AUTH0_IGNORE_DRY_RUN_FIELDS is ignored by the databases and connections handlers

[mbogunovic]

Version

auth0-deploy-cli 8.42.0

What happens

AUTH0_IGNORE_DRY_RUN_FIELDS (added in #1385) has no effect for the databases and connections resource types. Configuring it for either type is silently a no-op, and the spurious dry-run rows it is meant to suppress remain.

These are the two types where it is most needed: databases.enabled_clients is written by the exporter but is not present in the plain connection GET the dry run compares against, so it produces Key [...] found in 'localObj' but not in 'remoteObj' on every single run. That is exactly the case the docs describe the option for:

Useful for suppressing noisy diffs on fields the Management API never returns... so dry-run output focuses on changes you can actually verify

Root cause

default.js reads the config-merged list:

// lib/tools/auth0/handlers/default.js:216 and :249
ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),

databases.js overrides dryRunChanges and passes the raw constructor list instead, so getEffectiveIgnoreDryRunFields() - the only place AUTH0_IGNORE_DRY_RUN_FIELDS is read - is never called:

// lib/tools/auth0/handlers/databases.js:548
ignoreDryRunFields: this.ignoreDryRunFields,

connections.js also overrides dryRunChanges and passes no ignoreDryRunFields at all.

For contrast, rules.js:155 and themes.js:534 override dryRunChanges and correctly call getEffectiveIgnoreDryRunFields(), which is presumably how #1437 ("Resolve spurious dry-run diffs for rules, themes, and hooks") was fixed. databases and connections appear to have been missed.

Reproduction

1. Export a tenant that has a database connection: a0deploy export --format=directory ...
2. Immediately dry-run that same export against the same tenant. Databases reports UPDATE although nothing differs.
3. Add to the config file:

"AUTH0_IGNORE_DRY_RUN_FIELDS": {
  "databases": ["enabled_clients", "disable_self_service_change_password"]
}

4. Dry-run again. The row is unchanged.

The same config shape does work for a type on the default path, e.g. { "clientGrants": ["subject_type"] } suppresses as documented, which isolates the cause to the two overriding handlers rather than to config parsing.

Expected

AUTH0_IGNORE_DRY_RUN_FIELDS is honoured for every handler, including those that override dryRunChanges.

Suggested fix

In databases.js and connections.js, pass this.getEffectiveIgnoreDryRunFields() where the handler currently passes this.ignoreDryRunFields (or nothing), matching rules.js and themes.js.

It may also be worth having dryRunChanges overrides obtain the list from a single accessor so a future handler cannot reintroduce this by forgetting.