Migrating from Auth0 to theauth-go

# Obtain a Management API token. Replace YOUR_DOMAIN, CLIENT_ID, CLIENT_SECRET.
TOKEN=$(curl -s -X POST \
  "https://YOUR_DOMAIN.auth0.com/oauth/token" \
  -H "Content-Type: application/json" \
  -d '{
    "client_id": "CLIENT_ID",
    "client_secret": "CLIENT_SECRET",
    "audience": "https://YOUR_DOMAIN.auth0.com/api/v2/",
    "grant_type": "client_credentials"
  }' | python3 -c "import json,sys; print(json.load(sys.stdin)['access_token'])")

# Fetch all users (paginated).
page=0
per_page=100
output="auth0-users.json"
echo '[' > "$output"
first=true

while true; do
  result=$(curl -s -G \
    "https://YOUR_DOMAIN.auth0.com/api/v2/users" \
    --header "Authorization: Bearer $TOKEN" \
    --data-urlencode "page=$page" \
    --data-urlencode "per_page=$per_page" \
    --data-urlencode "include_totals=false" \
    --data-urlencode "fields=user_id,email,email_verified,name,given_name,family_name,identities,app_metadata,user_metadata,multifactor,created_at,updated_at")

  count=$(echo "$result" | python3 -c "import json,sys; d=json.load(sys.stdin); print(len(d))")
  if [ "$count" -eq 0 ]; then
    break
  fi

  # Strip the surrounding array brackets and append.
  inner=$(echo "$result" | python3 -c "import json,sys; d=json.load(sys.stdin); print(json.dumps(d)[1:-1])")
  if [ "$first" = "true" ]; then
    echo "$inner" >> "$output"
    first=false
  else
    echo ",$inner" >> "$output"
  fi

  page=$((page + 1))
done

echo ']' >> "$output"

# Create a bulk export job that includes password_hash.
JOB_ID=$(curl -s -X POST \
  "https://YOUR_DOMAIN.auth0.com/api/v2/jobs/users-exports" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "connection_id": "con_XXXXXXX",
    "format": "json",
    "fields": [
      {"name": "user_id"},
      {"name": "email"},
      {"name": "email_verified"},
      {"name": "name"},
      {"name": "identities"},
      {"name": "app_metadata"},
      {"name": "user_metadata"},
      {"name": "multifactor"},
      {"name": "created_at"},
      {"name": "updated_at"},
      {"name": "custom_password_hash"}
    ]
  }' | python3 -c "import json,sys; print(json.load(sys.stdin)['id'])")

echo "Export job: $JOB_ID"

# Poll until complete.
while true; do
  status=$(curl -s \
    "https://YOUR_DOMAIN.auth0.com/api/v2/jobs/$JOB_ID" \
    -H "Authorization: Bearer $TOKEN" \
    | python3 -c "import json,sys; print(json.load(sys.stdin)['status'])")
  echo "Status: $status"
  if [ "$status" = "completed" ]; then
    break
  fi
  sleep 5
done

# Download the exported file.
location=$(curl -s \
  "https://YOUR_DOMAIN.auth0.com/api/v2/jobs/$JOB_ID" \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -c "import json,sys; print(json.load(sys.stdin)['location'])")

curl -s "$location" -o auth0-users.ndjson

# Convert newline-delimited JSON to a JSON array.
python3 -c "
import json, sys
users = [json.loads(line) for line in sys.stdin if line.strip()]
json.dump(users, sys.stdout, indent=2)
" < auth0-users.ndjson > auth0-users.json

theauth-migrate auth0 --export auth0-users.json --output bundle.json

theauth-migrate auth0 --export auth0-users.json --output bundle.json \
  --force-password-reset

theauth-migrate validate --input bundle.json

auth, err := theauth.New(theauth.Config{
    // ... existing config ...
    PasswordPolicy: theauth.PasswordPolicyConfig{
        AllowLegacyBcrypt: true,
        OnLegacyHashAccepted: func(userID string, newHash string) {
            // Optional: the library already persisted the new Argon2id hash.
            // This runs in a separate goroutine after a successful bcrypt
            // login; use it only to update a copy of the hash you keep elsewhere.
            go func() {
                ctx := context.Background()
                uid, _ := ulid.ParseStrict(userID)
                _ = mirrorStore.SetUserPassword(ctx, uid, newHash)
            }()
        },
    },
})

theauth-migrate auth0 --input bundle.json --apply --dry-run

theauth-migrate auth0 --input bundle.json --apply \
  --storage postgres \
  --dsn "postgres://theauth:secret@db.example.com:5432/theauth_prod"

PasswordPolicy: theauth.PasswordPolicyConfig{
    AllowLegacyBcrypt: false, // back to default; bcrypt hashes will be rejected
},