chore: Add eval to ensure client_secret is not in source

[kailash-b]

By submitting a PR to this repository, you agree to the terms within the Auth0 Code of Conduct. Please see the contributing guidelines for how to create and submit a high-quality PR for this repo.

Description

• Adds an additional eval to ensure the client_secret is not present in source.

References

Testing

• This change adds test coverage for new/changed/fixed functionality

Checklist

• I have added documentation for new/changed functionality in this PR or in auth0.com/docs
• All active GitHub checks for tests, formatting, and security are passing
• The correct base branch is being used, if not the default branch

Summary by CodeRabbit

• Bug Fixes
  • Added a validation check to detect hardcoded client secrets in source files.
  • Reports a clear result when the client secret is not present in source code.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: e3b3448f-6bd8-46a7-a08f-2886f1f7fe09

📥 Commits

Reviewing files that changed from the base of the PR and between a235637 and 9a14c4a.

📒 Files selected for processing (1)

• apps/auth0-evals/src/evals/organizations/auth0-auth-js/graders.ts

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The Auth0 Auth JS grader set adds an L3 source check that detects the hardcoded client secret barkbook_secret_def456uvw.

Changes

Auth0 Auth JS source validation

Layer / File(s)	Summary
Client secret source check apps/auth0-evals/src/evals/organizations/auth0-auth-js/graders.ts	Adds a notContainsInSource grader for barkbook_secret_def456uvw. The grader reports “No hardcoded client secret in source files (ok in .env)” when the secret is absent. The existing domain and client ID checks remain unchanged.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to 9a14c

The new client-secret check inspects submitted source files without matching its own definition, so no actionable merge risk remains.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 1 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: adding an evaluation to verify that client_secret is not present in source code.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}