[harshithRai]

🔧 Changes

import --dry-run listed resources that import never touches, so it couldn't be used as a drift check for a tenant the config only partly manages. The dry-run for clients and client grants skipped the filters processChanges applies, and the connections handler had a related bug that affected the real import too.

• Clients and client grants: the dry-run now applies the same exclusions as import: AUTH0_EXCLUDED_CLIENTS, the management client, AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS, and (for grants) system grants. Each handler's inline processChanges filter moved into one method that both paths call, so they can't drift apart again. ClientGrantsHandler gets its own dryRunChanges, which only lists clients when an exclusion or the third-party flag needs them.
• Connections: connections.list no longer returns enabled_clients, so getEnabledClients never saw that an excluded client was enabled and dropped it from the computed list. The dry-run reported an UPDATE, and a real import disabled the excluded client on that connection instead of leaving it as the tenant has it. This is the same problem fix: prevent false enabled_clients diff in database dry-run #1479 fixed for databases. calcChanges and dryRunChanges now pass the enriched getType() result into getEnabledClients, so excluded clients keep their enablement on import and the dry-run no longer reports a change for them.

Resource servers are not touched here. Their dry-run already honors AUTH0_EXCLUDED_RESOURCE_SERVERS as of 9.3.0.

📚 References

Fixes #1525. Related: #1479.

🔬 Testing

Unit tests

Added in test/tools/auth0/handlers/clients.tests.js:

• Leaves excluded clients and the management client out of dry-run deletes
• Leaves excluded clients out of dry-run updates and creates
• Still reports every client when nothing is excluded
• Leaves third-party clients out of the dry-run when AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS is true

Added in test/tools/auth0/handlers/clientGrants.tests.js:

• Leaves grants of excluded clients, the management client and system grants out of dry-run deletes
• Leaves grants of excluded clients out of dry-run updates and creates
• Reports grants of every client except system grants when nothing is excluded
• Leaves grants of third-party clients out of the dry-run when AUTH0_EXCLUDE_THIRD_PARTY_CLIENTS is true

Added in test/tools/auth0/handlers/connections.tests.js:

• Reports no dry-run change when the config omits an excluded client that is enabled on the tenant
• Reports no dry-run change when the config names an excluded client that is enabled on the tenant
• Still reports the change for the same config when nothing is excluded
• Keeps the excluded client enabled in the import changes when other enabled clients change

Manual verification

Run against a live tenant, in both directory and YAML format:

1. Create two applications, each with a client grant, and a social connection with both enabled. Export the tenant.
2. Remove one application and its grant from the export, and set AUTH0_EXCLUDED_CLIENTS to that application's name.
3. Run import --dry-run with and without the exclusion. Without it, the removed application and grant show as DELETE * and the connections as UPDATE. With it, the dry-run reports no changes, including when the connection's enabled_clients omits or names the excluded application.
4. Run the real import with AUTH0_ALLOW_DELETE=true. Verify through the Management API that the excluded application, its grant, and its enablement on the connections are untouched.
5. Export again and re-import with the exclusion to confirm the round trip is non-destructive.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

❌ Patch coverage is 88.88889% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 82.66%. Comparing base (5770977) to head (25d8915).

Files with missing lines	Patch %	Lines
src/tools/auth0/handlers/connections.ts	0.00%	0 Missing and 2 partials ⚠️
src/tools/auth0/handlers/clientGrants.ts	93.33%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1536      +/-   ##
==========================================
+ Coverage   82.64%   82.66%   +0.01%     
==========================================
  Files         193      193              
  Lines        9301     9314      +13     
  Branches     2061     2066       +5     
==========================================
+ Hits         7687     7699      +12     
  Misses        816      816              
- Partials      798      799       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.