@salesforce/webapp-template-app-react-sample-b2x-experimental 1.68.0 → 1.69.0

package/dist/force-app/main/default/webapplications/appreactsampleb2x/src/utils/linkUtils.ts

@@ -0,0 +1,14 @@
+/**
+ * Shared allowlist for link protocols (e.g. for FormattedUrl, and future mailto/tel if rendered as links).
+ * Centralizes protocol checks so new link types can be added in one place.
+ */
+export const ALLOWED_LINK_PROTOCOLS = ["http:", "https:"] as const;
+
+export function isAllowedLinkUrl(value: string): boolean {
+	try {
+		const u = new URL(value);
+		return (ALLOWED_LINK_PROTOCOLS as readonly string[]).includes(u.protocol);
+	} catch {
+		return false;
+	}
+}

package/dist/force-app/main/default/webapplications/appreactsampleb2x/src/utils/paginationUtils.ts

@@ -0,0 +1,49 @@
+/**
+ * Pagination Utilities
+ *
+ * Utility functions for pagination-related operations including page size validation.
+ */
+
+/**
+ * Default page size options for pagination
+ */
+export const PAGE_SIZE_OPTIONS = [
+	{ value: "10", label: "10" },
+	{ value: "20", label: "20" },
+	{ value: "50", label: "50" },
+] as const;
+
+/**
+ * Valid page size values extracted from PAGE_SIZE_OPTIONS
+ */
+export const VALID_PAGE_SIZES = PAGE_SIZE_OPTIONS.map((opt) => parseInt(opt.value, 10));
+
+/**
+ * Validates that a page size is one of the allowed options
+ * @param size - The page size to validate
+ * @returns true if valid, false otherwise
+ *
+ * @example
+ * ```tsx
+ * if (isValidPageSize(userInput)) {
+ *   setPageSize(userInput);
+ * }
+ * ```
+ */
+export function isValidPageSize(size: number): boolean {
+	return VALID_PAGE_SIZES.includes(size);
+}
+
+/**
+ * Gets a valid page size, defaulting to the first option if invalid
+ * @param size - The page size to validate
+ * @returns A valid page size
+ *
+ * @example
+ * ```tsx
+ * const safePageSize = getValidPageSize(userInput); // Returns valid size or default
+ * ```
+ */
+export function getValidPageSize(size: number): number {
+	return isValidPageSize(size) ? size : VALID_PAGE_SIZES[0];
+}

package/dist/force-app/main/default/webapplications/appreactsampleb2x/src/utils/recordUtils.ts

