@salesforce/templates 66.13.5 → 66.13.6

package/lib/templates/project/angularextapp/scripts/org-setup.mjs

@@ -46,6 +46,7 @@ import {
   existsSync,
   readFileSync,
   writeFileSync,
+  mkdirSync,
   mkdtempSync,
   rmSync,
   openSync,
@@ -286,6 +287,7 @@ function parseArgs() {
     skipGraphql: false,
     skipUIBundleBuild: false,
     skipSelfReg: false,
+    skipSocialLogin: false,
   };
   for (let i = 0; i < args.length; i++) {
     if (args[i] === '--target-org' && args[i + 1]) {
@@ -299,6 +301,7 @@ function parseArgs() {
     else if (args[i] === '--skip-role') flags.skipRole = true;
     else if (args[i] === '--skip-data') flags.skipData = true;
     else if (args[i] === '--skip-self-reg') flags.skipSelfReg = true;
+    else if (args[i] === '--skip-social-login') flags.skipSocialLogin = true;
     else if (args[i] === '--skip-graphql') flags.skipGraphql = true;
     else if (args[i] === '--skip-ui-bundle-build') flags.skipUIBundleBuild = true;
     // --skip-login and --skip-dev are retired: login is now an unconditional
@@ -322,6 +325,7 @@ Options:
   --permset-name <name>  Assign only this permission set (repeatable). Default: all sets under permissionsets/
   --skip-deploy          Do not deploy metadata
   --skip-permset         Do not assign permission set
+  --skip-social-login    Do not enable social login (auth providers + community profile)
   --skip-data            Do not prepare data or run data import
   --skip-graphql         Do not fetch schema or run GraphQL codegen
   --skip-ui-bundle-build Do not npm install / build the UI bundle
@@ -521,6 +525,435 @@ function loadSelfRegConfig(config) {
   };
 }
 
+/**
+ * Social login config, read from the already-validated config.
+ *
+ * Config shape:
+ *   {
+ *     "socialLogin": {
+ *       "communityMemberProfile": "Customer Community User",
+ *       "authProviderNames": ["Google", "Facebook", "My_SAML_Provider"],
+ *       "communityUserPermset": "myapp_Guest_User_Api_Access"   // optional
+ *     }
+ *   }
+ *
+ * - communityMemberProfile: profile added to NetworkMemberGroup (required for access)
+ * - authProviderNames: DeveloperNames of AuthProvider (OAuth) or SamlSsoConfig (SAML) records to link to site
+ * - communityUserPermset: permset assigned to community users so getCurrentUser()
+ *   works (requires PermissionsApiEnabled for /chatter/users/me via /sf/api/)
+ *
+ * Returns null if no "socialLogin" section exists in config (the step is hidden).
+ */
+function loadSocialLoginConfig(config) {
+  const section = config.socialLogin;
+  if (!section) return null;
+  return {
+    communityMemberProfile: section.communityMemberProfile,
+    authProviderNames: section.authProviderNames,
+    communityUserPermset: section.communityUserPermset || null,
+  };
+}
+
+/**
+ * Enable the "Allow using standard external profiles for self-registration,
+ * user creation, and login" org setting via Metadata API deploy.
+ *
+ * This setting is required for SSO registration handlers to create users with
+ * standard community profiles (e.g. "Customer Community User"). Without it,
+ * auth providers return FIELD_INTEGRITY_EXCEPTION on user insert.
+ *
+ * The correct metadata field is `enableOotbProfExtUserOpsEnable` in
+ * CommunitiesSettings. The REST/Tooling API approaches also fail on many
+ * org types. Deploying via Metadata API is the most reliable method.
