feat: support third_party_client_access and cross_app_access_resource_app

[harshithRai]

🔧 Changes

Adds support for two new Early Access properties introduced in node-auth0 6.3.0. Bumps the auth0 dependency to ^6.3.0.

1. clients -> my_organization_configuration.third_party_client_access

Controls whether third-party clients can access the organization via the My Organization API. Shape: { default_value, allowed_values } where default_value is block and allowed_values is an array of allow / block.

2. connectionProfiles -> cross_app_access_resource_app

Controls whether organization admins may enable Cross App Access (XAA) on their Identity Providers. Shape: { status: { default_value, allowed_values } } where default_value is enabled / disabled and allowed_values is an array of enabled / disabled.

Both properties are optional and are gated behind tenant feature flags on the Management API side.

YAML examples

clients:
  - name: "My Enterprise App"
    my_organization_configuration:
      allowed_strategies:
        - okta
      connection_deletion_behavior: allow_if_empty
      third_party_client_access:
        default_value: block
        allowed_values:
          - allow
          - block

connectionProfiles:
  - name: "Enterprise SSO Profile"
    enabled_features:
      - scim
    cross_app_access_resource_app:
      status:
        default_value: enabled
        allowed_values:
          - enabled
          - disabled

JSON (directory format) examples

clients/My Enterprise App.json

{
  "name": "My Enterprise App",
  "my_organization_configuration": {
    "allowed_strategies": ["okta"],
    "connection_deletion_behavior": "allow_if_empty",
    "third_party_client_access": {
      "default_value": "block",
      "allowed_values": ["allow", "block"]
    }
  }
}

connection-profiles/Enterprise SSO Profile.json

{
  "name": "Enterprise SSO Profile",
  "enabled_features": ["scim"],
  "cross_app_access_resource_app": {
    "status": {
      "default_value": "enabled",
      "allowed_values": ["enabled", "disabled"]
    }
  }
}

🔬 Testing

• Added unit tests covering AJV schema validation for both new properties (valid payloads pass, missing required sub-fields fail).
• Verified end to end against a live tenant: import correctly serializes and sends both new fields to the Management API. On a tenant without the feature flags enabled, the API returns the expected 403 operation_not_supported responses, confirming the fields reach the API rather than being stripped:
  • third_party_client_access: "The account is not allowed to set third_party_client_access"
  • cross_app_access_resource_app: "The account is not enabled to set cross_app_access_resource_app"
• Full round-trip create + export requires these tenant feature flags: organizations_third_party_client_support, my_orgs_cross_app_access_resource_app, cross_app_access_resource_application_beta.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.52%. Comparing base (7e2f72c) to head (aea5b54).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1471   +/-   ##
=======================================
  Coverage   80.52%   80.52%           
=======================================
  Files         163      163           
  Lines        7754     7755    +1     
  Branches     1728     1728           
=======================================
+ Hits         6244     6245    +1     
  Misses        808      808           
  Partials      702      702           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ankita10119]

third_party_client_access in clients.ts marks both default_value and allowed_values as required, but cross_app_access_resource_app.status here only requires default_value , making allowed_values optional. Is this difference intentional based on what each Management API endpoint actually accepts? If the client API rejects a payload without allowed_values but the connection profile API accepts it, that's fine and worth a comment here. But if both APIs behave the same way, these schemas should be consistent with each other

[harshithRai]

Yes, this is intentional.. matches the node-auth0 SDK types. ClientMyOrganizationThirdPartyClientAccessConfiguration requires both fields, but ConnectionProfileCrossAppAccessResourceAppStatus marks allowed_values optional. So the client API rejects a payload without allowed_values while the connection-profile API accepts it. Added a comment to document it.