feat!: phone provider protection, FedCM & native social login config (breaking: user date fields, clients.update login types) (#868)

## Changes

### ⚠️ Breaking Changes

- **`clients.update()` social/FedCM request types changed** —
`native_social_login` and `fedcm_login` on `clients.update()` (`PATCH
/api/v2/clients/{id}`) changed from `NativeSocialLogin` / `FedCmLogin`
to `NativeSocialLoginPatch` / `FedCmLoginPatch`. `clients.create()`
still uses the non-patch types, so create and update now require
different types for the same logical field. Code passing the old types
to `update()` must switch to the `*Patch` variants.
- **`UserDateSchema` removed — user date fields now `datetime`** — the
`UserDateSchema` type (`Union[str, Dict[str, Any]]`) is deleted and no
longer exported from `auth0.management.types`. `created_at`,
`updated_at`, `last_login`, `last_password_reset`, and
`multifactor_last_modified` on `GetUserResponseContent`,
`CreateUserResponseContent`, `UpdateUserResponseContent`, and
`UserResponseSchema` are now `Optional[datetime.datetime]`. Code that
read these as strings/dicts must update.

### Type Changes

- **Clients — FedCM / Google One Tap** — new `fedcm_login` (read:
`FedCmLogin`/`FedCmLoginGoogle`; write:
`FedCmLoginPatch`/`FedCmLoginGooglePatch`) on create/update/response,
gating the Google One Tap prompt in New Universal Login via
`fedcm_login.google.is_enabled`.
- **Clients — Native Social Login patch types** — new
`NativeSocialLoginPatch` wrapping `apple`/`facebook`/`google` patch
variants (each `enabled: Optional[bool]`) for `clients.update()`.
- **Clients — Token Vault Privileged Access** — new
`token_vault_privileged_access` field on create/update/response, typed
`ClientTokenVaultPrivilegedAccessWithPublicKey` (create) and
`ClientTokenVaultPrivilegedAccessWithCredentialId` (update), each with
`credentials` + `ip_allowlist`.
- **Connections — Cross App Access** — new
`cross_app_access_requesting_app` field
(`CrossAppAccessRequestingApp{active: bool}`) on
`connections.create()`/`update()`, OIDC/Okta request types, and all
connection response types.
- **Identity `user_id` widened to `Union[str, int]`** — on
`UserIdentitySchema`, `UserIdentity`, and
`DeleteUserIdentityResponseContentItem`, fixing Pydantic errors on
numeric (e.g. GitHub) identity IDs.
- **Email templates** — new `auth_email_by_code` value in
`EmailTemplateNameEnum`.
- **Attack Protection — Phone Provider Protection** — new
`attack_protection.phone_provider_protection` sub-client with `get()` /
`patch(type=...)` (`GET`/`PATCH
/attack-protection/phone-provider-protection`); new
`PhoneProviderProtectionBackoffStrategyEnum` (`exponential`/`none`) and
response types.

### Bug Fixes

- **404 handling added across multiple raw clients** — `keys.signing`,
`organizations` (connections, enabled connections, members, member
roles), `roles.permissions`, `self_service_profiles.sso_ticket`,
`user_attribute_profiles`, and `users` (connected accounts,
organizations, permissions, roles) now raise a typed `NotFoundError` on
404 instead of an unhandled parse error.

Author: rmad17

reference.md

@@ -1966,6 +1966,14 @@ client.clients.create(
 <dl>
 <dd>
 
+**token_vault_privileged_access:** `typing.Optional[ClientTokenVaultPrivilegedAccessWithPublicKey]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **compliance_level:** `typing.Optional[ClientComplianceLevelEnum]` 
 
 </dd>
@@ -2758,15 +2766,15 @@ client.clients.update(
 <dl>
 <dd>
 
-**native_social_login:** `typing.Optional[NativeSocialLogin]` 
+**native_social_login:** `typing.Optional[NativeSocialLoginPatch]` 
 
 </dd>
 </dl>
 
 <dl>
 <dd>
 
-**fedcm_login:** `typing.Optional[FedCmLogin]` 
+**fedcm_login:** `typing.Optional[FedCmLoginPatch]` 
 
 </dd>
 </dl>
@@ -2846,6 +2854,14 @@ client.clients.update(
 <dl>
 <dd>
 
+**token_vault_privileged_access:** `typing.Optional[ClientTokenVaultPrivilegedAccessWithCredentialId]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **compliance_level:** `typing.Optional[ClientComplianceLevelEnum]` 
 
 </dd>
@@ -3891,6 +3907,14 @@ client.connections.create(
 <dl>
 <dd>
 
+**cross_app_access_requesting_app:** `typing.Optional[CrossAppAccessRequestingApp]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -4204,6 +4228,14 @@ client.connections.update(
 <dl>
 <dd>
 
+**cross_app_access_requesting_app:** `typing.Optional[CrossAppAccessRequestingApp]` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
 **request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
 
 </dd>
@@ -5565,7 +5597,7 @@ client.email_templates.create(
 <dl>
 <dd>
 
-Retrieve an email template by pre-defined name. These names are `verify_email`, `verify_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, and `async_approval`. The names `change_password`, and `password_reset` are also supported for legacy scenarios.
+Retrieve an email template by pre-defined name. These names are `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, and `async_approval`. The names `change_password`, and `password_reset` are also supported for legacy scenarios.
 </dd>
 </dl>
 </dd>
@@ -5606,7 +5638,7 @@ client.email_templates.get(
 <dl>
 <dd>
 
-**template_name:** `EmailTemplateNameEnum` — Template name. Can be `verify_email`, `verify_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy).
+**template_name:** `EmailTemplateNameEnum` — Template name. Can be `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy).
 
 </dd>
 </dl>
@@ -5680,7 +5712,7 @@ client.email_templates.set(
 <dl>
 <dd>
 
-**template_name:** `EmailTemplateNameEnum` — Template name. Can be `verify_email`, `verify_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy).
+**template_name:** `EmailTemplateNameEnum` — Template name. Can be `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy).
 
 </dd>
 </dl>
@@ -5825,7 +5857,7 @@ client.email_templates.update(
 <dl>
 <dd>
 
-**template_name:** `EmailTemplateNameEnum` — Template name. Can be `verify_email`, `verify_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy).
+**template_name:** `EmailTemplateNameEnum` — Template name. Can be `verify_email`, `verify_email_by_code`, `auth_email_by_code`, `reset_email`, `reset_email_by_code`, `welcome_email`, `blocked_account`, `stolen_credentials`, `enrollment_email`, `mfa_oob_code`, `user_invitation`, `async_approval`, `change_password` (legacy), or `password_reset` (legacy).
 
 </dd>
 </dl>
@@ -19420,6 +19452,143 @@ client.attack_protection.captcha.update()
 </dl>
 
 
+</dd>
+</dl>
+</details>
+
+## AttackProtection PhoneProviderProtection
+<details><summary><code>client.attack_protection.phone_provider_protection.<a href="src/auth0.management/attack_protection/phone_provider_protection/client.py">get</a>() -> GetPhoneProviderProtectionResponseContent</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Get the phone provider protection configuration for a tenant.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```python
+from auth0.management import Auth0
+from auth0.management.environment import Auth0Environment
+
+client = Auth0(
+    token="<token>",
+    environment=Auth0Environment.DEFAULT,
+)
+
+client.attack_protection.phone_provider_protection.get()
+
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
+</dd>
+</dl>
+</details>
+
+<details><summary><code>client.attack_protection.phone_provider_protection.<a href="src/auth0.management/attack_protection/phone_provider_protection/client.py">patch</a>(...) -> PatchPhoneProviderProtectionResponseContent</code></summary>
+<dl>
+<dd>
+
+#### 📝 Description
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+Update the phone provider protection configuration for a tenant.
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### 🔌 Usage
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+```python
+from auth0.management import Auth0
+from auth0.management.environment import Auth0Environment
+
+client = Auth0(
+    token="<token>",
+    environment=Auth0Environment.DEFAULT,
+)
+
+client.attack_protection.phone_provider_protection.patch(
+    type="exponential",
+)
+
+```
+</dd>
+</dl>
+</dd>
+</dl>
+
+#### ⚙️ Parameters
+
+<dl>
+<dd>
+
+<dl>
+<dd>
+
+**type:** `PhoneProviderProtectionBackoffStrategyEnum` 
+    
+</dd>
+</dl>
+
+<dl>
+<dd>
+
+**request_options:** `typing.Optional[RequestOptions]` — Request-specific configuration.
+    
+</dd>
+</dl>
+</dd>
+</dl>
+
+
 </dd>
 </dl>
 </details>
@@ -37633,7 +37802,7 @@ client.users.identities.link(
 <dl>
 <dd>
 
-**user_id:** `typing.Optional[UserId]` 
+**user_id:** `typing.Optional[UserId]` — user_id of the secondary user account being linked.
 
 </dd>
 </dl>