Deprecated external paths for actions throwing warnings for relative config paths

[Nanovox]

Checklist

• I have looked into the README and have not found a suitable solution or answer.
• I have looked into the documentation and have not found a suitable solution or answer.
• I have searched the issues and have not found a suitable solution or answer.
• I have upgraded to the latest version of this tool and the issue still persists.
• I have searched the Auth0 Community forums and have not found a suitable solution or answer.
• I agree to the terms within the Auth0 Code of Conduct.

Description

The changes made in #1388 and subsequent warning message in #1392 are throwing warnings for action code mapped to a relative path.

We're using directory format for our configuration and the auth0-deploy-cli to deploy the configuration by executing the following:

a0deploy import --input_file ./tenant/config

We have several actions that are laid out in paths as follows:

• ./tenant/config/actions/action_one.json
• ./tenant/config/actions/action_one/do_action_one.js

The configuration for the action looks like this:

{
   "name": "Action One",
   "code": "actions/action_one/do_action_one.js"
   ...
}

Performing the deploy produces warnings as follows despite the relative paths:

warn: Support for absolute paths and paths outside the config root will be deprecated in a future version to improve the security of the tool. Please update your configuration to use paths relative to the config directory. Current absolute path used: ["tenant/config/actions/action_one/do_add_one.js"]

It seems that the path is being resolved to an external path before being evaluated as a relative config path.

We've tried several things to get this to fall into the non-warned code path, but it seems to behave one of these three ways:

(1) It finds the code file and produce the warning -- action.code set to actions/action_one/do_action_one.js

warn: Support for absolute paths...

(2) It doesn't fine the path and dies -- action.code set to action_one/do_action_one.js

error: Unable to load file /workingdir/tenant/config/action_one/do_action_one.js due to Error: ENOENT: no such file or directory, access '/workingdir/tenant/config/action_one/do_action_one.js'

(3) The action.code is not set yet it throws a 400 error -- code is placed in the exported location actions/Action One/code.js

error: Problem updating actions {"id":"{{some-guid}}","name":"Action One"}
BadRequestError: BadRequestError
Status code: 400
Body: {
"statusCode": 400,
"error": "Bad Request",
"message": "Code is required and must not exceed 100KB."
}

It seems as though the warning is produced regardless of whether a relative or absolute/external path is used for the code path.

Expectation

Warnings are not produced when the action.code path is not absolute or external to the config path as defined by the "--input_file" parameter.

Reproduction

1. Decide a config path for the --input_file, e.g. tenant/config/
2. Define an action json config in the actions/ directory with a friendly name like "Action One"
3. Set the action.code path to one relative to the --input_file parameter, i.e. actions/action_one/do_action_one.js
4. Create an action code file in the expected location as defined by action.code, i.e. tenant/config/actions/action_one/do_action_one.js
5. Run the deploy from the parent to the config: a0deploy import --input_file ./tenant/config
6. Observe the warning, warn: Support for absolute paths... during the deploy

Deploy CLI version

8.41.0

Node version

22.23.1

[harshithRai]

Hi @Nanovox ,
Thank you for reporting this. We have started looking into this and will be back with an update when we have one.

Thanks!