feat!: remove federated connections tokensets, add network ACL auth0_managed field (#873)

### Changes

#### ⚠️ Breaking Changes

- **Federated Connections Tokensets removed** — the
`users.federated_connections_tokensets` client and its `list`/`delete`
methods are removed, along with the `FederatedConnectionTokenSet` and
`ConnectionFederatedConnectionsAccessTokens` types.
- **`federated_connections_access_tokens` field removed** — this
optional field is no longer present on `ConnectionOptionsAzureAd`,
`ConnectionOptionsCommonOidc`, `ConnectionOptionsGoogleApps`,
`ConnectionPropertiesOptions`, and `UpdateConnectionOptions`.
- **OAuth scopes removed** — `read:federated_connections_tokens` and
`delete:federated_connections_tokens` are no longer valid values of
`OauthScope`.
- **`ClientSessionTransferDelegationDeviceBindingEnum` narrowed** — the
`"asn"` value is removed; the enum now only accepts `"ip"`.

#### Features

- **`NetworkAclMatch`** — new optional `auth0_managed:
Optional[List[str]]` field (serialized as `auth0_managed`), available on
both the `match` and `not_match` rule blocks. This lets network ACL
rules reference Auth0-managed lists when matching or excluding traffic.

### References

N/A

### Testing

Wiremock test fixtures were updated to reflect the removed federated
connections tokensets endpoint and the new `auth0_managed` field. The
existing unit and wire test suite should pass without errors.

- [ ] This change adds unit test coverage
- [ ] This change adds integration test coverage
- [x] This change has been tested on the latest version of the
platform/language or why not

### Checklist

- [x] I have read the [Auth0 general contribution
guidelines](https://github.com/auth0/open-source-template/blob/master/GENERAL-CONTRIBUTING.md)
- [x] I have read the [Auth0 Code of
Conduct](https://github.com/auth0/open-source-template/blob/master/CODE-OF-CONDUCT.md)
- [x] All existing and new tests complete without errors

Author: rmad17

.fern/replay.lock

@@ -37575,148 +37575,6 @@ client.users.enrollments.get(
 </dl>
 
 
-</dd>
-</dl>
-</details>
-
-## Users FederatedConnectionsTokensets
-<details><summary><code>client.users.federated_connections_tokensets.<a href="src/auth0.management/users/federated_connections_tokensets/client.py">list</a>(...) -> typing.List[FederatedConnectionTokenSet]</code></summary>
-<dl>
-<dd>
-
-#### 📝 Description
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-List active federated connections tokensets for a provided user
-</dd>
-</dl>
-</dd>
-</dl>
-
-#### 🔌 Usage
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-```python
-from auth0.management import Auth0
-from auth0.management.environment import Auth0Environment
-
-client = Auth0(
-    token="<token>",
-    environment=Auth0Environment.DEFAULT,
-)
-
-client.users.federated_connections_tokensets.list(
-    id="id",
-)
-
-```
-</dd>
-</dl>
-</dd>
-</dl>
-
-#### ⚙️ Parameters
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-**id:** `str` — User identifier
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
-    
-</dd>
-</dl>
-</dd>
-</dl>
-
-
-</dd>
-</dl>
-</details>
-
-<details><summary><code>client.users.federated_connections_tokensets.<a href="src/auth0.management/users/federated_connections_tokensets/client.py">delete</a>(...)</code></summary>
-<dl>
-<dd>
-
-#### 🔌 Usage
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-```python
-from auth0.management import Auth0
-from auth0.management.environment import Auth0Environment
-
-client = Auth0(
-    token="<token>",
-    environment=Auth0Environment.DEFAULT,
-)
-
-client.users.federated_connections_tokensets.delete(
-    id="id",
-    tokenset_id="tokenset_id",
-)
-
-```
-</dd>
-</dl>
-</dd>
-</dl>
-
-#### ⚙️ Parameters
-
-<dl>
-<dd>
-
-<dl>
-<dd>
-
-**id:** `str` — Id of the user that owns the tokenset
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**tokenset_id:** `str` — The tokenset id
-    
-</dd>
-</dl>
-
-<dl>
-<dd>
-
-**request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
-    
-</dd>
-</dl>
-</dd>
-</dl>
-
-
 </dd>
 </dl>
 </details>

reference.md

@@ -366,7 +366,6 @@
         ConnectionExtIsSuspended,
         ConnectionExtIsSuspendedGoogleApps,
         ConnectionExtProfile,
-        ConnectionFederatedConnectionsAccessTokens,
         ConnectionFieldsMap,
         ConnectionFieldsMapSaml,
         ConnectionFieldsMapSamlValue,
@@ -1861,7 +1860,6 @@
         FedCmLoginGoogle,
         FedCmLoginGooglePatch,
         FedCmLoginPatch,
-        FederatedConnectionTokenSet,
         FlowAction,
         FlowActionActivecampaign,
         FlowActionActivecampaignListContacts,
@@ -3561,7 +3559,6 @@
     "ConnectionExtIsSuspended": ".types",
     "ConnectionExtIsSuspendedGoogleApps": ".types",
     "ConnectionExtProfile": ".types",
-    "ConnectionFederatedConnectionsAccessTokens": ".types",
     "ConnectionFieldsMap": ".types",
     "ConnectionFieldsMapSaml": ".types",
     "ConnectionFieldsMapSamlValue": ".types",
@@ -5061,7 +5058,6 @@
     "FedCmLoginGoogle": ".types",
     "FedCmLoginGooglePatch": ".types",
     "FedCmLoginPatch": ".types",
-    "FederatedConnectionTokenSet": ".types",
     "FlowAction": ".types",
     "FlowActionActivecampaign": ".types",
     "FlowActionActivecampaignListContacts": ".types",
@@ -6773,7 +6769,6 @@ def __dir__():
     "ConnectionExtIsSuspended",
     "ConnectionExtIsSuspendedGoogleApps",
     "ConnectionExtProfile",
-    "ConnectionFederatedConnectionsAccessTokens",
     "ConnectionFieldsMap",
     "ConnectionFieldsMapSaml",
     "ConnectionFieldsMapSamlValue",
@@ -8273,7 +8268,6 @@ def __dir__():
     "FedCmLoginGoogle",
     "FedCmLoginGooglePatch",
     "FedCmLoginPatch",
-    "FederatedConnectionTokenSet",
     "FlowAction",
     "FlowActionActivecampaign",
     "FlowActionActivecampaignListContacts",

