feat: Exclude Third-Party Clients via `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` config property by mgyarmathy · Pull Request #1212 · auth0/auth0-deploy-cli

mgyarmathy · 2025-11-19T17:50:35Z

🔧 Changes

When Dynamic Client Registration (DCR) is enabled on a tenant, it can often have an innumerable amount of third-party clients that don't need to be directly managed through a tool like auth0-deploy-cli.

This PR adds a new AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property that enables the CLI to filter out third-party clients using the Client API's is_first_party request parameter.

🔬 Testing

I've added a simple unit test and confirmed this works as expected on my own tenant (which includes third-party clients created via DCR), but would welcome the assistance of this project's maintainers to add E2E test recordings from the deploy-cli-dev or auth0-deploy-cli-e2e tenant to further validate this new feature.

📝 Checklist

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

kushalshit27 · 2025-11-20T04:14:17Z

Thank you for submitting this PR! Your contribution is greatly appreciated. We'll review it shortly

kushalshit27 · 2025-11-24T04:51:56Z

Hi, @mgyarmathy

Really appreciate your idea. 👍

The primary use of Deploy CLI is for "Infrastructure as Code." The source of truth is a static local file (YAML/JSON).

Since the dynamic nature of DCR clients, it would be better to use the opposite approach, AUTH0_INCLUDE_THIRD_PARTY_CLIENTS is false (default).

Thanks again, Great work on this PR! Thanks for taking the time to contribute. Let me know if you have any questions. Looking forward to your updates!

mgyarmathy · 2025-11-24T19:50:29Z

Hi, @mgyarmathy

Really appreciate your idea. 👍

The primary use of Deploy CLI is for "Infrastructure as Code." The source of truth is a static local file (YAML/JSON).

Since the dynamic nature of DCR clients, it would be better to use the opposite approach, AUTH0_INCLUDE_THIRD_PARTY_CLIENTS is false (default).

Thanks again, Great work on this PR! Thanks for taking the time to contribute. Let me know if you have any questions. Looking forward to your updates!

If we implement the opposite behavior, we'd be introducing a breaking change, since currently third-party clients are included by default. Is this the direction you'd like to take this?

kushalshit27 · 2025-11-25T05:07:48Z

Agree, this is a good candidate for v9.X.X. For v8 AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS looks safe to me also.

src/tools/auth0/handlers/clients.ts

kushalshit27 · 2025-12-02T07:15:55Z

Hi, @mgyarmathy,
The proposed changes look great.

I’ll take care of the failing CI check [ci/circleci: E2E tests as Node module]

kushalshit27 · 2025-12-02T09:18:49Z

Hi, @mgyarmathy,
To merge the PR, all commits need to be signed. seems one of your commits is not signed. Can you please update that?

mgyarmathy · 2025-12-02T21:35:41Z

Hi, @mgyarmathy, To merge the PR, all commits need to be signed. seems one of your commits is not signed. Can you please update that?

@kushalshit27 apologies -- I've signed all of the commits. Can you re-add the new e2e recordings before merging?

kushalshit27 · 2025-12-03T03:56:24Z

Sure 👍

kushalshit27 · 2025-12-04T04:28:34Z

Hi, @mgyarmathy
Merged! Your changes will be in the next release—thanks for making the project better! 🤝

mgyarmathy · 2025-12-05T15:51:23Z

Hi, @mgyarmathy Merged! Your changes will be in the next release—thanks for making the project better! 🤝

Much appreciated!

