feat: support limit M2M usage - EA

src/tools/auth0/handlers/clients.ts

@@ -82,6 +82,31 @@ export const schema = {
           policies: multiResourceRefreshTokenPolicies,
         },
       },
+      token_quota: {
+        type: ['object', 'null'],
+        properties: {
+          client_credentials: {
+            type: 'object',
+            properties: {
+              enforce: {
+                type: 'boolean',
+                default: true,
+              },
+              per_day: {
+                type: 'integer',
+                minimum: 1,
+              },
+              per_hour: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+            additionalProperties: false,
+            minProperties: 1,
+          },
+        },
+        required: ['client_credentials'],
+      },
     },
     required: ['name'],
   },

src/tools/auth0/handlers/organizations.ts

@@ -45,6 +45,31 @@ export const schema = {
         },
         default: [],
       },
+      token_quota: {
+        type: ['object', 'null'],
+        properties: {
+          client_credentials: {
+            type: 'object',
+            properties: {
+              enforce: {
+                type: 'boolean',
+                default: true,
+              },
+              per_day: {
+                type: 'integer',
+                minimum: 1,
+              },
+              per_hour: {
+                type: 'integer',
+                minimum: 1,
+              },
+            },
+            additionalProperties: false,
+            minProperties: 1,
+          },
+        },
+        required: ['client_credentials'],
+      },
     },
     required: ['name'],
   },

src/tools/auth0/handlers/tenant.ts

@@ -11,8 +11,45 @@ import { convertJsonToString } from '../../utils';
 import { Asset, Assets } from '../../../types';
 import log from '../../../logger';
 
+const tokenQuotaConfigurationSchema = {
+  type: 'object',
+  properties: {
+    client_credentials: {
+      type: 'object',
+      properties: {
+        enforce: {
+          type: 'boolean',
+          default: true,
+        },
+        per_day: {
+          type: 'integer',
+          minimum: 1,
+        },
+        per_hour: {
+          type: 'integer',
+          minimum: 1,
+        },
+      },
+      additionalProperties: false,
+      minProperties: 1,
+    },
+  },
+  required: ['client_credentials'],
+};
+
 export const schema = {
   type: 'object',
+  properties: {
+    default_token_quota: {
+      type: 'object',
+      properties: {
+        clients: tokenQuotaConfigurationSchema,
+        organizations: tokenQuotaConfigurationSchema,
+      },
+      additionalProperties: false,
+      minProperties: 1,
+    },
+  },
 };
 
 export type Tenant = TenantSettings;

test/tools/auth0/handlers/clients.tests.js

@@ -184,6 +184,46 @@ describe('#clients handler', () => {
       await stageFn.apply(handler, [{ clients: [clientWithRefreshTokenPolicies] }]);
     });
 
+    it('should allow valid token_quota property in client', async () => {
+      const clientWithTokenQuota = {
+        name: 'clientWithTokenQuota',
+        token_quota: {
+          client_credentials: {
+            enforce: true,
+            per_day: 1000,
+            per_hour: 100,
+          },
+        },
+      };
+      let wasCreateCalled = false;
+      const auth0 = {
+        clients: {
+          create: function (data) {
+            wasCreateCalled = true;
+            expect(data).to.be.an('object');
+            expect(data.name).to.equal('clientWithTokenQuota');
+            expect(data.token_quota).to.deep.equal({
+              client_credentials: {
+                enforce: true,
+                per_day: 1000,
+                per_hour: 100,
+              },
+            });
+            return Promise.resolve({ data });
+          },
+          update: () => Promise.resolve({ data: [] }),
+          delete: () => Promise.resolve({ data: [] }),
+          getAll: (params) => mockPagedData(params, 'clients', []),
+        },
+        pool,
+      };
+      const handler = new clients.default({ client: pageClient(auth0), config });
+      const stageFn = Object.getPrototypeOf(handler).processChanges;
+      await stageFn.apply(handler, [{ clients: [clientWithTokenQuota] }]);
+      // eslint-disable-next-line no-unused-expressions
+      expect(wasCreateCalled).to.be.true;
+    });
+
     it('should get clients', async () => {
       const auth0 = {
         clients: {

test/tools/auth0/handlers/organizations.tests.js

@@ -218,6 +218,58 @@ describe('#organizations handler', () => {
       ]);
     });
 
