[ankita10119]

🔧 Changes

require_consent_non_repudiation is configured on customer resource servers (the APIs that rich authorization requests are made for). The system Auth0 My Account API resource server does not accept it: the Management API returns 400 Additional properties not allowed. This PR aligns deploy-cli with that behaviour.

• src/tools/auth0/handlers/resourceServers.ts
  • Removed require_consent_non_repudiation from the system resource server export allowlist (sanitizeResourceServersFields) and update payload (updateResourceServer).
  • Added stripSystemResourceServerFields. When a config sets the field on a system resource server (e.g. copied from the feat: support consent non-repudiation fields on resource server and client models #1508 example), it logs a warning and drops the field. It runs before both the real import (processChanges) and the dry-run comparison (dryRunChanges), so the dry run no longer reports a permanent UPDATE. ignoreDryRunFields wasn't used because it applies to every resource server and would hide real changes on custom APIs.
  • The field stays in the resource server schema, so custom resource servers are unchanged.
• docs/resource-specific-documentation.md: the require_consent_non_repudiation section now shows the field on a customer API, with a note that the Auth0 My Account API does not currently accept it.
• Examples: moved the field from the Auth0 My Account API to My API in examples/yaml/tenant.yaml and examples/directory/resource-servers/.

API shape (EA)

Verified on a tenant with my_account_consents / consent_non_repudiation enabled and with them disabled:

• GET /api/v2/resource-servers omits require_consent_non_repudiation unless it has been set on that resource server, so export only writes it for APIs where it was configured.
  • Once set, it is returned, including false.
  • It is still returned after the entitlement is removed.
• Without the entitlement, create and update with the field return 400 Additional properties not allowed, even with false.
  • So a config exported from a resource server where the field was set can't be re-imported to a non-entitled tenant until the field is removed.
  • This is expected for an entitlement-gated field.

📚 References

• Follow-up to feat: support consent non-repudiation fields on resource server and client models #1508

🔬 Testing

Unit tests (npm test, full suite passing):

• resourceServers.tests.js
  • Auth0 My Account API
    • require_consent_non_repudiation is not kept on export and not sent in the update payload.
    • A warning is logged.
    • Dry-run reports no UPDATE.
  • Custom resource server
    • require_consent_non_repudiation is sent on create and update.
    • Dry-run still reports the UPDATE, with no warning.

Manual verification, with the entitlement enabled:

• ✅ Custom resource server
  • YAML import with true.
  • YAML and directory export both return true.
  • Directory import with false, value confirmed via the Management API.
• ✅ Auth0 My Account API with the field set
  • Import succeeds with a warning, the field is omitted and other settings are unchanged. Previously this returned 400.
  • Dry-run shows the warning and no UPDATE.

Manual verification, with the entitlement disabled:

• ✅ Custom resource server
  • Create and update with the field return 400 and the import fails with a clear error.
  • Import without the field succeeds.
• ✅ Auth0 My Account API with the field set: import succeeds with the warning.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.58%. Comparing base (3a35d05) to head (f2a2939).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1533      +/-   ##
==========================================
+ Coverage   82.54%   82.58%   +0.03%     
==========================================
  Files         193      193              
  Lines        9289     9301      +12     
  Branches     2059     2061       +2     
==========================================
+ Hits         7668     7681      +13     
  Misses        819      819              
+ Partials      802      801       -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[harshithRai]

Since this field is entitlement-gated, could you add a note to the PR description on the API shape this relies on? Specifically: does the resource server list endpoint return require_consent_non_repudiation for custom APIs (and as false or omitted when unset)? If it returns false on every API, export would write it into every custom API file, and re-importing to a tenant without my_account_consents would then 400.
Thanks!

[harshithRai]

Minor: a config that still has require_consent_non_repudiation: true on Auth0 My Account API (e.g. copied from the #1508 example) is now dropped silently on import. The dry-run also reports a permanent UPDATE for it, because the remote side no longer carries the field (debug log: found in 'localObj' but not in 'remoteObj'). Could you add a log.warn when a system resource server config includes this field, and ideally ignore it in the dry-run comparison so it doesn't show a false UPDATE?

[ankita10119]

Good catch, thanks! Reproduced the dry-run UPDATE. The field is now stripped from system resource servers with a log.warn before both the dry-run comparison and the real import, so there's no false UPDATE. I didn't use ignoreDryRunFields, because it applies to every resource server and would also hide real changes on custom APIs. Added tests for the warning, the dry-run result, and the custom-API case.

[harshithRai]

LGTM(pending merge conflicts)