feat(cli): port universal-portals setup and audit to Go (Beta)

docs/auth0_universal-portals.md

@@ -5,9 +5,10 @@ has_children: true
 ---
 # auth0 universal-portals
 
-Manage Auth0 Universal Portals resources.
+Set up and audit Auth0 Universal Portals.
 
 ## Commands
 
-- [auth0 universal-portals setup](auth0_universal-portals_setup.md) - Set up Auth0 resources for a Universal Portals application
+- [auth0 universal-portals audit](auth0_universal-portals_audit.md) - Check a Universal Portal
+- [auth0 universal-portals setup](auth0_universal-portals_setup.md) - Set up a Universal Portal
 

docs/auth0_universal-portals_audit.md

@@ -0,0 +1,54 @@
+---
+layout: default
+parent: auth0 universal-portals
+has_toc: false
+---
+# auth0 universal-portals audit
+
+Checks a Universal Portal and its application against what setup makes, and tells what is wrong and how to fix it.
+
+An error breaks the portal or one of its components, and a warning is something degraded or different from the setup guide. The command fails when there is an error, and with --strict when there is a warning too.
+
+With a terminal it offers to fix the errors the CLI can fix, and with --fix it fixes them without asking. Warnings are never changed, because they may be intentional.
+
+## Usage
+```
+auth0 universal-portals audit <portal-id> [flags]
+```
+
+## Examples
+
+```
+  auth0 universal-portals audit up_123
+  auth0 universal-portals audit up_123 --fix
+  auth0 up audit up_123 --organization org_123 --strict --json
+```
+
+
+## Flags
+
+```
+      --fix                   Apply the errors the CLI can fix, without asking. Warnings are never changed.
+      --json                  Output in json format.
+  -o, --organization string   Business only: the ID of the organization the portal opens in, to check that it shares a connection with the application.
+      --strict                Also fail when there are warnings.
+```
+
+
+## Inherited Flags
+
+```
+      --agent-mode      Output JSON, disable prompts and colors. Auto-enabled for AI agents; set AUTH0_AGENT_MODE=false to disable.
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 universal-portals audit](auth0_universal-portals_audit.md) - Check a Universal Portal
+- [auth0 universal-portals setup](auth0_universal-portals_setup.md) - Set up a Universal Portal
+
+

docs/auth0_universal-portals_setup.md

@@ -5,11 +5,9 @@ has_toc: false
 ---
 # auth0 universal-portals setup
 
-Provisions the Auth0 resources required by a Universal Portals application:
+Creates a Universal Portal with its application, forms and pages, and checks that the logged-in session has the permissions it needs before it creates anything.
 
-  - Auth0 My Account API and My Organization API (resource servers)
-  - A Regular Web App client with the required configuration
-  - Client grants for My Account API, My Organization API, and the Management API
+Running the command again after a failure resumes: what exists is reused.
 
 ## Usage
 ```
@@ -20,16 +18,22 @@ auth0 universal-portals setup [flags]
 
 ```
   auth0 universal-portals setup
-  auth0 universal-portals setup --name "Acme" --slug "acme"
-  auth0 up setup -n "Acme" -s "acme"
+  auth0 universal-portals setup --template business --name "Acme Admin" --user jane@acme.com
+  auth0 universal-portals setup --template consumer --name "Acme Account" --dry-run
+  auth0 up setup --no-input --template consumer --name "Acme Account" --json
 ```
 
 
 ## Flags
 
