Skip to content

Commit f0987cb

Browse files
willveddwillvedd
authored
Only manage allowed tenant flags (#797)
* Adding more tests * Adding logging warning * Re-recording tests * Removing reference to new_universal_login_experience_enabled flag --------- Co-authored-by: Will Vedder <[email protected]>
1 parent 54d8174 commit f0987cb

13 files changed

+5277
-3795
lines changed

‎src/tools/auth0/handlers/tenant.ts

+67-46
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ import DefaultHandler, { order } from './default';
44
import { supportedPages, pageNameMap } from './pages';
55
import { convertJsonToString } from '../../utils';
66
import { Asset, Assets, Language } from '../../../types';
7+
import log from '../../../logger';
78

89
export const schema = {
910
type: 'object',
@@ -63,17 +64,15 @@ export default class TenantHandler extends DefaultHandler {
6364
// Do nothing if not set
6465
if (!tenant) return;
6566

66-
const existingTenant = this.existing || (await this.getType());
67-
68-
const updatedTenant = {
67+
const updatedTenant: Partial<Tenant> = {
6968
...tenant,
7069
};
7170

7271
if ('flags' in updatedTenant) {
73-
updatedTenant.flags = sanitizeMigrationFlags({
74-
existingFlags: existingTenant.flags,
75-
proposedFlags: tenant.flags,
76-
});
72+
updatedTenant.flags = removeUnallowedTenantFlags(tenant.flags);
73+
if (Object.keys(updatedTenant.flags).length === 0) {
74+
delete updatedTenant.flags;
75+
}
7776
}
7877

7978
if (updatedTenant && Object.keys(updatedTenant).length > 0) {
@@ -84,47 +83,69 @@ export default class TenantHandler extends DefaultHandler {
8483
}
8584
}
8685

87-
export const sanitizeMigrationFlags = ({
88-
existingFlags = {},
89-
proposedFlags = {},
90-
}: {
91-
existingFlags: Tenant['flags'];
92-
proposedFlags: Tenant['flags'];
93-
}): Tenant['flags'] => {
94-
/*
95-
Tenants can only update migration flags that are already configured.
96-
If moving configuration from one tenant to another, there may be instances
97-
where different migration flags exist and cause an error on update. This
98-
function removes any migration flags that aren't already present on the target
99-
tenant. See: https://github.com/auth0/auth0-deploy-cli/issues/374
100-
*/
101-
102-
const tenantMigrationFlags = [
103-
'disable_clickjack_protection_headers',
104-
'enable_mgmt_api_v1',
105-
'trust_azure_adfs_email_verified_connection_property',
106-
'include_email_in_reset_pwd_redirect',
107-
'include_email_in_verify_email_redirect',
108-
];
109-
110-
return Object.keys(proposedFlags).reduce(
86+
/*
87+
Tenant flags are used to facilitate a number of functionalities, some
88+
public, some internal. The subset of flags that are allowed to be updated
89+
in the context of the Deploy CLI is based on wether they're publicly exposed
90+
in the Auth0 API docs:
91+
92+
https://auth0.com/docs/api/management/v2#!/Tenants/patch_settings
93+
*/
94+
export const allowedTenantFlags = [
95+
'change_pwd_flow_v1',
96+
'enable_client_connections',
97+
'enable_apis_section',
98+
'enable_pipeline2',
99+
'enable_dynamic_client_registration',
100+
'enable_custom_domain_in_emails',
101+
'allow_legacy_tokeninfo_endpoint',
102+
'enable_legacy_profile',
103+
'enable_idtoken_api2',
104+
'enable_public_signup_user_exists_error',
105+
'allow_legacy_delegation_grant_types',
106+
'allow_legacy_ro_grant_types',
107+
'enable_sso',
108+
'disable_clickjack_protection_headers',
109+
'no_disclose_enterprise_connections',
110+
'disable_management_api_sms_obfuscation',
111+
'enforce_client_authentication_on_passwordless_start',
112+
'trust_azure_adfs_email_verified_connection_property',
113+
'enable_adfs_waad_email_verification',
114+
'revoke_refresh_token_grant',
115+
'dashboard_log_streams_next',
116+
'dashboard_insights_view',
117+
'disable_fields_map_fix',
118+
'require_pushed_authorization_requests',
119+
'mfa_show_factor_list_on_enrollment',
120+
];
121+
122+
export const removeUnallowedTenantFlags = (proposedFlags: Tenant['flags']): Tenant['flags'] => {
123+
const removedFlags: string[] = [];
124+
const filteredFlags = Object.keys(proposedFlags).reduce(
111125
(acc: Tenant['flags'], proposedKey: string): Tenant['flags'] => {
112-
const isMigrationFlag = tenantMigrationFlags.includes(proposedKey);
113-
if (!isMigrationFlag)
114-
return {
115-
...acc,
116-
[proposedKey]: proposedFlags[proposedKey],
117-
};
118-
119-
const keyCurrentlyExists = existingFlags[proposedKey] !== undefined;
120-
if (keyCurrentlyExists)
121-
return {
122-
...acc,
123-
[proposedKey]: proposedFlags[proposedKey],
124-
};
125-
126-
return acc;
126+
const isAllowedFlag = allowedTenantFlags.includes(proposedKey);
127+
if (!isAllowedFlag) {
128+
removedFlags.push(proposedKey);
129+
return acc;
130+
}
131+
return {
132+
...acc,
133+
[proposedKey]: proposedFlags[proposedKey],
134+
};
127135
},
128136
{}
129137
);
138+
139+
if (removedFlags.length > 0) {
140+
log.warn(
141+
`The following tenant flag${
142+
removedFlags.length > 1 ? 's have not been' : ' has not been'
143+
} updated because deemed incompatible with the target tenant: ${removedFlags.join(', ')}
144+
${
145+
removedFlags.length > 1 ? 'These flags' : 'This flag'
146+
} can likely be removed from the tenant definition file. If you believe this removal is an error, please report via a Github issue.`
147+
);
148+
}
149+
150+
return filteredFlags;
130151
};

