feat: add auth0_managed field support for network ACLs (Curated Blocklists - EA)

[harshithRai]

🔧 Changes

Adds Deploy CLI support for the new auth0_managed field on Network ACL rules, part of the Curated Blocklists Early Access feature.

The Auth0 Node SDK (auth0@6.1.0) already types this field on NetworkAclMatch, so it flows through create/update/import automatically. However, the handler maintains its own hand-written validation schema (MatchSchema) with additionalProperties: false, which rejected any config containing auth0_managed at the validation gate. This change adds the field to that schema so configs using it pass validation.

• Added auth0_managed to MatchSchema in networkACLs handler (string array, uniqueItems, validated against the pattern ^auth0\.[^.\s]+$). Applies to both match and not_match.
• No SDK bump required.
• Mutual exclusivity of auth0_managed across match/not_match and the advanced-breached-password-detection entitlement remain enforced by the API (returns HTTP 400/403), not replicated client-side.

The field accepts Auth0-managed IP range identifiers such as auth0.icloud_relay_proxy and auth0.low_reputation. The feature is gated behind the tenant_acl_curated_blocklists feature flag and requires the advanced-breached-password-detection entitlement.

YAML example

networkACLs:
  - description: 'Block iCloud Private Relay Exits'
    active: true
    priority: 4
    rule:
      action:
        block: true
      scope: 'tenant'
      match:
        auth0_managed: ['auth0.icloud_relay_proxy']

Directory (JSON) example

Contents of ./networkACLs/Block iCloud Private Relay Exits-p-4.json:

{
  "description": "Block iCloud Private Relay Exits",
  "active": true,
  "priority": 4,
  "rule": {
    "action": {
      "block": true
    },
    "scope": "tenant",
    "match": {
      "auth0_managed": ["auth0.icloud_relay_proxy"]
    }
  }
}

📚 References

• DXCDT-1970
• API Spec: Curated Blocklists (auth0_managed) - Q2 FY26
• Initiative: Curated Blocklists - Edge Enforcement (PNT-2638)

🔬 Testing

Added schema-level unit tests in test/tools/auth0/handlers/networkACLs.test.ts that run ajv against the exported handler schema:

• auth0_managed in match passes validation
• auth0_managed in not_match passes validation
• auth0_managed values not matching ^auth0\.[^.\s]+$ are rejected

Existing directory and YAML context tests continue to pass, confirming the field round-trips on import/export without changes.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (master@52b338f). Learn more about missing BASE report.

Additional details and impacted files

@@            Coverage Diff            @@
##             master    #1435   +/-   ##
=========================================
  Coverage          ?   80.23%           
=========================================
  Files             ?      163           
  Lines             ?     7533           
  Branches          ?     1663           
=========================================
  Hits              ?     6044           
  Misses            ?      800           
  Partials          ?      689           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.