feat: add guardian (MFA) command group - #1646
Open
developerkunal wants to merge 5 commits into
Open
Conversation
Add a top-level `auth0 guardian` command group for managing Auth0 multi-factor authentication, built on the go-auth0/v3 SDK. Covers MFA policies, user enrollments, factor enable/disable, and provider configuration for phone, SMS, push (APNs, FCM, FCM v1, SNS) and Duo. The legacy phone/SMS provider, template and Twilio endpoints are marked (legacy) and return actionable guidance on tenants moved to the unified phone experience, where those endpoints are no longer reachable via Management API tokens. Bumps go-auth0/v3 to v3.4.0 and adds the required Guardian scopes to the device-code login flow.
Replace the six integration cases that asserted a 403 legacy_mfa_phone_provider_not_allowed on the phone/SMS legacy provider, template and Twilio endpoints. Their outcome is tenant-dependent (403 on tenants moved to the unified phone experience, success or an empty-body error where the legacy provider is still enabled), so they cannot be asserted deterministically against a single live tenant. Cover the deprecation-hint logic with a deterministic unit test instead.
The GetTemplates endpoints return an empty body when a tenant has no templates configured. The go-auth0 SDK surfaces that as an error, so show-templates failed with "the server responded with nothing" on a valid empty state. Treat the empty-body error as no templates and render blank rows instead. Adds isEmptyResponseErr plus unit coverage.
The Duo, APNs and FCM secrets set by the guardian tests are write-only and cannot be cleared via the API. Left enabled, the auth0_guardian resource exported those required sensitive fields as null, which made the terraform integration suite fail terraform plan. Disable the duo and push-notification factors in the restore section so auth0_guardian returns to a plannable state.
Require --policy/--none for policies set and --enabled for factors set when running non-interactively, so an empty invocation no longer silently clears MFA policies or disables a factor. Prompt Duo, FCM, APNs and SNS secrets with the hidden password input instead of echoing them. Add mock-backed unit tests for the set handlers and integration cases for the new guards.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Adds a new top-level
auth0 guardiancommand group for managing Auth0 multi-factor authentication (Guardian), built entirely on thego-auth0/v3SDK (cli.apiv3).New commands:
guardian policies—show,set(all-applications, confidence-score, none /--none).guardian enrollments—show,delete,create-ticket.guardian factors—list,set <factor> --enabled[=false]for every factor (sms, push-notification, otp, duo, webauthn-roaming, webauthn-platform, recovery-code, email).guardian factors push—show/set-provider(guardian, sns, direct), APNs (show/set/update-apns), FCM (set/update-fcm), FCM v1 (set-fcmv1), SNS (show/set/update-sns).guardian factors duo settings—show,set(full replace, all fields required),update(partial, interactive).guardian factors phone—show/set-message-typesplus the legacyshow/set-provider,show/set-templates,show/set-twilio.guardian factors sms— the legacyshow/set-provider,show/set-templates,show/set-twilio.Behavior notes:
display.MaskSecretand never printed.setcommands that perform a full replace (duo settings, APNs, SNS) reject an empty invocation instead of silently wiping configuration, andupdatecommands re-fetch after the PATCH so they render the complete current state.(legacy)in help/docs. On tenants moved to the unified phone experience these endpoints are no longer reachable with Management API tokens, so a403 legacy_mfa_phone_provider_not_allowednow surfaces an actionable hint pointing to the unified phone experience.go-auth0/v3to v3.4.0 and adds the required Guardian scopes to the device-code login flow.📚 References
🔬 Testing
internal/display/guardian_test.go) and covered by the existinginternal/cliandinternal/authsuites;make test-unitpasses.test/integration/guardian-test-cases.yamlcovering factors, policies, enrollment error paths, push providers, APNs/SNS/FCM, Duo settings, the full-replace guards, and the legacy-endpoint 403s.make docsregenerated;make lintclean for all new files.📝 Checklist