feat: integrated identifiers in theme and country_codes in tenant

docs/data-sources/branding_theme.md

@@ -24,6 +24,7 @@ data "auth0_branding_theme" "my_branding_theme" {}
 - `display_name` (String) The display name for the branding theme.
 - `fonts` (List of Object) (see [below for nested schema](#nestedatt--fonts))
 - `id` (String) The ID of this resource.
+- `identifiers` (List of Object) Configuration for identifier input display settings. Requires the identifier input feature flag to be enabled on the tenant. Once added, identifiers can only be updated but not removed (see [below for nested schema](#nestedatt--identifiers))
 - `page_background` (List of Object) (see [below for nested schema](#nestedatt--page_background))
 - `widget` (List of Object) (see [below for nested schema](#nestedatt--widget))
 
@@ -139,6 +140,25 @@ Read-Only:
 
 
 
+<a id="nestedatt--identifiers"></a>
+### Nested Schema for `identifiers`
+
+Read-Only:
+
+- `login_display` (String)
+- `otp_autocomplete` (Boolean)
+- `phone_display` (List of Object) (see [below for nested schema](#nestedobjatt--identifiers--phone_display))
+
+<a id="nestedobjatt--identifiers--phone_display"></a>
+### Nested Schema for `identifiers.phone_display`
+
+Read-Only:
+
+- `formatting` (String)
+- `masking` (String)
+
+
+
 <a id="nestedatt--page_background"></a>
 ### Nested Schema for `page_background`
 

docs/data-sources/tenant.md

@@ -23,6 +23,7 @@ data "auth0_tenant" "my_tenant" {}
 - `allow_organization_name_in_authentication_api` (Boolean) Whether to accept an organization name instead of an ID on auth endpoints.
 - `allowed_logout_urls` (List of String) URLs that Auth0 may redirect to after logout.
 - `client_id_metadata_document_supported` (Boolean) Whether the tenant supports Client ID Metadata Document (CIMD) for client registration.
+- `country_codes` (List of Object) Configuration for phone identifier country code filtering. Remove this block to disable filtering. Requires the country codes feature flag to be enabled on the tenant. (see [below for nested schema](#nestedatt--country_codes))
 - `customize_mfa_in_postlogin_action` (Boolean) Whether to enable flexible factors for MFA in the PostLogin action.
 - `default_audience` (String) API Audience to use by default for API Authorization flows. This setting is equivalent to appending the audience to every authorization request made to the tenant for every application.
 - `default_directory` (String) Name of the connection to be used for Password Grant exchanges. Options include `auth0-adldap`, `ad`, `auth0`, `email`, `sms`, `waad`, and `adfs`.
@@ -54,6 +55,15 @@ data "auth0_tenant" "my_tenant" {}
 - `support_email` (String) Support email address for authenticating users.
 - `support_url` (String) Support URL for authenticating users.
 
+<a id="nestedatt--country_codes"></a>
+### Nested Schema for `country_codes`
+
+Read-Only:
+
+- `list` (Set of String)
+- `mode` (String)
+
+
 <a id="nestedatt--default_token_quota"></a>
 ### Nested Schema for `default_token_quota`
 