src/auth0/management/__init__.py

@@ -411,7 +411,6 @@
     from .connection_ext_is_suspended import ConnectionExtIsSuspended
     from .connection_ext_is_suspended_google_apps import ConnectionExtIsSuspendedGoogleApps
     from .connection_ext_profile import ConnectionExtProfile
-    from .connection_federated_connections_access_tokens import ConnectionFederatedConnectionsAccessTokens
     from .connection_fields_map import ConnectionFieldsMap
     from .connection_fields_map_saml import ConnectionFieldsMapSaml
     from .connection_fields_map_saml_value import ConnectionFieldsMapSamlValue
@@ -3042,7 +3041,6 @@
     from .fed_cm_login_google import FedCmLoginGoogle
     from .fed_cm_login_google_patch import FedCmLoginGooglePatch
     from .fed_cm_login_patch import FedCmLoginPatch
-    from .federated_connection_token_set import FederatedConnectionTokenSet
     from .flow_action import FlowAction
     from .flow_action_activecampaign import FlowActionActivecampaign
     from .flow_action_activecampaign_list_contacts import FlowActionActivecampaignListContacts
@@ -4808,7 +4806,6 @@
     "ConnectionExtIsSuspended": ".connection_ext_is_suspended",
     "ConnectionExtIsSuspendedGoogleApps": ".connection_ext_is_suspended_google_apps",
     "ConnectionExtProfile": ".connection_ext_profile",
-    "ConnectionFederatedConnectionsAccessTokens": ".connection_federated_connections_access_tokens",
     "ConnectionFieldsMap": ".connection_fields_map",
     "ConnectionFieldsMapSaml": ".connection_fields_map_saml",
     "ConnectionFieldsMapSamlValue": ".connection_fields_map_saml_value",
@@ -6303,7 +6300,6 @@
     "FedCmLoginGoogle": ".fed_cm_login_google",
     "FedCmLoginGooglePatch": ".fed_cm_login_google_patch",
     "FedCmLoginPatch": ".fed_cm_login_patch",
-    "FederatedConnectionTokenSet": ".federated_connection_token_set",
     "FlowAction": ".flow_action",
     "FlowActionActivecampaign": ".flow_action_activecampaign",
     "FlowActionActivecampaignListContacts": ".flow_action_activecampaign_list_contacts",
@@ -7951,7 +7947,6 @@ def __dir__():
     "ConnectionExtIsSuspended",
     "ConnectionExtIsSuspendedGoogleApps",
     "ConnectionExtProfile",
-    "ConnectionFederatedConnectionsAccessTokens",
     "ConnectionFieldsMap",
     "ConnectionFieldsMapSaml",
     "ConnectionFieldsMapSamlValue",
@@ -9446,7 +9441,6 @@ def __dir__():
     "FedCmLoginGoogle",
     "FedCmLoginGooglePatch",
     "FedCmLoginPatch",
-    "FederatedConnectionTokenSet",
     "FlowAction",
     "FlowActionActivecampaign",
     "FlowActionActivecampaignListContacts",

src/auth0/management/types/__init__.py

@@ -2,4 +2,4 @@
 
 import typing
 
-ClientSessionTransferDelegationDeviceBindingEnum = typing.Union[typing.Literal["ip", "asn"], typing.Any]
+ClientSessionTransferDelegationDeviceBindingEnum = typing.Union[typing.Literal["ip"], typing.Any]

src/auth0/management/types/client_session_transfer_delegation_device_binding_enum.py

@@ -16,7 +16,6 @@
 from .connection_ext_groups_azure_ad import ConnectionExtGroupsAzureAd
 from .connection_ext_is_suspended import ConnectionExtIsSuspended
 from .connection_ext_profile import ConnectionExtProfile
-from .connection_federated_connections_access_tokens import ConnectionFederatedConnectionsAccessTokens
 from .connection_icon_url_azure_ad import ConnectionIconUrlAzureAd
 from .connection_identity_api_azure_ad import ConnectionIdentityApiAzureAd
 from .connection_max_groups_to_retrieve import ConnectionMaxGroupsToRetrieve
@@ -260,7 +259,6 @@ class ConnectionOptionsAzureAd(ConnectionOptionsCommon):
     When false, prevents storing an alternative user ID. When true (default), this user ID is persisted in the user profile.
     """
 
-    federated_connections_access_tokens: typing.Optional[ConnectionFederatedConnectionsAccessTokens] = None
     granted: typing.Optional[bool] = pydantic.Field(default=None)
     """
     Indicates whether admin consent has been granted for the required Azure AD permissions. Read-only status field managed by Auth0 during the OAuth authorization flow.

