[21758] fix(salesforce_rest_api): enforce parentObjectType on instant deliveries (#21774)

* fix(salesforce_rest_api): enforce parentObjectType on instant deliveries

* fix(salesforce_rest_api): enforce parentObjectType on instant deliveries

* chore(salesforce): bump patch versions

Author: ashwins01

components/salesforce_rest_api/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pipedream/salesforce_rest_api",
-  "version": "2.0.0",
+  "version": "2.0.1",
   "description": "Pipedream Salesforce (REST API) Components",
   "main": "salesforce_rest_api.app.mjs",
   "keywords": [

components/salesforce_rest_api/sources/common/common-feed.mjs

@@ -26,7 +26,7 @@ export default {
     parentObjectType: {
       type: "string",
       label: "Parent Object Type",
-      description: "Optional. The Salesforce SObject API name of the parent record to filter by, e.g. `Case` or `Opportunity`. When set, appends `AND Parent.Type = '<value>'` to the SOQL WHERE clause (traversal of the polymorphic `ParentId`). Leave blank to emit events on any parent object.",
+      description: "Optional. Only emit events whose parent record is of this Salesforce SObject API name, e.g. `Case` or `Opportunity`. Enforced on both delivery paths: `AND Parent.Type = '<value>'` in the polling SOQL, and the parent's Salesforce ID key prefix on instant (webhook) deliveries. Leave blank to emit events on any parent object.",
       optional: true,
     },
     excludeSelf: {
@@ -89,6 +89,62 @@ export default {
       }
       return userId;
     },
+    _getParentKeyPrefix() {
+      return this.db.get("parentKeyPrefix");
+    },
+    _setParentKeyPrefix(parentKeyPrefix) {
+      this.db.set("parentKeyPrefix", parentKeyPrefix);
+    },
+    async _resolveParentKeyPrefix() {
+      const objectType = this.parentObjectType;
+
+      // The cache records which object type it was resolved for, so editing the
+      // prop on a deployed source re-resolves instead of reusing a stale prefix.
+      const cached = this._getParentKeyPrefix();
+      if (cached?.objectType === objectType) {
+        return cached.keyPrefix;
+      }
+
+      let keyPrefix;
+      try {
+        ({ keyPrefix } = await this.getObjectTypeDescription(objectType));
+      } catch (err) {
+        console.log(`Error describing ${objectType} to resolve its ID key prefix:`, err);
+      }
+
+      if (!keyPrefix) {
+        // Not cached, so a transient describe failure is retried on the next event.
+        console.log(`No ID key prefix available for ${objectType}, falling back to a per-event Parent.Type lookup.`);
+        return null;
+      }
+
+      this._setParentKeyPrefix({
+        objectType,
+        keyPrefix,
+      });
+      return keyPrefix;
+    },
+    async _parentTypeMatches(record) {
+      const parentId = record?.ParentId;
+      if (!parentId) {
+        return false;
+      }
+
+      // Salesforce ID key prefixes are stable per SObject (Case = `500`,
+      // Account = `001`, ...), so the parent's type is read straight off the
+      // pushed ParentId with no extra API call per event.
+      const keyPrefix = await this._resolveParentKeyPrefix();
+      if (keyPrefix) {
+        return parentId.startsWith(keyPrefix);
+      }
+
+      // Fallback for an object with no key prefix: one SOQL lookup per event,
+      // reusing the same polymorphic traversal as the polling query.
+      const { records } = await this.query({
+        query: `SELECT Id FROM ${this.getObjectType()} WHERE Id = '${record.Id}' AND Parent.Type = '${this.parentObjectType}'`,
+      });
+      return !!records?.length;
+    },
     async _buildExtraConditions() {
       const conditions = [];
       if (this.parentObjectType) {
@@ -101,13 +157,16 @@ export default {
       return conditions.join(" ");
     },
     async processWebhookEvent(event) {
-      // Instant/webhook deliveries can't filter on Parent.Type (the pushed
-      // payload has ParentId but not the parent's object type), so
-      // parentObjectType is only enforced on the polling/deploy SOQL queries.
-      // excludeSelf is enforced here to prevent self-trigger loops.
+      // Instant/webhook deliveries can't filter on Parent.Type in SOQL (the
+      // pushed payload carries ParentId but not the parent's object type), so
+      // both props are enforced here to match the polling/deploy queries.
+      const record = event.body?.New;
+      if (this.parentObjectType && !(await this._parentTypeMatches(record))) {
+        return;
+      }
       if (this.excludeSelf) {
         const userId = await this._resolveAuthenticatedUserId();
-        if (event.body?.New?.CreatedById === userId) {
+        if (record?.CreatedById === userId) {
           return;
         }
       }

