feat: add M2M client syncer (NHI APP_REGISTRATION) - #54
feat: add M2M client syncer (NHI APP_REGISTRATION)#54c1-squire-dev[bot] wants to merge 3 commits into
Conversation
Connector PR Review: feat: add M2M client syncer (NHI APP_REGISTRATION)Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Review SummaryThe new commit adds Security IssuesNone found. Correctness IssuesNone found. SuggestionsNone. |
Adds a new `client` resource-type syncer for Auth0 machine-to-machine (M2M) clients/applications (NHI Phase-1 Class-B, RFC §5.8.7 / §6 row 13). The connector previously synced no `client`/application resource type. - New `clientBuilder` + `clientResourceType` (TRAIT_APP), read-only paginated List over `GET /api/v2/clients`, filtered server-side to `app_type=non_interactive` with a `client_credentials` grant-type fallback. - Emits `WithNHIType(NHI_TYPE_APP_REGISTRATION, "auth0.m2m_client")` (axis-2 dotted-lowercase detail per RFC §2.8). - Bumps baton-sdk v0.10.0 -> v0.11.0 (provides the NHI trait + builder) and re-vendors. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
5ede052 to
47dedfb
Compare
Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| | Accounts | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | | | ||
| | Roles | <Icon icon="square-check" iconType="solid" color="#c937ae"/>\* | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | | ||
| | Organizations | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | | ||
| | M2M Clients | <Icon icon="square-check" iconType="solid" color="#c937ae"/> | | |
There was a problem hiding this comment.
🟡 Suggestion: The capabilities table now lists M2M Clients (addressing the previous review feedback), but the read:clients scope is still missing from both the READ and READ/WRITE permission lists later in this file (around lines 48-55 and 57-66). The new GET /api/v2/clients endpoint requires this scope — existing installs upgrading will need to add it. Please add read:clients to both permission lists.
The M2M client syncer calls GET /api/v2/clients, which requires the read:clients scope. Adds it to both the READ and READ/WRITE permission lists. Addresses review finding D3. Co-authored-by: c1-squire-dev[bot] <c1-squire-dev[bot]@users.noreply.github.com>
|
Addressed review finding D3: added |
1 participant
Summary
Adds a new
clientresource-type syncer for Auth0 machine-to-machine (M2M) clients/applications, emitting the new non-human-identity (NHI) spine valueNHI_TYPE_APP_REGISTRATION.This is NHI Phase-1, Class-B (new-syncer) work for Auth0 — see RFC v6 §5.8.7 and §6 row 13. The connector previously registered no
client/application resource type at all (resource_types.go), so M2M clients were invisible. M2M clients hold their own credentials & scopes → K3 /APP_REGISTRATION.What changed
clientResourceType(client,TRAIT_APP, skips entitlements/grants) —pkg/connector/resource_types.go.clientBuilderwith a read-only paginatedList—pkg/connector/clients.go. Registered inResourceSyncers(pkg/connector/connector.go).GetClientsoverGET /api/v2/clients—pkg/client/auth0.go(+Application/ClientsResponsemodels,apiPathGetClients).WithNHIType(NHI_TYPE_APP_REGISTRATION, "auth0.m2m_client")(axis-2 dotted-lowercase detail per RFC §2.8).baton-sdkv0.10.0 → v0.11.0 (provides the NHI trait +WithNHITypebuilder); re-vendored.pkg/connector/clients_test.gocovers the M2M discriminator and NHI emission.M2M discriminator (enumerability scope-guard)
GET /api/v2/clientsenumerates all tenant clients (Auth0 docs) and supports a server-sideapp_typefilter. We requestapp_type=non_interactive(the canonical Auth0 marker for M2M) and defensively re-check each result in code, accepting aclient_credentialsgrant type as a fallback signal. User-facing app types (spa,native,regular_web) are excluded. Scope-guard passes — enumeration is feasible and filtered.Verification
go build ./...✅go test ./...✅ (new + existing pass)golangci-lint run ./...✅ 0 issuesNotes / divergence from RFC
pkg/connector/auth0/auth0.go; the real connector path is flat (pkg/connector/connector.go). Wired there.WithNHISubtype; the real v0.11.0 API isWithNHIType(NonHumanIdentityTrait_NhiType, detail)— used the real symbol.🤖 Generated with Claude Code