feat: add http_message_signature signal to network-acl rules (EA only) - #1653
Merged
ramya18101 merged 12 commits intoSep 9, 2026
Conversation
- Remove the 12 rule flags (--action, --redirect-uri, --scope, --asns, --country-codes, --subdivision-codes, --ipv4-cidrs, --ipv6-cidrs, --ja3-fingerprints, --ja4-fingerprints, --user-agents, --auth0-managed) from create and update; they were never read non-interactively, where the rule is built only from --rule. Interactive prompting for these values is unchanged. - Register --description, --active, --priority and --rule through the package-level Flag structs (RegisterString/RegisterInt and the U variants) and switch flag checks to IsSet, dropping raw cmd.Flags() calls. - Collapse the two update branches that patch from flags into one guard placed before the ACL read, removing a wasted API call when flags are provided in interactive mode. - Extract validateNetworkACLDescription and reuse it across create and update. - Regenerate command docs. BREAKING CHANGE: the 12 removed flags now fail with an "unknown flag" error. Pass the full rule as JSON via --rule to configure it non-interactively.
- Re-add the 12 per-criteria rule flags (--action, --redirect-uri, --scope, --asns, --country-codes, --subdivision-codes, --ipv4-cidrs, --ipv6-cidrs, --ja3-fingerprints, --ja4-fingerprints, --user-agents, --auth0-managed) to create and update, restoring backward compatibility so existing scripts no longer fail with an "unknown flag" error. - Mark each flag deprecated via a new Flag.Deprecate helper, which wraps cobra's MarkDeprecated and panics with the flag name on failure. Using a flag now prints guidance to pass the rule as JSON via --rule, and the flag is hidden from help and generated docs. - The flags are accepted but ignored when building the rule, matching their prior non-interactive behavior; the rule is still built solely from --rule or the interactive prompts.
- Replace shared top-level Flag variables with locally-defined Flag structs in promptForRuleDetails and promptForMatchCriteria, so interactive prompts no longer reuse the deprecated command flags. - Drop the LongForm on the inlined prompt flags, which is unused for interactive prompting.
- Introduce the NetworkACLKeyAPIV3 interface wrapping the V3 SDK /keys/network-acls List endpoint, plus its generated mock. - Wire NetworkACLKey into the APIV3 struct and NewAPIV3 via m.Keys.NetworkACLs so commands can resolve existing signing keys. - Only List is exposed; key create/delete is intentionally deferred. List requires the read:network_acl_keys scope.
- Add the http_message_signature signal to network-acl create/update, set interactively via a new "Signature Keys" picker or non-interactively through the --rule JSON, with no dedicated per-field flag. - Add pickNetworkACLSignatureKeys, which lists tenant signing keys by name (V3 NetworkACLKey.List), pre-selects the rule's current keys when editing, and errors when no keys exist for the tenant. - Extend buildNetworkACLRule and extractCurrentRuleDefaults to emit and read HTTPMessageSignature on both match and not_match. - Render SIGNATURE KEY IDS / NOT SIGNATURE KEY IDS rows in the ACL view. - Add AskMultiSelectWithDefault to pre-select current options in a prompt. - Bump the go-auth0 v1 SDK to a build carrying the HTTPMessageSignature types and regenerate command docs. http_message_signature is an Early Access feature gated behind the tenant_acl_hmac_signature flag; the interactive picker needs the read:network_acl_keys scope.
- Upgrade go-auth0 from the v1.48.1 pre-release pseudo-version to the tagged v1.49.0 release for a stable, reproducible dependency.
…2269/add-hmac-sign-signal-network-acl-rule
bkiran6398
changed the title
bkiran6398
marked this pull request as ready for review
September 9, 2026 12:39
…2269/add-hmac-sign-signal-network-acl-rule
ramya18101
approved these changes
Sep 9, 2026
ramya18101
deleted the
DXCDT-2269/add-hmac-sign-signal-network-acl-rule
branch
September 9, 2026 14:11
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Adds support for the
http_message_signaturesignal innetwork-aclrules, so a rule can match on requests carrying an HTTP message signature from selected tenant signing keys.--ruleoncreateandupdate.NetworkACLKeyV3 API wrapper over/keys/network-acls(list only) to resolve available signing keys. The picker needs theread:network_acl_keysscope.http_message_signatureis Early Access, gated behind the tenanttenant_acl_hmac_signatureflag.Usage:
📚 References
Depends on SDK v1 PR auth0/go-auth0#857
🔬 Testing
create/updateboth with--ruleJSON and interactively through the "Signature Keys" picker, then verified the rendered output.📝 Checklist