feat: Exclude Third-Party Clients via AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property

[mgyarmathy]

🔧 Changes

When Dynamic Client Registration (DCR) is enabled on a tenant, it can often have an innumerable amount of third-party clients that don't need to be directly managed through a tool like auth0-deploy-cli.

This PR adds a new AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS config property that enables the CLI to filter out third-party clients using the Client API's is_first_party request parameter.

🔬 Testing

I've added a simple unit test and confirmed this works as expected on my own tenant (which includes third-party clients created via DCR), but would welcome the assistance of this project's maintainers to add E2E test recordings from the deploy-cli-dev or auth0-deploy-cli-e2e tenant to further validate this new feature.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[kushalshit27]

Thank you for submitting this PR! Your contribution is greatly appreciated. We'll review it shortly

[kushalshit27]

Hi, @mgyarmathy

Really appreciate your idea. 👍

The primary use of Deploy CLI is for "Infrastructure as Code." The source of truth is a static local file (YAML/JSON).

Since the dynamic nature of DCR clients, it would be better to use the opposite approach, AUTH0_INCLUDE_THIRD_PARTY_CLIENTS is false (default).

Thanks again, Great work on this PR! Thanks for taking the time to contribute. Let me know if you have any questions. Looking forward to your updates!

[mgyarmathy]

Hi, @mgyarmathy

Really appreciate your idea. 👍

The primary use of Deploy CLI is for "Infrastructure as Code." The source of truth is a static local file (YAML/JSON).

Since the dynamic nature of DCR clients, it would be better to use the opposite approach, AUTH0_INCLUDE_THIRD_PARTY_CLIENTS is false (default).

Thanks again, Great work on this PR! Thanks for taking the time to contribute. Let me know if you have any questions. Looking forward to your updates!

If we implement the opposite behavior, we'd be introducing a breaking change, since currently third-party clients are included by default. Is this the direction you'd like to take this?

[kushalshit27]

Agree, this is a good candidate for v9.X.X. For v8 AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS looks safe to me also.

[kushalshit27]

Hi, @mgyarmathy,
The proposed changes look great.

I’ll take care of the failing CI check [ci/circleci: E2E tests as Node module]

[kushalshit27]

Hi, @mgyarmathy,
To merge the PR, all commits need to be signed. seems one of your commits is not signed. Can you please update that?

[mgyarmathy]

Hi, @mgyarmathy, To merge the PR, all commits need to be signed. seems one of your commits is not signed. Can you please update that?

@kushalshit27 apologies -- I've signed all of the commits. Can you re-add the new e2e recordings before merging?

[kushalshit27]

Sure 👍