feat: add Cross App Access (XAA) resource app support for connections and clients

[harshithRai]

🔧 Changes

Adds Deploy CLI support for the XAA (Cross App Access) - "Auth0 as Resource Application Authorization Server" EA feature, covering the new Management API properties on connections and clients:

• Connections - new top-level cross_app_access_resource_app object (src/tools/auth0/handlers/connections.ts):
  • cross_app_access_resource_app.status: "enabled" | "disabled" - enables the connection as a Cross App Access Resource Application.
• Clients - new top-level identity_assertion_authorization_grant object (src/tools/auth0/handlers/clients.ts):
  • identity_assertion_authorization_grant.active: boolean - enables ID-JAG token exchange for the client.
• SAML connections - options.discovery_url (string) and options.oidc_metadata (object), previously only meaningful for OIDC, are now accepted for strategy: samlp connections. No schema change was required: connectionOptionsSchema already allows additional properties and these fields are not strategy-restricted; a test was added to lock in the behavior.

Both new properties are additive and pass through to the Management API on create/update and round-trip back on export.

Shape

New optional fields; both YAML and directory (JSON) formats supported.

Connection: cross_app_access_resource_app (optional)

YAML (connections in tenant.yaml):

connections:
  - name: enterprise-saml
    strategy: samlp
    cross_app_access_resource_app:
      status: enabled   # "enabled" | "disabled"

JSON (connections/enterprise-saml.json):

{
  "name": "enterprise-saml",
  "strategy": "samlp",
  "cross_app_access_resource_app": {
    "status": "enabled"
  }
}

Client: identity_assertion_authorization_grant (optional)

YAML (clients in tenant.yaml):

clients:
  - name: My XAA Client
    identity_assertion_authorization_grant:
      active: true

JSON (clients/My XAA Client.json):

{
  "name": "My XAA Client",
  "identity_assertion_authorization_grant": {
    "active": true
  }
}

SAML connection options: strategy: samlp now also accepts (previously OIDC-only)

YAML:

options:
  discovery_url: https://idp.example.com/.well-known/openid-configuration
  oidc_metadata:
    issuer: https://idp.example.com

JSON:

"options": {
  "discovery_url": "https://idp.example.com/.well-known/openid-configuration",
  "oidc_metadata": {
    "issuer": "https://idp.example.com"
  }
}

🔬 Testing

Unit tests

• test/tools/auth0/handlers/connections.tests.js: added tests for cross_app_access_resource_app (accept valid status, reject invalid status, pass-through on update); updated existing options test to cover SAML discovery_url/oidc_metadata.
• test/tools/auth0/handlers/clients.tests.js: added test for identity_assertion_authorization_grant (accepted + passed through on create).

Manual end-to-end (verified against a real EA tenant):

1. export a tenant, add identity_assertion_authorization_grant: { active: true } to a client, import, then re-export → field persisted.
2. import a samlp connection with cross_app_access_resource_app: { status: enabled } (plus a valid issuer/cert, required by the API), then re-export → cross_app_access_resource_app, discovery_url, and oidc_metadata all round-tripped from the tenant.

Note: the EA feature flags must be enabled on the tenant for the API to store these fields.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@52b338f). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #1431   +/-   ##
=========================================
  Coverage          ?   80.23%           
=========================================
  Files             ?      163           
  Lines             ?     7533           
  Branches          ?     1663           
=========================================
  Hits              ?     6044           
  Misses            ?      800           
  Partials          ?      689           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.