@pipedream/salesforce_rest_api 2.0.1 → 3.0.1

package/sources/new-email-template-instant/new-email-template-instant.mjs

@@ -7,7 +7,7 @@ export default {
   name: "New Email Template (Instant, of Selectable Type)",
   key: "salesforce_rest_api-new-email-template-instant",
   description: "Emit new event when an email template is created. [See the documentation](https://sforce.co/3yPSJZy)",
-  version: "0.0.12",
+  version: "0.0.13",
   props: {
     salesforce: common.props.salesforce,
     db: "$.service.db",

package/sources/new-feed-comment/new-feed-comment.mjs

@@ -12,7 +12,7 @@ export default {
   name: "New Chatter Feed Comment (Instant or Polling)",
   key: "salesforce_rest_api-new-feed-comment",
   description: "Emit new events for each Chatter FeedComment (reply) created in Salesforce, polling `FeedComment` via SOQL on `CreatedDate`. Use this to react to comments on Chatter posts, since Chatter activity does not update the parent record's `LastModifiedDate`. The payload includes both `ParentId` (a polymorphic reference to the feed's parent - either a record feed, e.g. a Case ID starting with `500`, or a User feed) and `FeedItemId` (the ID of the FeedItem the comment belongs to) - these are distinct fields; do not confuse them. Set `parentObjectType` to a parent object API name (e.g. `Case`) to only emit comments whose parent record is of that type. Set `excludeSelf` to `true` to drop comments authored by the connected integration user. Note: querying FeedComment without a parent filter requires the `View All Data` permission on the connected user. Attempts instant delivery via webhook and falls back to timer polling automatically. [See the documentation](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_feedcomment.htm)",
-  version: "0.0.5",
+  version: "0.0.6",
   props: {
     ...common.props,
     parentObjectType: {

package/sources/new-feed-item/new-feed-item.mjs

@@ -12,7 +12,7 @@ export default {
   name: "New Chatter Feed Item (Instant or Polling)",
   key: "salesforce_rest_api-new-feed-item",
   description: "Emit new events for each Chatter FeedItem (post) created in Salesforce, polling `FeedItem` via SOQL on `CreatedDate`. Use this to react to Chatter posts on Cases and other records, since Chatter activity does not update the parent record's `LastModifiedDate` (so **New Record (Instant, of Selectable Type)** and **New Case (Instant, of Selectable Type)** never emit for it). Set `parentObjectType` to the parent object's API name (e.g. `Case`, `Opportunity`) to only emit posts whose parent record is of that type. Set `excludeSelf` to `true` to drop posts authored by the connected integration user. Note: `Body` is null for system-generated post types (e.g. `TrackedChange`). Attempts instant delivery via webhook and falls back to timer polling automatically when the Streaming API does not support this object. [See the documentation](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_feeditem.htm)",
-  version: "0.0.5",
+  version: "0.0.6",
   props: {
     ...common.props,
     parentObjectType: {

package/sources/new-knowledge-article-instant/new-knowledge-article-instant.mjs

@@ -7,7 +7,7 @@ export default {
   name: "New Knowledge Article (Instant, of Selectable Type)",
   key: "salesforce_rest_api-new-knowledge-article-instant",
   description: "Emit new event when a knowledge article is created. [See the documentation](https://sforce.co/3yPSJZy)",
-  version: "0.0.12",
+  version: "0.0.13",
   props: {
     salesforce: common.props.salesforce,
     db: "$.service.db",

package/sources/new-outbound-message/new-outbound-message.mjs

@@ -1,12 +1,13 @@
 import { XMLParser } from "fast-xml-parser";
 import salesforce from "../../salesforce_rest_api.app.mjs";
+import constants from "../../common/constants.mjs";
 