docs/resources/branding_theme.md

@@ -109,6 +109,17 @@ resource "auth0_branding_theme" "my_theme" {
     logo_url              = "https://google.com/logo.png"
     social_buttons_layout = "top"
   }
+
+  # Requires the identifier input feature flag to be enabled on the tenant.
+  identifiers {
+    login_display    = "unified"
+    otp_autocomplete = true
+
+    phone_display {
+      formatting = "international"
+      masking    = "mask_digits"
+    }
+  }
 }
 ```
 
@@ -126,6 +137,7 @@ resource "auth0_branding_theme" "my_theme" {
 ### Optional
 
 - `display_name` (String) The display name for the branding theme.
+- `identifiers` (Block List, Max: 1) Configuration for identifier input display settings. Requires the identifier input feature flag to be enabled on the tenant. Once added, identifiers can only be updated but not removed (see [below for nested schema](#nestedblock--identifiers))
 
 ### Read-Only
 
@@ -267,6 +279,24 @@ Optional:
 - `logo_url` (String) Logo url. Defaults to an empty string.
 - `social_buttons_layout` (String) Social buttons layout. Available options: `bottom`, `top`. Defaults to `bottom`.
 
+
+<a id="nestedblock--identifiers"></a>
+### Nested Schema for `identifiers`
+
+Required:
+
+- `login_display` (String) Login display style. Available options: `unified`, `separate`.
+- `otp_autocomplete` (Boolean) Whether OTP autocomplete is enabled.
+- `phone_display` (Block List, Min: 1, Max: 1) Phone number display settings. (see [below for nested schema](#nestedblock--identifiers--phone_display))
+
+<a id="nestedblock--identifiers--phone_display"></a>
+### Nested Schema for `identifiers.phone_display`
+
+Required:
+
+- `formatting` (String) Phone number formatting. Available options: `international`, `regional`.
+- `masking` (String) Phone number masking. Available options: `mask_digits`, `hide_country_code`, `show_all`.
+
 ## Import
 
 Import is supported using the following syntax:

docs/resources/tenant.md

@@ -47,6 +47,13 @@ resource "auth0_tenant" "my_tenant" {
     show_log_link = false
     url           = "https://example.com/error"
   }
+
+  # Requires the country codes feature flag to be enabled on the tenant.
+  # Remove this block entirely to disable filtering.
+  country_codes {
+    list = ["US", "CA"]
+    mode = "allow"
+  }
 }
 ```
 
@@ -59,6 +66,7 @@ resource "auth0_tenant" "my_tenant" {
 - `allow_organization_name_in_authentication_api` (Boolean) Whether to accept an organization name instead of an ID on auth endpoints.
 - `allowed_logout_urls` (List of String) URLs that Auth0 may redirect to after logout.
 - `client_id_metadata_document_supported` (Boolean) Whether the tenant supports Client ID Metadata Document (CIMD) for client registration.
+- `country_codes` (Block List, Max: 1) Configuration for phone identifier country code filtering. Remove this block to disable filtering. Requires the country codes feature flag to be enabled on the tenant. (see [below for nested schema](#nestedblock--country_codes))
 - `customize_mfa_in_postlogin_action` (Boolean) Whether to enable flexible factors for MFA in the PostLogin action.
 - `default_audience` (String) API Audience to use by default for API Authorization flows. This setting is equivalent to appending the audience to every authorization request made to the tenant for every application.
 - `default_directory` (String) Name of the connection to be used for Password Grant exchanges. Options include `auth0-adldap`, `ad`, `auth0`, `email`, `sms`, `waad`, and `adfs`.
@@ -91,6 +99,15 @@ resource "auth0_tenant" "my_tenant" {
 
 - `id` (String) The ID of this resource.
 
+<a id="nestedblock--country_codes"></a>
+### Nested Schema for `country_codes`
+
+Required:
+
+- `list` (Set of String) List of ISO 3166-1 alpha-2 country codes.
+- `mode` (String) Whether the list is an allow-list or deny-list. Available options: `allow`, `deny`.
+
+
 <a id="nestedblock--default_token_quota"></a>
 ### Nested Schema for `default_token_quota`
 

examples/resources/auth0_branding_theme/resource.tf

@@ -96,4 +96,15 @@ resource "auth0_branding_theme" "my_theme" {
     logo_url              = "https://google.com/logo.png"
     social_buttons_layout = "top"
   }
+
+  # Requires the identifier input feature flag to be enabled on the tenant.
+  identifiers {
+    login_display    = "unified"
+    otp_autocomplete = true
+
+    phone_display {
+      formatting = "international"
+      masking    = "mask_digits"
+    }
+  }
 }

examples/resources/auth0_tenant/resource.tf

@@ -31,4 +31,11 @@ resource "auth0_tenant" "my_tenant" {
     show_log_link = false
     url           = "https://example.com/error"
   }
+
+  # Requires the country codes feature flag to be enabled on the tenant.
+  # Remove this block entirely to disable filtering.
+  country_codes {
+    list = ["US", "CA"]
+    mode = "allow"
+  }
 }

