refactor: migrate management SDK usage from go-auth0 v2 to v3 - #1597
Merged
Conversation
Update all go-auth0/v2 imports to go-auth0/v3 and rename the v2-flavored identifiers (APIV2, apiv2, managementv2 alias, NewAPIV2, initializeManagementClientV2) to their v3 equivalents. Regenerate the phone-notification-template mock and drop go-auth0/v2 from go.mod. No command surface or behavior changes; v3 is a near drop-in for v2 and none of the tightened v3 types are referenced.
Contributor
|
Thanks @developerkunal for raising the PR. Can you also replace v2 to v3 in CLAUDE.MD too..? |
ramya18101
previously approved these changes
Aug 6, 2026
2 tasks
ramya18101
approved these changes
Aug 10, 2026
developerkunal
enabled auto-merge (squash)
August 10, 2026 04:39
developerkunal
added a commit
that referenced
this pull request
Aug 10, 2026
The go-auth0 v3 migration (#1597) is now merged into main, so the integration-tests job no longer needs to run on PRs targeting feat/go-auth0-v3-migration.
ramya18101
added a commit
that referenced
this pull request
Aug 12, 2026
* docs: add beta installation instructions to README (#1576) Add a collapsible "Installing the Beta" section covering Homebrew, cURL, Scoop, Powershell, Go, and manual install for the beta build. * chore(deps): bump github.com/schollz/progressbar/v3 from 3.19.0 to 3.19.1 (#1572) chore(deps): bump github.com/schollz/progressbar/v3 Bumps [github.com/schollz/progressbar/v3](https://github.com/schollz/progressbar) from 3.19.0 to 3.19.1. - [Release notes](https://github.com/schollz/progressbar/releases) - [Commits](schollz/progressbar@v3.19.0...v3.19.1) --- updated-dependencies: - dependency-name: github.com/schollz/progressbar/v3 dependency-version: 3.19.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Ramya Anusri <62586490+ramya18101@users.noreply.github.com> * docs: use official Homebrew core and Scoop main bucket for install (#1578) The Auth0 CLI is now published to Homebrew core and the Scoop main bucket, so the custom tap and bucket are no longer required. Simplify the stable install commands and add migration notes for users on the old tap/bucket. * fix(security): bump goldmark to v1.8.4 to resolve XSS (GO-2026-5320) (#1586) chore(deps): update goldmark to v1.8.4 * chore(deps): bump golang.org/x/text from 0.38.0 to 0.40.0 (#1584) Bumps [golang.org/x/text](https://github.com/golang/text) from 0.38.0 to 0.40.0. - [Release notes](https://github.com/golang/text/releases) - [Commits](golang/text@v0.38.0...v0.40.0) --- updated-dependencies: - dependency-name: golang.org/x/text dependency-version: 0.40.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump golang.org/x/term from 0.44.0 to 0.45.0 (#1583) Bumps [golang.org/x/term](https://github.com/golang/term) from 0.44.0 to 0.45.0. - [Commits](golang/term@v0.44.0...v0.45.0) --- updated-dependencies: - dependency-name: golang.org/x/term dependency-version: 0.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/getsentry/sentry-go from 0.47.0 to 0.48.0 (#1589) Bumps [github.com/getsentry/sentry-go](https://github.com/getsentry/sentry-go) from 0.47.0 to 0.48.0. - [Release notes](https://github.com/getsentry/sentry-go/releases) - [Changelog](https://github.com/getsentry/sentry-go/blob/master/CHANGELOG.md) - [Commits](getsentry/sentry-go@v0.47.0...v0.48.0) --- updated-dependencies: - dependency-name: github.com/getsentry/sentry-go dependency-version: 0.48.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * docs: update Agent Integration for consolidated auth0 skill (#1580) The standalone auth0-cli skill was folded into a single consolidated `auth0` skill that routes across all Auth0 SDKs, features, and tooling (including the CLI). Point install instructions at the official Claude Code plugins marketplace and the correct skill directory. Co-authored-by: Ramya Anusri <62586490+ramya18101@users.noreply.github.com> * chore(deps): bump github.com/auth0/go-auth0 from 1.44.0 to 1.45.0 (#1591) Bumps [github.com/auth0/go-auth0](https://github.com/auth0/go-auth0) from 1.44.0 to 1.45.0. - [Release notes](https://github.com/auth0/go-auth0/releases) - [Changelog](https://github.com/auth0/go-auth0/blob/v1.45.0/CHANGELOG.md) - [Commits](auth0/go-auth0@v1.44.0...v1.45.0) --- updated-dependencies: - dependency-name: github.com/auth0/go-auth0 dependency-version: 1.45.