Repository navigation
feat(plugins): add per-tenant consent and approvals - #1729
Open
developerkunal wants to merge 1 commit into
Open
developerkunal wants to merge 1 commit into
developerkunal wants to merge 1 commit into
Conversation
developerkunal
force-pushed
the
DXCDT-2607/consent-approvals
branch
from
October 24, 2026 15:30
fd08fe9 to
cefdd43
Compare
developerkunal
force-pushed
the
DXCDT-2607/consent-approvals
branch
from
November 2, 2026 11:12
cefdd43 to
1a3eee9
Compare
developerkunal
force-pushed
the
DXCDT-2607/consent-approvals
branch
from
November 2, 2026 14:31
1a3eee9 to
9914125
Compare
- Record approvals per tenant and plugin, keyed on the permissions hash - Pin approvals for CI with AUTH0_CLI_PLUGIN_APPROVALS - Refuse to approve unless a person is at an interactive terminal - Show the full permissions, or only the changes for an approved tenant - Remove a plugin's approvals on uninstall and a tenant's on logout
developerkunal
force-pushed
the
DXCDT-2607/consent-approvals
branch
from
November 2, 2026 19:37
9914125 to
bc11b8e
Compare
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
🔧 Changes
Adds
internal/plugins/approvals, which records what a person approved for each plugin on each tenant and answers whether a plugin is approved to run. There are no new commands, so the only user visible change is the logout behavior below.An approval is keyed on the plugin's permissions hash, not on its version. A new release that asks for the same permissions does not ask again, and one that asks for anything else does. Approving a new hash replaces the old one, so a rollback to a version with different permissions also asks again.
Storage. Approvals live in
approvals.jsonin the plugins directory. It must be a regular file that other users cannot write to, in the expected format. A file that fails the checks is reported as damaged and is never replaced silently.Who can approve. Only a person can create an approval. A session in agent mode or without a terminal is refused before anything is shown or read. Anything other than an explicit
yoryesis a decline, and so is end of input.Recording. The approval is written only after the install or update succeeded, and only for the plugin and version the person was shown, so a failed download leaves no approval behind.
CI pins.
AUTH0_CLI_PLUGIN_APPROVALStakes a comma separated list ofregistry/name@sha256:<64 hex digits>. A pin approves that plugin at that hash on whatever tenant is in use and is never written toapprovals.json. A malformed entry is an error that names the entry, so a typo cannot look like having no pins.Removal. A plugin's approvals, or a tenant's, can be dropped. A damaged file is deleted, because consent can only shrink here and a bad file should not block uninstalling or logging out.
Existing code.
auth0 logoutnow removes the tenant's approvals before it removes the tenant from the config and the keyring. If that fails, the tenant stays logged in and logout can be run again.Config.PluginsDir()returns thepluginsdirectory next to the config file.📚 References
DXCDT-2607. Part of the plugin framework stack of 11 PRs, and it builds on the one below it (DXCDT-2606).
🔬 Testing
The new code is covered by unit tests.
📝 Checklist