go.mod

@@ -89,13 +89,13 @@ require (
 	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
 	golang.org/x/crypto v0.53.0 // indirect
 	golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d // indirect
-	golang.org/x/mod v0.36.0 // indirect
-	golang.org/x/net v0.55.0 // indirect
+	golang.org/x/mod v0.37.0 // indirect
+	golang.org/x/net v0.56.0 // indirect
 	golang.org/x/oauth2 v0.36.0 // indirect
 	golang.org/x/sync v0.21.0 // indirect
 	golang.org/x/sys v0.46.0 // indirect
-	golang.org/x/text v0.38.0 // indirect
-	golang.org/x/tools v0.45.0 // indirect
+	golang.org/x/text v0.39.0 // indirect
+	golang.org/x/tools v0.47.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
 	google.golang.org/grpc v1.79.3 // indirect

go.sum

@@ -277,16 +277,16 @@ golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsi
 golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d h1:N0hmiNbwsSNwHBAvR3QB5w25pUwH4tK0Y/RltD1j1h4=
 golang.org/x/exp v0.0.0-20240525044651-4c93da0ed11d/go.mod h1:XtvwrStGgqGPLc4cjQfWqZHG1YFdYs6swckp8vpsjnc=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.36.0 h1:JJjpVx6myfUsUdAzZuOSTTmRE0PfZeNWzzvKrP7amb4=
-golang.org/x/mod v0.36.0/go.mod h1:moc6ELqsWcOw5Ef3xVprK5ul/MvtVvkIXLziUOICjUQ=
+golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
+golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20210510120150-4163338589ed/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8=
-golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww=
+golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o=
+golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec=
 golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
 golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -318,13 +318,13 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
-golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
+golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
+golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.45.0 h1:18qN3FAooORvApf5XjCXgsuayZOEtXf6JK18I3+ONa8=
-golang.org/x/tools v0.45.0/go.mod h1:LuUGqqaXcXMEFEruIVJVm5mgDD8vww/z/SR1gQ4uE/0=
+golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
+golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 gonum.org/v1/gonum v0.16.0 h1:5+ul4Swaf3ESvrOnidPp4GZbzf0mxVQpDCYUQE7OJfk=

internal/auth0/branding/expand.go

@@ -111,9 +111,26 @@ func expandBrandingTheme(data *schema.ResourceData) management.BrandingTheme {
 		SocialButtonsLayout: data.Get("widget.0.social_buttons_layout").(string),
 	}
 
+	brandingTheme.Identifiers = expandBrandingThemeIdentifiers(data)
+
 	return brandingTheme
 }
 
+func expandBrandingThemeIdentifiers(data *schema.ResourceData) *management.BrandingThemeIdentifiers {
+	if len(data.Get("identifiers").([]interface{})) == 0 {
+		return nil
+	}
+
+	return &management.BrandingThemeIdentifiers{
+		LoginDisplay:    data.Get("identifiers.0.login_display").(string),
+		OTPAutocomplete: data.Get("identifiers.0.otp_autocomplete").(bool),
+		PhoneDisplay: management.BrandingThemePhoneDisplay{
+			Formatting: data.Get("identifiers.0.phone_display.0.formatting").(string),
+			Masking:    data.Get("identifiers.0.phone_display.0.masking").(string),
+		},
+	}
+}
+
 func expandBrandingColors(config cty.Value) *management.BrandingColors {
 	var brandingColors management.BrandingColors
 

internal/auth0/branding/expand_test.go

@@ -0,0 +1,43 @@
+package branding
+
+import (
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestExpandBrandingThemeIdentifiers(t *testing.T) {
+	t.Run("it returns nil when identifiers block is not configured", func(t *testing.T) {
+		data := schema.TestResourceDataRaw(t, NewThemeResource().Schema, map[string]interface{}{})
+
+		identifiers := expandBrandingThemeIdentifiers(data)
+
+		assert.Nil(t, identifiers)
+	})
+
+	t.Run("it returns the populated struct when identifiers block is configured", func(t *testing.T) {
+		data := schema.TestResourceDataRaw(t, NewThemeResource().Schema, map[string]interface{}{
+			"identifiers": []interface{}{
+				map[string]interface{}{
+					"login_display":    "separate",
+					"otp_autocomplete": false,
+					"phone_display": []interface{}{
+						map[string]interface{}{
+							"formatting": "regional",
+							"masking":    "show_all",
+						},
+					},
+				},
+			},
+		})
+
+		identifiers := expandBrandingThemeIdentifiers(data)
+
+		assert.NotNil(t, identifiers)
+		assert.Equal(t, "separate", identifiers.LoginDisplay)
+		assert.Equal(t, false, identifiers.OTPAutocomplete)
+		assert.Equal(t, "regional", identifiers.PhoneDisplay.Formatting)
+		assert.Equal(t, "show_all", identifiers.PhoneDisplay.Masking)
+	})
+}