+ */
+function enableExternalProfiles(targetOrg) {
+  const dir = mkdtempSync(join(tmpdir(), APEX_TMP_PREFIX));
+  try {
+    // Create a minimal sfdx project with just the Communities setting
+    const settingsDir = join(dir, 'force-app', 'main', 'default', 'settings');
+    mkdirSync(settingsDir, { recursive: true });
+
+    writeFileSync(join(dir, 'sfdx-project.json'), JSON.stringify({
+      packageDirectories: [{ path: 'force-app', default: true }],
+      sourceApiVersion: '68.0',
+    }));
+
+    writeFileSync(join(settingsDir, 'Communities.settings-meta.xml'), [
+      '<?xml version="1.0" encoding="UTF-8"?>',
+      '<CommunitiesSettings xmlns="http://soap.sforce.com/2006/04/metadata">',
+      '    <enableOotbProfExtUserOpsEnable>true</enableOotbProfExtUserOpsEnable>',
+      '</CommunitiesSettings>',
+    ].join('\n'));
+
+    const result = spawnSync('sf', [
+      'project', 'deploy', 'start',
+      '--target-org', targetOrg,
+      '--source-dir', join(dir, 'force-app'),
+      '--json',
+    ], { cwd: dir, stdio: 'pipe', shell: true, timeout: 120000 });
+
+    const out = result.stdout?.toString() || '';
+    let deployResult;
+    try { deployResult = JSON.parse(out); } catch { deployResult = null; }
+
+    if (deployResult?.status === 0 || deployResult?.result?.status === 'Succeeded') {
+      console.log('  Enabled "Allow using standard external profiles" org setting.');
+    } else {
+      // Check if it failed because the setting is already enabled or not deployable
+      const errMsg = deployResult?.message || deployResult?.result?.details?.componentFailures?.[0]?.problem || '';
+      if (errMsg.includes('already') || errMsg.includes('enableOotbProfExtUserOpsEnable')) {
+        console.log('  Warning: could not deploy "Allow standard external profiles" setting.');
+        console.log(`  Detail: ${errMsg}`);
+        console.log('  The setting may already be active. Enable manually via Setup > Digital Experiences > Settings if needed.');
+      } else {
+        console.log('  Warning: could not enable "Allow standard external profiles".');
+        console.log(`  Deploy result: ${errMsg || 'unknown error'}`);
+        console.log('  Enable manually via Setup > Digital Experiences > Settings.');
+      }
+    }
+  } finally {
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* best effort */ }
+  }
+}
+
+/**
+ * Enable Auth Providers for a community by creating AuthConfigProviders junction
+ * records via Anonymous Apex + REST API callouts.
+ *
+ * React (Site Container) sites intentionally hide SSO configuration in the Admin
+ * UI, so this must be done programmatically. The approach:
+ *   1. Query the AuthConfig record for the site (one per community).
+ *   2. Query AuthProvider records by DeveloperName.
+ *   3. Query SamlSsoConfig records by DeveloperName (for SAML providers).
+ *   4. Check existing AuthConfigProviders to avoid duplicates.
+ *   5. Create missing AuthConfigProviders via REST API (DML is not allowed on this object).
+ *
+ * AuthConfig.AuthOptionsAuthProvider auto-flips to true when AuthConfigProviders
+ * are inserted — no separate update needed.
+ *
+ * @param {string[]} authProviderNames - DeveloperNames of AuthProvider or SamlSsoConfig records
+ * @param {string} siteName - Name of the Network/community
+ * @param {string} targetOrg - Target org alias
+ */
+function enableAuthProvidersForSite(authProviderNames, siteName, targetOrg) {
+  // DML is not allowed on AuthConfigProviders, so we use Anonymous Apex with
+  // HTTP callouts to the REST API to create the junction records.
+  // Whitelist each DeveloperName before it is interpolated into the generated
+  // Apex `DeveloperName IN (…)` literal — same call-site guard the data-import
+  // path applies with validateApiName, and defense-in-depth alongside the
+  // up-front socialLogin validation in main(). loadSocialLoginConfig already
+  // rejects an empty list, so the resulting literal is never empty here.
