fix: prevent false enabled_clients diff in database dry-run

src/tools/auth0/handlers/databases.ts

@@ -605,6 +605,22 @@ export default class DatabaseHandler extends DefaultAPIHandler {
       }),
     ]);
 
+    // `enabled_clients` is no longer returned by connections.list; it must be fetched from the
+    // dedicated enabled-clients endpoint. Without this enrichment the remote connection lacks the
+    // field entirely, so the dry-run diff reports a false "found in localObj but not in remoteObj".
+    const existingWithEnabledClients = await Promise.all(
+      existingDatabasesConnections.map(async (con) => {
+        if (!con?.id) return con;
+
+        const enabledClients = await getConnectionEnabledClients(this.client, con.id);
+        if (enabledClients && enabledClients.length) {
+          return { ...con, enabled_clients: enabledClients };
+        }
+
+        return con;
+      })
+    );
+
     const formatted = databases.map((db) => {
       const { options, ...rest } = db;
       const formattedOptions = this.getFormattedOptions(options, actions);
@@ -614,7 +630,7 @@ export default class DatabaseHandler extends DefaultAPIHandler {
         formattedDb.enabled_clients = getEnabledClients(
           assets,
           db,
-          existingDatabasesConnections,
+          existingWithEnabledClients,
           clients
         );
       }
@@ -625,7 +641,7 @@ export default class DatabaseHandler extends DefaultAPIHandler {
     return calculateDryRunChanges({
       type: this.type,
       assets: formatted,
-      existing: existingDatabasesConnections,
+      existing: existingWithEnabledClients,
       identifiers: this.identifiers,
       ignoreDryRunFields: this.getEffectiveIgnoreDryRunFields(),
     });

test/tools/auth0/handlers/dryRun.tests.ts

@@ -141,6 +141,50 @@ describe('#handler dryRunChanges', () => {
     expect(changes.update).to.have.length(0);
   });
 
+  it('databases should not report enabled_clients diff when remote clients match', async () => {
+    const auth0 = {
+      connections: {
+        list: (params: any) =>
+          mockPagedData(params, 'connections', [
+            {
+              id: 'con1',
+              name: 'db-one',
+              strategy: 'auth0',
+              options: {},
+            },
+          ]),
+        clients: {
+          // enabled_clients only comes from this dedicated endpoint, not from connections.list
+          get: (_connectionId: any, params: any) =>
+            mockPagedData(params, 'connections', [{ client_id: 'client-id-1' }]),
+        },
+      },
+      clients: {
+        list: (params: any) =>
+          mockPagedData(params, 'clients', [{ name: 'app-one', client_id: 'client-id-1' }]),
+      },
+      actions: {
+        list: (params: any) => mockPagedData(params, 'actions', []),
+      },
+      pool,
+    };
+
+    const handler = new DatabasesHandler({ client: pageClient(auth0 as any), config } as any);
+
+    const changes = await handler.dryRunChanges({
+      databases: [
+        {
+          name: 'db-one',
+          options: {},
+          enabled_clients: ['app-one'],
+        },
+      ],
+    } as any);
+
+    expect(changes.update).to.have.length(0);
+    expect(changes.create).to.have.length(0);
+  });
+
   it('actions should enrich module IDs during dry run', async () => {
     const auth0 = {
       actions: {