‎test/e2e/recordings/should-deploy-directory-(JSON)-config-with-keyword-replacements.json

+1-138
Original file line numberDiff line numberDiff line change
@@ -1,69 +1,4 @@
11
[
2-
{
3-
"scope": "https://deploy-cli-dev.eu.auth0.com:443",
4-
"method": "GET",
5-
"path": "/api/v2/tenants/settings",
6-
"body": "",
7-
"status": 200,
8-
"response": {
9-
"allowed_logout_urls": [
10-
"https://mycompany.org/logoutCallback"
11-
],
12-
"change_password": {
13-
"enabled": true,
14-
"html": "<html>Change Password</html>\n"
15-
},
16-
"enabled_locales": [
17-
"en"
18-
],
19-
"error_page": {
20-
"html": "<html>Error Page</html>\n",
21-
"show_log_link": false,
22-
"url": "https://mycompany.org/error"
23-
},
24-
"flags": {
25-
"allow_changing_enable_sso": false,
26-
"allow_legacy_delegation_grant_types": true,
27-
"allow_legacy_ro_grant_types": true,
28-
"change_pwd_flow_v1": false,
29-
"disable_impersonation": true,
30-
"enable_apis_section": false,
31-
"enable_client_connections": false,
32-
"enable_custom_domain_in_emails": false,
33-
"enable_dynamic_client_registration": false,
34-
"enable_legacy_logs_search_v2": false,
35-
"enable_public_signup_user_exists_error": true,
36-
"enable_sso": true,
37-
"new_universal_login_experience_enabled": true,
38-
"universal_login": true,
39-
"use_scope_descriptions_for_consent": false,
40-
"revoke_refresh_token_grant": false,
41-
"disable_clickjack_protection_headers": false,
42-
"enable_pipeline2": false
43-
},
44-
"friendly_name": "This is the Travel0 Tenant",
45-
"guardian_mfa_page": {
46-
"enabled": true,
47-
"html": "<html>MFA</html>\n"
48-
},
49-
"idle_session_lifetime": 1,
50-
"picture_url": "https://upload.wikimedia.org/wikipedia/commons/0/0d/Grandmas_marathon_finishers.png",
51-
"sandbox_version": "12",
52-
"session_lifetime": 3.0166666666666666,
53-
"support_email": "[email protected]",
54-
"support_url": "https://mycompany.org/support",
55-
"universal_login": {},
56-
"session_cookie": {
57-
"mode": "non-persistent"
58-
},
59-
"sandbox_versions_available": [
60-
"16",
61-
"12"
62-
]
63-
},
64-
"rawHeaders": [],
65-
"responseIsBinary": false
66-
},
672
{
683
"scope": "https://deploy-cli-dev.eu.auth0.com:443",
694
"method": "PATCH",
@@ -73,9 +8,6 @@
738
"en"
749
],
7510
"friendly_name": "This is the ##COMPANY_NAME## Tenant",
76-
"flags": {
77-
"new_universal_login_experience_enabled": true
78-
},
7911
"universal_login": {}
8012
},
8113
"status": 200,
@@ -110,7 +42,6 @@
11042
"enable_public_signup_user_exists_error": true,
11143
"enable_sso": true,
11244
"enforce_client_authentication_on_passwordless_start": true,
113-
"new_universal_login_experience_enabled": true,
11445
"universal_login": true,
