feat: add HTTP message signature signal to network-acl rules (EA only)

docs/auth0_network-acl_create.md

@@ -25,8 +25,9 @@ auth0 network-acl create [flags]
   auth0 network-acl create -d "Block Bots" -p 4 --active true --rule '{"action":{"block":true},"scope":"tenant","match":{"user_agents":["badbot/*","malicious/*"],"ja3_fingerprints":["deadbeef","cafebabe"]}}'
   auth0 network-acl create --description "Complex Rule" --priority 5 --active true --rule '{"action":{"block":true},"scope":"tenant","match":{"ipv4_cidrs":["192.168.1.0/24"],"geo_country_codes":["US"]}}'
 
-  # Early Access (auth0_managed match/not_match value):
+  # Early Access (auth0_managed and http_message_signature match/not_match value):
   auth0 network-acl create -d "Curated Blocklist" -p 6 --active true --rule '{"action":{"log":true},"scope":"tenant","not_match":{"auth0_managed":["auth0.vpn","auth0.proxy"]}}'
+  auth0 network-acl create -d "Only Signed" -p 8 --active true --rule '{"action":{"allow":true},"scope":"authentication","match":{"http_message_signature":{"keys":[{"id": "key_123"}]}}}'
 
 ```
 
@@ -50,6 +51,7 @@ auth0 network-acl create [flags]
       --redirect-uri string         URI to redirect to when action is redirect
       --rule string                 Network ACL rule configuration in JSON format (required for non-interactive mode)
       --scope string                Scope of the rule (management, authentication, tenant)
+      --signature-key-ids strings   Comma-separated list of Network ACL key ids whose HTTP message signature satisfies the rule (Eg. key_abc,key_def). (EA only).
       --subdivision-codes strings   Comma-separated list of subdivision codes to match (Eg. US-NY,US-CA)
       --user-agents strings         Comma-separated list of user agents to match (Eg. badbot/*,malicious/*)
 ```

docs/auth0_network-acl_update.md

@@ -25,8 +25,9 @@ auth0 network-acl update [flags]
   auth0 network-acl update <id> --rule '{"action":{"block":true},"scope":"tenant","match":{"ipv4_cidrs":["192.168.1.0/24"]}}'
   auth0 network-acl update <id> --description "Complex Rule updated" --priority 1 --active true --rule '{"action":{"block":true},"scope":"tenant","match":{"ipv4_cidrs":["192.168.1.0/24"],"geo_country_codes":["US"]}}'
 
-  # Early Access (auth0_managed match/not_match value):
+  # Early Access (auth0_managed and http_message_signature match/not_match value):
   auth0 network-acl update <id> --rule '{"action":{"allow":true},"scope":"tenant","match":{"auth0_managed":["auth0.low_reputation"]}}'
+  auth0 network-acl update <id> --rule '{"action":{"allow":true},"scope":"authentication","match":{"http_message_signature":{"keys":[{"id": "key_123"},{"id": "key_456"}]}}}'
 
 ```
 
@@ -49,6 +50,7 @@ auth0 network-acl update [flags]
       --redirect-uri string         URI to redirect to when action is redirect
       --rule string                 Network ACL rule configuration in JSON format
       --scope string                Scope of the rule (management, authentication, tenant)
+      --signature-key-ids strings   Comma-separated list of Network ACL key ids whose HTTP message signature satisfies the rule (Eg. key_abc,key_def). (EA only).
       --subdivision-codes strings   Comma-separated list of subdivision codes to match (Eg. US-NY,US-CA)
       --user-agents strings         Comma-separated list of user agents to match (Eg. badbot/*,malicious/*)
 ```

go.mod

@@ -6,7 +6,7 @@ require (
 	github.com/AlecAivazis/survey/v2 v2.3.7
 	github.com/PuerkitoBio/rehttp v1.4.0
 	github.com/atotto/clipboard v0.1.4
-	github.com/auth0/go-auth0 v1.48.0
+	github.com/auth0/go-auth0 v1.48.1-0.20260901104455-6d71a49e53f3
 	github.com/auth0/go-auth0/v3 v3.3.0
 	github.com/briandowns/spinner v1.23.2
 	github.com/charmbracelet/glamour v1.0.0