+    it('should allow valid token_quota property in organization', async () => {
+      const orgWithTokenQuota = {
+        name: 'orgWithTokenQuota',
+        token_quota: {
+          client_credentials: {
+            enforce: false,
+            per_day: 500,
+            per_hour: 50,
+          },
+        },
+      };
+      let wasCreateCalled = false;
+      const auth0 = {
+        organizations: {
+          create: function (data) {
+            wasCreateCalled = true;
+            expect(data).to.be.an('object');
+            expect(data.name).to.equal('orgWithTokenQuota');
+            expect(data.token_quota).to.deep.equal({
+              client_credentials: {
+                enforce: false,
+                per_day: 500,
+                per_hour: 50,
+              },
+            });
+            data.id = 'fake';
+            return Promise.resolve({ data });
+          },
+          update: () => Promise.resolve({ data: [] }),
+          delete: () => Promise.resolve({ data: [] }),
+          getAll: (params) => Promise.resolve(mockPagedData(params, 'organizations', [sampleOrg])),
+          getEnabledConnections: () => Promise.resolve({ data: [] }),
+          getOrganizationClientGrants: () => ({ data: [] }),
+        },
+        connections: {
+          getAll: (params) => mockPagedData(params, 'connections', []),
+        },
+        clients: {
+          getAll: (params) => mockPagedData(params, 'clients', sampleClients),
+        },
+        clientGrants: {
+          getAll: (params) => mockPagedData(params, 'client_grants', [sampleClientGrant]),
+        },
+        pool,
+      };
+      const handler = new organizations.default({ client: pageClient(auth0), config });
+      const stageFn = Object.getPrototypeOf(handler).processChanges;
+      await stageFn.apply(handler, [{ organizations: [orgWithTokenQuota] }]);
+      // eslint-disable-next-line no-unused-expressions
+      expect(wasCreateCalled).to.be.true;
+    });
+
     it('should get organizations', async () => {
       const auth0 = {
         organizations: {

test/tools/auth0/handlers/tenant.tests.ts

@@ -83,6 +83,60 @@ describe('#tenant handler', () => {
       await stageFn.apply(handler, [{ tenant: { sandbox_version: '4' } }]);
     });
 
+    it('should allow valid default_token_quota property in tenant', async () => {
+      const tenantWithDefaultTokenQuota = {
+        default_token_quota: {
+          clients: {
+            client_credentials: {
+              enforce: true,
+              per_day: 2000,
+              per_hour: 200,
+            },
+          },
+          organizations: {
+            client_credentials: {
+              enforce: false,
+              per_day: 1000,
+              per_hour: 100,
+            },
+          },
+        },
+      };
+      let wasUpdateCalled = false;
+      const auth0 = {
+        tenants: {
+          getSettings: () => ({ data: {} }),
+          updateSettings: function (data) {
+            wasUpdateCalled = true;
+            expect(data).to.be.an('object');
+            expect(data.default_token_quota).to.deep.equal({
+              clients: {
+                client_credentials: {
+                  enforce: true,
+                  per_day: 2000,
+                  per_hour: 200,
+                },
+              },
+              organizations: {
+                client_credentials: {
+                  enforce: false,
+                  per_day: 1000,
+                  per_hour: 100,
+                },
+              },
+            });
+            return Promise.resolve(data);
+          },
+        },
+      };
+      // @ts-ignore
+      const handler = new tenantHandler({ client: auth0 });
+      const stageFn = Object.getPrototypeOf(handler).processChanges;
+      await stageFn.apply(handler, [{ tenant: tenantWithDefaultTokenQuota }]);
+      // eslint-disable-next-line no-unused-expressions
+      expect(wasUpdateCalled).to.be.true;
+    });
+
     describe('filtering-out unallowed tenant flags', async () => {
       it('should filter-out unallowed tenant flags', async () => {
         const proposedFlags = {