feat: add token_vault_privileged_access support for clients

[harshithRai]

🔧 Changes

Adds support for the token_vault_privileged_access property on clients, which hardens a privileged Token Vault worker by restricting the caller IPs, connections, and scopes it may use at runtime.

• clients schema - new token_vault_privileged_access object with two properties:
  • ip_allowlist (array of strings) - IPv4/IPv6 addresses or CIDR ranges permitted to call token exchange on behalf of the client.
  • grants (array of objects) - connection/scope pin objects, each with connection (name) and scopes (array). Max 5 connections; max 20 scopes total (enforced server-side).
• credentials is intentionally excluded - Auth0 returns it as credential references (id), and the Deploy CLI never syncs IDs. Privileged-client credentials are managed directly on the tenant.
• No node-auth0 bump required - the installed SDK (v6.0.0) already ships these types.

Early Access: Enforcement of ip_allowlist and grants is gated by the token_vault_subject_type_jwt_ea_rollout feature flag. When the flag is off, the fields are accepted but not stored or returned.

Example shape

YAML:

clients:
  - name: My Token Vault Privileged App
    app_type: non_interactive
    token_vault_privileged_access:
      ip_allowlist:
        - "192.168.1.0/24"
        - "10.0.0.1"
      grants:
        - connection: google-oauth2
          scopes:
            - "https://www.googleapis.com/auth/calendar.readonly"
        - connection: slack
          scopes:
            - "chat:write"
            - "channels:read"

JSON (directory format):

{
  "name": "My Token Vault Privileged App",
  "app_type": "non_interactive",
  "token_vault_privileged_access": {
    "ip_allowlist": ["192.168.1.0/24", "10.0.0.1"],
    "grants": [
      {
        "connection": "google-oauth2",
        "scopes": ["https://www.googleapis.com/auth/calendar.readonly"]
      },
      {
        "connection": "slack",
        "scopes": ["chat:write", "channels:read"]
      }
    ]
  }
}

🔬 Testing

• Added a unit test in test/tools/auth0/handlers/clients.tests.js verifying token_vault_privileged_access (ip_allowlist + grants) passes through on client create.
• The 5-connection / 20-scope limits and PATCH clear/preserve semantics are enforced server-side and are not duplicated in the CLI schema.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@52b338f). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #1430   +/-   ##
=========================================
  Coverage          ?   80.23%           
=========================================
  Files             ?      163           
  Lines             ?     7534           
  Branches          ?     1663           
=========================================
  Hits              ?     6045           
  Misses            ?      800           
  Partials          ?      689           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.