go.sum

@@ -20,8 +20,8 @@ github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
 github.com/atotto/clipboard v0.1.4 h1:EH0zSVneZPSuFR11BlR9YppQTVDbh5+16AmcJi4g1z4=
 github.com/atotto/clipboard v0.1.4/go.mod h1:ZY9tmq7sm5xIbd9bOK4onWV4S6X0u6GY7Vn0Yu86PYI=
-github.com/auth0/go-auth0 v1.48.0 h1:INqEEZbDEkXVI0xUZluS1zzoB4YbYzvCysHH2CNEGzc=
-github.com/auth0/go-auth0 v1.48.0/go.mod h1:32sQB1uAn+99fJo6N819EniKq8h785p0ag0lMWhiTaE=
+github.com/auth0/go-auth0 v1.48.1-0.20260901104455-6d71a49e53f3 h1:5qdbLleMceOdd7pjtOv8zjGi+3NOUMsnDcNb7qZTem4=
+github.com/auth0/go-auth0 v1.48.1-0.20260901104455-6d71a49e53f3/go.mod h1:32sQB1uAn+99fJo6N819EniKq8h785p0ag0lMWhiTaE=
 github.com/auth0/go-auth0/v3 v3.3.0 h1:p/OxyycZNUtFekO6uXGBqrVXtnJ92gO7ikXtVDuT0ZA=
 github.com/auth0/go-auth0/v3 v3.3.0/go.mod h1:wb20iE6T4wCGWtMXAZTWTTxx1/T1aHfVK+dOWleQvlg=
 github.com/aybabtme/iocontrol v0.0.0-20150809002002-ad15bcfc95a0 h1:0NmehRCgyk5rljDQLKUO+cRJCnduDyn11+zGZIc9Z48=

internal/auth/auth.go

@@ -145,6 +145,7 @@ var RequiredScopes = []string{
 	"read:attack_protection", "update:attack_protection",
 	"read:event_streams", "create:event_streams", "update:event_streams", "delete:event_streams", "read:events",
 	"read:network_acls", "create:network_acls", "update:network_acls", "delete:network_acls",
+	"read:network_acl_keys",
 	"read:token_exchange_profiles", "create:token_exchange_profiles", "update:token_exchange_profiles", "delete:token_exchange_profiles",
 	"read:organization_invitations", "create:organization_invitations", "delete:organization_invitations",
 	"read:organization_discovery_domains", "read:self_service_profiles", "read:user_attribute_profiles",

internal/auth0/auth0.go

@@ -87,6 +87,7 @@ type APIV3 struct {
 	UserRefreshToken             UserRefreshTokenAPIV3
 	ActionModule                 ActionModuleAPIV3
 	ActionModuleVersion          ActionModuleVersionAPIV3
+	NetworkACLKey                NetworkACLKeyAPIV3
 }
 
 func NewAPIV3(m *managementv3.Management) *APIV3 {
@@ -102,6 +103,7 @@ func NewAPIV3(m *managementv3.Management) *APIV3 {
 		UserRefreshToken:             m.Users.RefreshToken,
 		ActionModule:                 m.Actions.Modules,
 		ActionModuleVersion:          m.Actions.Modules.Versions,
+		NetworkACLKey:                m.Keys.NetworkACLs,
 	}
 }
 

internal/auth0/network_acl_key.go

@@ -0,0 +1,22 @@
+//go:generate mockgen -source=network_acl_key.go -destination=mock/network_acl_key_mock.go -package=mock
+
+package auth0
+
+import (
+	"context"
+
+	managementv3 "github.com/auth0/go-auth0/v3/management"
+	"github.com/auth0/go-auth0/v3/management/option"
+)
+
+// NetworkACLKeyAPIV3 is the V3 SDK interface for the /keys/network-acls endpoint.
+//
+// Only List is exposed today: the network-acl command uses it to let a user pick
+// existing signing keys by name when adding the http_message_signature signal to a
+// rule. Key create/delete is intentionally not wired yet (DXCDT-2269).
+type NetworkACLKeyAPIV3 interface {
+	// List retrieves all Network ACL keys for the tenant.
+	//
+	// Required scope: `read:network_acl_keys`. The response is not paginated.
+	List(ctx context.Context, opts ...option.RequestOption) (*managementv3.GetAllKeysNetworkACLsResponseContent, error)
+}