feat(management): add enforceSSOExclusions to tenant create and update

README.md

@@ -614,21 +614,46 @@ You can create, update, delete or load tenants, as well as read and update tenan
 ```typescript
 // The self provisioning domains or optional. If given they'll be used to associate
 // Users logging in to this tenant
-await descopeClient.management.tenant.create('My Tenant', ['domain.com'], {
-  customAttributeName: 'val',
-});
+await descopeClient.management.tenant.create(
+  'My Tenant',
+  ['domain.com'],
+  { customAttributeName: 'val' },
+  true, // enforceSSO
+  false, // disabled
+  '', // parent tenant ID
+  'none', // roleInheritance
+  ['<user-ID>'], // enforceSSOExclusions - Descope user IDs excluded from SSO enforcement
+);
 
-// You can optionally set your own ID when creating a tenant
-await descopeClient.management.tenant.createWithId('my-custom-id', 'My Tenant', ['domain.com'], {
-  customAttributeName: 'val',
-});
+// You can optionally set your own ID when creating a tenant. It accepts the same
+// optional arguments as create, shifted one position to make room for the ID.
+await descopeClient.management.tenant.createWithId(
+  'my-custom-id',
+  'My Tenant',
+  ['domain.com'],
+  { customAttributeName: 'val' },
+  true, // enforceSSO
+  false, // disabled
+  '', // parent tenant ID
+  'none', // roleInheritance
+  ['<user-ID>'], // enforceSSOExclusions - Descope user IDs excluded from SSO enforcement
+);
 
 // Update will override all fields as is. Use carefully.
+// Every parameter update takes is replaced, so any one you omit is cleared on the tenant -
+// read the tenant first and pass back the values you want to keep. Fields update has no
+// parameter for, such as the parent tenant and default roles, are not affected.
+// The values below are illustrative rather than defaults: copying this call as-is also
+// turns enforceSSO on.
 await descopeClient.management.tenant.update(
   'my-custom-id',
   'My Tenant',
   ['domain.com', 'another-domain.com'],
   { customAttributeName: 'val' },
+  true, // enforceSSO
+  false, // disabled
+  'none', // roleInheritance
+  ['<user-ID>'], // enforceSSOExclusions - Descope user IDs excluded from SSO enforcement
 );
 
 // Update the tenant's default roles by providing role names.

lib/management/tenant.test.ts

@@ -65,13 +65,15 @@ describe('Management Tenant', () => {
         true,
         'p',
         'none',
+        ['excluded@example.com'],
       );
 
       expect(mockHttpClient.post).toHaveBeenCalledWith(apiPaths.tenant.create, {
         name: 'name',
         selfProvisioningDomains: ['d1'],
         customAttributes: { customAttr: 'value' },
         enforceSSO: true,
+        enforceSSOExclusions: ['excluded@example.com'],
         disabled: true,
         parent: 'p',
         roleInheritance: 'none',
@@ -146,6 +148,7 @@ describe('Management Tenant', () => {
         true,
         'p',
         '',
+        ['excluded@example.com'],
       );
 
       expect(mockHttpClient.post).toHaveBeenCalledWith(apiPaths.tenant.create, {
@@ -154,6 +157,7 @@ describe('Management Tenant', () => {
         selfProvisioningDomains: ['d1'],
         customAttributes: { customAttr: 'value' },
         enforceSSO: true,
+        enforceSSOExclusions: ['excluded@example.com'],
         disabled: true,
         parent: 'p',
         roleInheritance: '',
@@ -227,6 +231,7 @@ describe('Management Tenant', () => {
         true,
         true,
         'none',
+        ['excluded@example.com'],
       );
 
       expect(mockHttpClient.post).toHaveBeenCalledWith(apiPaths.tenant.update, {
@@ -235,6 +240,7 @@ describe('Management Tenant', () => {
         selfProvisioningDomains: ['d1'],
         customAttributes: { customAttr: 'value' },
         enforceSSO: true,
+        enforceSSOExclusions: ['excluded@example.com'],
         disabled: true,
         roleInheritance: 'none',
       });

lib/management/tenant.ts

@@ -21,13 +21,15 @@ const withTenant = (httpClient: HttpClient) => ({
     disabled?: boolean,
     parent?: string,
     roleInheritance?: '' | 'none' | 'userOnly',
+    enforceSSOExclusions?: string[],
   ): Promise<SdkResponse<CreateTenantResponse>> =>
     transformResponse(
       httpClient.post(apiPaths.tenant.create, {
         name,
         selfProvisioningDomains,
         customAttributes,
         enforceSSO,
+        enforceSSOExclusions,
         disabled,
         parent,
         roleInheritance,
@@ -42,6 +44,7 @@ const withTenant = (httpClient: HttpClient) => ({
     disabled?: boolean,
     parent?: string,
     roleInheritance?: '' | 'none' | 'userOnly',
+    enforceSSOExclusions?: string[],
   ): Promise<SdkResponse<never>> =>
     transformResponse(
       httpClient.post(apiPaths.tenant.create, {
@@ -50,6 +53,7 @@ const withTenant = (httpClient: HttpClient) => ({
         selfProvisioningDomains,
         customAttributes,
         enforceSSO,
+        enforceSSOExclusions,
         disabled,
         parent,
         roleInheritance,
@@ -63,6 +67,7 @@ const withTenant = (httpClient: HttpClient) => ({
     enforceSSO?: boolean,
     disabled?: boolean,
     roleInheritance?: '' | 'none' | 'userOnly',
+    enforceSSOExclusions?: string[],
   ): Promise<SdkResponse<never>> =>
     transformResponse(
       httpClient.post(apiPaths.tenant.update, {
@@ -71,6 +76,7 @@ const withTenant = (httpClient: HttpClient) => ({
         selfProvisioningDomains,
         customAttributes,
         enforceSSO,
+        enforceSSOExclusions,
         disabled,
         roleInheritance,
       }),

lib/management/types.ts

@@ -190,8 +190,10 @@ export type Tenant = {
   domains?: string[];
   authType?: 'none' | 'saml' | 'oidc';
   enforceSSO?: boolean;
+  enforceSSOExclusions?: string[];
   disabled?: boolean;
   defaultRoles?: string[];
+  roleInheritance?: '' | 'none' | 'userOnly';
 };
 
 export type SSOSetupSuiteSettingsDisabledFeatures = {