components/salesforce_rest_api/sources/new-feed-comment/new-feed-comment.mjs

@@ -11,13 +11,13 @@ export default {
   type: "source",
   name: "New Chatter Feed Comment (Instant or Polling)",
   key: "salesforce_rest_api-new-feed-comment",
-  description: "Emit new events for each Chatter FeedComment (reply) created in Salesforce, polling `FeedComment` via SOQL on `CreatedDate`. Use this to react to comments on Chatter posts, since Chatter activity does not update the parent record's `LastModifiedDate`. The payload includes both `ParentId` (a polymorphic reference to the feed's parent - either a record feed, e.g. a Case ID starting with `500`, or a User feed) and `FeedItemId` (the ID of the FeedItem the comment belongs to) - these are distinct fields; do not confuse them. Set `parentObjectType` to a parent object API name (e.g. `Case`) to append `AND Parent.Type = '<value>'` to the SOQL WHERE clause. Set `excludeSelf` to `true` to drop comments authored by the connected integration user. Note: querying FeedComment without a parent filter requires the `View All Data` permission on the connected user. Attempts instant delivery via webhook and falls back to timer polling automatically. [See the documentation](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_feedcomment.htm)",
-  version: "0.0.4",
+  description: "Emit new events for each Chatter FeedComment (reply) created in Salesforce, polling `FeedComment` via SOQL on `CreatedDate`. Use this to react to comments on Chatter posts, since Chatter activity does not update the parent record's `LastModifiedDate`. The payload includes both `ParentId` (a polymorphic reference to the feed's parent - either a record feed, e.g. a Case ID starting with `500`, or a User feed) and `FeedItemId` (the ID of the FeedItem the comment belongs to) - these are distinct fields; do not confuse them. Set `parentObjectType` to a parent object API name (e.g. `Case`) to only emit comments whose parent record is of that type. Set `excludeSelf` to `true` to drop comments authored by the connected integration user. Note: querying FeedComment without a parent filter requires the `View All Data` permission on the connected user. Attempts instant delivery via webhook and falls back to timer polling automatically. [See the documentation](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_feedcomment.htm)",
+  version: "0.0.5",
   props: {
     ...common.props,
     parentObjectType: {
       ...common.props.parentObjectType,
-      description: "Optional. The Salesforce SObject API name of the parent business record to filter by, e.g. `Case`. When set, appends `AND Parent.Type = '<value>'` to the SOQL WHERE clause (traversal of the polymorphic `FeedComment.ParentId`). Leave blank to emit comments on any parent object (requires `View All Data` permission).",
+      description: "Optional. Only emit comments whose parent record is of this Salesforce SObject API name, e.g. `Case` (traversal of the polymorphic `FeedComment.ParentId`). Enforced on both delivery paths: `AND Parent.Type = '<value>'` in the polling SOQL, and the parent's Salesforce ID key prefix on instant (webhook) deliveries. Leave blank to emit comments on any parent object (requires `View All Data` permission).",
     },
     excludeSelf: {
       ...common.props.excludeSelf,

components/salesforce_rest_api/sources/new-feed-item/new-feed-item.mjs

@@ -12,12 +12,12 @@ export default {
   name: "New Chatter Feed Item (Instant or Polling)",
   key: "salesforce_rest_api-new-feed-item",
   description: "Emit new events for each Chatter FeedItem (post) created in Salesforce, polling `FeedItem` via SOQL on `CreatedDate`. Use this to react to Chatter posts on Cases and other records, since Chatter activity does not update the parent record's `LastModifiedDate` (so **New Record (Instant, of Selectable Type)** and **New Case (Instant, of Selectable Type)** never emit for it). Set `parentObjectType` to the parent object's API name (e.g. `Case`, `Opportunity`) to only emit posts whose parent record is of that type. Set `excludeSelf` to `true` to drop posts authored by the connected integration user. Note: `Body` is null for system-generated post types (e.g. `TrackedChange`). Attempts instant delivery via webhook and falls back to timer polling automatically when the Streaming API does not support this object. [See the documentation](https://developer.salesforce.com/docs/atlas.en-us.object_reference.meta/object_reference/sforce_api_objects_feeditem.htm)",
-  version: "0.0.4",
+  version: "0.0.5",
   props: {
     ...common.props,
     parentObjectType: {
       ...common.props.parentObjectType,
-      description: "Optional. The Salesforce SObject API name of the parent record to filter by, e.g. `Case` or `Opportunity`. When set, appends `AND Parent.Type = '<value>'` to the SOQL WHERE clause (traversal of the polymorphic `FeedItem.ParentId`). Leave blank to emit posts on any parent object.",
+      description: "Optional. Only emit posts whose parent record is of this Salesforce SObject API name, e.g. `Case` or `Opportunity` (traversal of the polymorphic `FeedItem.ParentId`). Enforced on both delivery paths: `AND Parent.Type = '<value>'` in the polling SOQL, and the parent's Salesforce ID key prefix on instant (webhook) deliveries. Leave blank to emit posts on any parent object.",
     },
     excludeSelf: {
       ...common.props.excludeSelf,