fix: managing `Auth0 My Account API` in `resourceServers` #1229

kushalshit27 · 2025-12-10T03:56:13Z

🔧 Changes

This PR fixes an issue where System Resource Servers (such as the "Auth0 My Account API") could not be updated due to read-only fields being included in the payload.

📚 References

https://auth0.com/docs/manage-users/my-account-api

🔬 Testing

Added unit tests to verify:
- getType correctly sanitizes fields for system resource servers.
- update correctly strips name and is_system other restricted fields when updating "Auth0 My Account API".

📝 Checklist

All new/changed/fixed functionality is covered by tests (or N/A)
I have added documentation for all new/changed functionality (or N/A)

- package.json: bump winston to ^3.19.0 - package.json: bump @types/lodash to ^4.17.21 - package.json: bump typescript to ^5.9.3

- src/tools/auth0/handlers/resourceServers.ts: allow updating specific fields for system resource servers - src/tools/auth0/handlers/resourceServers.ts: sanitize fields of resource servers before returning - src/tools/auth0/handlers/resourceServers.ts: add updateResourceServer method to handle name exclusion for system servers

- src/tools/auth0/handlers/resourceServers.ts: removed 'token_lifetime_for_web' TODO - src/tools/auth0/handlers/resourceServers.ts: removed 'allow_offline_access' TODO

- test/tools/auth0/handlers/resourceServers.tests.js: sanitize system resource servers in getType for Auth0 My Account API - test/tools/auth0/handlers/resourceServers.tests.js: update 'Auth0 My Account API' without name and is_system

codecov-commenter · 2025-12-10T04:05:28Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 79.78%. Comparing base (bb95927) to head (81cff91).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1229      +/-   ##
==========================================
+ Coverage   79.71%   79.78%   +0.06%     
==========================================
  Files         137      137              
  Lines        5438     5455      +17     
  Branches     1128     1131       +3     
==========================================
+ Hits         4335     4352      +17     
  Misses        601      601              
  Partials      502      502

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

* chore(deps): bump js-yaml from 4.1.0 to 4.1.1 (#1206) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 4.1.0 to 4.1.1. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@4.1.0...4.1.1) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 4.1.1 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump js-yaml from 3.14.1 to 3.14.2 (#1208) Bumps [js-yaml](https://github.com/nodeca/js-yaml) from 3.14.1 to 3.14.2. - [Changelog](https://github.com/nodeca/js-yaml/blob/master/CHANGELOG.md) - [Commits](nodeca/js-yaml@3.14.1...3.14.2) --- updated-dependencies: - dependency-name: js-yaml dependency-version: 3.14.2 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: updated `session_transfer` schema for `clients` (#1211) * Support for ACUL:GA (#1209) * streamline rendering update payload construction and remove under EA * Add screenRenderers to prompts in context tests * Update logging to check for non-empty list before displaying msg * Remove ACUL from EA_FEATURES array * fix: handle responses when paginating custom domains (#1214) * Update CHANGELOG * 8.20.3 * fix(client.ts): improve getEntity function to handle various response types - Update getEntity to accept ApiResponse or Asset[] as input - Return empty array for empty responses instead of throwing an error - Directly return response if it is an array * feat: Add support for Connection Profiles and Express Configuration on Clients (#1204) * 8.21.0 (#1215) * Update CHANGELOG * 8.21.0 * feat: Exclude Third-Party Clients via `AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS` config property (#1212) * added AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property * add unit test * update processChanges to also apply third party client filter * add comments to client filtering logic --------- Co-authored-by: kushalshit27 <43465488+kushalshit27@users.noreply.github.com> * fix: `cross_origin_auth` is deprecated and migrated to `cross_origin_authentication` (#1223) * fix: added warning for legacy cross_origin_auth and added sanitizeDeprecatedClientFields for handling deprecated field and new field * test: add migration tests for deprecated cross_origin_auth to cross_origin_authentication * fix: rename variable for clarity in sanitizeClientFields function * fix: update client sanitization to handle deprecated cross_origin_auth field * fix: refactor client field sanitization to improve clarity and handle deprecated cross_origin_auth field * fix: specify type for fields in sanitizeClientFields function * fix: rename variable for clarity in sanitizeClientFields function and update handling of deprecated cross_origin_auth field * fix: migrate deprecated cross_origin_auth to cross_origin_authentication in client export * fix: ensure newline at end of file in clients.tests.js * fix: refactor cross_origin_auth sanitization into a dedicated method * fix: improve client field sanitization and handle deprecated cross_origin_auth field * Refactor code structure for improved readability and maintainability * fix: correct spelling of 'sanitized' in client field sanitization methods * fix: update deprecation warning for 'cross_origin_auth' parameter * fix: managing `Auth0 My Account API` in `resourceServers` (#1229) * fix: update dependencies to latest versions - package.json: bump winston to ^3.19.0 - package.json: bump @types/lodash to ^4.17.21 - package.json: bump typescript to ^5.9.3 * feat: enhance resource server handling - src/tools/auth0/handlers/resourceServers.ts: allow updating specific fields for system resource servers - src/tools/auth0/handlers/resourceServers.ts: sanitize fields of resource servers before returning - src/tools/auth0/handlers/resourceServers.ts: add updateResourceServer method to handle name exclusion for system servers * fix: remove from allowedKeys in ResourceServersHandler - src/tools/auth0/handlers/resourceServers.ts: removed 'token_lifetime_for_web' TODO - src/tools/auth0/handlers/resourceServers.ts: removed 'allow_offline_access' TODO * feat(test): add tests for Auth0 My Account API resource server handling - test/tools/auth0/handlers/resourceServers.tests.js: sanitize system resource servers in getType for Auth0 My Account API - test/tools/auth0/handlers/resourceServers.tests.js: update 'Auth0 My Account API' without name and is_system * 8.22.0 (#1230) * Update CHANGELOG * 8.22.0 * fix: improved_signup_bot_detection_in_classic is added in allowed tenant flags (#1231) fix: improved_signup_bot_detection_in_classic flag is added in allowed tenant flags * feat: update dependencies in package.json and package-lock.json - package.json: update auth0 from ^5.1.0 to ^5.2.0 - package.json: update winston from ^3.18.3 to ^3.19.0 - package.json: update @types/lodash from ^4.17.20 to ^4.17.21 - package.json: update @typescript-eslint/eslint-plugin from ^8.47.0 to ^8.49.0 - package.json: update @typescript-eslint/parser from ^8.47.0 to ^8.49.0 * feat: update method names from getAll to list for consistency * feat: update dependencies and improve handlers - package.json: update eslint and typescript-eslint dependencies to latest versions - package-lock.json: update eslint and typescript-eslint dependencies to latest versions - src/tools/auth0/handlers/clientGrants.ts: removed 'scope' from required fields - src/tools/auth0/handlers/connectionProfiles.ts: added update function and refactored processChanges - src/tools/auth0/handlers/emailTemplates.ts: added objString method for email templates - src/tools/auth0/handlers/resourceServers.ts: refactored updateResourceServer to exclude name from updates - src/tools/auth0/handlers/selfServiceProfiles.ts: added objString method for self-service profiles * feat: update Node version in README and remove redundant validation test - README.md: update Node version from 20.18.1 to 20.19.0 - test/tools/auth0/validator.tests.js: remove test for missing 'scope' validation * feat: update connectionProfiles and resourceServers handlers for parameter consistency - test/tools/auth0/handlers/connectionProfiles.tests.js: change update function parameter from params to id - test/tools/auth0/handlers/resourceServers.tests.js: change update function parameter from params to id * add lint check * add lint check * feat: update console warning handling and ESLint rules - src/context/directory/handlers/flowVaultConnections.ts: add console warning for setup key limitations - src/context/yaml/handlers/flowVaultConnections.ts: add console warning for setup key limitations - src/keywordPreservation.ts: add console warning for remote value preservation - eslint.config.js: change no-console rule to warn - src/index.ts: format error logging for better readability - test/tools/auth0/handlers/databases.tests.js: remove redundant console warning tests * E2E updated ---------