+  const providerNamesLiteral = authProviderNames
+    .map((n) => `'${validateSoqlName(n, 'socialLogin.authProviderNames entry')}'`)
+    .join(', ');
+
+  const apex = `
+// Enable Auth Providers (OAuth + SAML) for community "${siteName}"
+Http http = new Http();
+String baseUrl = Url.getOrgDomainUrl().toExternalForm();
+String token = UserInfo.getSessionId();
+
+// Step 1: Find the AuthConfig for this site
+List<AuthConfig> authConfigs = [
+    SELECT Id, Url
+    FROM AuthConfig
+    WHERE Url LIKE '%${siteName}%'
+    LIMIT 1
+];
+if (authConfigs.isEmpty()) {
+    System.debug('ERROR_NO_AUTHCONFIG');
+    return;
+}
+AuthConfig ac = authConfigs[0];
+System.debug('AUTHCONFIG_FOUND:' + ac.Id + ':' + ac.Url);
+
+// Step 2: Query AuthProvider records by DeveloperName (OAuth providers)
+List<AuthProvider> oauthProviders = [
+    SELECT Id, DeveloperName, FriendlyName
+    FROM AuthProvider
+    WHERE DeveloperName IN (${providerNamesLiteral})
+];
+System.debug('OAUTH_PROVIDERS_FOUND:' + oauthProviders.size());
+
+// Step 3: Query SamlSsoConfig records by DeveloperName (SAML providers)
+List<SamlSsoConfig> samlProviders = [
+    SELECT Id, DeveloperName
+    FROM SamlSsoConfig
+    WHERE DeveloperName IN (${providerNamesLiteral})
+];
+System.debug('SAML_PROVIDERS_FOUND:' + samlProviders.size());
+
+// Combine both into a unified list with (Id, DeveloperName, Type)
+List<Map<String, String>> allProviders = new List<Map<String, String>>();
+for (AuthProvider ap : oauthProviders) {
+    allProviders.add(new Map<String, String>{
+        'Id' => ap.Id,
+        'DeveloperName' => ap.DeveloperName,
+        'Type' => 'OAuth'
+    });
+}
+for (SamlSsoConfig sp : samlProviders) {
+    allProviders.add(new Map<String, String>{
+        'Id' => sp.Id,
+        'DeveloperName' => sp.DeveloperName,
+        'Type' => 'SAML'
+    });
+}
+
+if (allProviders.isEmpty()) {
+    System.debug('ERROR_NO_PROVIDERS');
+    return;
+}
+System.debug('TOTAL_PROVIDERS_FOUND:' + allProviders.size());
+
+// Step 4: Check existing AuthConfigProviders to avoid duplicates
+Set<Id> existingProviderIds = new Set<Id>();
+for (AuthConfigProviders acp : [
+    SELECT AuthProviderId FROM AuthConfigProviders WHERE AuthConfigId = :ac.Id
+]) {
+    existingProviderIds.add(acp.AuthProviderId);
+}
+
+// Step 5: Create missing junction records via REST API
+Integer inserted = 0;
+for (Map<String, String> provider : allProviders) {
+    String providerId = provider.get('Id');
+    String providerName = provider.get('DeveloperName');
+    String providerType = provider.get('Type');
+
+    if (existingProviderIds.contains(providerId)) {
+        System.debug('ALREADY_LINKED:' + providerName + ':' + providerType);
+        continue;
+    }
+    HttpRequest req = new HttpRequest();
+    req.setEndpoint(baseUrl + '/services/data/v62.0/sobjects/AuthConfigProviders');
+    req.setMethod('POST');
+    req.setHeader('Authorization', 'Bearer ' + token);
+    req.setHeader('Content-Type', 'application/json');
+    req.setBody('{"AuthConfigId":"' + ac.Id + '","AuthProviderId":"' + providerId + '"}');
+    HttpResponse res = http.send(req);
+    if (res.getStatusCode() == 201 || res.getStatusCode() == 200) {
+        System.debug('INSERTED:' + providerName + ':' + providerType);
+        inserted++;
+    } else {
+        System.debug('INSERT_FAILED:' + providerName + ':' + providerType + ':' + res.getStatusCode() + ':' + res.getBody());
+    }
+}
+if (inserted == 0 && existingProviderIds.size() >= allProviders.size()) {
+    System.debug('ALL_ALREADY_LINKED');
+} else {
+    System.debug('TOTAL_INSERTED:' + inserted);
+}
+`;
+
+  const apexOut = withApexTempDir((writeApex) => {
+    const tmpApex = writeApex('auth-providers.apex', apex);
+    const result = spawnSync('sf', [
+      'apex', 'run', '--target-org', targetOrg, '--file', tmpApex,
+    ], { cwd: ROOT, stdio: 'pipe', shell: true, timeout: 60000 });
+    const out = result.stdout?.toString() || '';
+    const err = result.stderr?.toString() || '';
+    if (result.status !== 0 && !out.includes('Compiled successfully')) {
+      process.stderr.write(err || out);
+      throw new StepError('failed to execute AuthConfigProviders apex');
+    }
+    return out;
+  });
+
+  // Parse output for status — match only |DEBUG| lines to avoid false positives
+  // from the "Execute Anonymous:" source echo that sf apex run always prints.
