openstax_salesforce 8.3.0 → 9.0.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bf919b6d6920d7d82d015943b3ff8d549d07cf17efeb7c96a647325db8c0d4b2
-  data.tar.gz: 49c7b037ee8efd35440f57c522835da9492f2113ecc4108fe0dd82acd9a43ca0
+  metadata.gz: 2df3568d0d57428c97b0eff64ce15be14c9e16912bf756fcc9ed937a88e18ac2
+  data.tar.gz: 1c8571197d7287c9d1d20c8e96044215c18884761b81fb96071c53839b3c0713
 SHA512:
-  metadata.gz: 0211e9fb82f1f97c7a9e84262b90f8e8f8b43a265505d0ead8472828b6abf28cf5377cbfcc4395e0b42bee9dfb19e321eeadb231c8728274af7756a18ad39d81
-  data.tar.gz: 97fe491307cc943429e4e3bf557bcbc5de2907d3a1d63a428ce3172e59f5645b48d724c6d3d842fa9f474359dadd08b8425ce74550a61d171c0d14703ac88949
+  metadata.gz: c9f27f8ac4bda5075dfb9d4f048ab0c29e930cea5dd13f4ecbf5776bb58e85e66152a79c41ccd476cdad6636c8eaca4b24eb7ad35c2e0d1bc1734406cfca0f44
+  data.tar.gz: 7fbb3be31886114129e888d45d7f0dff61f00f037c55fb0af7af50c809641133ee89c8249d6d83f18435623707a4a27a8a5fe12a56ba924ca4507ad4f6dcc67c

data/README.md

@@ -38,13 +38,24 @@ After installation, the initializer for OpenStax::Salesforce will be located und
 `config/initializers/openstax_salesforce.rb`. Make sure to configure it to suit your needs.
 
 You will need the following information from Salesforce:
-  - Your username (append .sandboxname if using a sandbox)
-  - Your password
-  - Your security token
   - Connected App's client key
   - Connected App's client secret
+  - Your org's My Domain login domain (e.g. `openstax.my.salesforce.com`, or
+    `openstax--sandboxname.sandbox.my.salesforce.com` for a sandbox)
 Enter all the above information in the initializer, secrets.yml or environment variables.
 
+This uses the OAuth 2.0 client credentials flow. In Salesforce, the Connected App
+needs "Enable Client Credentials Flow" checked and a **Run As** user set under
+OAuth Policies — every object and field this gem touches must be readable and
+writable by that user. Requests to `login.salesforce.com` and `test.salesforce.com`
+are not supported by this flow, which is why the login domain must be My Domain.
+
+### Username-password flow (deprecated)
+
+Also setting `username`, `password` and `security_token` switches back to the OAuth
+username-password flow. Salesforce stops supporting it in Spring '27, so this exists
+only to let apps migrate one at a time. Leave the username unset for new setups.
+
 ## Testing
 
 From the gem's main folder, run `bundle install` and then `bundle exec rake` to run all the specs.

data/config/initializers/openstax_salesforce.rb

@@ -9,13 +9,18 @@ OpenStax::Salesforce.configure do |config|
     raise "Add a `salesforce` section to your Rails secrets!"
   end
 
-  # Username, client id, instance url and private key for connecting to the Salesforce app
+  # Connected App credentials for the OAuth client credentials flow. The login
+  # domain must be the org's My Domain; Salesforce rejects this flow at
+  # login.salesforce.com and test.salesforce.com.
+  config.consumer_key    = salesforce_secrets[:consumer_key]
+  config.consumer_secret = salesforce_secrets[:consumer_secret]
+
+  # Setting these switches back to the username-password flow, which Salesforce
+  # stops supporting in Spring '27. See the README.
   config.username        = salesforce_secrets[:username]
   config.password        = salesforce_secrets[:password]
   config.security_token  = salesforce_secrets[:security_token]
-  config.consumer_key    = salesforce_secrets[:consumer_key]
-  config.consumer_secret = salesforce_secrets[:consumer_secret]
 
-  config.api_version  = salesforce_secrets.fetch :api_version, '37.0'
+  config.api_version  = salesforce_secrets.fetch :api_version, '61.0'
   config.login_domain = salesforce_secrets.fetch :login_domain, 'test.salesforce.com'
 end

data/lib/openstax/salesforce/client.rb

@@ -7,14 +7,25 @@ module OpenStax
 
         configuration.validate!
 
