feat: Exclude Third-Party Clients via AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property

docs/configuring-the-deploy-cli.md

@@ -155,6 +155,10 @@ Provides ability to exclude any unwanted properties from management.
 
 String. Separate value from audience value while retrieving an access token for management API. Useful when default Management API endpoints are not publicly exposed.
 
+### `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS`
+
+Boolean. When enabled, excludes third-party clients from being managed. Only first-party clients will be included in export and import operations. This is useful when you have Dynamic Client Registration (DCR) enabled and you have a lot of third-party clients in your tenant. Default: `false`.
+
 ### `AUTH0_EXCLUDED_RULES`
 
 Array of strings. Excludes the management of specific rules by ID. **Note:** This configuration may be subject to deprecation in the future. See: [excluding resources from management](excluding-from-management.md).

docs/excluding-from-management.md

@@ -55,6 +55,18 @@ Some resource types support exclusions of individual resource by name. This is p
 
 > ⚠️ **NOTE:** Excluding resources by ID is being considered for deprecation in future major versions. See the [resource exclusion proposal](https://github.com/auth0/auth0-deploy-cli/issues/451) for more details.
 
+### Excluding third-party clients
+
+You can also exclude all third-party clients at once using the `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` configuration option. When enabled, only first-party clients will be included in export and import operations. This is useful when you have Dynamic Client Registration (DCR) enabled and you have a lot of third-party clients in your tenant.
+
+```json
+{
+  "AUTH0_DOMAIN": "example-site.us.auth0.com",
+  "AUTH0_CLIENT_ID": "<YOUR_AUTH0_CLIENT_ID>",
+  "AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS": true
+}
+```
+
 ## Omitted vs excluded vs empty
 
 The above sections pertain to exclusion which forcefully ignore configurations bi-directionally. It is worth noting similar but very different concepts: “omissions” and “empty” states.

src/tools/auth0/handlers/clients.ts

@@ -367,10 +367,15 @@ export default class ClientHandler extends DefaultAPIHandler {
   async getType() {
     if (this.existing) return this.existing;
 
+    const excludeThirdPartyClients =
+      this.config('AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS') === 'true' ||
+      this.config('AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS') === true;
+
     const clients = await paginate<Client>(this.client.clients.getAll, {
       paginate: true,
       include_totals: true,
       is_global: false,
+      ...(excludeThirdPartyClients && { is_first_party: true }),
     });
 
     this.existing = clients;

src/types.ts

@@ -26,6 +26,7 @@ type SharedPaginationParams = {
   checkpoint?: boolean;
   paginate?: boolean;
   is_global?: boolean;
+  is_first_party?: boolean;
   include_totals?: boolean;
   id?: string;
   strategy?: GetConnectionsStrategyEnum[];
@@ -63,6 +64,7 @@ export type Config = {
   AUTH0_INPUT_FILE: string;
   AUTH0_ALLOW_DELETE: boolean;
   AUTH0_EXCLUDED?: AssetTypes[];
+  AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS?: boolean;
   AUTH0_INCLUDED_ONLY?: AssetTypes[];
   AUTH0_PRESERVE_KEYWORDS: boolean;
   EXTENSION_SECRET: string;

test/tools/auth0/handlers/clients.tests.js

@@ -399,6 +399,40 @@ describe('#clients handler', () => {
       ]);
     });
 
+    it('should get clients with is_first_party when AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS is enabled', async () => {
+      const getAllParams = [];
+      const auth0 = {
+        clients: {
+          getAll: (params) => {
+            getAllParams.push(params);
+            return mockPagedData(params, 'clients', [
+              { name: 'first party client', client_id: 'first-party-client-id' },
+            ]);
+          },
+        },
+        pool,
+      };
+
+      const testConfig = function (key) {
+        return testConfig.data && testConfig.data[key];
+      };
+      testConfig.data = {
+        AUTH0_CLIENT_ID: 'client_id',
+        AUTH0_ALLOW_DELETE: true,
+        AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS: true,
+      };
+
+      const handler = new clients.default({ client: pageClient(auth0), config: testConfig });
+      await handler.getType();
+
+      expect(getAllParams.length).to.be.greaterThan(0);
+      const firstCallParams = getAllParams[0];
+      expect(firstCallParams).to.be.an('object');
+      expect(firstCallParams.is_first_party).to.equal(true);
+      expect(firstCallParams.include_totals).to.equal(true);
+      expect(firstCallParams.is_global).to.equal(false);
+    });
+
     it('should update client', async () => {
       const auth0 = {
         clients: {