* chore(deps): bump js-yaml from 4.1.0 to 4.1.1 (#1206) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump js-yaml from 3.14.1 to 3.14.2 (#1208) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.14.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: updated `session_transfer` schema for `clients` (#1211) * Support for ACUL:GA (#1209) * streamline rendering update payload construction and remove under EA * Add screenRenderers to prompts in context tests * Update logging to check for non-empty list before displaying msg * Remove ACUL from EA_FEATURES array * fix: handle responses when paginating custom domains (#1214) * Update CHANGELOG * 8.20.3 * fix(client.ts): improve getEntity function to handle various response types - Update getEntity to accept ApiResponse or Asset[] as input - Return empty array for empty responses instead of throwing an error - Directly return response if it is an array * feat: Add support for Connection Profiles and Express Configuration on Clients (#1204) * 8.21.0 (#1215) * Update CHANGELOG * 8.21.0 * feat: Exclude Third-Party Clients via `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` config property (#1212) * added AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property * add unit test * update processChanges to also apply third party client filter * add comments to client filtering logic --------- Co-authored-by: kushalshit27 <43465488+kushalshit27@users.noreply.github.com> * fix: `cross_origin_auth` is deprecated and migrated to `cross_origin_authentication` (#1223) * fix: added warning for legacy cross_origin_auth and added sanitizeDeprecatedClientFields for handling deprecated field and new field * test: add migration tests for deprecated cross_origin_auth to cross_origin_authentication * fix: rename variable for clarity in sanitizeClientFields function * fix: update client sanitization to handle deprecated cross_origin_auth field * fix: refactor client field sanitization to improve clarity and handle deprecated cross_origin_auth field * fix: specify type for fields in sanitizeClientFields function * fix: rename variable for clarity in sanitizeClientFields function and update handling of deprecated cross_origin_auth field * fix: migrate deprecated cross_origin_auth to cross_origin_authentication in client export * fix: ensure newline at end of file in clients.tests.js * fix: refactor cross_origin_auth sanitization into a dedicated method * fix: improve client field sanitization and handle deprecated cross_origin_auth field * Refactor code structure for improved readability and maintainability * fix: correct spelling of 'sanitized' in client field sanitization methods * fix: update deprecation warning for 'cross_origin_auth' parameter * fix: managing `Auth0 My Account API` in `resourceServers` (#1229) * fix: update dependencies to latest versions - package.json: bump winston to ^3.19.0 - package.json: bump @types/lodash to ^4.17.21 - package.json: bump typescript to ^5.9.3 * feat: enhance resource server handling - src/tools/auth0/handlers/resourceServers.ts: allow updating specific fields for system resource servers - src/tools/auth0/handlers/resourceServers.ts: sanitize fields of resource servers before returning - src/tools/auth0/handlers/resourceServers.ts: add updateResourceServer method to handle name exclusion for system servers * fix: remove from allowedKeys in ResourceServersHandler - src/tools/auth0/handlers/resourceServers.ts: removed 'token_lifetime_for_web' TODO - src/tools/auth0/handlers/resourceServers.ts: removed 'allow_offline_access' TODO * feat(test): add tests for Auth0 My Account API resource server handling - test/tools/auth0/handlers/resourceServers.tests.js: sanitize system resource servers in getType for Auth0 My Account API - test/tools/auth0/handlers/resourceServers.tests.js: update 'Auth0 My Account API' without name and is_system * 8.22.0 (#1230) * Update CHANGELOG * 8.22.0 * fix: improved_signup_bot_detection_in_classic is added in allowed tenant flags (#1231) fix: improved_signup_bot_detection_in_classic flag is added in allowed tenant flags * feat: update dependencies in package.json and package-lock.json - package.json: update auth0 from ^5.1.0 to ^5.2.0 - package.json: update winston from ^3.18.3 to ^3.19.0 - package.json: update @types/lodash from ^4.17.20 to ^4.17.21 - package.json: update @typescript-eslint/eslint-plugin from ^8.47.0 to ^8.49.0 - package.json: update @typescript-eslint/parser from ^8.47.0 to ^8.49.0 * feat: update method names from getAll to list for consistency * feat: update dependencies and improve handlers - package.json: update eslint and typescript-eslint dependencies to latest versions - package-lock.json: update eslint and typescript-eslint dependencies to latest versions - src/tools/auth0/handlers/clientGrants.ts: removed 'scope' from required fields - src/tools/auth0/handlers/connectionProfiles.ts: added update function and refactored processChanges - src/tools/auth0/handlers/emailTemplates.ts: added objString method for email templates - src/tools/auth0/handlers/resourceServers.ts: refactored updateResourceServer to exclude name from updates - src/tools/auth0/handlers/selfServiceProfiles.ts: added objString method for self-service profiles * feat: update Node version in README and remove redundant validation test - README.md: update Node version from 20.18.1 to 20.19.0 - test/tools/auth0/validator.tests.js: remove test for missing 'scope' validation * feat: update connectionProfiles and resourceServers handlers for parameter consistency - test/tools/auth0/handlers/connectionProfiles.tests.js: change update function parameter from params to id - test/tools/auth0/handlers/resourceServers.tests.js: change update function parameter from params to id * add lint check * add lint check * feat: update console warning handling and ESLint rules - src/context/directory/handlers/flowVaultConnections.ts: add console warning for setup key limitations - src/context/yaml/handlers/flowVaultConnections.ts: add console warning for setup key limitations - src/keywordPreservation.ts: add console warning for remote value preservation - eslint.config.js: change no-console rule to warn - src/index.ts: format error logging for better readability - test/tools/auth0/handlers/databases.tests.js: remove redundant console warning tests * E2E updated ---------

