feat: add client-grants command resource

.github/workflows/main.yml

@@ -66,8 +66,9 @@ jobs:
 
     # Skip running if the PR is coming from a fork or is created by dependabot or snyk due to missing repo secrets.
     # Only run on pushes to main or PRs targeting main.
+    # TEMPORARY: also run on PRs targeting feat/go-auth0-v3-migration to verify the client-grants suite. Revert before merge.
     if: github.event.pull_request.head.repo.fork == false && (github.actor != 'dependabot[bot]' && github.actor != 'snyk-bot') &&
-        (github.ref == 'refs/heads/main' || github.base_ref == 'main')
+        (github.ref == 'refs/heads/main' || github.base_ref == 'main' || github.base_ref == 'feat/go-auth0-v3-migration')
 
     steps:
       - name: Check out the code

README.md

@@ -269,6 +269,7 @@ Select **y** to proceed with your default tenant, or **N** to choose a different
 - [auth0 api](https://auth0.github.io/auth0-cli/auth0_api.html) - Makes an authenticated HTTP request to the Auth0 Management API
 - [auth0 apis](https://auth0.github.io/auth0-cli/auth0_apis.html) - Manage resources for APIs
 - [auth0 apps](https://auth0.github.io/auth0-cli/auth0_apps.html) - Manage resources for applications
+- [auth0 client-grants](https://auth0.github.io/auth0-cli/auth0_client-grants.html) - Manage client grants
 - [auth0 completion](https://auth0.github.io/auth0-cli/auth0_completion.html) - Setup autocomplete features for this CLI on your terminal
 - [auth0 domains](https://auth0.github.io/auth0-cli/auth0_domains.html) - Manage custom domains
 - [auth0 email](https://auth0.github.io/auth0-cli/auth0_email.html) - Manage email settings

docs/auth0_client-grants.md

@@ -0,0 +1,17 @@
+---
+layout: default
+has_toc: false
+has_children: true
+---
+# auth0 client-grants
+
+Manage client grants. A client grant authorizes an application (client) to request access tokens for an API (audience), optionally scoped to specific permissions or organizations.
+
+## Commands
+
+- [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
+- [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
+- [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
+- [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
+

docs/auth0_client-grants_create.md

@@ -0,0 +1,71 @@
+---
+layout: default
+parent: auth0 client-grants
+has_toc: false
+---
+# auth0 client-grants create
+
+Create a new client grant.
+
+To create interactively, use `auth0 client-grants create` with no flags.
+
+To create non-interactively, supply the audience and either a client id (`--client-id`) or a default group (`--default-for`), which are mutually exclusive, along with any optional scopes or organization settings through the flags. A grant can authorize specific scopes (`--scopes`), every scope on the API (`--allow-all-scopes`), or no scopes at all.
+
+Note: for the Auth0 Management API with `--subject-type user`, scopes must be a subset of the fixed current_user set and cannot be listed dynamically, so pass them inline, for example: `--scopes "read:current_user,update:current_user_metadata,delete:current_user_metadata,create:current_user_metadata,create:current_user_device_credentials,delete:current_user_device_credentials,update:current_user_identities"`.
+
+## Usage
+```
+auth0 client-grants create [flags]
+```
+
+## Examples
+
+```
+  auth0 client-grants create
+  auth0 client-grants create --client-id <client-id> --audience <api-identifier>
+  auth0 client-grants create --default-for third_party_clients --audience <api-identifier>
+  auth0 client-grants create --client-id <client-id> --audience <api-identifier> --scopes "read:users,update:users"
+  auth0 client-grants create --client-id <client-id> --audience <api-identifier> --allow-all-scopes
+  auth0 client-grants create --client-id <client-id> --audience <api-identifier> --authorization-details-types "payment,transfer"
+  auth0 client-grants create -c <client-id> -a <api-identifier> -s "read:users" -o require --allow-any-organization=false
+  auth0 client-grants create -c <client-id> -a <api-identifier> --subject-type user
+  auth0 client-grants create -c <client-id> -a <api-identifier> --json
+```
+
+
+## Flags
+
+```
+      --allow-all-scopes                      Grant every scope configured on the API. Mutually exclusive with --scopes.
+      --allow-any-organization                Whether any organization can be used with this grant (true) or only explicitly assigned organizations (false).
+  -a, --audience string                       Audience (API identifier) of the client grant. Cannot be changed once set.
+      --authorization-details-types strings   Comma-separated list of authorization_details types allowed for this grant (Rich Authorization Requests).
+  -c, --client-id string                      Client ID of the application to authorize. Cannot be changed once set. Mutually exclusive with --default-for.
+      --default-for string                    Make this the default grant for a group of clients instead of authorizing a specific client. Mutually exclusive with --client-id. Possible value: third_party_clients.
+      --json                                  Output in json format.
+      --json-compact                          Output in compact json format.
+  -o, --organization-usage string             Whether organizations can be used with this grant. Possible values: deny, allow, require.
+  -s, --scopes strings                        Comma-separated list of scopes (permissions) to grant.
+      --subject-type string                   Subject type of the grant. Cannot be changed once set. Possible values: client, user, anonymous_user.
+```
+
+
+## Inherited Flags
+
+```
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
+- [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
+- [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
+- [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
+
+

