feat: add Cross App Access support to connection and client (EA only)#1658
Open
bkiran6398 wants to merge 6 commits into
Open
feat: add Cross App Access support to connection and client (EA only)#1658bkiran6398 wants to merge 6 commits into
bkiran6398 wants to merge 6 commits into
Conversation
- Move go-auth0 from v1.45.0 to v1.45.1-0.20260723144816-9d11f57d3d2e, which includes the XAA (Cross App Access) SDK types the provider needs. - Replaces the temporary local replace directive used during development, so the module now resolves the SDK from a published commit.
- Add the identity_assertion_authorization_grant nested block to the
auth0_client resource and client data sources, exposing the ID-JAG
exchange used for Cross App Access (XAA, EA only).
- Wire expand/flatten for the block and its required active sub-field.
- Actively remove the block when dropped from config by sending a raw
PATCH {"identity_assertion_authorization_grant": null} via
fetchNullableFields; the attribute is Optional-only (not Computed) so
the removal diff surfaces and the typed omitempty update cannot silently
swallow it.
- Add unit and acceptance tests (create, toggle active, true removal) with
the recorded HTTP cassette, plus regenerated docs.
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your changes status has failed because you have indirect coverage changes. Learn more about Unexpected Coverage Changes and reasons for indirect coverage changes. Additional details and impacted files@@ Coverage Diff @@
## main #1658 +/- ##
==========================================
- Coverage 86.98% 86.57% -0.41%
==========================================
Files 186 193 +7
Lines 27001 28712 +1711
==========================================
+ Hits 23486 24858 +1372
- Misses 2649 2947 +298
- Partials 866 907 +41
🚀 New features to boost your workflow:
|
bkiran6398
changed the title
- Add the cross_app_access_resource_app block so a connection can act as a
Cross App Access (XAA) resource application, with a required status of
enabled or disabled. Kept Optional-only (not Computed) so removing the
block surfaces a diff.
- Actively remove the block on update by sending a raw
PATCH {"cross_app_access_resource_app": null} before the typed update,
since the omitempty field is otherwise dropped from the typed request.
- Add the oidc_metadata option (Optional + Computed) across the oidc, okta,
and samlp option paths, exposing the OIDC discovery document that the
provider never surfaced before. Computed absorbs the server-populated
value from discovery_url without a perpetual diff.
- Wire expand and flatten for both fields and cover create, toggle, and
true removal in acceptance tests plus a flatten unit test.
- Regenerate connection resource and data-source docs.
- Reword the raw-PATCH comment in updateConnection to start with a capital letter, satisfying the godot linter. - Realign the oidc_metadata struct field in optionsSchema so gofmt passes.
bkiran6398
changed the title
- Update github.com/auth0/go-auth0 to v1.45.1-0.20260724090452-213cca328f5c to pick up the latest Cross App Access SDK changes.
bkiran6398
marked this pull request as ready for review
July 24, 2026 10:22
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Adds Cross App Access (XAA) support across
auth0_connectionandauth0_client. XAA lets a connection act as a resource application and lets a client exchange ID-JAGs for access tokens. Early Access (EA) only.auth0_clientidentity_assertion_authorization_grantblock with a requiredactiveboolean, marking whether the client can exchange ID-JAGs (Identity Assertion Authorization Grants) for access tokens.PATCH {"identity_assertion_authorization_grant": null}, so deleting it from config removes it rather than leaving a stale value.auth0_connectioncross_app_access_resource_appblock with a requiredstatusofenabledordisabled, marking the connection as an XAA resource application. Supported onokta,oidc, andsamlpstrategies (the API rejects others).PATCH {"cross_app_access_resource_app": null}.oidc_metadataconnection option (the OIDC discovery document, as a JSON string). This was never exposed by the provider before, for any strategy. It is auto-populated by the API fromdiscovery_urlwhen omitted, or uploaded directly to skip discovery.discovery_urlis now also honoured forsamlpconnections.Both new blocks are
Optional-only (notComputed) so removing them surfaces a diff and the removal call runs.oidc_metadataisOptional + Computedso the server-populated discovery document does not cause a perpetual diff.📚 References
🔬 Testing
cross_app_access_resource_appandidentity_assertion_authorization_grant, plus asamlp+oidc_metadataround-trip. Recorded cassettes prove the raw null PATCH goes out on removal.oidc_metadatamapping to state.📝 Checklist