+        # Restforce picks its auth middleware from whichever options are present, and
+        # a username/password pair wins over client credentials.
+        legacy_options =
+          if configuration.username_password_flow?
+            {
+              username: configuration.username,
+              password: configuration.password,
+              security_token: configuration.security_token
+            }
+          else
+            {}
+          end
+
         super(
-          username: configuration.username,
-          password: configuration.password,
-          security_token: configuration.security_token,
           client_id: configuration.consumer_key,
           client_secret: configuration.consumer_secret,
           api_version: configuration.api_version,
-          host: configuration.login_domain
+          host: configuration.login_domain,
+          **legacy_options
         )
       end
     end

data/lib/openstax/salesforce/version.rb

@@ -1,5 +1,5 @@
 module OpenStax
   module Salesforce
-    VERSION = '8.3.0'
+    VERSION = '9.0.0'
   end
 end

data/lib/openstax_salesforce.rb

@@ -19,6 +19,9 @@ require "openstax/salesforce/remote/campaign_member"
 require "openstax/salesforce/remote/account_contact_relation"
 require "openstax/salesforce/remote/openstax_account"
 
+# openstax_utilities defines this too, but this gem doesn't depend on it
+class IllegalState < StandardError; end unless defined?(IllegalState)
+
 module OpenStax
   module Salesforce
     def self.configure
@@ -31,6 +34,9 @@ module OpenStax
 
     # See `config/initializers/openstax_salesforce.rb` for documentation on options
     class Configuration
+      # Salesforce rejects client credentials token requests sent to these
+      GENERIC_LOGIN_DOMAINS = %w[login.salesforce.com test.salesforce.com].freeze
+
       attr_writer :api_version, :login_domain
       attr_accessor :username, :password, :security_token, :consumer_key, :consumer_secret
 
@@ -42,12 +48,39 @@ module OpenStax
         @login_domain ||= 'test.salesforce.com'
       end
 
+      # Salesforce retires the OAuth username-password flow in Spring '27, so a
+      # username is now optional: leave it unset to use client credentials.
+      def username_password_flow?
+        !username.nil?
+      end
+
       def validate!
-        raise(IllegalState, "The Salesforce username is missing") if username.nil?
-        raise(IllegalState, "The Salesforce password is missing") if password.nil?
-        raise(IllegalState, "The Salesforce security token is missing") if security_token.nil?
         raise(IllegalState, "The Salesforce consumer key is missing") if consumer_key.nil?
         raise(IllegalState, "The Salesforce consumer secret is missing") if consumer_secret.nil?
+
+        if username_password_flow?
+          raise(IllegalState, "The Salesforce password is missing") if password.nil?
+          raise(IllegalState, "The Salesforce security token is missing") if security_token.nil?
+          return
+        end
+
+        # Half-removed credentials would otherwise switch flows silently
+        unless password.nil? && security_token.nil?
+          raise(
+            IllegalState,
+            "The Salesforce password and security token only apply to the username-password " \
+            "flow. Remove them to use client credentials, or set a username to keep using " \
+            "the username-password flow."
+          )
+        end
+
+        if GENERIC_LOGIN_DOMAINS.include?(login_domain)
+          raise(
+            IllegalState,
+            "The Salesforce client credentials flow requires the org's My Domain as the " \
+            "login domain (e.g. myorg.my.salesforce.com), not #{login_domain}"
+          )
+        end
       end
     end
 

metadata

@@ -1,16 +1,16 @@
 --- !ruby/object:Gem::Specification
 name: openstax_salesforce
 version: !ruby/object:Gem::Version
-  version: 8.3.0
+  version: 9.0.0
 platform: ruby
 authors:
 - JP Slavinsky
 - Dante Soares
 - Michael Volo
-autorequire: 
+autorequire:
 bindir: bin
 cert_chain: []
-date: 2026-05-13 00:00:00.000000000 Z
+date: 2026-08-17 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails
@@ -18,34 +18,28 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '6.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '5.0'
-    - - "<"
-      - !ruby/object:Gem::Version
-        version: '7.0'
+        version: '6.1'
 - !ruby/object:Gem::Dependency
   name: restforce
   requirement: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '7.1'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '0'
+        version: '7.1'
 - !ruby/object:Gem::Dependency
   name: openstax_active_force
   requirement: !ruby/object:Gem::Requirement
@@ -180,7 +174,7 @@ homepage: https://github.com/openstax/openstax_salesforce
 licenses:
 - MIT
 metadata: {}
-post_install_message: 
+post_install_message:
 rdoc_options: []
 require_paths:
 - lib
@@ -188,15 +182,15 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '0'
+      version: '3.0'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
       version: '0'
 requirements: []
-rubygems_version: 3.0.3.1
-signing_key: 
+rubygems_version: 3.3.27
+signing_key:
 specification_version: 4
 summary: Interface gem for accessing OpenStax's Salesforce instance
 test_files: []