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/mattn/go-isatty from 0.0.22 to 0.0.23 (#1590) Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.22 to 0.0.23. - [Commits](mattn/go-isatty@v0.0.22...v0.0.23) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.23 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/mattn/go-isatty from 0.0.23 to 0.0.24 (#1593) Bumps [github.com/mattn/go-isatty](https://github.com/mattn/go-isatty) from 0.0.23 to 0.0.24. - [Commits](mattn/go-isatty@v0.0.23...v0.0.24) --- updated-dependencies: - dependency-name: github.com/mattn/go-isatty dependency-version: 0.0.24 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat: add session-transfer delegation flags in apps (EA only) (#1587) * feat(apps): add session-transfer delegation flags - Add --delegation-allow-delegated-access and --delegation-enforce-device-binding flags to `apps session-transfer update`, surfacing the Early Access Custom Token Exchange impersonation settings (client.session_transfer.delegation). - Send delegation only when a flag is set, so updates to legacy session-transfer settings leave it untouched for clients not using the feature. - Validate --delegation-enforce-device-binding as 'ip' or 'asn' before any API call, matching the Management API enum (no 'none', unlike the parent field). - Render delegation in `session-transfer show`/`update` output only when the client has it configured, keeping output unchanged for existing clients. - Add display unit tests plus an integration case for the validation error, and regenerate the command docs. * test(apps): revert integration test updates of delegation session-transfer - Remove the integration test that exercised --delegation-enforce-device-binding and restore the original apps test-case numbering. - Any delegation update sends a session_transfer.delegation payload, which the Management API rejects on tenants without the cte_session_transfer_token Early Access flag; the CI test tenant lacks it, so the case could not run reliably. - Delegation rendering stays covered by display unit tests; the update path is verified manually against an EA-enabled tenant. * refactor(apps): address review on delegation flags - Add short forms -d and -b to the delegation-allow-delegated-access and delegation-enforce-device-binding flags, matching the sibling session-transfer flags which all expose a short form. - Remove the client-side ip/asn check on the delegation device binding; invalid values now surface the Management API's validation error, consistent with the rest of the v1 command. - Regenerate the command docs for the new short forms. * docs(apps): mark delegation example as Early Access - Move the delegation flags example to its own block under a "# Delegation (Early Access): impersonation via Session Transfer" comment on `apps session-transfer update`, so users can tell the EA feature apart from the generally-available session-transfer flags. - Regenerate the command docs to reflect the annotated example. * docs: add CLAUDE.md agent guidelines for auth0-cli (#1588) * docs: add CLAUDE.md agent guidelines with references Generate CLAUDE.md as the single source of truth for AI coding agents, plus an AGENTS.md pointer and offloaded references/ files (commands, testing, code-style, git-workflow, pitfalls, docs-update). * docs: refine agent guidelines per PR feedback - Shorten the verbose pointer line in AGENTS.md - Add first-timer M2M setup guidance (AUTH0_DOMAIN/CLIENT_ID/SECRET) to references/testing.md - Document --json-compact + jq output pattern in references/code-style.md - Remove redundant docs blockquote in CLAUDE.md already covered by "Always Do" and docs-update.md * docs: condense Your Role overview in CLAUDE.md to one sentence * chore(deps): bump github.com/lestrrat-go/jwx/v3 from 3.1.1 to 3.2.0 (#1594) Bumps [github.com/lestrrat-go/jwx/v3](https://github.com/lestrrat-go/jwx) from 3.1.1 to 3.2.0. - [Release notes](https://github.com/lestrrat-go/jwx/releases) - [Changelog](https://github.com/lestrrat-go/jwx/blob/v3.2.0/Changes) - [Commits](lestrrat-go/jwx@v3.1.1...v3.2.0) --- updated-dependencies: - dependency-name: github.com/lestrrat-go/jwx/v3 dependency-version: 3.2.