auth0-deploy-cli 9.0.0-beta.2 → 9.1.0

package/lib/tools/auth0/handlers/guardianPolicies.js

@@ -7,6 +7,7 @@ exports.schema = void 0;
 const default_1 = __importDefault(require("./default"));
 const constants_1 = __importDefault(require("../../constants"));
 const utils_1 = require("../../utils");
+const logger_1 = __importDefault(require("../../../logger"));
 exports.schema = {
     type: 'object',
     properties: {
@@ -48,7 +49,16 @@ class GuardianPoliciesHandler extends default_1.default {
             }
         }
         const data = guardianPolicies.policies;
-        await this.client.guardian.policies.set(data);
+        try {
+            await this.client.guardian.policies.set(data);
+        }
+        catch (err) {
+            if ((0, utils_1.isInsufficientEntitlementError)(err)) {
+                logger_1.default.warn('Skipping guardianPolicies deploy: tenant does not have Adaptive MFA entitlement (confidence-score requires an Enterprise add-on)');
+                return;
+            }
+            throw err;
+        }
         this.updated += 1;
         this.didUpdate(guardianPolicies);
     }

package/lib/tools/auth0/handlers/guardianSettings.d.ts

@@ -0,0 +1,30 @@
+import DefaultHandler from './default';
+import { Asset, Assets } from '../../../types';
+export declare const schema: {
+    type: string;
+    properties: {
+        display_remember_me_checkbox: {
+            type: string;
+            description: string;
+        };
+        remember_me_default_value: {
+            type: string;
+            description: string;
+        };
+        mfa_session_inactivity_timeout: {
+            type: string;
+            description: string;
+        };
+        mfa_session_overall_timeout: {
+            type: string;
+            description: string;
+        };
+    };
+    additionalProperties: boolean;
+};
+export default class GuardianSettingsHandler extends DefaultHandler {
+    existing: Asset;
+    constructor(options: any);
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+}

package/lib/tools/auth0/handlers/guardianSettings.js

@@ -0,0 +1,85 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importDefault(require("./default"));
+const utils_1 = require("../../utils");
+exports.schema = {
+    type: 'object',
+    properties: {
+        display_remember_me_checkbox: {
+            type: 'boolean',
+            description: 'Determines whether to display the "Remember Me" checkbox on the MFA prompt in Universal Login.',
+        },
+        remember_me_default_value: {
+            type: 'boolean',
+            description: 'Determines the default state of the "Remember Me" checkbox on the MFA prompt in Universal Login.',
+        },
+        mfa_session_inactivity_timeout: {
+            type: 'number',
+            description: 'Duration of inactivity (seconds) after which the user will be prompted for MFA. Cannot exceed the overall timeout.',
+        },
+        mfa_session_overall_timeout: {
+            type: 'number',
+            description: 'Maximum duration (seconds) after which the user will be prompted for MFA regardless of activity.',
+        },
+    },
+    additionalProperties: false,
+};
+class GuardianSettingsHandler extends default_1.default {
+    constructor(options) {
+        super({
+            ...options,
+            type: 'guardianSettings',
+        });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            const data = await this.client.guardian.get();
+            this.existing = data;
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err)) {
+                // Gracefully skip processing this configuration value.
+                return null;
+            }
+            if ((0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                return null;
+            }
+            throw err;
+        }
+        return this.existing;
+    }
+    async processChanges(assets) {
+        // No API to delete or create guardianSettings, we can only update.
+        const { guardianSettings } = assets;
+        // Do nothing if not set
+        if (!guardianSettings) {
+            return;
+        }
+        if ((0, utils_1.isDryRun)(this.config)) {
+            const { del, update, create } = await this.calcChanges(assets);
+            if (create.length === 0 && update.length === 0 && del.length === 0) {
+                return;
+            }
+        }
+        try {
+            await this.client.guardian.set(guardianSettings);
+        }
+        catch (err) {
+            if ((0, utils_1.isFeatureUnavailableError)(err) || (0, utils_1.isForbiddenFeatureError)(err, this.type)) {
+                // Feature is unavailable (404) or disabled (403) on this tenant; skip instead of failing
+                // the import. The 403 path logs a warning via isForbiddenFeatureError; the 404 path is silent.
+                return;
+            }
+            throw err;
+        }
+        this.updated += 1;
+        this.didUpdate(guardianSettings);
+    }
+}
+exports.default = GuardianSettingsHandler;

