[harshithRai]

🔧 Changes

Flow vault connection export wrote account_name and ready into flow-vault-connections/*.json and tenant.yaml, but the Management API accepts neither field on create or update. Import already drops them, so a value (or a keyword mapping) set on those fields in an exported file looked editable but was silently discarded.

Both dump handlers (directory and YAML) now leave account_name and ready out of the export. Import is unchanged, so older exports that still contain them import as before and the fields are ignored. Added a short "Flow Vault Connections" note to docs/resource-specific-documentation.md.

The docs also explain how to manage setup: it is not exported, it accepts keyword replacement in both formats (##KEY## for a string, a quoted '@@KEY@@' for a whole object), and a later export over the same files removes it.

This changes export output for this resource. Anyone who commits their exports will see a one-time diff removing those two lines. Deploys are not affected.

Dry-run also ignores account_name and ready for flow vault connections. Import never sends them, so an old export with edited values no longer shows a dry-run UPDATE that the import would discard.

Shape

Directory, before:

{
  "name": "My Connection",
  "app_id": "HTTP",
  "account_name": "Bearer tok***one",
  "ready": true
}

Directory, after:

{
  "name": "My Connection",
  "app_id": "HTTP"
}

YAML, before:

flowVaultConnections:
  - name: My Connection
    app_id: HTTP
    account_name: Bearer tok***one
    ready: true

YAML, after:

flowVaultConnections:
  - name: My Connection
    app_id: HTTP

📚 References

Fixes #1523

🔬 Testing

Unit tests

Updated in test/context/directory/flowVaultConnections.test.js and test/context/yaml/flowVaultConnections.test.js:

• Dumping connections that carry account_name and ready writes only name and app_id. The directory "sanitized" test and the YAML dump test assert this against literal output. The earlier directory dump test compared the file against the object dump mutates in place, so it could not fail. It duplicated the sanitized test, so it was removed.
• Keyword replacement in setup works in both formats: ##KEY## as a string value and '@@KEY@@' as a whole object.
• Dry-run does not report an update when only account_name or ready differ, but still reports one when a real field such as app_id changes.

Updated in test/tools/auth0/handlers/flowVaultConnections.tests.js:

• The create test now also asserts account_name and ready are not sent. This guards existing import behavior, which the docs now describe.

Manual verification

Against a live tenant with no flow vault connections, after npm run build:

1. Import a directory and a YAML config holding an HTTP connection with a bearer setup token, plus account_name and ready set in the file. The dry-run lists a CREATE and the real import creates it. Reading it back from the Management API shows account_name generated by the API (for example Bearer tok***one), not the value from the file.
2. Export in both formats. account_name is absent from the connection files. setup is still not exported, as before.
3. Import the export twice. The connection is kept, and its ready and account_name do not change.
4. Dry-run an old-style config where account_name and ready are hand-edited and setup is absent. It shows no flow vault change, where it previously showed an UPDATE.

Not covered: the ready removal was added after this live pass, so it is covered by the unit tests only. An AUTH0 connection with OAUTH_APP setup could not be created on the test tenant (the API returned 400 "Failed to create OAuth session", also when called directly), so account_name for that type is unverified.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.64%. Comparing base (29c9d68) to head (9e18d22).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1532      +/-   ##
==========================================
+ Coverage   82.58%   82.64%   +0.06%     
==========================================
  Files         193      193              
  Lines        9301     9301              
  Branches     2061     2061              
==========================================
+ Hits         7681     7687       +6     
+ Misses        819      816       -3     
+ Partials      801      798       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ankita10119]

Maybe worth adding here that a config with setup will show as an UPDATE on every dry run, since it's never exported?

[harshithRai]

Added. Also noted AUTH0_IGNORE_DRY_RUN_FIELDS with { "flowVaultConnections": ["setup"] } to hide it from the preview.

[ankita10119]

Approving. One optional follow-up: an old export with an edited account_name or ready still shows an UPDATE in dry run that import drops. Adding ignoreDryRunFields: ['account_name', 'ready'] to the handler (like clientGrants) would hide it. Happy for that to go in here or later.

[harshithRai]

Approving. One optional follow-up: an old export with an edited account_name or ready still shows an UPDATE in dry run that import drops. Adding ignoreDryRunFields: ['account_name', 'ready'] to the handler (like clientGrants) would hide it. Happy for that to go in here or later.

Done, added ignoreDryRunFields: ['account_name', 'ready'] to the handler with a unit test. Checked against a live tenant in both formats: a hand-edited old export no longer shows an UPDATE in dry-run.