Skip to content

Salesforce: fix the cross-org Lead lookup, and drop the no-op sfdx logout - #8743

Merged
vdesabou merged 2 commits into
vdesabou:masterfrom
vishesh1999gupta:salesforce-sink-duplicate-lead-lookup
Aug 6, 2026
Merged

Salesforce: fix the cross-org Lead lookup, and drop the no-op sfdx logout#8743
vdesabou merged 2 commits into
vdesabou:masterfrom
vishesh1999gupta:salesforce-sink-duplicate-lead-lookup

Conversation

@vishesh1999gupta

@vishesh1999gupta vishesh1999gupta commented Aug 5, 2026

Copy link
Copy Markdown
Contributor

Two independent fixes to the Salesforce tests. Both verified against the shared test org.


1. The cross-org Lead lookup rejected duplicates

The sink tests that verify their record reached the second org intermittently failed at the
very end, with every assertion already green and no error shown:

✨ Display content of topic success-responses, it contains 1 messages
✨ Display content of topic error-responses, it contains 0 messages
   Login with sfdx CLI on the account #2
   Authorized to [email protected]
   Get the Lead created on account #2
🧹 Cleaning up: Lead John_24730 Doe_25713 (both orgs) …
🔥 RESULT: FAILURE

Cause

sfdx data:record:get --target-org "$SALESFORCE_USERNAME_ACCOUNT2" -s Lead \
  -w "FirstName='$LEAD_FIRSTNAME' LastName='$LEAD_LASTNAME' Company=Confluent"

data:record:get requires the where-clause to resolve to exactly one record:

Error (1): FirstName='…' LastName='…' Company=Confluent is not a unique qualifier
for Lead; 2 records were retrieved.

The sink connectors insert — never upsert — so a shared org accumulates Leads, and any
run that dies before its cleanup trap leaves one behind. LEAD_FIRSTNAME is John_$RANDOM
(0–32767), so a later run redrawing that pair fails permanently, even though the record
it just wrote is present and correct. The org used for these tests holds ~500
Company='Confluent' Leads, so orphans accumulate and each poisons its own name pair.

The error was invisible in CI because the command runs under set -e, so the following
cat /tmp/result.log never executed — the run showed only a bare RESULT: FAILURE.

Fix

data:query returns every match and exits 0. The existing grep still fails when the
record is genuinely absent, so the assertion keeps its meaning — it just stops requiring a
uniqueness the tests never guaranteed. || true is added so cat always runs.

Verification

Scenario data:record:get data:query
2 matching Leads exit 1, "not a unique qualifier" exit 0, both rows, grep passes
0 matching Leads exit 1 retrieved: 0, grep fails — regression still caught

Full salesforce-sobject-sink.sh run with one duplicate pre-seeded in the second org:

  • beforeRESULT: FAILURE, is not a unique qualifier for Lead; 2 records were retrieved
  • afterRESULT: SUCCESS, /tmp/result.log showing both rows

Applied to all six affected tests, including the proxy variants.


2. sfdx force:auth:logout --all in cleanup was a no-op that broke later steps

The cleanup traps ended with a logout, justified by a comment claiming a run "accumulates
sessions against the same user and later logins evict earlier ones". Both halves are wrong:

  • No per-user session cap exists. The Developer Edition limit of 5 is Concurrent API
    Request Limits
    (requests running ≥20s) and returns REQUEST_LIMIT_EXCEEDED rather than
    evicting.
  • It makes no network call. In the image these tests use (sfdx-cli 7.209.6,
    plugin-auth 2.8.4, @salesforce/core 4.3.10) it resolves to deleting
    ~/.sfdx/<user>.json; there is no reference to services/oauth2/revoke in either
    package. Sessions lapsed on idle timeout either way.
  • It is redundant. The sfdx-cli container is recreated per test — hence
    Config folder does not exists, Creating Folder on every login. The store already starts
    empty.

What it did do is delete credentials later steps need. Querying the second org after a test
consistently failed with No authorization information found for <user> until the account
was re-authenticated.

Verified: salesforce-sobject-sink.sh passes with the call removed, and a query against
the second org afterwards now succeeds with no re-login — previously it always failed.


bash -n clean on all changed files.

…e match

The three sink tests that verify their record landed in the second org ended with:

  sfdx data:record:get --target-org "$SALESFORCE_USERNAME_ACCOUNT2" -s Lead \
    -w "FirstName='$LEAD_FIRSTNAME' LastName='$LEAD_LASTNAME' Company=Confluent"

data:record:get requires the where-clause to identify exactly one record. The sink
connectors insert (they never upsert), so a shared org accumulates Leads, and a run
that dies before its cleanup trap leaves one behind. Any later run that redraws the
same John_$RANDOM / Doe_$RANDOM pair then fails permanently:

  Error (1): FirstName='...' LastName='...' Company=Confluent is not a unique
  qualifier for Lead; 2 records were retrieved.

The record the test just wrote is present and correct - the lookup simply refuses to
return it. Because the command runs under set -e, the script aborted on that line and
the following `cat /tmp/result.log` never executed, so the reason was invisible in CI
artifacts and the run only showed a bare RESULT: FAILURE.

data:query returns every match and exits 0, and the existing grep still fails when the
record is genuinely absent, so the assertion keeps its meaning. Verified against the
shared test org:

  - 2 matching Leads: data:record:get exits 1, data:query exits 0 and grep passes
  - 0 matching Leads: data:query returns "retrieved: 0" and grep fails, so a real
    regression is still caught
  - full salesforce-sobject-sink.sh run with a duplicate pre-seeded in the second org:
    FAILURE before this change, SUCCESS after

`|| true` is added so cat always runs; without it set -e hides whatever went wrong.

Applied to all six affected tests, including the proxy variants.
The cleanup traps ended with:

  sfdx force:auth:logout --all --no-prompt

justified by a comment claiming that "a run accumulates sessions against the same
user and later logins evict earlier ones". Both halves of that are wrong.

Salesforce enforces no per-user session cap. The Developer Edition limit of 5 is
Concurrent API Request Limits - inbound requests running 20 seconds or longer -
and it returns REQUEST_LIMIT_EXCEEDED rather than evicting anything.

force:auth:logout also makes no network call. In the sfdx-cli image these tests
use (sfdx-cli 7.209.6, plugin-auth 2.8.4, @salesforce/core 4.3.10) it resolves to
deleting ~/.sfdx/<user>.json; there is no reference to services/oauth2/revoke
anywhere in either package. It never released a server-side session, so the
sessions it claimed to release lapsed on their idle timeout either way.

It is also redundant: the sfdx-cli container is recreated per test, which is why
every login logs "Config folder does not exists, Creating Folder". The auth store
already starts empty.

What it did do is delete credentials that later steps still need. Querying the
second org after a test consistently failed with

  Error (1): Parsing --target-org
        No authorization information found for <user>.

until the account was re-authenticated. That breaks any step added after cleanup
and makes post-run debugging against the container needlessly awkward.

Verified: salesforce-sobject-sink.sh passes with the call removed, and a query
against the second org afterwards now succeeds with no re-login.
@vishesh1999gupta vishesh1999gupta changed the title Salesforce: query for the cross-org Lead instead of demanding a unique match Salesforce: fix the cross-org Lead lookup, and drop the no-op sfdx logout Aug 5, 2026
@vdesabou
vdesabou merged commit fe3df7c into vdesabou:master Aug 6, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants