feat: support match_all in network ACL rules for unconditional block/allow

[harshithRai]

🔧 Changes

Adds support for the match_all field on network ACL rules, which lets a rule unconditionally match all traffic within a scope without specifying any other criteria. This backs unconditional block-all and allow-all rules.

• Added a third rule variant to the networkACLs schema requiring action, scope, and match_all. The field only accepts true, mirroring the API, which rejects false.
• The new variant forbids match and not_match, so the CLI fails fast on the mutually exclusive combinations the API would reject with a 400.
• No type or SDK changes were needed. NetworkACL already derives from the node-auth0 GetNetworkAclsResponseContent type, which carries match_all, so create, update, and dump pass it through unchanged.
• Documented match_all in the resource docs with YAML and directory examples.

The API gates match_all behind the tenant_acl_match_all feature flag and returns a 400 if it is not enabled for the tenant. The CLI does not gate on this flag itself.

Shape

A new optional match_all field on rule, mutually exclusive with match/not_match.

YAML, before:

networkACLs:
  - description: 'Block a country'
    active: true
    priority: 1
    rule:
      action: { block: true }
      scope: 'tenant'
      match:
        geo_country_codes: ['US']

YAML, after (unconditional block-all):

networkACLs:
  - description: 'Block All Tenant Traffic'
    active: true
    priority: 99
    rule:
      action: { block: true }
      scope: 'tenant'
      match_all: true   # no match / not_match

Directory JSON, before:

{
  "rule": {
    "action": { "block": true },
    "scope": "tenant",
    "match": { "geo_country_codes": ["US"] }
  }
}

Directory JSON, after:

{
  "rule": {
    "action": { "block": true },
    "scope": "tenant",
    "match_all": true
  }
}

🔬 Testing

Unit tests: added schema tests covering a valid match_all: true rule, rejection of match_all: false, and rejection of match_all combined with either match or not_match. Existing create, update, get, and delete tests continue to pass.

Verified against a live tenant with tenant_acl_match_all enabled, scoped to networkACLs only:

• Dry run of a match_all: true rule produced the expected plan (YAML and directory).
• Import created and updated a match_all block-all rule (YAML and directory).
• Export round-tripped match_all: true back into both YAML and directory output.
• Transitioning a rule from match_all to match via import cleared match_all server-side and applied without a 400, confirming rule-type transitions work through the CLI's full-object update.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.82%. Comparing base (4955e4b) to head (5f5338f).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1483   +/-   ##
=======================================
  Coverage   80.81%   80.82%           
=======================================
  Files         163      163           
  Lines        7805     7807    +2     
  Branches     1741     1741           
=======================================
+ Hits         6308     6310    +2     
  Misses        797      797           
  Partials      700      700           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.