+  if (apexOut.match(/\|DEBUG\|ERROR_NO_AUTHCONFIG/)) {
+    throw new StepError(`no AuthConfig found for site "${siteName}" — ensure the site is published/active`);
+  }
+  if (apexOut.match(/\|DEBUG\|ERROR_NO_PROVIDERS/)) {
+    throw new StepError(`no AuthProvider or SamlSsoConfig records found for names: ${authProviderNames.join(', ')} — create them in Setup first`);
+  }
+
+  // Check for insert failures
+  const insertFails = [...apexOut.matchAll(/\|DEBUG\|INSERT_FAILED:([^:]+):(OAuth|SAML):(\d+):([^\n]+)/g)];
+  if (insertFails.length > 0) {
+    for (const m of insertFails) {
+      console.error(`    ✖ ${m[1]} (${m[2]}) — HTTP ${m[3]}: ${m[4].trim()}`);
+    }
+    throw new StepError(`failed to link ${insertFails.length} Auth Provider(s) to site AuthConfig`);
+  }
+
+  const totalMatch = apexOut.match(/\|DEBUG\|TOTAL_INSERTED:(\d+)/);
+  if (totalMatch) {
+    console.log(`  Linked ${totalMatch[1]} Auth Provider(s) to site "${siteName}".`);
+  } else if (apexOut.match(/\|DEBUG\|ALL_ALREADY_LINKED/)) {
+    console.log(`  All Auth Provider(s) already linked to site "${siteName}"; no changes needed.`);
+  }
+
+  // Log individual provider statuses
+  const alreadyLinked = [...apexOut.matchAll(/\|DEBUG\|ALREADY_LINKED:([^:]+):(OAuth|SAML)/g)];
+  for (const m of alreadyLinked) {
+    console.log(`    ✔ ${m[1]} (${m[2]}, already linked)`);
+  }
+  const inserted = [...apexOut.matchAll(/\|DEBUG\|INSERTED:([^:]+):(OAuth|SAML)/g)];
+  for (const m of inserted) {
+    console.log(`    + ${m[1]} (${m[2]}, newly linked)`);
+  }
+}
+
+/**
+ * Add a community user profile to the NetworkMemberGroup so that SSO-registered
+ * users (who get assigned this profile by the registration handler) can access
+ * the community.
+ *
+ * Without this, users created by the SSO registration handler get
+ * "NO_ACCESS: User was not authorized for the community".
