feat: add Auth0 emulator

Author: mvanhorn

README.md

@@ -141,7 +141,7 @@ afterAll(() => Promise.all([github.close(), vercel.close()]))
 
 | Option | Default | Description |
 |--------|---------|-------------|
-| `service` | *(required)* | Service name: `'vercel'`, `'github'`, `'google'`, `'slack'`, `'apple'`, `'microsoft'`, or `'aws'` |
+| `service` | *(required)* | Service name: `'vercel'`, `'github'`, `'google'`, `'slack'`, `'apple'`, `'microsoft'`, `'aws'`, or `'auth0'` |
 | `port` | `4000` | Port for the HTTP server |
 | `seed` | none | Inline seed data (same shape as YAML config) |
 | `baseUrl` | none | Override advertised base URL. Per-service `baseUrl` in seed config takes highest priority, then this option, then `EMULATE_BASE_URL` env var (supports `{service}`), then `PORTLESS_URL` (supports `{service}`, automatically set by the `portless` CLI wrapper), then `http://localhost:<port>`. |
@@ -299,6 +299,24 @@ aws:
     roles:
       - role_name: lambda-execution-role
         description: Role for Lambda function execution
+
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types: [authorization_code, refresh_token, client_credentials]
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
 ```
 
 ## OAuth & Integrations
@@ -399,6 +417,25 @@ microsoft:
         - "http://localhost:3000/api/auth/callback/microsoft-entra-id"
 ```
 
+### Auth0 Applications
+
+```yaml
+auth0:
+  tenant: "my-tenant"
+  applications:
+    - client_id: "my-app"
+      client_secret: "secret"
+      callbacks:
+        - "http://localhost:3000/api/auth/callback"
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  apis:
+    - audience: "https://api.example.test/"
+      name: "Example API"
+```
+
 ## Vercel API
 
 Every endpoint below is fully stateful with Vercel-style JSON responses and cursor-based pagination.
@@ -690,6 +727,22 @@ All operations via `POST /iam/` with `Action` parameter:
 All operations via `POST /sts/` with `Action` parameter:
 - `GetCallerIdentity`, `AssumeRole`
 
+## Auth0 API
+
+Auth0 identity provider emulation with tenant-aware OIDC discovery, Universal Login pages, PKCE, refresh token rotation, Userinfo, and Management API resources.
+
+- `GET /.well-known/openid-configuration` - OIDC discovery document
+- `GET /.well-known/jwks.json` - JSON Web Key Set (JWKS)
+- `GET /authorize` - authorization endpoint (shows Universal Login)
+- `POST /oauth/token` - token exchange (authorization code, refresh token, client credentials)
+- `GET /userinfo` - OpenID Connect user info
+- `GET /v2/logout` - logout
+- `GET /api/v2/users` / `POST /api/v2/users` - list and create users
+- `GET /api/v2/roles` / `POST /api/v2/roles` - list and create roles
+- `GET /api/v2/applications` / `POST /api/v2/applications` - list and create applications
+- `GET /api/v2/organizations` / `POST /api/v2/organizations` - list and create organizations
+- `GET /api/v2/connections` / `POST /api/v2/connections` - list and create connections
+
 ## Next.js Integration
 
 Embed emulators directly in your Next.js app so they run on the same origin. This solves the Vercel preview deployment problem where OAuth callback URLs change with every deployment.

apps/web/app/docs/architecture/page.mdx

@@ -17,6 +17,7 @@ packages/
     mongoatlas/     # MongoDB Atlas Admin API + Data API
     resend/         # Resend email API
     stripe/         # Stripe billing and payments API
+    auth0/          # Auth0 identity provider / OIDC
 apps/
   web/              # Documentation site (Next.js)
 ```

apps/web/app/docs/auth0/layout.tsx

@@ -0,0 +1,7 @@
+import { pageMetadata } from "@/lib/page-metadata";
+
+export const metadata = pageMetadata("auth0");
+
+export default function Layout({ children }: { children: React.ReactNode }) {
+  return children;
+}

apps/web/app/docs/auth0/page.mdx

@@ -0,0 +1,85 @@
+# Auth0
+
+Auth0 identity provider emulation with OAuth 2.0 / OIDC, Universal Login pages, refresh token rotation, Userinfo, and Management API resources for users, roles, applications, organizations, and connections.
+
+## OAuth / OIDC
+
+- `GET /.well-known/openid-configuration` — OIDC discovery
+- `GET /.well-known/jwks.json` — JSON Web Key Set
+- `GET /authorize` — authorization endpoint
+- `GET /u/login` — Universal Login page
+- `POST /oauth/token` — token endpoint
+- `GET /userinfo` — user info
+- `GET /v2/logout` — logout
+
+Authorization Code with PKCE is supported with both `plain` and `S256` code challenge methods. The token endpoint supports `authorization_code`, `refresh_token`, and `client_credentials`.
+
+## Tenant URLs
+
+Auth0 advertises tenant-aware URLs. With this config:
+
+```yaml
+auth0:
+  tenant: my-tenant
+```
+
+Discovery returns endpoints under:
+
+```text
+http://my-tenant.auth0.localhost:4012
+```
+
+For test environments that cannot route subdomains, call discovery with a tenant query parameter:
+
+```bash
+curl "http://localhost:4012/.well-known/openid-configuration?tenant=my-tenant"
+```
+
+The returned endpoints include the same `tenant` parameter.
+
+## Management API
+
+- `GET /api/v2/users` — list users
+- `POST /api/v2/users` — create user
+- `GET /api/v2/users/:id` — get user
+- `PATCH /api/v2/users/:id` — update user
+- `DELETE /api/v2/users/:id` — delete user
+- `GET /api/v2/users/:id/roles` — list user roles
+- `POST /api/v2/users/:id/roles` — assign roles
+- `GET /api/v2/roles` — list roles
+- `POST /api/v2/roles` — create role
+- `GET /api/v2/applications` — list applications
+- `POST /api/v2/applications` — create application
+- `GET /api/v2/organizations` — list organizations
+- `POST /api/v2/organizations` — create organization
+- `GET /api/v2/connections` — list connections
+- `POST /api/v2/connections` — create connection
+
+## Seed Config
+
+```yaml
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      name: My App
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
+  apis:
+    - audience: https://api.example.test/
+      name: Example API
+```

apps/web/app/docs/configuration/page.mdx

@@ -327,6 +327,34 @@ mongoatlas:
       username: app-user
 ```
 