docs/auth0_client-grants_delete.md

@@ -0,0 +1,56 @@
+---
+layout: default
+parent: auth0 client-grants
+has_toc: false
+---
+# auth0 client-grants delete
+
+Delete a client grant.
+
+To delete interactively, use `auth0 client-grants delete` with no arguments.
+
+To delete non-interactively, supply the client grant id and the `--force` flag to skip confirmation.
+
+## Usage
+```
+auth0 client-grants delete [flags]
+```
+
+## Examples
+
+```
+  auth0 client-grants delete
+  auth0 client-grants rm
+  auth0 client-grants delete <client-grant-id>
+  auth0 client-grants delete <client-grant-id> --force
+  auth0 client-grants delete <client-grant-id> <client-grant-id2> <client-grant-idn>
+  auth0 client-grants delete <client-grant-id> <client-grant-id2> <client-grant-idn> --force
+```
+
+
+## Flags
+
+```
+      --force   Skip confirmation.
+```
+
+
+## Inherited Flags
+
+```
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
+- [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
+- [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
+- [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
+
+

docs/auth0_client-grants_list.md

@@ -0,0 +1,63 @@
+---
+layout: default
+parent: auth0 client-grants
+has_toc: false
+---
+# auth0 client-grants list
+
+List your existing client grants. To create one, run: `auth0 client-grants create`.
+
+Use the filter flags to narrow the results server-side by client, audience, subject type, default group or organization usage.
+
+## Usage
+```
+auth0 client-grants list [flags]
+```
+
+## Examples
+
+```
+  auth0 client-grants list
+  auth0 client-grants ls
+  auth0 client-grants ls --number 100
+  auth0 client-grants ls --audience <api-identifier>
+  auth0 client-grants ls --client-id <client-id> --subject-type client
+  auth0 client-grants ls --default-for third_party_clients
+  auth0 client-grants ls --allow-any-organization=true
+  auth0 client-grants ls -n 100 --json
+```
+
+
+## Flags
+
+```
+      --allow-any-organization   Filter by whether any organization can be used with the grant (true) or only explicitly assigned organizations (false).
+  -a, --audience string          Filter by audience (API identifier).
+  -c, --client-id string         Filter by client ID. Mutually exclusive with --default-for.
+      --default-for string       Filter by the group this grant is the default for. Possible value: third_party_clients. Mutually exclusive with --client-id.
+      --json                     Output in json format.
+      --json-compact             Output in compact json format.
+  -n, --number int               Number of client grants to retrieve. Minimum 1, maximum 1000. (default 100)
+      --subject-type string      Filter by subject type. Possible values: client, user, anonymous_user.
+```
+
+
+## Inherited Flags
+
+```
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
+- [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
+- [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
+- [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
+
+

docs/auth0_client-grants_show.md

@@ -0,0 +1,51 @@
+---
+layout: default
+parent: auth0 client-grants
+has_toc: false
+---
+# auth0 client-grants show
+
+Display the client, audience, scopes, and other information about a client grant.
+
+## Usage
+```
+auth0 client-grants show [flags]
+```
+
+## Examples
+
+```
+  auth0 client-grants show
+  auth0 client-grants show <client-grant-id>
+  auth0 client-grants show <client-grant-id> --json
+  auth0 client-grants show <client-grant-id> --json-compact
+```
+
+
+## Flags
+
+```
+      --json           Output in json format.
+      --json-compact   Output in compact json format.
+```
+
+
+## Inherited Flags
+
+```
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
+- [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
+- [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
+- [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
+
+