+ *
+ * @param {string} profileName - Profile name to add (e.g. "Customer Community User")
+ * @param {string} siteName - Name of the Network/community
+ * @param {string} targetOrg - Target org alias
+ */
+function addCommunityMemberProfile(profileName, siteName, targetOrg) {
+  // Query Network Id
+  const netQuery = `SELECT Id FROM Network WHERE Name = '${siteName}'`;
+  const netResult = spawnSync('sf', [
+    'data', 'query', '--query', netQuery, '--target-org', targetOrg, '--json',
+  ], { cwd: ROOT, encoding: 'utf8' });
+  let networkId = null;
+  if (netResult.status === 0) {
+    try {
+      const json = JSON.parse(netResult.stdout);
+      networkId = json.result?.records?.[0]?.Id || null;
+    } catch { /* fall through */ }
+  }
+  if (!networkId) {
+    throw new StepError(`could not find Network "${siteName}" in org`);
+  }
+
+  // Query Profile Id
+  const profQuery = `SELECT Id FROM Profile WHERE Name = '${profileName}'`;
+  const profResult = spawnSync('sf', [
+    'data', 'query', '--query', profQuery, '--target-org', targetOrg, '--json',
+  ], { cwd: ROOT, encoding: 'utf8' });
+  let profileId = null;
+  if (profResult.status === 0) {
+    try {
+      const json = JSON.parse(profResult.stdout);
+      profileId = json.result?.records?.[0]?.Id || null;
+    } catch { /* fall through */ }
+  }
+  if (!profileId) {
+    throw new StepError(`could not find Profile "${profileName}" in org`);
+  }
+
+  // Check if already a member
+  const memberQuery = `SELECT Id FROM NetworkMemberGroup WHERE NetworkId = '${networkId}' AND ParentId = '${profileId}'`;
+  const memberResult = spawnSync('sf', [
+    'data', 'query', '--query', memberQuery, '--target-org', targetOrg, '--json',
+  ], { cwd: ROOT, encoding: 'utf8' });
+  let alreadyExists = false;
+  if (memberResult.status === 0) {
+    try {
+      const json = JSON.parse(memberResult.stdout);
+      alreadyExists = (json.result?.records?.length || 0) > 0;
+    } catch { /* proceed to create */ }
+  }
+  if (alreadyExists) {
+    console.log(`  Profile "${profileName}" is already a member of community "${siteName}"; skipping.`);
+    return;
+  }
+
+  // Create NetworkMemberGroup record
+  const createResult = spawnSync('sf', [
+    'data', 'create', 'record',
+    '--sobject', 'NetworkMemberGroup',
+    '--values', `NetworkId='${networkId}' ParentId='${profileId}'`,
+    '--target-org', targetOrg,
+    '--json',
+  ], { cwd: ROOT, encoding: 'utf8' });
+  if (createResult.status !== 0) {
+    const out = (createResult.stderr || '') + (createResult.stdout || '');
+    if (out) process.stderr.write(out);
+    throw new StepError(`failed to add profile "${profileName}" to NetworkMemberGroup for "${siteName}"`);
+  }
+  try {
+    const json = JSON.parse(createResult.stdout);
+    const id = json.result?.id;
+    console.log(`  Added profile "${profileName}" to community "${siteName}" (NetworkMemberGroup: ${id}).`);
+  } catch {
+    console.log(`  Added profile "${profileName}" to community "${siteName}".`);
+  }
+}
+
+/**
+ * Assign a permission set to all existing community users with a given profile.
+ *
+ * After SSO login, community users need the app's API-enabled permset so that
+ * getCurrentUser() (which calls /chatter/users/me via the /sf/api/ proxy) works.
+ * Without PermissionsApiEnabled the proxy returns API_DISABLED_FOR_ORG and the
+ * React app treats the user as unauthenticated.
+ *
+ * This is idempotent: already-assigned users are skipped.
+ */
+function assignPermsetToCommunityUsers(permsetName, profileName, targetOrg) {
+  // Resolve PermissionSet Id
+  const psQuery = `SELECT Id FROM PermissionSet WHERE Name = '${permsetName}'`;
+  const psResult = spawnSync('sf', [
+    'data', 'query', '--query', psQuery, '--target-org', targetOrg, '--json',
+  ], { cwd: ROOT, encoding: 'utf8' });
+  let permsetId = null;
+  if (psResult.status === 0) {
+    try {
+      const json = JSON.parse(psResult.stdout);
+      permsetId = json.result?.records?.[0]?.Id || null;
+    } catch { /* fall through */ }
+  }
+  if (!permsetId) {
+    throw new StepError(`could not find PermissionSet "${permsetName}" in org`);
+  }
+
