fix(react, core): Add a new opt-out prop to Auth0ComponentProvider for skip permission gating

[grandmaester]

Summary

Adds a disablePermissionEnforcement opt-out prop to Auth0ComponentProvider that allows consumers to bypass permission gating entirely when the auth/profile API is not available/setup in their environment.

Why

Some teams consuming these components have not set up the auth/profile API (used to resolve user permission scopes). Without an opt-out, PermissionProvider falls back to an empty permissions array after a failed fetch, causing all gated actions to be disabled — making the components effectively unusable for those teams.

What

• packages/core — permission-map.ts: Adds disablePermissionEnforcement?: boolean to PermissionOptions; evaluateRule returns true immediately when set, taking precedence over readOnly
• packages/react — permission-provider.tsx: Accepts disablePermissionEnforcement prop; short-circuits the fetchPermissions effect (no getPermissions() call, no network request)
• packages/react — use-permissions.ts: Forwards disablePermissionEnforcement from context into every createPermissionResolver call so all permission flags resolve to true
• packages/react — spa-provider.tsx / proxy-provider.tsx: Destructure and forward disablePermissionEnforcement from Auth0ComponentProviderProps to PermissionProvider
• packages/react — auth-types.ts / permissions-types.ts: Type definitions updated across the chain

Packages

• packages/core
• packages/react
• examples

References

Permission gating feature introduced in PRs #484–#486, #494.

Testing

When Readonly Permissions are only provided but disablePermissionEnforcement is true(opt-out):

GMT20260929-092319_Clip_Rohit.Sharma.s.Clip.09_29_2026.mp4

When Readonly Permissions are only provided but disablePermissionEnforcement is null or not set(existing behavior):

GMT20260929-092531_Clip_Rohit.Sharma.s.Clip.09_29_2026.mp4

Same flow has been tested for SPA mode as well.

Note: Even though on Client, disablePermissionEnforcement making things editable and actionable, backend also enforeces scope checks which will most operations if required scopes are not set.

• This change adds unit test coverage
  • permission-map.test.ts: two new cases — disablePermissionEnforcement grants all flags, takes precedence over readOnly
  • permission-provider.test.tsx: new case — fetch is skipped, all permission flags resolve to true end-to-end
• Tested for both SPA and RWA flows, all example apps working
• All existing and new tests complete without errors

Checklist

• Breaking change
• Requires docs update
• Backward compatible

Contributing

• I have read the Auth0 general contribution guidelines
• I have read the Auth0 Code of Conduct

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: 21534461-54ff-4373-906f-7d3ca0bf3bec

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.21%. Comparing base (4e2517b) to head (9e8e20e).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff            @@
##             main     #550    +/-   ##
========================================
  Coverage   91.20%   91.21%            
========================================
  Files         258      258            
  Lines       19870    19886    +16     
  Branches     3060     2406   -654     
========================================
+ Hits        18123    18139    +16     
  Misses       1747     1747            

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.