 export default {
   type: "source",
   name: "New Outbound Message (Instant)",
   key: "salesforce_rest_api-new-outbound-message",
-  description: "Emit new event when a new outbound message is received in Salesforce.",
-  version: "0.1.14",
+  description: "Emit new event when a new outbound message is received in Salesforce. [See the documentation](https://developer.salesforce.com/docs/atlas.en-us.api.meta/api/sforce_api_om_outboundmessaging_notifications.htm)",
+  version: "1.0.0",
   dedupe: "unique",
   props: {
     db: "$.service.db",
@@ -15,6 +16,13 @@ export default {
       customResponse: true,
     },
     salesforce,
+    validateSessionId: {
+      type: "boolean",
+      label: "Validate Session ID",
+      description: "Additionally verify the `SessionId` of each outbound message against the Salesforce API. Requires the outbound message's `Send Session ID` option to be enabled. Leave this disabled unless you need it: sessions that are IP-locked, or that belong to a user without API access, cannot be verified and their messages are rejected.",
+      optional: true,
+      default: false,
+    },
     infoBox: {
       type: "alert",
       alertType: "info",
@@ -22,13 +30,33 @@ export default {
 \\
 Set the Outbound Message's \`Endpoint URL\` to the endpoint of this source, which you can view after it is created.
 \\
-The \`Send Session ID\` option must be enabled in Salesforce for validating outbound messages.`,
+The outbound message must be sent from the same Salesforce org as the connected account above. Each message is verified against that org's \`Organization Id\`, so the \`Send Session ID\` option is no longer required.`,
     },
   },
   methods: {
+    _getOrganizationId() {
+      return this.db.get("organizationId");
+    },
+    _setOrganizationId(organizationId) {
+      this.db.set("organizationId", organizationId);
+    },
+    _getOrganizationCheckedAt() {
+      return this.db.get("organizationCheckedAt") || 0;
+    },
+    _setOrganizationCheckedAt(timestamp) {
+      this.db.set("organizationCheckedAt", timestamp);
+    },
     _unwrapMessage(message) {
       const parser = new XMLParser({
         removeNSPrefix: true,
+        // Salesforce sends identifiers such as CaseNumber, postal codes and
+        // external IDs as digit strings. Parsing those as numbers strips
+        // leading zeros and rewrites E-notation and hex-like values.
+        numberParseOptions: {
+          leadingZeros: false,
+          eNotation: false,
+          hex: false,
+        },
       });
       const obj = parser.parse(message);
       const notifications = obj["Envelope"]["Body"].notifications;
@@ -55,22 +83,69 @@ The \`Send Session ID\` option must be enabled in Salesforce for validating outb
         },
       });
     },
-    async _isValidSessionId(sessionId) {
-      try {
-        const data = await this.salesforce.getUserInfo(sessionId);
-        return Boolean(data);
-      } catch (err) {
-        console.log("Error validating SessionId:", err);
+    // Compare on the leading 15 characters so that a 15 character ID and its 18
+    // character form match. Both values come from Salesforce in canonical case,
+    // so the comparison stays case-sensitive.
+    _toShortId(id) {
+      return `${id}`.slice(0, constants.ID_SHORT_LENGTH);
+    },
+    async _fetchOrganizationId() {
+      const { organization_id: organizationId } =
+        await this.salesforce.getUserInfo(this.salesforce._authToken());
+      return organizationId;
+    },
+    // The cached ID belongs to whichever account was connected when it was
+    // stored, and Salesforce exposes no stable connection identity to key it
+    // on. So re-resolve from the connected account whenever the incoming ID
+    // does not match: pointing the source at a different org then heals itself
+    // on the next message instead of rejecting every message from then on.
+    async _matchesConnectedOrganization(organizationId) {
+      const cachedOrganizationId = this._getOrganizationId();
+      if (cachedOrganizationId
+        && this._toShortId(organizationId) === this._toShortId(cachedOrganizationId)) {
+        return true;
+      }
+
+      // Re-resolve on a mismatch, but at most once per cooldown, so a stream of
+      // rejected messages cannot amplify into a stream of Salesforce API calls.
+      const now = Date.now();
+      if (now - this._getOrganizationCheckedAt() < constants.ORGANIZATION_REFRESH_COOLDOWN_MS) {
         return false;
       }
+
+      // Stamp before the request so a failing or concurrent refresh still
+      // consumes the cooldown rather than retrying on every delivery.
+      this._setOrganizationCheckedAt(now);
+      const currentOrganizationId = await this._fetchOrganizationId();
+      this._setOrganizationId(currentOrganizationId);
+      return this._toShortId(organizationId) === this._toShortId(currentOrganizationId);
+    },
+    // Errors are intentionally not caught: a session that cannot be verified
+    // must surface as a failed execution rather than a discarded message.
+    async _isValidSessionId(sessionId) {
+      const data = await this.salesforce.getUserInfo(sessionId);
+      return Boolean(data);
     },
     async _isValidSource(data) {
-      const { SessionId: sessionId } = data;
-      if (!sessionId) {
-        throw new Error("The outbound message is missing a Session ID. Please configure the outbound message to send Session ID to validate the webhook source.");
+      const {
+        OrganizationId: organizationId,
+        SessionId: sessionId,
+      } = data;
+      if (!organizationId) {
+        return false;
+      }
+
+      if (!(await this._matchesConnectedOrganization(organizationId))) {
+        return false;
       }
 