+  // Find community users on the given profile who do NOT already have the permset
+  const usersQuery = [
+    `SELECT Id, Username FROM User`,
+    `WHERE Profile.Name = '${profileName}'`,
+    `AND IsActive = true`,
+    `AND UserType IN ('CspLitePortal', 'CustomerSuccess', 'PowerCustomerSuccess')`,
+    `AND Id NOT IN (SELECT AssigneeId FROM PermissionSetAssignment WHERE PermissionSetId = '${permsetId}')`,
+  ].join(' ');
+  const usersResult = spawnSync('sf', [
+    'data', 'query', '--query', usersQuery, '--target-org', targetOrg, '--json',
+  ], { cwd: ROOT, encoding: 'utf8' });
+  let users = [];
+  if (usersResult.status === 0) {
+    try {
+      const json = JSON.parse(usersResult.stdout);
+      users = json.result?.records || [];
+    } catch { /* empty list */ }
+  }
+
+  if (users.length === 0) {
+    console.log(`  No community users on profile "${profileName}" need permset "${permsetName}"; skipping.`);
+    return;
+  }
+
+  // Assign the permset to each user
+  let assigned = 0;
+  for (const user of users) {
+    const createResult = spawnSync('sf', [
+      'data', 'create', 'record',
+      '--sobject', 'PermissionSetAssignment',
+      '--values', `PermissionSetId='${permsetId}' AssigneeId='${user.Id}'`,
+      '--target-org', targetOrg,
+      '--json',
+    ], { cwd: ROOT, encoding: 'utf8' });
+    if (createResult.status === 0) {
+      assigned++;
+    } else {
+      // Log but don't fail — user might already have it via race condition
+      const out = (createResult.stdout || '') + (createResult.stderr || '');
+      if (!out.includes('DUPLICATE_VALUE')) {
+        console.warn(`  Warning: could not assign "${permsetName}" to ${user.Username}: ${out.slice(0, 120)}`);
+      }
+    }
+  }
+  console.log(`  Assigned permset "${permsetName}" to ${assigned}/${users.length} community user(s).`);
+}
+
 /**
  * Ensure the self-registration profile is listed in networkMemberGroups.
  * This must happen BEFORE the initial deploy so that the profile is a recognised
@@ -1056,7 +1489,10 @@ function buildApexInsert(sobject, records, refIds) {
   lines.push('  else { m.put(\'err\', results[i].getErrors()[0].getMessage()); }');
   lines.push('  setupOut.add(m);');
   lines.push('}');
-  lines.push("System.debug('SETUP_RESULT_JSON:' + JSON.serialize(setupOut));");
+  // Use LoggingLevel.ERROR to ensure this critical line appears near the end of
+  // the debug log and isn't truncated by excessive DEBUG-level noise from DML
+  // operations, workflow rules, or process builders that fire during insert.
+  lines.push("System.debug(LoggingLevel.ERROR, 'SETUP_RESULT_JSON:' + JSON.serialize(setupOut));");
   return lines.join('\n');
 }
 
@@ -1316,6 +1752,7 @@ async function main() {
     skipPermset: argSkipPermset,
     skipRole: argSkipRole,
     skipSelfReg: argSkipSelfReg,
+    skipSocialLogin: argSkipSocialLogin,
     skipData: argSkipData,
     skipGraphql: argSkipGraphql,
     skipUIBundleBuild: argSkipUIBundleBuild,
@@ -1349,6 +1786,8 @@ async function main() {
   const hasRoleConfig = roleConfig !== null;
   const selfRegConfig = loadSelfRegConfig(config);
   const hasSelfRegConfig = selfRegConfig !== null;
+  const socialLoginConfig = loadSocialLoginConfig(config);
+  const hasSocialLoginConfig = socialLoginConfig !== null;
 
   // Validate the selfRegProfile name for SOQL-safety up front, alongside the
   // config validation and BEFORE any org mutation (login/deploy). A quote /
@@ -1364,6 +1803,30 @@ async function main() {
     }
   }
 
+  // Same fail-fast treatment for the socialLogin identifiers, alongside the
+  // self-reg guard above and BEFORE any org mutation. communityMemberProfile,
+  // every authProviderNames entry, and the optional communityUserPermset are all
+  // interpolated into generated SOQL / CLI value strings — the Profile and
+  // PermissionSet `WHERE Name = '…'` lookups, the AuthProvider/SamlSsoConfig
+  // `DeveloperName IN (…)` list, and the NetworkMemberGroup/User queries. These
+  // are developer-authored identifiers the app ships, so a quote / backslash /
+  // control char is a config mistake to surface loudly here rather than a value
+  // to silently escape (same rationale as validateSoqlName's self-reg use).