@@ -0,0 +1,159 @@
+/**
+ * Record utilities: layout-derived fields for GraphQL fetch, safe keys, ID validation.
+ *
+ * calculateFieldsToFetch: from layout + object metadata → field names and relation map;
+ * used by objectDetailService and list to build columns. findIdFieldForRelationship ensures
+ * Id + relationship name are both requested for reference display.
+ *
+ * @module utils/recordUtils
+ */
+
+import type { ObjectInfoResult } from "../types/objectInfo/objectInfo";
+import type {
+	LayoutResponse,
+	LayoutRow,
+	LayoutSection,
+	LayoutItem,
+	LayoutComponent,
+} from "../types/recordDetail/recordDetail";
+
+/**
+ * Find the Id field (reference foreign key) whose relationshipName matches the given name,
+ * so we can request both Id and relationship in the record query for display.
+ */
+function findIdFieldForRelationship(
+	metadata: ObjectInfoResult,
+	relationshipName: string,
+): string | null {
+	if (!metadata.fields || !relationshipName) return null;
+	for (const [apiName, field] of Object.entries(metadata.fields)) {
+		const isReference = field.dataType != null && field.dataType.toLowerCase() === "reference";
+		if (field.relationshipName === relationshipName && (isReference || apiName.endsWith("Id"))) {
+			return apiName;
+		}
+	}
+	return null;
+}
+
+const getFetchableFieldsFromLayoutItem = function (
+	metadata: ObjectInfoResult,
+	layoutItem: LayoutItem,
+	relationFieldMap: Record<string, string>,
+) {
+	const fields: Record<string, string> = {};
+	layoutItem.layoutComponents.forEach((comp: LayoutComponent) => {
+		// check if this is a field to add
+		if (!comp.apiName || comp.componentType !== "Field") {
+			return;
+		}
+
+		// add field: fieldType
+		const fieldMetadata = metadata.fields[comp.apiName];
+		fields[comp.apiName] = fieldMetadata ? fieldMetadata.dataType : "";
+
+		// add relatedField if one exists (Id field -> add relationship name so we request Owner.Name)
+		if (comp.apiName in metadata.fields) {
+			const relationshipName = fieldMetadata?.relationshipName;
+			if (relationshipName) {
+				fields[relationshipName] = fieldMetadata.dataType;
+
+				relationFieldMap[comp.apiName] = relationshipName;
+			}
+		} else {
+			// layout component is relationship name (e.g. Owner); ensure we also request the Id
+			// so buildSelectionTree sees both OwnerId and Owner and requests Owner { Name { value } }
+			const idField = findIdFieldForRelationship(metadata, comp.apiName);
+			if (idField) {
+				const idMeta = metadata.fields[idField];
+				fields[idField] = idMeta ? idMeta.dataType : "";
+				relationFieldMap[idField] = comp.apiName;
+			}
+		}
+	});
+	return fields;
+};
+
+const getFetchableFieldsFromLayoutRow = function (
+	metadata: ObjectInfoResult,
+	layoutRow: LayoutRow,
+	relationFieldMap: Record<string, string>,
+) {
+	let fieldsFromRow: Record<string, string> = {};
+	layoutRow.layoutItems.forEach((item: LayoutItem) => {
+		Object.assign(
+			fieldsFromRow,
+			getFetchableFieldsFromLayoutItem(metadata, item, relationFieldMap),
+		);
+	});
+	return fieldsFromRow;
+};
+
+const getFetchableFieldsFromSection = function (
+	metadata: ObjectInfoResult,
+	section: LayoutSection,
+	relationFieldMap: Record<string, string>,
+) {
+	let fieldsFromSection: Record<string, string> = {};
+	section.layoutRows.forEach((row: LayoutRow) => {
+		Object.assign(
+			fieldsFromSection,
+			getFetchableFieldsFromLayoutRow(metadata, row, relationFieldMap),
+		);
+	});
+	return fieldsFromSection;
+};
+
+const getFetchableFieldsFromLayout = function (
+	metadata: ObjectInfoResult,
+	layout: LayoutResponse,
+	relationFieldMap: Record<string, string>,
+) {
+	let fieldsFromLayout: Record<string, string> = {};
+	layout.sections.forEach((section) => {
+		Object.assign(
+			fieldsFromLayout,
+			getFetchableFieldsFromSection(metadata, section, relationFieldMap),
+		);
+	});
+	return fieldsFromLayout;
+};
+
+/**
+ * Returns field API names to request for records from layout + object metadata.
+ * Includes both Id and relationship name for reference fields so GraphQL can fetch display value.
+ *
+ * @param metadata - Object info (fields with dataType, relationshipName).
+ * @param layout - Layout response (sections, layoutItems, layoutComponents).
+ * @param shouldPrefixedWithEntityName - If true, prefix names with object (e.g. Account.Name).
+ * @returns [fieldNames, fieldTypes, relationFieldMap] for buildSelectionTree / optionalFields.
+ */
+export const calculateFieldsToFetch = function (
+	metadata: ObjectInfoResult,
+	layout: LayoutResponse,
+	shouldPrefixedWithEntityName: boolean,
+): [string[], string[], Record<string, string>] {
+	const relationFieldMap: Record<string, string> = {};
+	// populating fields to query for layout
+	const fields = getFetchableFieldsFromLayout(metadata, layout, relationFieldMap);
+	let fieldsToFetch = Object.keys(fields);
+	if (shouldPrefixedWithEntityName) {
+		fieldsToFetch = fieldsToFetch.map((field) => `${metadata.apiName}.${field}`);
+	}
+	// populate field types for o11y logging
+	const fieldTypes = Object.values(fields).filter((fieldType) => fieldType !== "");
+	return [fieldsToFetch, fieldTypes, relationFieldMap];
+};
+/** Type guard: true if id is a non-empty string matching 15- or 18-char Salesforce ID format. */
+export function isValidSalesforceId(id: string | null | undefined): id is string {
+	if (!id || typeof id !== "string") return false;
+	return /^[a-zA-Z0-9]{15}$|^[a-zA-Z0-9]{18}$/.test(id);
+}
+
+/** Safe React key from record id or fallback to prefix-index. */
+export function getSafeKey(
+	recordId: string | null | undefined,
+	index: number,
+	prefix: string = "result",
+): string {
+	return isValidSalesforceId(recordId) ? recordId : `${prefix}-${index}`;
+}

package/dist/force-app/main/default/webapplications/appreactsampleb2x/src/utils/sanitizationUtils.ts

@@ -0,0 +1,49 @@
+/**
+ * Sanitization Utilities
+ *
+ * Utility functions for sanitizing user input to prevent injection attacks.
+ * These utilities provide basic sanitization for filter values.
+ */
+
+/**
+ * Sanitizes a string value by removing potentially dangerous characters
+ * and trimming whitespace.
+ *
+ * This is a basic sanitization - for production, consider using a library like DOMPurify for more
+ * comprehensive sanitization.
+ * Also, note this is NOT an end-to-end security control.
+ * Client-side sanitization can be bypassed by any attacker using `curl` or Postman.
+ * To prevent injection attacks (SOSL Injection, XSS):
+ * 1. The BACKEND (Salesforce API) handles SOSL injection if parameters are passed correctly.
+ * 2. React handles XSS automatically when rendering variables in JSX (e.g., <div>{value}</div>).
+ * Do not rely on this function for end-to-end security enforcement.
+ *
+ * @param value - The string value to sanitize
+ * @returns Sanitized string value
+ *
+ * @remarks
+ * - Removes control characters (except newlines, tabs, carriage returns)
+ * - Trims leading/trailing whitespace
+ * - Limits length to prevent DoS attacks (default: 1000 characters)
+ * - Preserves alphanumeric, spaces, and common punctuation
+ *
+ * @example
+ * ```tsx
+ * const sanitized = sanitizeFilterValue(userInput);
+ * ```
+ */
+export function sanitizeFilterValue(value: string, maxLength: number = 1000): string {
+	if (typeof value !== "string") {
+		return "";
+	}
+
+	let sanitized = value.trim();
+
+	if (sanitized.length > maxLength) {
+		sanitized = sanitized.substring(0, maxLength);
+	}
+
+	sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+
+	return sanitized;
+}

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/webapp-template-base-sfdx-project-experimental",
-  "version": "1.68.0",
+  "version": "1.69.0",
   "description": "Base SFDX project template",
   "private": true,
   "files": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@salesforce/webapp-template-app-react-sample-b2x-experimental",
-  "version": "1.68.0",
+  "version": "1.69.0",
   "description": "B2C sample app template with app shell",
   "license": "SEE LICENSE IN LICENSE.txt",
   "author": "",
@@ -26,7 +26,7 @@
       "build": {
         "executor": "@salesforce/webapp-template-cli-experimental:apply-patches",
         "options": {
-          "skipDependencyChanges": true
+          "skipDependencyChanges": false
         }
       },
       "watch": {

package/dist/force-app/main/default/classes/MaintenanceRequestListAction.cls

@@ -1,111 +0,0 @@
-public with sharing class MaintenanceRequestListAction {
-  /**
-   * Lists open Maintenance_Request__c records for Agentforce.
-   * Returns key fields with security enforced.
-   */
-  @InvocableMethod
-  public static List<MaintenanceRequestRecord> listOpen(
-    List<ListRequest> requests
-  ) {
-    Integer maxResults = 200;
-    if (requests != null && !requests.isEmpty()) {
-      Integer candidate = requests[0] != null ? requests[0].maxResults : null;
-      if (candidate != null) {
-        if (candidate < 1) {
-          candidate = 1;
-        }
-        if (candidate > 200) {
-          candidate = 200;
-        }
-        maxResults = candidate;
-      }
-    }
-
-    try {
-      List<Maintenance_Request__c> records = [
-        SELECT
-          Id,
-          Name,
-          Title__c,
-          Priority__c,
-          Status__c,
-          Type__c,
-          Date_Requested__c,
-          Estimated_Cost__c,
-          Property__r.Name,
-          Tenant__r.Name,
-          Assigned_Worker__r.Name
-        FROM Maintenance_Request__c
-        WHERE Status__c = 'Open'
-        WITH SECURITY_ENFORCED
-        ORDER BY Date_Requested__c DESC, CreatedDate DESC
-        LIMIT :maxResults
-      ];
-
-      List<MaintenanceRequestRecord> out = new List<MaintenanceRequestRecord>();
-      for (Maintenance_Request__c mr : records) {
-        MaintenanceRequestRecord r = new MaintenanceRequestRecord();
-        r.recordId = mr.Id;
-        r.requestNumber = mr.Name;
-        r.title = mr.Title__c;
-        r.priority = mr.Priority__c;
-        r.status = mr.Status__c;
-        r.type = mr.Type__c;
-        r.dateRequested = mr.Date_Requested__c;
-        r.estimatedCost = mr.Estimated_Cost__c;
-        r.propertyName = mr.Property__r != null ? mr.Property__r.Name : null;
-        r.tenantName = mr.Tenant__r != null ? mr.Tenant__r.Name : null;
-        r.assignedWorkerName = mr.Assigned_Worker__r != null
-          ? mr.Assigned_Worker__r.Name
-          : null;
-        out.add(r);
-      }
-      return out;
-    } catch (Exception e) {
-      // Surface a safe error for Agentforce/Flow
-      throw new AuraHandledException(
-        'Unable to list maintenance requests: ' + e.getMessage()
-      );
-    }
-  }
-
-  public class ListRequest {
-    @InvocableVariable
-    public Integer maxResults;
-  }
-
-  public class MaintenanceRequestRecord {
-    @InvocableVariable
-    public Id recordId;
-
-    @InvocableVariable
-    public String requestNumber;
-
-    @InvocableVariable
-    public String title;
-
-    @InvocableVariable
-    public String priority;
-
-    @InvocableVariable
-    public String status;
-
-    @InvocableVariable
-    public String type;
-
-    @InvocableVariable
-    public Date dateRequested;
-
-    @InvocableVariable
-    public Decimal estimatedCost;
-
-    @InvocableVariable
-    public String propertyName;
-
-    @InvocableVariable
-    public String tenantName;
-
-    @InvocableVariable
-    public String assignedWorkerName;
-  }
-}

