diff --git a/docs/auth0_apps_session-transfer_update.md b/docs/auth0_apps_session-transfer_update.md index dcc7a42b4..c148c56b8 100644 --- a/docs/auth0_apps_session-transfer_update.md +++ b/docs/auth0_apps_session-transfer_update.md @@ -19,8 +19,6 @@ auth0 apps session-transfer update [flags] auth0 apps session-transfer update auth0 apps session-transfer update --can-create-token --json auth0 apps session-transfer update --can-create-token=true --allowed-auth-methods=cookie,query --enforce-device-binding=ip - - # Delegation (Early Access): impersonation via Session Transfer auth0 apps session-transfer update --delegation-allow-delegated-access=true --delegation-enforce-device-binding=asn ``` @@ -30,8 +28,8 @@ auth0 apps session-transfer update [flags] ``` -m, --allowed-auth-methods strings Comma-separated list of authentication methods (e.g., cookie, query). -t, --can-create-token Allow creation of session transfer tokens. - -d, --delegation-allow-delegated-access (Early Access) Allow the application to accept Session Transfer Tokens containing an Actor, enabling delegated (impersonation) access. Defaults to false. - -b, --delegation-enforce-device-binding string (Early Access) Device binding enforcement for delegated (impersonation) access: 'ip' or 'asn'. Defaults to 'ip'. + -d, --delegation-allow-delegated-access Allow the application to accept Session Transfer Tokens containing an Actor, enabling delegated (impersonation) access. Defaults to false. + -b, --delegation-enforce-device-binding string Device binding enforcement for delegated (impersonation) access: 'ip' or 'asn'. Defaults to 'ip'. -e, --enforce-device-binding string Device binding enforcement: 'none', 'ip', or 'asn'. --json Output in json format. --json-compact Output in compact json format. diff --git a/internal/cli/acul_app_scaffolding.go b/internal/cli/acul_app_scaffolding.go index af3e12077..f33eec6d9 100644 --- a/internal/cli/acul_app_scaffolding.go +++ b/internal/cli/acul_app_scaffolding.go @@ -51,7 +51,7 @@ type Metadata struct { Description string `json:"description"` } -const stableACULVersion = "v2.0.1" +const stableACULVersion = "v3.0.0" // loadManifest downloads and parses the manifest.json for the latest release. func loadManifest(tag string) (*Manifest, error) { diff --git a/internal/cli/apps.go b/internal/cli/apps.go index 1a479868f..f2ac16761 100644 --- a/internal/cli/apps.go +++ b/internal/cli/apps.go @@ -168,15 +168,17 @@ var ( Name: "Allow Delegated Access", LongForm: "delegation-allow-delegated-access", ShortForm: "d", - Help: "(Early Access) Allow the application to accept Session Transfer Tokens containing an Actor, " + + Help: "Allow the application to accept Session Transfer Tokens containing an Actor, " + "enabling delegated (impersonation) access. Defaults to false.", + AlwaysPrompt: true, } appSTDelegationDeviceBinding = Flag{ Name: "Delegation Enforce Device Binding", LongForm: "delegation-enforce-device-binding", ShortForm: "b", - Help: "(Early Access) Device binding enforcement for delegated (impersonation) access: 'ip' or 'asn'. " + + Help: "Device binding enforcement for delegated (impersonation) access: 'ip' or 'asn'. " + "Defaults to 'ip'.", + AlwaysPrompt: true, } refreshToken = Flag{ Name: "Refresh Token", @@ -1245,8 +1247,6 @@ func appsSessionTransferUpdateCmd(cli *cli) *cobra.Command { auth0 apps session-transfer update auth0 apps session-transfer update --can-create-token --json auth0 apps session-transfer update --can-create-token=true --allowed-auth-methods=cookie,query --enforce-device-binding=ip - - # Delegation (Early Access): impersonation via Session Transfer auth0 apps session-transfer update --delegation-allow-delegated-access=true --delegation-enforce-device-binding=asn`, RunE: func(cmd *cobra.Command, args []string) error { if len(args) == 0 { @@ -1278,6 +1278,13 @@ func appsSessionTransferUpdateCmd(cli *cli) *cobra.Command { } } + if current.SessionTransfer.Delegation == nil { + current.SessionTransfer.Delegation = &management.SessionTransferDelegation{ + AllowDelegatedAccess: auth0.Bool(false), + EnforceDeviceBinding: auth0.String("ip"), + } + } + if err := appSTCanCreateToken.AskBoolU(cmd, &inputs.CanCreateToken, current.SessionTransfer.CanCreateSessionTransferToken); err != nil { return err } @@ -1291,6 +1298,14 @@ func appsSessionTransferUpdateCmd(cli *cli) *cobra.Command { return err } + if err := appSTDelegationAllowAccess.AskBoolU(cmd, &inputs.DelegationAllowAccess, current.SessionTransfer.Delegation.AllowDelegatedAccess); err != nil { + return err + } + + if err := appSTDelegationDeviceBinding.SelectU(cmd, &inputs.DelegationDeviceBinding, []string{"ip", "asn"}, current.SessionTransfer.Delegation.EnforceDeviceBinding); err != nil { + return err + } + // Set the flag if it was supplied or entered by the prompt. if appSTCanCreateToken.IsSet(cmd) || noLocalFlagSet(cmd) { st.CanCreateSessionTransferToken = &inputs.CanCreateToken @@ -1306,16 +1321,17 @@ func appsSessionTransferUpdateCmd(cli *cli) *cobra.Command { st.EnforceDeviceBinding = current.SessionTransfer.EnforceDeviceBinding } - // Delegation (EA) is sent only when a flag is set, leaving it untouched for - // others. The API merges sub-fields, so sending just the changed one is enough. - if appSTDelegationAllowAccess.IsSet(cmd) || appSTDelegationDeviceBinding.IsSet(cmd) { - delegation := &management.SessionTransferDelegation{} + if appSTDelegationAllowAccess.IsSet(cmd) || appSTDelegationDeviceBinding.IsSet(cmd) || noLocalFlagSet(cmd) { + delegation := &management.SessionTransferDelegation{ + AllowDelegatedAccess: current.SessionTransfer.Delegation.AllowDelegatedAccess, + EnforceDeviceBinding: current.SessionTransfer.Delegation.EnforceDeviceBinding, + } - if appSTDelegationAllowAccess.IsSet(cmd) { + if appSTDelegationAllowAccess.IsSet(cmd) || noLocalFlagSet(cmd) { delegation.AllowDelegatedAccess = &inputs.DelegationAllowAccess } - if appSTDelegationDeviceBinding.IsSet(cmd) { + if appSTDelegationDeviceBinding.IsSet(cmd) || noLocalFlagSet(cmd) { delegation.EnforceDeviceBinding = &inputs.DelegationDeviceBinding }