+## Auth0 Seed Config
+
+```yaml
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
+  apis:
+    - audience: https://api.example.test/
+      name: Example API
+```
+
 ## Resend Seed Config
 
 ```yaml

apps/web/app/docs/page.mdx

@@ -1,6 +1,6 @@
 # Getting Started
 
-Local drop-in replacement for Vercel, GitHub, Google, Slack, Apple, Microsoft, AWS, Okta, MongoDB Atlas, Resend, and Stripe APIs. Built for CI and no-network sandboxes. Fully stateful, production-fidelity API emulation. Not mocks.
+Local drop-in replacement for Vercel, GitHub, Google, Slack, Apple, Microsoft, AWS, Okta, MongoDB Atlas, Resend, Stripe, and Auth0 APIs. Built for CI and no-network sandboxes. Fully stateful, production-fidelity API emulation. Not mocks.
 
 ## Quick Start
 
@@ -21,6 +21,7 @@ All services start with sensible defaults. No config file needed:
 - **MongoDB Atlas** on `http://localhost:4008`
 - **Resend** on `http://localhost:4009`
 - **Stripe** on `http://localhost:4010`
+- **Auth0** on `http://localhost:4012`
 
 ## CLI
 

apps/web/app/docs/programmatic-api/page.mdx

@@ -59,7 +59,7 @@ afterAll(() => Promise.all([github.close(), vercel.close()]))
     <tr>
       <td><code>service</code></td>
       <td><em>(required)</em></td>
-      <td>Service name: <code>'vercel'</code>, <code>'github'</code>, <code>'google'</code>, <code>'slack'</code>, <code>'apple'</code>, <code>'microsoft'</code>, <code>'aws'</code>, <code>'okta'</code>, <code>'mongoatlas'</code>, <code>'resend'</code>, or <code>'stripe'</code></td>
+      <td>Service name: <code>'vercel'</code>, <code>'github'</code>, <code>'google'</code>, <code>'slack'</code>, <code>'apple'</code>, <code>'microsoft'</code>, <code>'aws'</code>, <code>'okta'</code>, <code>'mongoatlas'</code>, <code>'resend'</code>, <code>'stripe'</code>, or <code>'auth0'</code></td>
     </tr>
     <tr>
       <td><code>port</code></td>
@@ -133,6 +133,7 @@ npm install @emulators/github @emulators/google @emulators/stripe
     <tr><td><code>@emulators/mongoatlas</code></td><td>MongoDB Atlas Admin API + Data API</td></tr>
     <tr><td><code>@emulators/resend</code></td><td>Resend email API</td></tr>
     <tr><td><code>@emulators/stripe</code></td><td>Stripe billing and payments API</td></tr>
+    <tr><td><code>@emulators/auth0</code></td><td>Auth0 identity provider / OIDC</td></tr>
     <tr><td><code>@emulators/core</code></td><td>Shared store, middleware, and utilities</td></tr>
     <tr><td><code>@emulators/adapter-next</code></td><td>Next.js App Router integration</td></tr>
   </tbody>

apps/web/lib/docs-navigation.ts

@@ -17,6 +17,7 @@ export const allDocsPages: NavItem[] = [
   { name: "AWS", href: "/docs/aws" },
   { name: "Okta", href: "/docs/okta" },
   { name: "MongoDB Atlas", href: "/docs/mongoatlas" },
+  { name: "Auth0", href: "/docs/auth0" },
   { name: "Resend", href: "/docs/resend" },
   { name: "Stripe", href: "/docs/stripe" },
   { name: "Authentication", href: "/docs/authentication" },

apps/web/lib/page-titles.ts

@@ -12,6 +12,7 @@ export const PAGE_TITLES: Record<string, string> = {
   aws: "AWS",
   okta: "Okta",
   mongoatlas: "MongoDB Atlas",
+  auth0: "Auth0",
   resend: "Resend",
   stripe: "Stripe",
   authentication: "Authentication",

emulate.config.example.yaml

@@ -128,3 +128,27 @@ google:
       mime_type: application/vnd.google-apps.folder
       parent_ids:
         - root
+
+auth0:
+  tenant: my-tenant
+  applications:
+    - client_id: my-app
+      client_secret: secret
+      callbacks:
+        - http://localhost:3000/api/auth/callback
+      grant_types:
+        - authorization_code
+        - refresh_token
+        - client_credentials
+  users:
+    - email: dev@example.com
+      name: Developer
+      password: pass
+  roles:
+    - name: admin
+  connections:
+    - name: Username-Password-Authentication
+      strategy: auth0
+  apis:
+    - audience: https://api.example.test/
+      name: Example API