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * chore(deps): bump github.com/auth0/go-auth0 from 1.45.0 to 1.46.0 (#1596) Bumps [github.com/auth0/go-auth0](https://github.com/auth0/go-auth0) from 1.45.0 to 1.46.0. - [Release notes](https://github.com/auth0/go-auth0/releases) - [Changelog](https://github.com/auth0/go-auth0/blob/v1.46.0/CHANGELOG.md) - [Commits](auth0/go-auth0@v1.45.0...v1.46.0) --- updated-dependencies: - dependency-name: github.com/auth0/go-auth0 dependency-version: 1.46.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> * feat(analytics): add `is_api` telemetry property for raw api command (#1602) feat(analytics): add is_api telemetry property for raw api command * refactor: migrate management SDK usage from go-auth0 v2 to v3 (#1597) * refactor: migrate management SDK usage from go-auth0 v2 to v3 Update all go-auth0/v2 imports to go-auth0/v3 and rename the v2-flavored identifiers (APIV2, apiv2, managementv2 alias, NewAPIV2, initializeManagementClientV2) to their v3 equivalents. Regenerate the phone-notification-template mock and drop go-auth0/v2 from go.mod. No command surface or behavior changes; v3 is a near drop-in for v2 and none of the tightened v3 types are referenced. * update claude.md to v3 * fix conflicts * docs: update installation instructions for Homebrew and Scoop --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Kunal Dawar <35455566+developerkunal@users.noreply.github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: sanchitmehtagit <sanchit.mehta@okta.com> Co-authored-by: KIRAN KUMAR B <bkiran6398@gmail.com>
developerkunal
added a commit
that referenced
this pull request
Aug 14, 2026
* refactor: migrate management SDK usage from go-auth0 v2 to v3 Update all go-auth0/v2 imports to go-auth0/v3 and rename the v2-flavored identifiers (APIV2, apiv2, managementv2 alias, NewAPIV2, initializeManagementClientV2) to their v3 equivalents. Regenerate the phone-notification-template mock and drop go-auth0/v2 from go.mod. No command surface or behavior changes; v3 is a near drop-in for v2 and none of the tightened v3 types are referenced. * feat: add client-grants command resource Add a client-grants command group (list, create, show, update, delete) backed by the go-auth0 v3 Management SDK, giving the CLI full CRUD coverage for client grants. Create supports specific scopes, all scopes (--allow-all-scopes), or no scopes at all, matching the API. It also accepts --subject-type (client, user, anonymous_user); the organization flags are rejected for user and anonymous_user subject types, which the API does not allow. The detail view always shows the subject type, defaulting an empty value to client so it reads clearly. The v3 SDK client grant wrapper replaces the v1 one, and the callers that used it (quickstarts, terraform, test) are moved over. Adds unit tests, commander integration tests and helper scripts, and the generated command docs. * ci: temporarily run integration tests on v3-migration base Temporary: allow the integration-tests job to run on PRs targeting feat/go-auth0-v3-migration so the client-grants suite is exercised against the live tenant. Revert before merge. * test: fix client-grants show table spacing assertion The detail view now always shows SUBJECT TYPE, which is the widest label, so the label column pads wider than before. Update the expected spacing in the show-table integration test to match. * feat: guard system grants and add no-scopes update option Update and delete now fail fast when a client grant is a system grant (is_system), which Auth0 refuses to modify, instead of surfacing the raw 400 after the whole interactive flow. System grants are also hidden from the update and delete pickers so they can't be selected. The update scope picker now offers the No scopes option too, matching create. Choosing it sends scope: [] so the grant's scopes are cleared, rather than being read as leaving them untouched. * fix: align client-grants update org handling with create Update now reads the grant's immutable subject type and, like create, skips the organization