feat: add organization flags to auth0 apps create and update

docs/auth0_apps_create.md

@@ -35,6 +35,7 @@ auth0 apps create [flags]
   auth0 apps create --name "My API Client" --type resource_server --resource-server-identifier "https://api.example.com"
   auth0 apps create --name myapp --type resource_server --allow-any-profile-of-type custom_authentication,on_behalf_of_token_exchange
   auth0 apps create --name "My 3P App" --type regular --is-first-party=false --third-party-security-mode strict --redirection-policy open_redirect_protection
+  auth0 apps create --name myapp --type regular --organization-usage require --organization-require-behavior pre_login_prompt --organization-discovery-methods email,organization_name
 
   # Discover the payload schema
   auth0 apps create --schema
@@ -50,31 +51,34 @@ auth0 apps create [flags]
 ## Flags
 
 ```
-  -p, --allow-any-profile-of-type strings   Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
-  -a, --auth-method string                  Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
-  -c, --callbacks strings                   After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
-      --data string                         JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
-  -d, --description string                  Description of the application. Max character count is 140.
-  -g, --grants strings                      List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
-  -f, --is-first-party                      Whether the application is a first-party client (true) or third-party client (false). (default true)
-      --json                                Output in json format.
-      --json-compact                        Output in compact json format.
-  -l, --logout-urls strings                 Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
-      --metadata stringToString             Arbitrary keys-value pairs (max 255 characters each), that  can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
-  -n, --name string                         Name of the application.
-  -o, --origins strings                     Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
-  -y, --redirection-policy string           Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
-  -z, --refresh-token string                Refresh Token Config for the application, formatted as JSON.
-      --resource-server-identifier string   The identifier of the resource server that this client is associated with. This property can only be sent when app_type=resource_server and cannot be changed once the client is created.
-  -r, --reveal-secrets                      Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
-      --schema                              Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
-  -s, --third-party-security-mode string    Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
-  -t, --type string                         Type of application:
-                                            - native: mobile, desktop, CLI and smart device apps running natively.
-                                            - spa (single page application): a JavaScript front-end app that uses an API.
-                                            - regular: Traditional web app using redirects.
-                                            - m2m (machine to machine): CLIs, daemons or services running on your backend.
-  -w, --web-origins strings                 Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
+  -p, --allow-any-profile-of-type strings        Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
+  -a, --auth-method string                       Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
+  -c, --callbacks strings                        After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
+      --data string                              JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
+  -d, --description string                       Description of the application. Max character count is 140.
+  -g, --grants strings                           List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
+  -f, --is-first-party                           Whether the application is a first-party client (true) or third-party client (false). (default true)
+      --json                                     Output in json format.
+      --json-compact                             Output in compact json format.
+  -l, --logout-urls strings                      Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
+      --metadata stringToString                  Arbitrary keys-value pairs (max 255 characters each), that  can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
+  -n, --name string                              Name of the application.
+      --organization-discovery-methods strings   Comma-separated list of methods for discovering organizations during the 'pre_login_prompt'. Possible values: 'email', 'organization_name'. Requires --organization-require-behavior=pre_login_prompt.
+      --organization-require-behavior string     How to prompt for an organization at authentication: 'no_prompt', 'pre_login_prompt', or 'post_login_prompt'. 'post_login_prompt' requires an OIDC-conformant application.
+      --organization-usage string                How the application handles organizations at authentication: 'deny', 'allow', or 'require'.
+  -o, --origins strings                          Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
+  -y, --redirection-policy string                Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
+  -z, --refresh-token string                     Refresh Token Config for the application, formatted as JSON.
+      --resource-server-identifier string        The identifier of the resource server that this client is associated with. This property can only be sent when app_type=resource_server and cannot be changed once the client is created.
+  -r, --reveal-secrets                           Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
+      --schema                                   Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
+  -s, --third-party-security-mode string         Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
+  -t, --type string                              Type of application:
+                                                 - native: mobile, desktop, CLI and smart device apps running natively.
+                                                 - spa (single page application): a JavaScript front-end app that uses an API.
+                                                 - regular: Traditional web app using redirects.
+                                                 - m2m (machine to machine): CLIs, daemons or services running on your backend.
+  -w, --web-origins strings                      Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
 ```
 
 

docs/auth0_apps_update.md

@@ -34,6 +34,7 @@ auth0 apps update [flags]
   auth0 apps update <app-id> -n myapp -d <description> -t [native|spa|regular|m2m] -r --json --metadata "foo=bar,bazz=buzz"
   auth0 apps update <app-id> --allow-any-profile-of-type custom_authentication,on_behalf_of_token_exchange
   auth0 apps update <app-id> --redirection-policy allow_always
+  auth0 apps update <app-id> --organization-usage require --organization-require-behavior pre_login_prompt
 
