrichmentFilter = null;
         const [connections, directoryProvisioningConfigs] = await Promise.all([
             (0, client_1.paginate)(this.client.connections.list, {
                 checkpoint: true,
@@ -602,7 +654,11 @@ class ConnectionsHandler extends default_1.default {
         this.existing = filteredConnections;
         if (this.existing === null)
             return [];
-        const connectionTasks = filteredConnections.map((con, index) => ({ con, index }));
+        // Import: enrich only local-config connections. Export (null): enrich all.
+        const shouldEnrich = (con) => enrichmentFilter === null || (con.name != null && enrichmentFilter.has(con.name));
+        const connectionTasks = filteredConnections
+            .map((con, index) => ({ con, index }))
+            .filter(({ con }) => shouldEnrich(con));
         const connectionsWithEnabledClients = await this.client.pool
             .addEachTask({
             data: connectionTasks,
@@ -638,9 +694,9 @@ class ConnectionsHandler extends default_1.default {
             },
         })
             .promise();
-        this.existing = connectionsWithEnabledClients
-            .sort((a, b) => a.index - b.index)
-            .map(({ connection }) => connection);
+        // Merge enriched connections back by index; skipped ones pass through.
+        const enrichedByIndex = new Map(connectionsWithEnabledClients.map(({ index, connection }) => [index, connection]));
+        this.existing = filteredConnections.map((con, index) => enrichedByIndex.get(index) ?? con);
         // Apply `scim_configuration` to all the relevant `SCIM` connections. This method mutates `this.existing`.
         await this.scimHandler.applyScimConfiguration(this.existing);
         return this.existing;
@@ -655,6 +711,8 @@ class ConnectionsHandler extends default_1.default {
                 update: [],
                 conflicts: [],
             };
+        // Scope getType() enrichment to the local config (see getType()).
+        this.setEnabledClientsEnrichmentFilter(connections);
         // Convert enabled_clients by name to the id
         const clients = await (0, client_1.paginate)(this.client.clients.list, {
             paginate: true,
@@ -692,6 +750,8 @@ class ConnectionsHandler extends default_1.default {
                 conflicts: [],
             };
         }
+        // Scope getType() enrichment to the local config (see getType()).
+        this.setEnabledClientsEnrichmentFilter(connections);
         const clients = await (0, client_1.paginate)(this.client.clients.list, {
             paginate: true,
             include_totals: true,
@@ -709,7 +769,11 @@ class ConnectionsHandler extends default_1.default {
                 ...(enabledClients !== undefined && { enabled_clients: enabledClients }),
             };
         });
-        const proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        let proposedChanges = await super.dryRunChanges({ ...assets, connections: formatted });
+        const includedConnections = (assets.include && assets.include.connections) || [];
+        const excludedConnections = (assets.exclude && assets.exclude.connections) || [];
+        proposedChanges = (0, utils_1.filterExcluded)(proposedChanges, excludedConnections);
+        proposedChanges = (0, utils_1.filterIncluded)(proposedChanges, includedConnections);
         return (0, exports.addExcludedConnectionPropertiesToChanges)({
             proposedChanges,
             existingConnections,

package/lib/tools/auth0/handlers/databases.d.ts

@@ -195,6 +195,33 @@ export declare const schema: {
                             };
                         };
                     };
+                    otp_settings: {
+                        type: string;
+                        properties: {
+                            email: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                            phone: {
+                                type: string;
+                                properties: {
+                                    otp_length: {
+                                        type: string;
+                                    };
+                                    otp_expiry: {
+                                        type: string;
+                                    };
+                                };
+                            };
+                        };
+                    };
                     password_options: {
                         type: string;
                         properties: {
@@ -295,6 +322,7 @@ export default class DatabaseHandler extends DefaultAPIHandler {
     private validatePasswordlessSettings;
     private validateEmailUniqueConstraints;
     getClientFN(fn: 'create' | 'delete' | 'getAll' | 'update'): Function;
+    private enrichConnectionsWithEnabledClients;
     getType(): Promise<Connection[]>;
     calcChanges(assets: Assets): Promise<CalculatedChanges>;
     dryRunChanges(assets: Assets): Promise<CalculatedChanges>;