fix: strip read-only field from roles to fix export/import round-trip (#1439)

[harshithRai]

🔧 Changes

Tenant roles could not be round-tripped: export → import failed with a 400.

The roles GET endpoint returns a read-only type field (e.g. tenant), but the roles create/update endpoints reject it with Payload validation error: 'Additional properties not allowed: type'. The handler wrote the exported type straight back on import, breaking the round-trip.

This strips type in two places in src/tools/auth0/handlers/roles.ts:

• getType() (export) - omit type from exported output so new exports stay round-trippable.
• createRole() / updateRole() (import write paths) - strip type before calling the API so files that were already exported with the field (pre-fix) can still be imported without re-exporting.

Shape (export output)

The only shape change is on the export side - the type field no longer appears on roles. Import accepts both shapes (with or without type).

Before (YAML):

roles:
  - name: Test Role
    description: Role to reproduce the error
    permissions:
      - permission_name: some:perm
        resource_server_identifier: https://example.com/
    type: tenant          # read-only, rejected on import

After (YAML):

roles:
  - name: Test Role
    description: Role to reproduce the error
    permissions:
      - permission_name: some:perm
        resource_server_identifier: https://example.com/

Before (directory JSON - roles/Test Role.json):

{
  "name": "Test Role",
  "description": "Role to reproduce the error",
  "permissions": [
    {
      "permission_name": "some:perm",
      "resource_server_identifier": "https://example.com/"
    }
  ],
  "type": "tenant"
}

After (Directory JSON - roles/Test Role.json):

{
  "name": "Test Role",
  "description": "Role to reproduce the error",
  "permissions": [
    {
      "permission_name": "some:perm",
      "resource_server_identifier": "https://example.com/"
    }
  ]
}

📚 References

• Fixes Role fields from export cannot be imported #1439

🔬 Testing

• Unit tests (test/tools/auth0/handlers/roles.tests.js): assert type never reaches the roles.create/roles.update payloads, and that it is stripped from getType() output.
• Live tenant (dev): verified export -f yaml produces roles with no type field; re-importing that export succeeds. Also injected type: tenant into an export file (simulating a pre-fix file) and confirmed it now imports cleanly - while the same file reproduces the original 400 on master.
• Full regression: auth0 handler suite (680) and context handler suite (411) pass.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A) - N/A, no public API or config surface change

---

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.37%. Comparing base (e245f16) to head (3336b84).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #1445   +/-   ##
=======================================
  Coverage   80.36%   80.37%           
=======================================
  Files         163      163           
  Lines        7595     7598    +3     
  Branches     1677     1677           
=======================================
+ Hits         6104     6107    +3     
  Misses        797      797           
  Partials      694      694           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.