Skip to content

Conversation

@kushalshit27
Copy link
Contributor

@kushalshit27 kushalshit27 commented Jan 27, 2026

🔧 Changes

  • Added support for the allow_all_scopes boolean property in Client Grants, which when enabled, allows all scopes configured on the resource server without explicitly listing them
  • Add validation between allow_all_scopes and scope properties - when allow_all_scopes is true, the scope array cannot be specified

Examples

YAML format
clientGrants:
  - client_id: "My M2M Application"
    audience: "https://api.example.com"
    allow_all_scopes: true
JSON format (Directory structure)
{
  "client_id": "My M2M Application",
  "audience": "https://api.example.com",
  "allow_all_scopes": true
}

📌 Note:

When allow_all_scopes is set to true, the scope property must not be provided or must be empty

🔬 Testing

  • Added 2 validation tests to ensure allow_all_scopes and scope are mutually exclusive and that valid configurations pass validation
  • Added process test to verify client grants can be created with allow_all_scopes property

📝 Checklist

  • All new/changed/fixed functionality is covered by tests (or N/A)
  • I have added documentation for all new/changed functionality (or N/A)

- src/tools/auth0/handlers/clientGrants.ts: add allow_all_scopes property to schema and implement validation logic
- src/tools/auth0/handlers/prompts.ts: update ScreenRenderer type to Management.GetAculResponseContent
- test/tools/auth0/handlers/clientGrants.tests.js: ensure scope is not allowed when allow_all_scopes is true
- test/tools/auth0/handlers/clientGrants.tests.js: validate successful creation of client grants with allow_all_scopes
- package.json: bump auth0 from ^5.2.0 to ^5.3.0
- package-lock.json: bump auth0 from 5.2.0 to 5.3.0
@kushalshit27 kushalshit27 force-pushed the DXCDT-1313-app-access-permissions-ga branch from 822a167 to f26f24a Compare January 29, 2026 07:12
@kushalshit27 kushalshit27 marked this pull request as ready for review January 29, 2026 07:12
@kushalshit27 kushalshit27 requested a review from a team as a code owner January 29, 2026 07:12
- package.json: bump auth0 from ^5.2.0 to ^5.3.0
- package-lock.json: bump auth0 from 5.2.0 to 5.3.0
@codecov-commenter
Copy link

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.28%. Comparing base (067f99b) to head (beb4108).

Additional details and impacted files
@@            Coverage Diff             @@
##           master    #1278      +/-   ##
==========================================
+ Coverage   80.26%   80.28%   +0.02%     
==========================================
  Files         146      146              
  Lines        5817     5823       +6     
  Branches     1191     1193       +2     
==========================================
+ Hits         4669     4675       +6     
  Misses        655      655              
  Partials      493      493              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@kushalshit27 kushalshit27 merged commit 0c86dbd into master Jan 29, 2026
6 checks passed
@kushalshit27 kushalshit27 deleted the DXCDT-1313-app-access-permissions-ga branch January 29, 2026 07:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants