Skip to content

feat: add http_message_signature signal to network-acl rules (EA only) - #1653

Merged
ramya18101 merged 12 commits into
mainfrom
DXCDT-2269/add-hmac-sign-signal-network-acl-rule
Sep 9, 2026
Merged

feat: add http_message_signature signal to network-acl rules (EA only)#1653
ramya18101 merged 12 commits into
mainfrom
DXCDT-2269/add-hmac-sign-signal-network-acl-rule

Conversation

@bkiran6398

@bkiran6398 bkiran6398 commented Sep 9, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🔧 Changes

Adds support for the http_message_signature signal in network-acl rules, so a rule can match on requests carrying an HTTP message signature from selected tenant signing keys.

  • Non-interactive: pass the signal in the rule JSON via --rule on create and update.
  • Interactive: a new "Signature Keys" option in the match/not-match picker lists the tenant's signing keys by name and pre-selects the rule's current keys when editing.
  • Adds a read-only NetworkACLKey V3 API wrapper over /keys/network-acls (list only) to resolve available signing keys. The picker needs the read:network_acl_keys scope.
  • Renders SIGNATURE KEY IDS / NOT SIGNATURE KEY IDS rows in the ACL view.

http_message_signature is Early Access, gated behind the tenant tenant_acl_hmac_signature flag.

Usage:

auth0 network-acl create -d "Only Signed" -p 8 --active true \
  --rule '{"action":{"allow":true},"scope":"authentication","match":{"http_message_signature":{"keys":[{"id":"key_123"}]}}}'

📚 References

Depends on SDK v1 PR auth0/go-auth0#857

🔬 Testing

  • Unit tests cover rule building/reading of the signal and the ACL view rows.
  • Manual: verified create/update both with --rule JSON and interactively through the "Signature Keys" picker, then verified the rendered output.

📝 Checklist

  • All new/changed/fixed functionality is covered by tests (or N/A)
  • I have added documentation for all new/changed functionality (or N/A)

bkiran6398 and others added 10 commits September 8, 2026 14:00
@bkiran6398
refactor(network-acl)!: remove redundant rule flags
5e7970f 
- Remove the 12 rule flags (--action, --redirect-uri, --scope, --asns,
  --country-codes, --subdivision-codes, --ipv4-cidrs, --ipv6-cidrs,
  --ja3-fingerprints, --ja4-fingerprints, --user-agents, --auth0-managed)
  from create and update; they were never read non-interactively, where the
  rule is built only from --rule. Interactive prompting for these values is
  unchanged.
- Register --description, --active, --priority and --rule through the
  package-level Flag structs (RegisterString/RegisterInt and the U variants)
  and switch flag checks to IsSet, dropping raw cmd.Flags() calls.
- Collapse the two update branches that patch from flags into one guard placed
  before the ACL read, removing a wasted API call when flags are provided in
  interactive mode.
- Extract validateNetworkACLDescription and reuse it across create and update.
- Regenerate command docs.

BREAKING CHANGE: the 12 removed flags now fail with an "unknown flag" error.
Pass the full rule as JSON via --rule to configure it non-interactively.
@bkiran6398
chore: lint fix
013420b
@bkiran6398
refactor(network-acl): deprecate rule flags instead of removing them
e735a34 
- Re-add the 12 per-criteria rule flags (--action, --redirect-uri, --scope,
  --asns, --country-codes, --subdivision-codes, --ipv4-cidrs, --ipv6-cidrs,
  --ja3-fingerprints, --ja4-fingerprints, --user-agents, --auth0-managed) to
  create and update, restoring backward compatibility so existing scripts no
  longer fail with an "unknown flag" error.
- Mark each flag deprecated via a new Flag.Deprecate helper, which wraps
  cobra's MarkDeprecated and panics with the flag name on failure. Using a
  flag now prints guidance to pass the rule as JSON via --rule, and the flag
  is hidden from help and generated docs.
- The flags are accepted but ignored when building the rule, matching their
  prior non-interactive behavior; the rule is still built solely from --rule
  or the interactive prompts.
@bkiran6398
Merge branch 'main' into DXCDT-2385/remove-redundant-flags-network-acl
d3b2235
@bkiran6398
refactor(network-acl): inline flag structs for interactive rule prompts
96b016d 
- Replace shared top-level Flag variables with locally-defined Flag structs
  in promptForRuleDetails and promptForMatchCriteria, so interactive prompts
  no longer reuse the deprecated command flags.
- Drop the LongForm on the inlined prompt flags, which is unused for
  interactive prompting.
@bkiran6398
Merge branch 'main' into DXCDT-2385/remove-redundant-flags-network-acl
551c66f
@bkiran6398
feat(auth0): add NetworkACLKey V3 API for listing signing keys
d27aa3b 
- Introduce the NetworkACLKeyAPIV3 interface wrapping the V3 SDK
  /keys/network-acls List endpoint, plus its generated mock.
- Wire NetworkACLKey into the APIV3 struct and NewAPIV3 via
  m.Keys.NetworkACLs so commands can resolve existing signing keys.
- Only List is exposed; key create/delete is intentionally deferred.
  List requires the read:network_acl_keys scope.
@bkiran6398
feat(network-acl): support http_message_signature signal in rules
40ffbe4 
- Add the http_message_signature signal to network-acl create/update,
  set interactively via a new "Signature Keys" picker or non-interactively
  through the --rule JSON, with no dedicated per-field flag.
- Add pickNetworkACLSignatureKeys, which lists tenant signing keys by name
  (V3 NetworkACLKey.List), pre-selects the rule's current keys when editing,
  and errors when no keys exist for the tenant.
- Extend buildNetworkACLRule and extractCurrentRuleDefaults to emit and read
  HTTPMessageSignature on both match and not_match.
- Render SIGNATURE KEY IDS / NOT SIGNATURE KEY IDS rows in the ACL view.
- Add AskMultiSelectWithDefault to pre-select current options in a prompt.
- Bump the go-auth0 v1 SDK to a build carrying the HTTPMessageSignature types
  and regenerate command docs.

http_message_signature is an Early Access feature gated behind the
tenant_acl_hmac_signature flag; the interactive picker needs the
read:network_acl_keys scope.
@bkiran6398
chore(deps): bump github.com/auth0/go-auth0 to v1.49.0
a2c42a2 
- Upgrade go-auth0 from the v1.48.1 pre-release pseudo-version to the tagged
  v1.49.0 release for a stable, reproducible dependency.
@bkiran6398
Merge branch 'main' of https://github.com/auth0/auth0-cli into DXCDT-…
03f32e6 
…2269/add-hmac-sign-signal-network-acl-rule
@bkiran6398 bkiran6398 changed the title add hmac sign signal network acl rule feat: add http_message_signature signal to network-acl rules (EA only) Sep 9, 2026
@bkiran6398
bkiran6398 marked this pull request as ready for review September 9, 2026 12:39
@bkiran6398
bkiran6398 requested a review from a team as a code owner September 9, 2026 12:39
@ramya18101
ramya18101 merged commit 41f6955 into main Sep 9, 2026
6 checks passed
@ramya18101
ramya18101 deleted the DXCDT-2269/add-hmac-sign-signal-network-acl-rule branch September 9, 2026 14:11
@ramya18101 ramya18101 mentioned this pull request Sep 10, 2026
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ramya18101 ramya18101 ramya18101 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@bkiran6398 @ramya18101