Skip to content

W-22917333: Rename beacon_child_consumer_{key,secret} to auto_installed_app_org_consumer_{key,secret}#2923

Open
wmathurin wants to merge 3 commits into
forcedotcom:devfrom
wmathurin:rename-beacon-child-consumer-keys
Open

W-22917333: Rename beacon_child_consumer_{key,secret} to auto_installed_app_org_consumer_{key,secret}#2923
wmathurin wants to merge 3 commits into
forcedotcom:devfrom
wmathurin:rename-beacon-child-consumer-keys

Conversation

@wmathurin

@wmathurin wmathurin commented Jun 10, 2026

Copy link
Copy Markdown
Contributor

Summary

Updates the token endpoint wire-format keys and adds a legacy fallback for servers that haven't yet rolled out version 264.

When parsing the token response, the SDK now:

  1. Checks for auto_installed_app_org_consumer_{key,secret} (new field name)
  2. Falls back to beacon_child_consumer_{key,secret} if the new field is absent

A TODO comment marks both fallback constants and the fallback logic for removal once server version 264 has rolled out everywhere.

All code symbol names (BEACON_CHILD_CONSUMER_KEY/SECRET constants, beaconChildConsumerKey field/getter, builder methods, etc.) are unchanged.

Files changed

  • OAuth2.java — new constant values + legacy fallback constants + parsing updated with new-then-old fallback
  • UserAccount.javaBEACON_CHILD_CONSUMER_KEY/SECRET constant values updated
  • AuthenticatorService.javaKEY_BEACON_CHILD_CONSUMER_KEY/SECRET constant values updated
  • LogRedactor.kt — redaction regex pattern string updated
  • UserAccountTest.java — test map key strings updated
  • SalesforceLoggerTest.java — test JSON key strings updated

Test plan

  • Android SDK and SalesforceAnalytics APKs build cleanly
  • connectedAndroidTest passes (requires connected device)
  • AuthFlowTester instrumentation tests pass (running externally)

Related

@github-actions

github-actions Bot commented Jun 10, 2026

Copy link
Copy Markdown
1 Warning
⚠️ libs/SalesforceSDK/src/com/salesforce/androidsdk/auth/AuthenticatorService.java#L58 - Do not place Android context classes in static fields (static reference to Authenticator which has field context pointing to Context); this is a memory leak

Generated by 🚫 Danger

tokenFormat = object.optString(TOKEN_FORMAT, null);
beaconChildConsumerKey = object.optString(BEACON_CHILD_CONSUMER_KEY, null);
beaconChildConsumerSecret = object.optString(BEACON_CHILD_CONSUMER_SECRET, null);
autoInstalledAppOrgConsumerKey = object.optString(AUTO_INSTALLED_APP_ORG_CONSUMER_KEY, null);

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Upgrade path for existing stored accounts

You've probably already considered this — for users who authenticated via an auto-installed app on 13.1+, their account data is persisted under the old "beacon_child_consumer_key" key. Between app upgrade and first successful token refresh, deserialization here won't find the value under the new key name, so getClientIdForRefresh() would fall back to the configured clientId.

Is the expectation that the refresh still succeeds with the configured clientId in that scenario (server accepts either), or would a fallback read be worth adding?

autoInstalledAppOrgConsumerKey = object.optString(AUTO_INSTALLED_APP_ORG_CONSUMER_KEY,
    object.optString("beacon_child_consumer_key", null));

(Same would apply to the secret, the Bundle constructor, and UserAccountManager.decryptUserData.)

This response was generated by an AI agent on behalf of @JohnsonEricAtSalesforce.

public static final String TOKEN_FORMAT = "tokenFormat";
public static final String BEACON_CHILD_CONSUMER_KEY = "beacon_child_consumer_key";
public static final String BEACON_CHILD_CONSUMER_SECRET = "beacon_child_consumer_secret";
public static final String AUTO_INSTALLED_APP_ORG_CONSUMER_KEY = "auto_installed_app_org_consumer_key";

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Scope vs. GUS story — confirming intent

I'm sure you decided this deliberately — the GUS story mentions keeping Java identifiers unchanged with no public API changes, but the PR renames constants, getters, and builder methods (public API break for 14.0). Just confirming this was an intentional expansion beyond what the story's agent wrote, since it seems like the right call for a major version.

This response was generated by an AI agent on behalf of @JohnsonEricAtSalesforce.

InfoSection(title = BEACON) {
InfoRowView(label = BEACON_CHILD_CONSUMER_KEY, value = currentUser?.beaconChildConsumerKey)
InfoRowView(label = BEACON_CHILD_CONSUMER_SECRET, value = currentUser?.beaconChildConsumerSecret, isSensitive = true)
InfoRowView(label = AUTO_INSTALLED_APP_ORG_CONSUMER_KEY, value = currentUser?.autoInstalledAppOrgConsumerKey)

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Minor: The UI section header still says "Beacon" (line 60). Probably intentional to keep it short, but mentioning in case it was just overlooked in the sweep.

This response was generated by an AI agent on behalf of @JohnsonEricAtSalesforce.

…y,secret} to auto_installed_app_org_consumer_{key,secret}

Updates only the string values parsed from the token endpoint response.
All code symbol names (constants, fields, getters, builder methods) are unchanged.
…eld absent

Checks auto_installed_app_org_consumer_{key,secret} first; falls back to
the old beacon_child_consumer_{key,secret} name for servers that have not
yet rolled out version 264.
LogRedactor now redacts both auto_installed_app_org_consumer_secret and
beacon_child_consumer_secret. The old pattern is guarded with a TODO to
remove it once server version 264 has rolled out everywhere.
@wmathurin

Copy link
Copy Markdown
Contributor Author

I decided to only change the value of the fields we look for in the response and keep beacon in our code and tests. The changes were getting large and would make cherry picking harder. Further more AutoInstalledApp is a mouthful compared to Beacon.

tokenFormat = parsedResponse.optString(TOKEN_FORMAT);

// Beacon child fields expected when using a beacon app and web server flow
// TODO: Remove LEGACY_BEACON_CHILD_CONSUMER_* fallback once server version 264 has rolled out everywhere.

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That way we can go against older instances and it should still work.

@JohnsonEricAtSalesforce JohnsonEricAtSalesforce left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

👍🏻

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants