fix: sort attackProtection arrays on export to prevent spurious diffs (#1440)

[harshithRai]

🔧 Changes

Fixes non-deterministic ordering of enum-like arrays under attackProtection on export. Previously each export re-serialized these arrays in whatever order the Auth0 API returned, producing spurious git diffs even when nothing changed.

• Added sortAttackProtectionArrays() in src/context/defaults.ts - recursively sorts primitive arrays within the attackProtection subtree (e.g. shields, admin_notification_frequency, allowlist). Arrays of objects are left untouched.
• Wired it into both dump handlers:
  • src/context/yaml/handlers/attackProtection.ts (YAML export)
  • src/context/directory/handlers/attackProtection.ts (directory export)
• Sorting is generic/alphabetical (not a hardcoded canonical order), so new enum values added server-side sort automatically without a code change.

Shape

The array values are reordered on export; keys and structure are unchanged. Applies to YAML (tenant.yaml → attackProtection.*) and directory (attack-protection/*.json).

YAML (tenant.yaml):

# before
bruteForceProtection:
  shields:
    - user_notification
    - block
# after
bruteForceProtection:
  shields:
    - block
    - user_notification

Directory (attack-protection/brute-force-protection.json):
before:

{ "shields": ["user_notification", "block"] }

after:

{ "shields": ["block", "user_notification"] }

The first export after this change shows a one-time diff as arrays settle into sorted order; subsequent exports are stable. No effect on deploy/import - the API treats these arrays as order-insensitive.

📚 References

• Fixes Array sorting in YAML is non-deterministic #1440

🔬 Testing

Unit tests - added a sortAttackProtectionArrays suite in test/context/defaults.test.js (sorts primitive arrays across the subtree; output is identical regardless of input order; object arrays left untouched). Existing test/context/yaml/attackProtection.test.js and test/context/directory/attackProtection.test.js pass unchanged.

Manual - exported a real tenant twice into separate folders and diffed, for both formats:

• export -f yaml: two consecutive exports are byte-identical (diff clean); previously the arrays reordered between runs.
• export -f directory: attack-protection/brute-force-protection.json shields output as ["block", "user_notification"] (sorted).

Dry-run: verified sorting on export does not alter dry-run behavior: the dry-run comparator (src/tools/calculateDryRunChanges.ts) already normalizes array order before comparing primitive arrays, so it treats these arrays as order-insensitive. Sorting the exported file cannot introduce or suppress a detected change.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A) - N/A, no user-facing docs describe attackProtection array output

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.46%. Comparing base (88e3e61) to head (9491ef2).

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1460      +/-   ##
==========================================
+ Coverage   80.43%   80.46%   +0.03%     
==========================================
  Files         163      163              
  Lines        7712     7724      +12     
  Branches     1708     1711       +3     
==========================================
+ Hits         6203     6215      +12     
  Misses        810      810              
  Partials      699      699              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.