-      return this._isValidSessionId(sessionId);
+      if (!this.validateSessionId) {
+        return true;
+      }
+
+      return sessionId
+        ? this._isValidSessionId(sessionId)
+        : false;
     },
     generateMeta(data) {
       const {
@@ -78,7 +153,7 @@ The \`Send Session ID\` option must be enabled in Salesforce for validating outb
         Notification: { Id: eventId },
       } = data;
       const id = `${eventId}-${actionId}`;
-      const summary = JSON.stringify(data);
+      const summary = `New outbound message with ID ${eventId}`;
       const ts = Date.now();
       return {
         id,
@@ -89,13 +164,17 @@ The \`Send Session ID\` option must be enabled in Salesforce for validating outb
   },
   async run(event) {
     const { bodyRaw } = event;
-    this._sendHttpResponse(true);
     const data = this._unwrapMessage(bodyRaw);
+
     if (!(await this._isValidSource(data))) {
-      console.log("Skipping event from unrecognized source");
-      return;
+      // Acknowledge `false` so Salesforce keeps the message queued and retries
+      // for up to 24 hours, rather than dropping it as delivered.
+      this._sendHttpResponse(false);
+      throw new Error(`Rejected an outbound message from Salesforce organization \`${data.OrganizationId}\` (connected organization: \`${this._getOrganizationId() || "unknown"}\`). Check that this source is connected to the organization that sends the outbound message, and, if \`Validate Session ID\` is enabled, that the message includes a valid Session ID.`);
     }
 
+    this._sendHttpResponse(true);
+
     let notifications = data.Notification;
     if (!Array.isArray(notifications)) {
       notifications = [
@@ -104,7 +183,7 @@ The \`Send Session ID\` option must be enabled in Salesforce for validating outb
     }
 
     notifications.forEach((n) => {
-      const notification = Object.assign(data, {
+      const notification = Object.assign({}, data, {
         Notification: n,
       });
       this.$emit(notification, this.generateMeta(notification));

package/sources/new-record-instant/new-record-instant.mjs

@@ -6,7 +6,7 @@ export default {
   name: "New Record (Instant, of Selectable Type)",
   key: "salesforce_rest_api-new-record-instant",
   description: "Emit new event when a record of the selected object type is created. [See the documentation](https://sforce.co/3yPSJZy)",
-  version: "0.2.12",
+  version: "0.2.13",
   props: {
     ...common.props,
     fieldsToObtain: {

package/sources/record-deleted-instant/record-deleted-instant.mjs

@@ -7,7 +7,7 @@ export default {
   name: "New Deleted Record (Instant, of Selectable Type)",
   key: "salesforce_rest_api-record-deleted-instant",
   description: "Emit new event when a record of the selected object type is deleted. [See the documentation](https://sforce.co/3msDDEE)",
-  version: "0.1.11",
+  version: "0.1.12",
   methods: {
     ...common.methods,
     generateWebhookMeta(data) {

package/sources/record-updated-instant/record-updated-instant.mjs

@@ -7,7 +7,7 @@ export default {
   name: "New Updated Record (Instant, of Selectable Type)",
   key: "salesforce_rest_api-record-updated-instant",
   description: "Emit new event when a record of the selected type is updated. [See the documentation](https://sforce.co/3yPSJZy)",
-  version: "0.2.12",
+  version: "0.2.13",
   props: {
     ...common.props,
     fields: {