prompts and request fields for the user and anonymous_user subject types, which Auth0 rejects organization settings on. It also runs the subject-type validation so the flag path fails fast with a clear message. Both create and update now drop the all-scopes option in the interactive picker when the audience is a system API, since Auth0 rejects allow_all_scopes on system APIs. * test: cover client-grants validations and note Management API user scopes Add command-level tests for the update system-grant fail-fast, the update subject-type organization guard, and the delete system-grant fail-fast. Also document that a user subject-type grant against the Auth0 Management API takes a fixed current_user scope set that cannot be listed dynamically, so the scopes must be passed inline with --scopes. * feat: add default-for and authorization-details-types to client-grants Add --default-for (mutually exclusive with --client-id) and --authorization-details-types to client-grants create, and --authorization-details-types to update. Both are selectable interactively, sourced from the audience API, and the audience API is read once and shared between the scope and authorization-details pickers. Skip organization settings for system APIs, which reject them with a reserved_identifier error, and stop sending a stray allow_any_organization when the user never engaged with organization settings. Show the authorization details types in the detail view, truncated like scopes. * ci: revert temporary integration-test trigger for v3 migration base The go-auth0 v3 migration (#1597) is now merged into main, so the integration-tests job no longer needs to run on PRs targeting feat/go-auth0-v3-migration. * feat: add --csv output to client-grants list Add a --csv flag to the client-grants list command, mutually exclusive with --json and --json-compact. * feat: validate client-grants scopes via flags and add --no-scopes to update Validate --scopes against the audience API for both create and update, returning a clear error for unknown scopes instead of a raw API 400. When the API exposes no scopes, reject specific scopes for the client subject type while still allowing inline scopes for user/anonymous_user (the fixed Management API current_user set). Add a --no-scopes flag to update so scopes can be cleared to an empty array non-interactively, mutually exclusive with --scopes and --allow-all-scopes. * test: exclude quickstart suite from integration runner The quickstart integration tests depend on the external metadata endpoint https://auth0.com/docs/meta/quickstarts, which now returns 404, so they fail regardless of the code under test. Run each remaining suite file individually and skip quickstarts until the endpoint is restored.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Migrates the CLI's Management API usage from go-auth0 v2 to v3. v3 keeps v2's client initialization, package layout, and option pattern, so this is effectively an import-path change plus a naming refresh. It lays the groundwork for the upcoming priority-resource commands, which will be built on v3.
github.com/auth0/go-auth0/v2import togithub.com/auth0/go-auth0/v3across theinternal/cli,internal/auth0, andinternal/displaypackages.managementv2import alias, theAPIV2struct and itsAttackProtectionBotDetectionAPIV2/EventsAPIV2interfaces, theNewAPIV2constructor, theapiv2field on theclistruct, andinitializeManagementClientV2.make test-mocks) against the v3 interface.go-auth0/v2fromgo.mod; the repo now depends on v1 + v3.No command surface, flags, or output behavior change. None of the tightened v3 types (connection attribute identifiers, role pagination, phone backoff enum, federated tokensets, session-transfer device-binding enum) are referenced in the CLI, so the migration required no type fixes.
📚 References
Part of the CLI Priority Resource Coverage effort. This is the first PR in a stack that will add Connections, Client Grants, Flows & Forms, and Sessions + Refresh Tokens commands on top of go-auth0 v3.
🔬 Testing
go build ./...andgo vet ./...pass.internal/cli,internal/auth0,internal/display).make lintsurfaces only pre-existing issues in files untouched by this change.📝 Checklist