docs/auth0_client-grants_update.md

@@ -0,0 +1,65 @@
+---
+layout: default
+parent: auth0 client-grants
+has_toc: false
+---
+# auth0 client-grants update
+
+Update a client grant.
+
+To update interactively, use `auth0 client-grants update` with no arguments.
+
+The client id and audience of a grant cannot be changed. To update non-interactively, supply the scopes or organization settings through the flags. Pass `--allow-all-scopes` to grant every scope on the API instead of a specific list.
+
+Note: for the Auth0 Management API with `--subject-type user`, scopes must be a subset of the fixed current_user set and cannot be listed dynamically, so pass them inline, for example: `--scopes "read:current_user,update:current_user_metadata,delete:current_user_metadata,create:current_user_metadata,create:current_user_device_credentials,delete:current_user_device_credentials,update:current_user_identities"`.
+
+## Usage
+```
+auth0 client-grants update [flags]
+```
+
+## Examples
+
+```
+  auth0 client-grants update
+  auth0 client-grants update <client-grant-id>
+  auth0 client-grants update <client-grant-id> --scopes "read:users,update:users"
+  auth0 client-grants update <client-grant-id> --allow-all-scopes
+  auth0 client-grants update <client-grant-id> --authorization-details-types "payment,transfer"
+  auth0 client-grants update <client-grant-id> -s "read:users" -o require --allow-any-organization=false
+  auth0 client-grants update <client-grant-id> --json
+```
+
+
+## Flags
+
+```
+      --allow-all-scopes                      Grant every scope configured on the API. Mutually exclusive with --scopes.
+      --allow-any-organization                Whether any organization can be used with this grant (true) or only explicitly assigned organizations (false).
+      --authorization-details-types strings   Comma-separated list of authorization_details types allowed for this grant (Rich Authorization Requests).
+      --json                                  Output in json format.
+      --json-compact                          Output in compact json format.
+  -o, --organization-usage string             Whether organizations can be used with this grant. Possible values: deny, allow, require.
+  -s, --scopes strings                        Comma-separated list of scopes (permissions) to grant.
+```
+
+
+## Inherited Flags
+
+```
+      --debug           Enable debug mode.
+      --no-color        Disable colors.
+      --no-input        Disable interactivity.
+      --tenant string   Specific tenant to use.
+```
+
+
+## Related Commands
+
+- [auth0 client-grants create](auth0_client-grants_create.md) - Create a new client grant
+- [auth0 client-grants delete](auth0_client-grants_delete.md) - Delete a client grant
+- [auth0 client-grants list](auth0_client-grants_list.md) - List your client grants
+- [auth0 client-grants show](auth0_client-grants_show.md) - Show a client grant
+- [auth0 client-grants update](auth0_client-grants_update.md) - Update a client grant
+
+

docs/index.md

@@ -84,6 +84,7 @@ Authenticating as a user is not supported for **private cloud** tenants. Instead
 - [auth0 api](auth0_api.md) - Makes an authenticated HTTP request to the Auth0 Management API
 - [auth0 apis](auth0_apis.md) - Manage resources for APIs
 - [auth0 apps](auth0_apps.md) - Manage resources for applications
+- [auth0 client-grants](auth0_client-grants.md) - Manage client grants
 - [auth0 completion](auth0_completion.md) - Setup autocomplete features for this CLI on your terminal
 - [auth0 domains](auth0_domains.md) - Manage custom domains
 - [auth0 email](auth0_email.md) - Manage email settings and configure email providers

internal/auth/auth.go

@@ -123,7 +123,7 @@ func WaitUntilUserLogsIn(ctx context.Context, httpClient *http.Client, state Sta
 var RequiredScopes = []string{
 	"openid",
 	"create:clients", "delete:clients", "read:clients", "update:clients",
-	"create:client_grants", "read:client_grants",
+	"create:client_grants", "read:client_grants", "update:client_grants", "delete:client_grants",
 	"create:resource_servers", "delete:resource_servers", "read:resource_servers", "update:resource_servers",
 	"create:roles", "delete:roles", "read:roles", "update:roles",
 	"create:rules", "delete:rules", "read:rules", "update:rules",

internal/auth/scopes_test.go

@@ -6,6 +6,7 @@ func TestRequiredScopes(t *testing.T) {
 	t.Run("Verify CRUD scopes", func(t *testing.T) {
 		crudResources := []string{
 			"clients",
+			"client_grants",
 			"log_streams",
 			"resource_servers",
 			"roles",