11546
"use_scope_descriptions_for_consent": false,
11647
"revoke_refresh_token_grant": false,
@@ -136,71 +67,6 @@
13667
"rawHeaders": [],
13768
"responseIsBinary": false
13869
},
139-
{
140-
"scope": "https://deploy-cli-dev.eu.auth0.com:443",
141-
"method": "GET",
142-
"path": "/api/v2/tenants/settings",
143-
"body": "",
144-
"status": 200,
145-
"response": {
146-
"allowed_logout_urls": [
147-
"https://mycompany.org/logoutCallback"
148-
],
149-
"change_password": {
150-
"enabled": true,
151-
"html": "<html>Change Password</html>\n"
152-
},
153-
"enabled_locales": [
154-
"en"
155-
],
156-
"error_page": {
157-
"html": "<html>Error Page</html>\n",
158-
"show_log_link": false,
159-
"url": "https://mycompany.org/error"
160-
},
161-
"flags": {
162-
"allow_changing_enable_sso": false,
163-
"allow_legacy_delegation_grant_types": true,
164-
"allow_legacy_ro_grant_types": true,
165-
"change_pwd_flow_v1": false,
166-
"disable_impersonation": true,
167-
"enable_apis_section": false,
168-
"enable_client_connections": false,
169-
"enable_custom_domain_in_emails": false,
170-
"enable_dynamic_client_registration": false,
171-
"enable_legacy_logs_search_v2": false,
172-
"enable_public_signup_user_exists_error": true,
173-
"enable_sso": true,
174-
"new_universal_login_experience_enabled": true,
175-
"universal_login": true,
176-
"use_scope_descriptions_for_consent": false,
177-
"revoke_refresh_token_grant": false,
178-
"disable_clickjack_protection_headers": false,
179-
"enable_pipeline2": false
180-
},
181-
"friendly_name": "This is the ##COMPANY_NAME## Tenant",
182-
"guardian_mfa_page": {
183-
"enabled": true,
184-
"html": "<html>MFA</html>\n"
185-
},
186-
"idle_session_lifetime": 1,
187-
"picture_url": "https://upload.wikimedia.org/wikipedia/commons/0/0d/Grandmas_marathon_finishers.png",
188-
"sandbox_version": "12",
189-
"session_lifetime": 3.0166666666666666,
190-
"support_email": "[email protected]",
191-
"support_url": "https://mycompany.org/support",
192-
"universal_login": {},
193-
"session_cookie": {
194-
"mode": "non-persistent"
195-
},
196-
"sandbox_versions_available": [
197-
"16",
198-
"12"
199-
]
200-
},
201-
"rawHeaders": [],
202-
"responseIsBinary": false
203-
},
20470
{
20571
"scope": "https://deploy-cli-dev.eu.auth0.com:443",
20672
"method": "PATCH",
@@ -210,9 +76,6 @@
21076
"en"
21177
],
21278
"friendly_name": "This is the Travel0 Tenant",
213-
"flags": {
214-
"new_universal_login_experience_enabled": true
215-
},
21679
"universal_login": {}
21780
},
21881
"status": 200,
@@ -338,4 +201,4 @@
338201
"rawHeaders": [],
339202
"responseIsBinary": false
340203
}
341-
]
204+
]

0 commit comments

Comments
 (0)