+  if (hasSocialLoginConfig) {
+    try {
+      validateSoqlName(socialLoginConfig.communityMemberProfile, 'socialLogin.communityMemberProfile');
+      for (const providerName of socialLoginConfig.authProviderNames ?? []) {
+        validateSoqlName(providerName, 'socialLogin.authProviderNames entry');
+      }
+      if (socialLoginConfig.communityUserPermset) {
+        validateSoqlName(socialLoginConfig.communityUserPermset, 'socialLogin.communityUserPermset');
+      }
+    } catch (err) {
+      console.error(`Invalid org-setup.config.json:\n  - ${err.message}`);
+      process.exit(1);
+    }
+  }
+
   // failFast is a fixed, implementer-owned classification — NOT
   // user-configurable. A fail-fast failure aborts the run immediately; a
   // skippable failure is recorded and the run continues. The exit code is
@@ -1378,6 +1841,7 @@ async function main() {
     { key: 'permset', label: permsetStepLabel, enabled: !argSkipPermset, available: true, failFast: false },
     { key: 'role', label: `Role — assign "${roleConfig?.roleName ?? '?'}" to current user`, enabled: !argSkipRole && hasRoleConfig, available: hasRoleConfig, failFast: false },
     { key: 'selfReg', label: 'Self-Registration — enable for site', enabled: !argSkipSelfReg && hasSelfRegConfig, available: hasSelfRegConfig, failFast: false },
+    { key: 'socialLogin', label: 'Social Login — enable auth providers + community profile', enabled: !argSkipSocialLogin && hasSocialLoginConfig, available: hasSocialLoginConfig, failFast: false },
     { key: 'data', label: 'Data — delete + import records via Apex', enabled: !argSkipData && hasDataPlan, available: hasDataPlan, failFast: true },
     { key: 'graphql', label: 'GraphQL — schema introspect + codegen', enabled: !argSkipGraphql, available: true, failFast: true },
   ];
@@ -1393,6 +1857,7 @@ async function main() {
   const skipPermset = !on.permset;
   const skipRole = !on.role;
   const skipSelfReg = !on.selfReg;
+  const skipSocialLogin = !on.socialLogin;
   const skipData = !on.data;
   const skipGraphql = !on.graphql;
 
@@ -1402,11 +1867,12 @@ async function main() {
 
   console.log('Setup — target org:', targetOrg, '| UI bundle:', uiBundleDir ?? '(none)');
   console.log(
-    'Steps: login=always deploy=%s permset=%s role=%s selfReg=%s data=%s graphql=%s uiBundle=%s',
+    'Steps: login=always deploy=%s permset=%s role=%s selfReg=%s socialLogin=%s data=%s graphql=%s uiBundle=%s',
     !skipDeploy,
     !skipPermset,
     !skipRole,
     !skipSelfReg,
+    !skipSocialLogin,
     doData,
     !skipGraphql,
     !skipUIBundleBuild
@@ -1619,6 +2085,53 @@ async function main() {
     recordSkipped(selfRegStep, selfRegStep.available ? 'not selected' : 'no config');
   }
 
+  const socialLoginStep = stepDefs.find((s) => s.key === 'socialLogin');
+  if (!skipSocialLogin) {
+    console.log('\n--- Social Login — enable auth providers + community profile ---');
+    await runStep(socialLoginStep, targetOrg, () => {
+      const siteName = deriveSiteName();
+      if (!siteName) {
+        throw new StepError(
+          'socialLogin is configured but no networks/<siteName>.network-meta.xml was found to derive the site',
+        );
+      }
+
+      const totalSubSteps = socialLoginConfig.communityUserPermset ? 4 : 3;
+
+      // Sub-step 1: Enable "Allow using standard external profiles" org setting.
+      // This is required so the SSO registration handler can create users with
+      // standard community profiles (e.g. "Customer Community User").
+      console.log(`  [1/${totalSubSteps}] Enabling "Allow standard external profiles" setting...`);
+      enableExternalProfiles(targetOrg);
+
+      // Sub-step 2: Link Auth Providers to the site's AuthConfig.
+      // React (Site Container) sites hide SSO config in Admin UI, so this must
+      // be done programmatically via AuthConfig/AuthConfigProviders records.
