fix: warn when JWT access token and API version < 68 cause empty metadata results @W-24046915@ - #1835
Merged
Merged
Conversation
…4124120@ Use lstatSync instead of statSync to reject symlinked content directories from partial-delete processing. Filter out symlinks within content directories before deletion. Add defense-in-depth symlink check in deleteFilePath.
Extract findSymlinkOnPath to shared fileSystemHandler utility and add symlink traversal protection to StandardWriter._write() — covers both the write and delete paths for all metadata types during retrieve.
Resolves conflicts in streams.ts (combined symlink + path traversal imports), streams.test.ts (kept both symlink and path traversal tests), and eslint-suppressions.json (combined _write dangle counts).
The delete path only checked the leaf segment for symlinks, so a symlinked ancestor directory (e.g. digitalExperiences/ → external) could let rmSync delete files outside the project before the write-path guard fired. - Add findSymlinkOnPathSync to walk all segments from package root - Use it in the pre-filter (before FileResponse creation) and as defense-in-depth in deleteFilePath - Guard both findSymlinkOnPath variants against destinations that resolve outside the root (.. traversal) - Remove now-dead isSymlinkSync helper
Exercises the exact gap Eric identified: a DEB project where digitalExperiences/ is a symlink to an external directory. Verifies findSymlinkOnPathSync catches the ancestor symlink and the external file survives.
…data results @W-24046915@ SOAP metadata operations silently fail when an org uses JWT-based access tokens and the API version is below 68.0. The ConnectionResolver catch block swallows these errors at debug level, producing a near-empty manifest with no user feedback. This adds a proactive warning before enumeration begins, telling users exactly what's wrong and how to fix it.
…data results @W-24046915@ SOAP metadata operations silently fail when an org uses JWT-based access tokens and the API version is below 68.0. The ConnectionResolver catch block swallows these errors at debug level, producing a near-empty manifest with no user feedback. This adds a proactive warning before enumeration begins, telling users exactly what's wrong and how to fix it.
WillieRuemmele
force-pushed
the
wr/jwtApiVersionWarning
branch
from
September 15, 2026 15:31
6d2001a to
6a7b0b8
Compare
jfeingold35
approved these changes
Sep 16, 2026
…ce-deploy-retrieve into wr/jwtApiVersionWarning
Member
Author
QA NotesVerified with Jamie on a call, here's command output ➜ dreamhouse-lwc git:(main) hub:(DevHub) scratch:(test-iny2rphjexuu@example.com) ➜ pd project generate manifest --from-org test-iny2rphjexuu@example.com
successfully wrote package.xml
Warning: This org uses JWT-based access tokens, which require API version 68.0 or later for SOAP metadata operations. The current API version is 60.0, so metadata listing may return empty or incomplete results. To resolve, use --api-version 68 or update sourceApiVersion in sfdx-project.json.
^^ org with JWT AT, warning shown
➜ dreamhouse-lwc git:(main) ✗ hub:(DevHub) scratch:(test-iny2rphjexuu@example.com) ➜ pd project generate manifest --from-org test-iny2rphjexuu@example.com --api-version 68.0
successfully wrote package.xml
^^ api version >= 68.0, no warning
➜ dreamhouse-lwc git:(main) ✗ hub:(DevHub) scratch:(test-iny2rphjexuu@example.com) ➜ vim sfdx-project.json
^^ updated sfdx-project.json sourceApiVersion field to 68.0
➜ dreamhouse-lwc git:(main) ✗ hub:(DevHub) scratch:(test-iny2rphjexuu@example.com) ➜ pd project generate manifest --from-org test-iny2rphjexuu@example.com
successfully wrote package.xml
^^ command, without flag, no warning |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ConnectionResolver.resolve()when the connection has a JWT-based access token and the API version is below 68.0--api-version 68or updatesourceApiVersion)Work Item
@W-24046915@: [JWTBAT] Metadata API listMetadata returns incomplete results with JWT-based access tokens when connection API version is below 68
Proof of Work
Test plan
project generate manifest --from-orgagainst an org with JWT tokens and sourceApiVersion < 68--api-version 68