 ```
-  -n, --name string   Display name of the portal.
-  -s, --slug string   URL-friendly identifier for the portal (e.g. my-portal).
+      --dry-run               Show what setup would create, without changing the tenant.
+      --json                  Output in json format.
+  -n, --name string           Name of the portal. Asked when omitted.
+  -o, --organization string   Business only: the ID or name of the organization, when the user has several.
+  -s, --slug string           URL slug of the portal, for example acme-account. Defaults to a slug made from the name.
+      --template string       Kind of portal: consumer, for end-users to manage their account, or business, for organization administrators to manage their organization. Asked when omitted.
+  -u, --user string           Business only: the email or user ID of the user who will test the portal.
 ```
 
 
@@ -46,6 +50,7 @@ auth0 universal-portals setup [flags]
 
 ## Related Commands
 
-- [auth0 universal-portals setup](auth0_universal-portals_setup.md) - Set up Auth0 resources for a Universal Portals application
+- [auth0 universal-portals audit](auth0_universal-portals_audit.md) - Check a Universal Portal
+- [auth0 universal-portals setup](auth0_universal-portals_setup.md) - Set up a Universal Portal
 
 

docs/index.md

@@ -121,6 +121,6 @@ The help for any command can also be emitted as JSON by combining `--help` with
 - [auth0 test](auth0_test.md) - Try your Universal Login box or get a token
 - [auth0 token-exchange](auth0_token-exchange.md) - Manage token exchange profiles
 - [auth0 universal-login](auth0_universal-login.md) - Manage the Universal Login experience
-- [auth0 universal-portals](auth0_universal-portals.md) - Manage Universal Portals resources
+- [auth0 universal-portals](auth0_universal-portals.md) - Set up and audit Universal Portals
 - [auth0 users](auth0_users.md) - Manage resources for users
 

internal/auth0/auth0.go

@@ -99,6 +99,7 @@ type APIV3 struct {
 	NetworkACLKey                NetworkACLKeyAPIV3
 	Connection                   ConnectionAPIV3
 	ConnectionEnabledClient      ConnectionEnabledClientAPIV3
+	ClientConnection             ClientConnectionAPIV3
 	Experiments                  ExperimentsAPI
 	FeatureFlags                 FeatureFlagsAPI
 	Variations                   VariationsAPI
@@ -133,6 +134,7 @@ func NewAPIV3(m *managementv3.Management) *APIV3 {
 		NetworkACLKey:                m.Keys.NetworkACLs,
 		Connection:                   m.Connections,
 		ConnectionEnabledClient:      m.Connections.Clients,
+		ClientConnection:             m.Clients.Connections,
 		Experiments:                  m.Experimentation.Experiments,
 		FeatureFlags:                 m.Experimentation.FeatureFlags,
 		Variations:                   m.Experimentation.FeatureFlags.Variations,

internal/auth0/client_connection_v3.go

@@ -0,0 +1,30 @@
+//go:generate go tool mockgen -source=client_connection_v3.go -destination=mock/client_connection_v3_mock.go -package=mock
+
+package auth0
+
+import (
+	"context"
+
+	managementv3 "github.com/auth0/go-auth0/v3/management"
+	"github.com/auth0/go-auth0/v3/management/core"
+	"github.com/auth0/go-auth0/v3/management/option"
+)
+
+// ClientConnectionPage aliases the checkpoint-paginated list of the connections
+// enabled for a client. The alias keeps the interface return type a single
+// identifier so mockgen's source parser can handle it.
+type ClientConnectionPage = core.Page[*string, *managementv3.ConnectionForList, *managementv3.ListClientConnectionsResponseContent]
+
+// ClientConnectionAPIV3 is the V3 SDK interface for the /clients/{id}/connections
+// endpoint, used to read which connections are enabled for a client.
+type ClientConnectionAPIV3 interface {
+	// Get the connections enabled for a client. The request must not be nil.
+	//
+	// Required scope: `read:connections`.
+	Get(
+		ctx context.Context,
+		id string,
+		request *managementv3.ConnectionsGetRequest,
+		opts ...option.RequestOption,
+	) (*ClientConnectionPage, error)
+}

internal/auth0/organization.go

@@ -49,6 +49,21 @@ type OrganizationAPI interface {
 	// See: https://auth0.com/docs/api/management/v2/#!/Organizations/get_enabled_connections
 	Connections(ctx context.Context, id string, opts ...management.RequestOption) (c *management.OrganizationConnectionList, err error)
 
+	// AddConnection enables a connection for an organization.
+	//
+	// See: https://auth0.com/docs/api/management/v2#!/Organizations/post_enabled_connections
+	AddConnection(ctx context.Context, id string, c *management.OrganizationConnection, opts ...management.RequestOption) (err error)
+
+	// AddMembers adds users to an organization as members.
+	//
+	// See: https://auth0.com/docs/api/management/v2#!/Organizations/post_members
+	AddMembers(ctx context.Context, id string, memberIDs []string, opts ...management.RequestOption) (err error)
+
+	// AssignMemberRoles assigns roles to a member of an organization.
+	//
+	// See: https://auth0.com/docs/api/management/v2#!/Organizations/post_organization_member_roles
+	AssignMemberRoles(ctx context.Context, id string, memberID string, roles []string, opts ...management.RequestOption) (err error)
+
 	// DiscoveryDomains retrieves the discovery domains for an organization.
 	DiscoveryDomains(ctx context.Context, id string, opts ...management.RequestOption) (d *management.DiscoveryDomainList, err error)
 

internal/auth0/user.go

@@ -56,6 +56,9 @@ type UserAPI interface {
 	// Roles lists all roles associated with a user.
 	Roles(ctx context.Context, id string, opts ...management.RequestOption) (r *management.RoleList, err error)
 
+	// Organizations lists the organizations a user is a member of.
+	Organizations(ctx context.Context, id string, opts ...management.RequestOption) (p *management.OrganizationList, err error)
+
 	// AssignRoles assigns roles to a user.
 	AssignRoles(ctx context.Context, id string, roles []*management.Role, opts ...management.RequestOption) error
 

internal/cli/auth_env.go

@@ -172,6 +172,7 @@ func (c *cli) setupWithEnvAuthentication(ctx context.Context) error {
 
 	c.api = auth0.NewAPI(api)
 	c.apiv3 = auth0.NewAPIV3(apiv3)
+	c.apiAccess = apiAccess{domain: domain, accessToken: accessToken, invokerMetadata: invokerMetadata}
 
 	return nil
 }

internal/cli/cli.go

@@ -58,9 +58,20 @@ type cli struct {
 	detectedAgent       string
 	executedCommandPath string
 
+	// What the Management API clients were built with, for a command that builds a client of its own.
+	apiAccess apiAccess
+
 	Config config.Config
 }
 
+// apiAccess is the tenant and the token the Management API clients were built with, and the metadata
+// they send with each request.
+type apiAccess struct {
+	domain          string
+	accessToken     string
+	invokerMetadata string
+}
+
 // setupWithAuthentication will fetch the tenant from the config.json
 // and regenerate its access token if needed. The access token will
 // then be used to configure an instance of the Auth0 Management SDK.
@@ -221,6 +232,7 @@ func (c *cli) setupWithAuthentication(ctx context.Context) error {
 
 	c.api = auth0.NewAPI(api)
 	c.apiv3 = auth0.NewAPIV3(apiv3)
+	c.apiAccess = apiAccess{domain: tenant.Domain, accessToken: accessToken, invokerMetadata: invokerMetadata}
 	return nil
 }