   # Discover the payload schema
   auth0 apps update --schema
@@ -49,30 +50,33 @@ auth0 apps update [flags]
 ## Flags
 
 ```
-  -p, --allow-any-profile-of-type strings   Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
-  -a, --auth-method string                  Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
-  -c, --callbacks strings                   After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
-      --data string                         JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
-  -d, --description string                  Description of the application. Max character count is 140.
-  -g, --grants strings                      List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
-  -f, --is-first-party                      Whether the application is a first-party client (true) or third-party client (false). (default true)
-      --json                                Output in json format.
-      --json-compact                        Output in compact json format.
-  -l, --logout-urls strings                 Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
-      --metadata stringToString             Arbitrary keys-value pairs (max 255 characters each), that  can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
-  -n, --name string                         Name of the application.
-  -o, --origins strings                     Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
-  -y, --redirection-policy string           Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
-  -z, --refresh-token string                Refresh Token Config for the application, formatted as JSON.
-  -r, --reveal-secrets                      Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
-      --schema                              Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
-  -s, --third-party-security-mode string    Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
-  -t, --type string                         Type of application:
-                                            - native: mobile, desktop, CLI and smart device apps running natively.
-                                            - spa (single page application): a JavaScript front-end app that uses an API.
-                                            - regular: Traditional web app using redirects.
-                                            - m2m (machine to machine): CLIs, daemons or services running on your backend.
-  -w, --web-origins strings                 Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
+  -p, --allow-any-profile-of-type strings        Comma-separated list of enabled token exchange types for this client. Possible values: custom_authentication, on_behalf_of_token_exchange.
+  -a, --auth-method string                       Defines the requested authentication method for the token endpoint. Possible values are 'None' (public application without a client secret), 'Post' (application uses HTTP POST parameters) or 'Basic' (application uses HTTP Basic).
+  -c, --callbacks strings                        After the user authenticates we will only call back to any of these URLs. You can specify multiple valid URLs by comma-separating them (typically to handle different environments like QA or testing). Make sure to specify the protocol (https://) otherwise the callback may fail in some cases. With the exception of custom URI schemes for native apps, all callbacks should use protocol https://.
+      --data string                              JSON payload for the operation, as a JSON string or file path (@file.json). Can also be piped via stdin.
+  -d, --description string                       Description of the application. Max character count is 140.
+  -g, --grants strings                           List of grant types supported for this application. Can include code, implicit, refresh-token, credentials, password, password-realm, mfa-oob, mfa-otp, mfa-recovery-code, and device-code.
+  -f, --is-first-party                           Whether the application is a first-party client (true) or third-party client (false). (default true)
+      --json                                     Output in json format.
+      --json-compact                             Output in compact json format.
+  -l, --logout-urls strings                      Comma-separated list of URLs that are valid to redirect to after logout from Auth0. Wildcards are allowed for subdomains.
+      --metadata stringToString                  Arbitrary keys-value pairs (max 255 characters each), that  can be assigned to each application. More about application metadata: https://auth0.com/docs/get-started/applications/configure-application-metadata (default [])
+  -n, --name string                              Name of the application.
+      --organization-discovery-methods strings   Comma-separated list of methods for discovering organizations during the 'pre_login_prompt'. Possible values: 'email', 'organization_name'. Requires --organization-require-behavior=pre_login_prompt.
+      --organization-require-behavior string     How to prompt for an organization at authentication: 'no_prompt', 'pre_login_prompt', or 'post_login_prompt'. 'post_login_prompt' requires an OIDC-conformant application.
+      --organization-usage string                How the application handles organizations at authentication: 'deny', 'allow', or 'require'.
+  -o, --origins strings                          Comma-separated list of URLs allowed to make requests from JavaScript to Auth0 API (typically used with CORS). By default, all your callback URLs will be allowed. This field allows you to enter other origins if necessary. You can also use wildcards at the subdomain level (e.g., https://*.contoso.com). Query strings and hash information are not taken into account when validating these URLs.
+  -y, --redirection-policy string                Controls whether Auth0 redirects users to the application's callback URL on authentication errors or in email verification flows: 'allow_always' or 'open_redirect_protection'. Require --is-first-party=false
+  -z, --refresh-token string                     Refresh Token Config for the application, formatted as JSON.
+  -r, --reveal-secrets                           Display the application secrets ('signing_keys', 'client_secret') as part of the command output.
+      --schema                                   Print the request payload schema for this command and exit. Use with --json or --json-compact for machine-readable output.
+  -s, --third-party-security-mode string         Security mode for third-party clients: 'strict' or 'permissive'. Require --is-first-party=false
+  -t, --type string                              Type of application:
+                                                 - native: mobile, desktop, CLI and smart device apps running natively.
+                                                 - spa (single page application): a JavaScript front-end app that uses an API.
+                                                 - regular: Traditional web app using redirects.
+                                                 - m2m (machine to machine): CLIs, daemons or services running on your backend.
+  -w, --web-origins strings                      Comma-separated list of allowed origins for use with Cross-Origin Authentication, Device Flow, and web message response mode.
 ```