package/dist/force-app/main/default/classes/MaintenanceRequestListAction.cls-meta.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" ?>
-<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
-    <apiVersion>62.0</apiVersion>
-    <status>Active</status>
-    
-</ApexClass>

package/dist/force-app/main/default/classes/MaintenanceRequestUpdatePriorityAction.cls

@@ -1,93 +0,0 @@
-public with sharing class MaintenanceRequestUpdatePriorityAction {
-  /**
-   * Updates the Priority__c field on a Maintenance_Request__c record.
-   * Validates against allowed picklist values.
-   */
-  @InvocableMethod
-  public static List<UpdateResult> updatePriority(
-    List<UpdateRequest> requests
-  ) {
-    if (requests == null || requests.isEmpty() || requests[0] == null) {
-      throw new AuraHandledException('Input is required');
-    }
-
-    UpdateRequest req = requests[0];
-    if (req.recordId == null) {
-      throw new AuraHandledException('recordId is required');
-    }
-    if (String.isBlank(req.priority)) {
-      throw new AuraHandledException('priority is required');
-    }
-
-    // Normalize priority input (trim and case-insensitive match)
-    String input = req.priority.trim();
-    Set<String> allowed = new Set<String>{
-      'Low',
-      'Medium',
-      'High',
-      'Emergency'
-    };
-    // Try to map case-insensitive matches to canonical labels
-    String canonical = null;
-    for (String a : allowed) {
-      if (a.equalsIgnoreCase(input)) {
-        canonical = a;
-        break;
-      }
-    }
-    if (canonical == null) {
-      throw new AuraHandledException(
-        'Invalid priority. Allowed values: Low, Medium, High, Emergency'
-      );
-    }
-
-    try {
-      // Field-level security check for Priority__c
-      if (
-        !Schema.SObjectType.Maintenance_Request__c.fields.Priority__c.isUpdateable()
-      ) {
-        throw new AuraHandledException(
-          'Insufficient field permissions to update Priority'
-        );
-      }
-      Maintenance_Request__c recordToUpdate = new Maintenance_Request__c(
-        Id = req.recordId,
-        Priority__c = canonical
-      );
-      update recordToUpdate;
-
-      UpdateResult result = new UpdateResult();
-      result.recordId = req.recordId;
-      result.priority = canonical;
-      result.message = 'Priority updated';
-      return new List<UpdateResult>{ result };
-    } catch (DmlException d) {
-      throw new AuraHandledException(
-        'Failed to update priority: ' + d.getDmlMessage(0)
-      );
-    } catch (Exception e) {
-      throw new AuraHandledException(
-        'Failed to update priority: ' + e.getMessage()
-      );
-    }
-  }
-
-  public class UpdateRequest {
-    @InvocableVariable
-    public Id recordId;
-
-    @InvocableVariable
-    public String priority;
-  }
-
-  public class UpdateResult {
-    @InvocableVariable
-    public Id recordId;
-
-    @InvocableVariable
-    public String priority;
-
-    @InvocableVariable
-    public String message;
-  }
-}

package/dist/force-app/main/default/classes/MaintenanceRequestUpdatePriorityAction.cls-meta.xml

@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8" ?>
-<ApexClass xmlns="http://soap.sforce.com/2006/04/metadata">
-    <apiVersion>62.0</apiVersion>
-    <status>Active</status>
-    
-</ApexClass>