internal/auth0/branding/flatten.go

@@ -30,6 +30,7 @@ func flattenBrandingTheme(data *schema.ResourceData, brandingTheme *management.B
 		data.Set("fonts", flattenBrandingThemeFonts(brandingTheme.Fonts)),
 		data.Set("page_background", flattenBrandingThemePageBackground(brandingTheme.PageBackground)),
 		data.Set("widget", flattenBrandingThemeWidget(brandingTheme.Widget)),
+		data.Set("identifiers", flattenBrandingThemeIdentifiers(brandingTheme.Identifiers)),
 	)
 
 	return result.ErrorOrNil()
@@ -181,6 +182,25 @@ func flattenBrandingThemeWidget(widget management.BrandingThemeWidget) []interfa
 	return []interface{}{m}
 }
 
+func flattenBrandingThemeIdentifiers(identifiers *management.BrandingThemeIdentifiers) []interface{} {
+	if identifiers == nil {
+		return nil
+	}
+
+	return []interface{}{
+		map[string]interface{}{
+			"login_display":    identifiers.LoginDisplay,
+			"otp_autocomplete": identifiers.OTPAutocomplete,
+			"phone_display": []interface{}{
+				map[string]interface{}{
+					"formatting": identifiers.PhoneDisplay.Formatting,
+					"masking":    identifiers.PhoneDisplay.Masking,
+				},
+			},
+		},
+	}
+}
+
 func flattenPhoneProvider(data *schema.ResourceData, phoneProvider *management.BrandingPhoneProvider) error {
 	result := multierror.Append(
 		data.Set("name", phoneProvider.GetName()),

internal/auth0/branding/flatten_test.go

@@ -0,0 +1,47 @@
+package branding
+
+import (
+	"testing"
+
+	"github.com/auth0/go-auth0/management"
+	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestFlattenBrandingTheme(t *testing.T) {
+	mockResourceData := schema.TestResourceDataRaw(t, NewThemeResource().Schema, map[string]interface{}{})
+
+	t.Run("it sets identifiers to nil if remote theme does not have them set", func(t *testing.T) {
+		brandingTheme := management.BrandingTheme{
+			Identifiers: nil,
+		}
+
+		err := flattenBrandingTheme(mockResourceData, &brandingTheme)
+
+		assert.NoError(t, err)
+		assert.Equal(t, mockResourceData.Get("identifiers"), []interface{}{})
+	})
+
+	t.Run("it sets identifiers if remote theme has them set", func(t *testing.T) {
+		brandingTheme := management.BrandingTheme{
+			Identifiers: &management.BrandingThemeIdentifiers{
+				LoginDisplay:    "unified",
+				OTPAutocomplete: true,
+				PhoneDisplay: management.BrandingThemePhoneDisplay{
+					Formatting: "international",
+					Masking:    "mask_digits",
+				},
+			},
+		}
+
+		err := flattenBrandingTheme(mockResourceData, &brandingTheme)
+
+		assert.NoError(t, err)
+		identifiers := mockResourceData.Get("identifiers").([]interface{})[0].(map[string]interface{})
+		assert.Equal(t, "unified", identifiers["login_display"])
+		assert.Equal(t, true, identifiers["otp_autocomplete"])
+		phoneDisplay := identifiers["phone_display"].([]interface{})[0].(map[string]interface{})
+		assert.Equal(t, "international", phoneDisplay["formatting"])
+		assert.Equal(t, "mask_digits", phoneDisplay["masking"])
+	})
+}