[sergiught]

📝 Summary

The vendored Management API skeleton was last refreshed in May. Auth0's spec has grown since then, so /api/v2 was missing 81 operations that real tenants serve. Requests to them got a 404 from the mock, and their request bodies weren't validated. This PR re-vendors the skeleton from Auth0's current openapi.json with make refresh-spec (downloaded by hand, as CONTRIBUTING.md asks).

• Paths: 221 → 261. Operations: 406 → 485.

• New operations (81):

  Area	Ops
  /experimentation/* (experiments, feature flags and variations, segments)	22
  /organizations/{id}/clients, org groups and group roles, member effective roles, role members	13
  /users/{id}/consent-signing-keys, effective-permissions, effective-roles	7
  /agents, /client-profiles, /rate-limit-policies (full CRUD each)	15
  /guardian/settings, /guardian/factors/{email,phone}/settings	6
  /groups/{id}/roles, /roles/{id}/groups	6
  /keys/network-acls	4
  GET …/search on clients, client-grants, organizations and resource-servers	4
  /attack-protection/phone-provider-protection	2
  /connections/{id}/directory-provisioning/synchronized-groups	2

• Removed: GET /users/{id}/federated-connections-tokensets and DELETE …/{tokenset_id}. Auth0 no longer lists them.

• Stripper fix. OpenAPI 3.1 lets a description sit next to a $ref. kin-openapi keeps that in a field the stripper couldn't reach, so 36 Auth0 descriptions would have been committed. genopenapi now drops them before loading, and a new test covers it. The skeleton has no descriptions, externalDocs or x- fields; summaries are kept on purpose, as before.

• Docs: endpoint counts in README, CONTRIBUTING.md and docs/ARCHITECTURE.md go from ~400 to ~480.

⚠️ Behaviour change

• Event and stream ids must now be 22 characters after evt_ / est_. They used to be 16. That's Auth0's new schema, and POST /admin0/events validates against it, so a test that pushes a 16-character id now gets 400 invalid_event. Fixtures and the README example are padded to 22.
• Requests to the two removed tokenset operations now get the mock's 404 no_match, with the usual near-miss hint.
• Other request schemas follow Auth0's current ones, with 336 new pattern constraints, mostly on the new endpoints. With SPEC_VALIDATION_STRICT=true (the default), a body that Auth0 would now reject is rejected by the mock too.

🏷 Type of change

• 🐛 Bug fix (non-breaking)
• ✨ Feature (non-breaking)
• 💥 Breaking change (consumers must update)
• ♻️ Refactor (no functional change)
• 📚 Docs only
• 🛠 Build / CI / tooling

🔗 Related issues

No issue. This came from the gap analysis of the mock: the skeleton had drifted from Auth0's spec.

✅ How to verify

make lint
make test
make test-features

To reproduce the refresh, download https://auth0.com/docs/api/management/openapi.json to api/auth0-management-api.raw.json (gitignored), then run make refresh-spec. git diff should be empty.

📋 Checklist

• 🧪 Tests added or updated (unit and/or features/*.feature)
• 📖 Docs updated (README, docs/COOKBOOK.md, docs/ARCHITECTURE.md, or godoc)
• 🏷 PR title follows Conventional Commits — CI rejects otherwise (release-please derives CHANGELOG.md from it; don't hand-edit the changelog)
• 🟢 make lint, make test, make test-features pass locally

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.65%. Comparing base (465b76d) to head (c4cea28).

Additional details and impacted files

@@            Coverage Diff             @@
##             main      #97      +/-   ##
==========================================
+ Coverage   85.18%   85.65%   +0.47%     
==========================================
  Files          81       81              
  Lines        5062     5082      +20     
==========================================
+ Hits         4312     4353      +41     
+ Misses        532      511      -21     
  Partials      218      218              

Flag	Coverage Δ
features	63.21% <ø> (ø)
unit	85.47% <100.00%> (+0.47%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🔵 Needs a closer look

The generated-spec diffs were not supplied for compatibility review, and the public ID helpers remain incompatible with the refreshed schemas.

1 open issue

• Generate 22-character event and stream ID suffixes · New

What changed in this PR

This PR refreshes the spec-driven Management API coverage and updates event fixtures for Auth0’s stricter ID requirements.

Changes:

• Documents expanded coverage of approximately 480 Management API operations.
• Removes descriptions beside $ref before loading the upstream spec, with a regression test.
• Updates event and stream ID examples and fixtures to use 22-character suffixes.

File	Description
README.md	Updates operation counts and event ID examples.
pkg/​auth0mock/​events_test.go	Updates client event payload fixtures.
internal/​spec/​validator_test.go	Updates the valid event validation fixture.
internal/​mgmtapi/​mount_test.go	Updates the event-header matching fixture.
internal/​admin0/​events_test.go	Updates the valid admin event fixture.
features/​Events.feature	Updates event and stream IDs across scenarios.
docs/​ARCHITECTURE.md	Updates the documented operation count.
CONTRIBUTING.md	Updates the generic handler’s documented coverage.
cmd/​genopenapi/​main.go	Strips $ref sibling descriptions before loading.
cmd/​genopenapi/​main_test.go	Adds coverage for stripping sibling descriptions.

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The broad upstream schema refresh changes validation contracts, but the generated-spec diffs are absent from the supplied review material.

No open issues 🎉

1 resolved since last review

• Generate 22-character event and stream ID suffixes

_{Review effort: Balanced}