src/auth0/management/types/connection_federated_connections_access_tokens.py

@@ -10,7 +10,6 @@
 from .connection_connection_settings import ConnectionConnectionSettings
 from .connection_domain_aliases import ConnectionDomainAliases
 from .connection_dpop_signing_alg_enum import ConnectionDpopSigningAlgEnum
-from .connection_federated_connections_access_tokens import ConnectionFederatedConnectionsAccessTokens
 from .connection_icon_url import ConnectionIconUrl
 from .connection_id_token_session_expiry_supported import ConnectionIdTokenSessionExpirySupported
 from .connection_id_token_signed_response_algs import ConnectionIdTokenSignedResponseAlgs
@@ -40,7 +39,6 @@ class ConnectionOptionsCommonOidc(UniversalBaseModel):
     connection_settings: typing.Optional[ConnectionConnectionSettings] = None
     domain_aliases: typing.Optional[ConnectionDomainAliases] = None
     dpop_signing_alg: typing.Optional[ConnectionDpopSigningAlgEnum] = None
-    federated_connections_access_tokens: typing.Optional[ConnectionFederatedConnectionsAccessTokens] = None
     icon_url: typing.Optional[ConnectionIconUrl] = None
     id_token_session_expiry_supported: typing.Optional[ConnectionIdTokenSessionExpirySupported] = None
     id_token_signed_response_algs: typing.Optional[ConnectionIdTokenSignedResponseAlgs] = None

src/auth0/management/types/connection_options_azure_ad.py

@@ -17,7 +17,6 @@
 from .connection_ext_groups_google_apps import ConnectionExtGroupsGoogleApps
 from .connection_ext_is_admin_google_apps import ConnectionExtIsAdminGoogleApps
 from .connection_ext_is_suspended_google_apps import ConnectionExtIsSuspendedGoogleApps
-from .connection_federated_connections_access_tokens import ConnectionFederatedConnectionsAccessTokens
 from .connection_handle_login_from_social_google_apps import ConnectionHandleLoginFromSocialGoogleApps
 from .connection_icon_url_google_apps import ConnectionIconUrlGoogleApps
 from .connection_options_common import ConnectionOptionsCommon
@@ -60,7 +59,6 @@ class ConnectionOptionsGoogleApps(ConnectionOptionsCommon):
 
     ext_is_admin: typing.Optional[ConnectionExtIsAdminGoogleApps] = None
     ext_is_suspended: typing.Optional[ConnectionExtIsSuspendedGoogleApps] = None
-    federated_connections_access_tokens: typing.Optional[ConnectionFederatedConnectionsAccessTokens] = None
     handle_login_from_social: typing.Optional[ConnectionHandleLoginFromSocialGoogleApps] = None
     icon_url: typing.Optional[ConnectionIconUrlGoogleApps] = None
     map_user_id_to_id: typing.Optional[bool] = pydantic.Field(default=None)

src/auth0/management/types/connection_options_common_oidc.py

@@ -11,7 +11,6 @@
 from .connection_authentication_methods import ConnectionAuthenticationMethods
 from .connection_custom_scripts import ConnectionCustomScripts
 from .connection_dpop_signing_alg_enum import ConnectionDpopSigningAlgEnum
-from .connection_federated_connections_access_tokens import ConnectionFederatedConnectionsAccessTokens
 from .connection_gateway_authentication import ConnectionGatewayAuthentication
 from .connection_id_token_session_expiry_supported import ConnectionIdTokenSessionExpirySupported
 from .connection_id_token_signed_response_algs import ConnectionIdTokenSignedResponseAlgs
@@ -103,7 +102,6 @@ class ConnectionPropertiesOptions(UniversalBaseModel):
     upstream_params: typing.Optional[ConnectionUpstreamParams] = None
     set_user_root_attributes: typing.Optional[ConnectionSetUserRootAttributesEnum] = None
     gateway_authentication: typing.Optional[ConnectionGatewayAuthentication] = None
-    federated_connections_access_tokens: typing.Optional[ConnectionFederatedConnectionsAccessTokens] = None
     password_options: typing.Optional[ConnectionPasswordOptions] = None
     assertion_decryption_settings: typing.Optional[ConnectionAssertionDecryptionSettings] = None
     id_token_signed_response_algs: typing.Optional[ConnectionIdTokenSignedResponseAlgs] = None