package/lib/tools/auth0/handlers/hooks.js

@@ -151,7 +151,7 @@ class HooksHandler extends default_1.default {
                 .get(hook.id)
                 .then((hookWithCode) => this.client.hooks.secrets
                 .get(hook.id)
-                .then(({ data: secrets }) => ({ ...hookWithCode, secrets })))));
+                .then((secrets) => ({ ...hookWithCode, secrets })))));
             return this.existing;
         }
         catch (err) {

package/lib/tools/auth0/handlers/index.js

@@ -51,6 +51,9 @@ const guardianFactorTemplates = __importStar(require("./guardianFactorTemplates"
 const guardianPolicies = __importStar(require("./guardianPolicies"));
 const guardianPhoneFactorSelectedProvider = __importStar(require("./guardianPhoneFactorSelectedProvider"));
 const guardianPhoneFactorMessageTypes = __importStar(require("./guardianPhoneFactorMessageTypes"));
+const guardianPhoneFactorSettings = __importStar(require("./guardianPhoneFactorSettings"));
+const guardianEmailFactorSettings = __importStar(require("./guardianEmailFactorSettings"));
+const guardianSettings = __importStar(require("./guardianSettings"));
 const roles = __importStar(require("./roles"));
 const branding = __importStar(require("./branding"));
 const phoneProviders = __importStar(require("./phoneProvider"));
@@ -69,12 +72,16 @@ const forms = __importStar(require("./forms"));
 const flows = __importStar(require("./flows"));
 const flowVaultConnections = __importStar(require("./flowVaultConnections"));
 const selfServiceProfiles = __importStar(require("./selfServiceProfiles"));
+const networkACLKeys = __importStar(require("./networkACLKeys"));
 const networkACLs = __importStar(require("./networkACLs"));
 const userAttributeProfiles = __importStar(require("./userAttributeProfiles"));
 const connectionProfiles = __importStar(require("./connectionProfiles"));
 const tokenExchangeProfiles = __importStar(require("./tokenExchangeProfiles"));
 const supplementalSignals = __importStar(require("./supplementalSignals"));
+const rateLimitPolicies = __importStar(require("./rateLimitPolicies"));
 const eventStreams = __importStar(require("./eventStreams"));
+const clientAuthCredentials = __importStar(require("./clientAuthCredentials"));
+const clientAuthCredentialsPre = __importStar(require("./clientAuthCredentialsPre"));
 const auth0ApiHandlers = {
     rules,
     rulesConfigs,
@@ -94,6 +101,9 @@ const auth0ApiHandlers = {
     guardianPolicies,
     guardianPhoneFactorSelectedProvider,
     guardianPhoneFactorMessageTypes,
+    guardianPhoneFactorSettings,
+    guardianEmailFactorSettings,
+    guardianSettings,
     roles,
     branding,
     phoneProviders,
@@ -113,11 +123,17 @@ const auth0ApiHandlers = {
     flows,
     flowVaultConnections,
     selfServiceProfiles,
+    networkACLKeys,
     networkACLs,
     userAttributeProfiles,
     connectionProfiles,
     tokenExchangeProfiles,
     supplementalSignals,
+    rateLimitPolicies,
     eventStreams,
+    clientAuthCredentials,
+    // clientAuthCredentialsPre is a deploy-only pre-pass handler (order 40) — not a user-facing
+    // asset type so it is not in AssetTypes, but must be registered here to run during deploy.
+    ...{ clientAuthCredentialsPre },
 };
 exports.default = auth0ApiHandlers; // TODO: apply stronger types to schema properties

package/lib/tools/auth0/handlers/networkACLKeys.d.ts

@@ -0,0 +1,45 @@
+import { Management } from 'auth0';
+import DefaultAPIHandler from './default';
+import { Asset, Assets, CalculatedChanges } from '../../../types';
+export type NetworkAclKey = Management.NetworkAclKey & {
+    value?: string;
+};
+export declare const schema: {
+    type: string;
+    description: string;
+    items: {
+        type: string;
+        required: string[];
+        properties: {
+            id: {
+                type: string;
+            };
+            name: {
+                type: string;
+                maxLength: number;
+            };
+            alg: {
+                type: string;
+                enum: string[];
+            };
+            value: {
+                type: string;
+            };
+            fingerprint: {
+                type: string;
+            };
+        };
+        additionalProperties: boolean;
+    };
+};
+export default class NetworkACLKeysHandler extends DefaultAPIHandler {
+    existing: NetworkAclKey[] | null;
+    constructor(config: DefaultAPIHandler);
+    objString(key: NetworkAclKey): string;
+    getType(): Promise<Asset | null>;
+    processChanges(assets: Assets): Promise<void>;
+    createNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    createNetworkACLKeys(creates: CalculatedChanges['create']): Promise<void>;
+    deleteNetworkACLKey(key: NetworkAclKey): Promise<void>;
+    deleteNetworkACLKeys(data: Asset[]): Promise<void>;
+}