mgyarmathy requested a review from a team as a code owner November 19, 2025 17:50

kushalshit27 reviewed Nov 25, 2025

View reviewed changes

src/tools/auth0/handlers/clients.ts Show resolved Hide resolved

kushalshit27 reviewed Dec 2, 2025

View reviewed changes

src/tools/auth0/handlers/clients.ts Show resolved Hide resolved

kushalshit27 previously approved these changes Dec 2, 2025

View reviewed changes

tanya732 previously approved these changes Dec 2, 2025

View reviewed changes

kushalshit27 self-requested a review December 2, 2025 12:51

mgyarmathy force-pushed the exclude-third-party-clients branch from 468df88 to a24f6a9 Compare December 2, 2025 16:28

mgyarmathy dismissed stale reviews from kushalshit27 and tanya732 via ba50fbe December 2, 2025 16:42

mgyarmathy force-pushed the exclude-third-party-clients branch 5 times, most recently from 4191f94 to c565e20 Compare December 2, 2025 21:28

mgyarmathy and others added 4 commits December 2, 2025 15:33

added AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property

f24a4aa

add unit test

14b3318

update processChanges to also apply third party client filter

5a90855

add comments to client filtering logic

2fda27b

mgyarmathy force-pushed the exclude-third-party-clients branch from c565e20 to 2fda27b Compare December 2, 2025 21:34

kushalshit27 approved these changes Dec 3, 2025

View reviewed changes

kushalshit27 merged commit a5e623b into auth0:master Dec 4, 2025
4 of 5 checks passed

mgyarmathy deleted the exclude-third-party-clients branch December 5, 2025 15:51

mgyarmathy mentioned this pull request Dec 5, 2025

Exclude third-party clients by default; supersede AUTH0_EXCLUDE_THIRD__PARTY_CLIENTS with AUTH0_INCLUDE_THIRD_PARTY_CLIENTS configuration option #1225

Draft

2 tasks

kushalshit27 mentioned this pull request Dec 10, 2025

8.22.0 #1230

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Exclude Third-Party Clients via `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` config property#1212

feat: Exclude Third-Party Clients via `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` config property#1212
kushalshit27 merged 4 commits intoauth0:masterfrom
mgyarmathy:exclude-third-party-clients

mgyarmathy commented Nov 19, 2025

Uh oh!

kushalshit27 commented Nov 20, 2025

Uh oh!

kushalshit27 commented Nov 24, 2025

Uh oh!

mgyarmathy commented Nov 24, 2025

Uh oh!

kushalshit27 commented Nov 25, 2025

Uh oh!

Uh oh!

Uh oh!

kushalshit27 commented Dec 2, 2025 •

edited

Loading

Uh oh!

kushalshit27 commented Dec 2, 2025

Uh oh!

mgyarmathy commented Dec 2, 2025

Uh oh!

kushalshit27 commented Dec 3, 2025

Uh oh!

Uh oh!

kushalshit27 commented Dec 4, 2025

Uh oh!

mgyarmathy commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

mgyarmathy commented Nov 19, 2025

🔧 Changes

🔬 Testing

📝 Checklist

Uh oh!

kushalshit27 commented Nov 20, 2025

Uh oh!

kushalshit27 commented Nov 24, 2025

Uh oh!

mgyarmathy commented Nov 24, 2025

Uh oh!

kushalshit27 commented Nov 25, 2025

Uh oh!

Uh oh!

Uh oh!

kushalshit27 commented Dec 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kushalshit27 commented Dec 2, 2025

Uh oh!

mgyarmathy commented Dec 2, 2025

Uh oh!

kushalshit27 commented Dec 3, 2025

Uh oh!

Uh oh!

kushalshit27 commented Dec 4, 2025

Uh oh!

mgyarmathy commented Dec 5, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

kushalshit27 commented Dec 2, 2025 •

edited

Loading