kushalshit27 added 4 commits December 9, 2025 13:42

fix: update dependencies to latest versions

17dea23

- package.json: bump winston to ^3.19.0 - package.json: bump @types/lodash to ^4.17.21 - package.json: bump typescript to ^5.9.3

fix: remove from allowedKeys in ResourceServersHandler

70cdd35

- src/tools/auth0/handlers/resourceServers.ts: removed 'token_lifetime_for_web' TODO - src/tools/auth0/handlers/resourceServers.ts: removed 'allow_offline_access' TODO

kushalshit27 changed the title ~~fix: handling of system resourceServers~~ fix: My Account API of system resourceServers Dec 10, 2025

kushalshit27 changed the title ~~fix: My Account API of system resourceServers~~ fix: managing My Account API resourceServers Dec 10, 2025

kushalshit27 changed the title ~~fix: managing My Account API resourceServers~~ fix: managing Auth0 My Account API in resourceServers Dec 10, 2025

kushalshit27 marked this pull request as ready for review December 10, 2025 04:07

kushalshit27 requested a review from a team as a code owner December 10, 2025 04:07

palashgdev approved these changes Dec 10, 2025

View reviewed changes

duedares-rvj approved these changes Dec 10, 2025

View reviewed changes

kushalshit27 merged commit 227e88d into master Dec 10, 2025
5 checks passed

kushalshit27 deleted the DXCDT-1327-fix-my-account-api-resource-servers branch December 10, 2025 05:29

kushalshit27 mentioned this pull request Dec 10, 2025

8.22.0 #1230

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: managing `Auth0 My Account API` in `resourceServers` #1229

fix: managing `Auth0 My Account API` in `resourceServers` #1229

Uh oh!

kushalshit27 commented Dec 10, 2025

Uh oh!

codecov-commenter commented Dec 10, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fix: managing Auth0 My Account API in resourceServers #1229

fix: managing Auth0 My Account API in resourceServers #1229

Uh oh!

Conversation

kushalshit27 commented Dec 10, 2025

🔧 Changes

📚 References

🔬 Testing

📝 Checklist

Uh oh!

codecov-commenter commented Dec 10, 2025

Codecov Report

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

fix: managing `Auth0 My Account API` in `resourceServers` #1229

fix: managing `Auth0 My Account API` in `resourceServers` #1229