package/lib/tools/auth0/handlers/networkACLKeys.js

@@ -0,0 +1,177 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.schema = void 0;
+const default_1 = __importStar(require("./default"));
+const logger_1 = __importDefault(require("../../../logger"));
+exports.schema = {
+    type: 'array',
+    description: 'List of Network ACL keys for HMAC signature verification',
+    items: {
+        type: 'object',
+        required: ['name', 'alg'],
+        properties: {
+            id: { type: 'string' },
+            name: { type: 'string', maxLength: 255 },
+            alg: { type: 'string', enum: ['hmac-sha256'] },
+            // value is write-only and never returned by the API.
+            // Provide it at deploy time via keyword replacement (e.g. ##HMAC_KEY_VALUE##).
+            // It is not exported and is omitted from exported configs.
+            value: { type: 'string' },
+            fingerprint: { type: 'string' },
+        },
+        additionalProperties: false,
+    },
+};
+class NetworkACLKeysHandler extends default_1.default {
+    constructor(config) {
+        super({
+            ...config,
+            type: 'networkACLKeys',
+            id: 'id',
+            identifiers: ['name'],
+            // value is write-only (never returned by API) and fingerprint/timestamps are
+            // API-generated — ignore all of them when computing dry-run diffs so keys
+            // with a local `value` don't show phantom UPDATEs.
+            ignoreDryRunFields: ['value', 'fingerprint', 'created_at', 'updated_at'],
+        });
+    }
+    objString(key) {
+        return super.objString({ name: key.name, alg: key.alg });
+    }
+    async getType() {
+        if (this.existing)
+            return this.existing;
+        try {
+            // Not paginated — tenant cap is 10 keys. Returns { keys: [...] }.
+            const result = await this.client.keys.networkAcls.list();
+            this.existing = result.keys;
+            return this.existing;
+        }
+        catch (err) {
+            if (err.statusCode === 404 || err.statusCode === 501) {
+                return null;
+            }
+            if (err.statusCode === 403) {
+                logger_1.default.debug('Network ACL key management is not enabled for this tenant. Please verify `scope` or contact Auth0 support.');
+                return null;
+            }
+            throw err;
+        }
+    }
+    async processChanges(assets) {
+        const { networkACLKeys } = assets;
+        // Do nothing if not set
+        if (!networkACLKeys)
+            return;
+        const { del, create } = await this.calcChanges(assets);
+        // Keys are immutable after creation — there is no update operation.
+        // A detected "update" (same name, different config) is a no-op: the existing key is kept as-is.
+        logger_1.default.debug(`Start processChanges for networkACLKeys [delete:${del.length}] [create:${create.length}]`);
+        await Promise.all([this.deleteNetworkACLKeys(del), this.createNetworkACLKeys(create)]);
+    }
+    async createNetworkACLKey(key) {
+        if (!key.value) {
+            logger_1.default.warn(`Skipping creation of Network ACL key "${key.name}": ` +
+                `'value' is required to create a key but is not present in the config. ` +
+                `Supply the key material via keyword replacement (e.g. ##HMAC_KEY_VALUE##) or create the key out-of-band.`);
+            return;
+        }
+        await this.client.keys.networkAcls.create({
+            name: key.name,
+            alg: key.alg,
+            value: key.value,
+        });
+        this.didCreate(key);
+        this.created += 1;
+    }
+    async createNetworkACLKeys(creates) {
+        await this.client.pool
+            .addEachTask({
+            data: creates || [],
+            generator: (item) => this.createNetworkACLKey(item).catch((err) => {
+                throw new Error(`Problem creating ${this.type} ${this.objString(item)}\n${err}`);
+            }),
+        })
+            .promise();
+    }
+    async deleteNetworkACLKey(key) {
+        if (!key.id) {
+            throw new Error(`Missing id for ${this.type} ${this.objString(key)}`);
+        }
+        await this.client.keys.networkAcls.delete(key.id);
+    }
+    async deleteNetworkACLKeys(data) {
+        if (!data || data.length === 0)
+            return;
+        if (this.config('AUTH0_ALLOW_DELETE') === 'true' ||
+            this.config('AUTH0_ALLOW_DELETE') === true) {
+            await this.client.pool
+                .addEachTask({
+                data: data || [],
+                generator: (item) => this.deleteNetworkACLKey(item)
+                    .then(() => {
+                    this.didDelete(item);
+                    this.deleted += 1;
+                })
+                    .catch((err) => {
+                    if (err.statusCode === 409) {
+                        throw new Error(`Cannot delete Network ACL key "${item.name}" — it is still referenced by one or more ACL rules. ` +
+                            `Remove the key reference from all ACL rules first.\n${err}`);
+                    }
+                    throw new Error(`Problem deleting ${this.type} ${this.objString(item)}\n${err}`);
+                }),
+            })
+                .promise();
+        }
+        else {
+            logger_1.default.warn(`Detected the following ${this.type} should be deleted. Doing so may be destructive.\nYou can enable deletes by setting 'AUTH0_ALLOW_DELETE' to true in the config
+      \n${data.map((i) => this.objString(i)).join('\n')}`);
+        }
+    }
+}
+exports.default = NetworkACLKeysHandler;
+__decorate([
+    (0, default_1.order)(60)
+], NetworkACLKeysHandler.prototype, "processChanges", null);