+      console.log(`  [2/${totalSubSteps}] Linking Auth Providers to site AuthConfig...`);
+      enableAuthProvidersForSite(socialLoginConfig.authProviderNames, siteName, targetOrg);
+
+      // Sub-step 3: Add the community member profile to NetworkMemberGroup.
+      // Without this, users created by the registration handler get
+      // "NO_ACCESS: User was not authorized for the community".
+      console.log(`  [3/${totalSubSteps}] Adding community member profile to NetworkMemberGroup...`);
+      addCommunityMemberProfile(socialLoginConfig.communityMemberProfile, siteName, targetOrg);
+
+      // Sub-step 4 (optional): Assign API-enabled permset to community users.
+      // Without this, getCurrentUser() fails because /chatter/users/me requires
+      // PermissionsApiEnabled which the standard community profile lacks.
+      if (socialLoginConfig.communityUserPermset) {
+        console.log(`  [4/${totalSubSteps}] Assigning API permset to community users...`);
+        assignPermsetToCommunityUsers(
+          socialLoginConfig.communityUserPermset,
+          socialLoginConfig.communityMemberProfile,
+          targetOrg,
+        );
+      }
+    });
+  } else {
+    recordSkipped(socialLoginStep, socialLoginStep.available ? 'not selected' : 'no config');
+  }
+
   const dataStep = stepDefs.find((s) => s.key === 'data');
   if (doData) {
    await runStep(dataStep, targetOrg, () => {
@@ -1672,8 +2185,14 @@ async function main() {
     // API headers (Sforce-Duplicate-Rule-Action) cannot override.
     console.log('\n--- Data import (Apex) ---');
     const refMap = new Map();
+    // Apex anonymous code is capped at ~1M chars total, but each batch is much
+    // smaller in practice. The real constraint is the SETUP_RESULT_JSON debug log
+    // line: Salesforce truncates debug lines at ~5KB, and large batches produce
+    // JSON arrays that exceed that limit. With RESULT_JSON_PER_RECORD = 150 and
+    // MAX_BATCH = 100, the worst-case output is ~15KB of JSON, which fits
+    // comfortably after the debug-line prefix and the marker.
     const APEX_CHAR_LIMIT = 25000;
-    const APEX_MAX_BATCH = 200;
+    const APEX_MAX_BATCH = 100;
 
     for (const entry of planEntries) {
       for (const file of entry.files) {
@@ -1705,7 +2224,16 @@ async function main() {
         // rendered refId literal is counted here too (mirroring the same
         // referenceId/_idx fallback the batch emit uses) — otherwise sizing
         // under-counts and a packed batch could edge past APEX_CHAR_LIMIT.
+        //
+        // CRITICAL: also account for the SETUP_RESULT_JSON output size. The
+        // System.debug line can exceed the Salesforce debug log line limit when
+        // the serialized JSON array is large. Estimate ~85 chars per success
+        // result ({"ref":"_idxNNN","id":"001XXXXXXXXXXXXXXX"}) and ~150 chars per
+        // potential error ({"ref":"_idxNNN","err":"typical error message"}), taking
+        // the higher value to be conservative. This ensures the batching prevents
+        // log truncation that would fail parseApexInsertResults.
         const overhead = buildApexInsert(entry.sobject, [], []).length;
+        const RESULT_JSON_PER_RECORD = 150;
         const recordSizes = records.map((rec, i) => {
           let size = `{ ${entry.sobject} r = new ${entry.sobject}();\n`.length + 'recs.add(r); }\n'.length;
           for (const [key, val] of Object.entries(rec)) {
@@ -1714,6 +2242,10 @@ async function main() {
           }
           const refId = rec.attributes?.referenceId || `_idx${i}`;
           size += `'${escapeSoqlString(refId)}',`.length;
+          // Add the estimated size of this record's JSON result entry in the
+          // SETUP_RESULT_JSON output. Without this, large batches can produce
+          // debug log lines that exceed Salesforce's limit and get truncated.
+          size += RESULT_JSON_PER_RECORD;
           return size;
         });
         const batches = planApexBatches(recordSizes, {