Connections YAML without enabled_clients is wiping out configured clients.

[whynotavailable]

Please do not report security vulnerabilities here. The Responsible Disclosure Program details the procedure for disclosing security issues.

Thank you in advance for helping us to improve this library! Please read through the template below and answer all relevant questions. Your additional work here is greatly appreciated and will help us respond as quickly as possible. For general support or usage questions, use the Auth0 Community or Auth0 Support. Finally, to avoid duplicates, please search existing Issues before submitting one here.

By submitting an Issue to this repository, you agree to the terms within the Auth0 Code of Conduct.

Description

We like using the CLI for configuring our connections, however we manage the enabled_clients through an automation service. If we do not include enabled_clients in our connection it wipes out the configured clients. If we do include the node, only those included will remain wiping out the rest.

It's due to this line of code. https://github.com/auth0/auth0-deploy-cli/blob/master/src/context/yaml/handlers/connections.js#L50 Where it defaults to [] if the entry doesn't exist.

Reproduction

1. Create a connection through the CLI without the enabled_clients node
2. Add a client through another means (like the admin console)
3. re-run the CLI
4. Your client no longer is configured.

Environment

• Version used was auth0-deploy-cli@3.5.0
• linux/amd64 (it's a dockerized environment)

[whynotavailable]

I made a mistake when doing my initial research. The issue in question is in the auth0-source-control-extension-tools repo. I have made a PR and linked this issue in that PR.

[shushen]

@whynotavailable The deploy-cli is expecting the configuration JSON files to be the single source of truth. Therefore, when the enabled_clients is not present, deploy-cli has to assume the intention is to remove all enabled_clients.

I think the described behavior is indeed by design.

[whynotavailable]

@shushen The only field that works this way is enabled_clients. Everything else is passed through as is with no changes or assumptions.

[jshanm]

@shushen
But is there anyway I can set all my clients should be enabled with this connection ?Without listing all the clients in the yaml.

[bastianwegge]

Funny thing is that it's even wiping working connections, when you're using EXCLUDED_PROPS in your config and then trying to import what you exported 😄

"EXCLUDED_PROPS": {
  "connections": ["options.client_secret"]
},

Is there anybody out there who's using this tool in production?

[willvedd]

@bastianwegge The issue you're describing has a healthy discussion in #420. The Auth0 team already thinking about ways forward.

Regarding the original issue, we'll still need to review if the proposed behavior is aligned with the goals of this project.

[whynotavailable]

So we are looking at this again, as far as I'm aware, this change has actually already been made. At least looking at https://github.com/auth0/auth0-deploy-cli/blob/master/src/context/yaml/handlers/connections.js#L69

That seems to align with the original request. I'm not sure when it was done, but thanks!
Closing since it's already done. If we find issues with it I'll open a separate issue with any bugs.