package/lib/tools/auth0/handlers/networkACLs.d.ts

@@ -21,7 +21,7 @@ export declare const schema: {
                 minimum: number;
             };
             rule: {
-                anyOf: {
+                anyOf: ({
                     type: string;
                     required: string[];
                     properties: {
@@ -85,6 +85,15 @@ export declare const schema: {
                                     uniqueItems: boolean;
                                     minItems: number;
                                 };
+                                auth0_managed: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    uniqueItems: boolean;
+                                    minItems: number;
+                                };
                                 geo_country_codes: {
                                     type: string;
                                     items: {
@@ -162,6 +171,29 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                 };
+                                http_message_signature: {
+                                    type: string;
+                                    properties: {
+                                        keys: {
+                                            type: string;
+                                            minItems: number;
+                                            maxItems: number;
+                                            uniqueItems: boolean;
+                                            items: {
+                                                type: string;
+                                                properties: {
+                                                    id: {
+                                                        type: string;
+                                                    };
+                                                };
+                                                required: string[];
+                                                additionalProperties: boolean;
+                                            };
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -176,6 +208,15 @@ export declare const schema: {
                                     uniqueItems: boolean;
                                     minItems: number;
                                 };
+                                auth0_managed: {
+                                    type: string;
+                                    items: {
+                                        type: string;
+                                        pattern: string;
+                                    };
+                                    uniqueItems: boolean;
+                                    minItems: number;
+                                };
                                 geo_country_codes: {
                                     type: string;
                                     items: {
@@ -253,6 +294,29 @@ export declare const schema: {
                                     };
                                     uniqueItems: boolean;
                                 };
+                                http_message_signature: {
+                                    type: string;
+                                    properties: {
+                                        keys: {
+                                            type: string;
+                                            minItems: number;
+                                            maxItems: number;
+                                            uniqueItems: boolean;
+                                            items: {
+                                                type: string;
+                                                properties: {
+                                                    id: {
+                                                        type: string;
+                                                    };
+                                                };
+                                                required: string[];
+                                                additionalProperties: boolean;
+                                            };
+                                        };
+                                    };
+                                    required: string[];
+                                    additionalProperties: boolean;
+                                };
                             };
                             additionalProperties: boolean;
                         };
@@ -260,9 +324,75 @@ export declare const schema: {
                             enum: string[];
                             type: string;
                         };
+                        match_all?: undefined;
+                    };
+                    additionalProperties: boolean;
+                } | {
+                    type: string;
+                    required: string[];
+                    properties: {
+                        action: {
+                            type: string;
+                            anyOf: ({
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    block: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    allow: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    log: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            } | {
+                                type: string;
+                                required: string[];
+                                properties: {
+                                    redirect: {
+                                        type: string;
+                                        enum: boolean[];
+                                    };
+                                    redirect_uri: {
+                                        type: string;
+                                        minLength: number;
+                                        maxLength: number;
+                                    };
+                                };
+                                additionalProperties: boolean;
+                            })[];
+                        };
+                        match_all: {
+                            type: string;
+                            enum: boolean[];
+                        };
+                        scope: {
+                            enum: string[];
+                            type: string;
+                        };
+                        match?: undefined;
+                        not_match?: undefined;
                     };
                     additionalProperties: boolean;
-                }[];
+                })[];
             };
         };
         additionalProperties: boolean;