fix: Salesforce tokens add `token_lifetime` by joeauyeung · Pull Request #27264 · calcom/cal.com

joeauyeung · 2026-01-26T22:19:12Z

What does this PR do?

Currently, Salesforce OAuth tokens do not include an expiry date. This means we refresh Salesforce tokens on every request, which is inefficient and can cause rate limiting issues.

This PR adds token lifetime tracking by:

Calling Salesforce's token introspection endpoint during OAuth connect to get the token lifetime
Storing token_lifetime in the credential alongside the access token
Checking if the token is still valid before making requests (using issued_at + token_lifetime with a 5-minute buffer)
Only refreshing when the token is actually expired
Adding a refreshFn to the jsforce connection that handles unexpected expiry by re-introspecting to recalibrate the lifetime

Visual Demo (For contributors especially)

N/A - Backend-only change with no UI impact.

Mandatory Tasks (DO NOT REMOVE)

I have self-reviewed the code (A decent size PR without self-review might be rejected).
I have updated the developer docs in /docs if this PR makes changes that would require a documentation change. N/A - no docs changes needed.
I confirm automated tests are in place that prove my fix is effective or that my feature works.

How should this be tested?

Connect a Salesforce account via the integrations page
Verify the credential is stored with a token_lifetime value
Make API calls that use Salesforce (e.g., CRM lookups during booking)
Verify tokens are not refreshed on every request (check logs or network traffic)
Wait for token to expire (or manually set issued_at to an old value) and verify refresh works correctly

Human Review Checklist

Verify time unit handling: issued_at is in milliseconds (string), token_lifetime is in seconds
Verify the introspection endpoint URL format (${instanceUrl}/services/oauth2/introspect) is correct
Check that hasAttemptedRefresh flag doesn't cause issues if the service instance is reused across multiple requests
Verify CredentialRepository.updateWhereId exists and works as expected

Checklist

I have read the contributing guide
My code follows the style guidelines of this project
I have commented my code, particularly in hard-to-understand areas
I have checked if my changes generate no new warnings

Updates since last revision

Added comprehensive test coverage:

getSalesforceTokenLifetime.test.ts: Unit tests for the new introspection function (5 tests covering lifetime calculation, endpoint parameters, Basic auth, error handling, and different lifetimes)
CrmService.integration.test.ts: Added "Token lifecycle management" test suite (4 tests covering valid token skip, expired token refresh, legacy credentials without token_lifetime, and 5-minute buffer behavior)
Fixed type error in CrmService.ts by extracting refreshToken variable after the null check to ensure type safety in the refreshFn callback

Link to Devin run: https://app.devin.ai/sessions/649172013c17485889563f15ca2c83e6
Requested by: joe@cal.com (@joeauyeung)

- Add unit tests for getSalesforceTokenLifetime function - Add integration tests for token lifecycle management in CrmService - Fix type error in CrmService.ts by extracting refreshToken variable Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>

joeauyeung · 2026-01-27T03:38:50Z

packages/app-store/salesforce/lib/CrmService.ts

+   * @param forceIntrospection - If true, always introspect to recalibrate token_lifetime (e.g., after unexpected expiry)
+   * @param existingTokenLifetime - The current token_lifetime to reuse if not forcing introspection
+   */
+  private refreshAccessToken = async ({


Extract the call to refresh the access token

joeauyeung · 2026-01-27T03:39:47Z

packages/app-store/salesforce/lib/CrmService.ts

+
+    // Introspect if forced or if we don't have a token_lifetime yet
+    let tokenLifetime = existingTokenLifetime;
+    if (forceIntrospection || !tokenLifetime) {


We'll query the introspection endpoint if there is no token_lifetime property on the credential or if we get a token error if the credential was marked as not expired but was. This is to handle the unlikely case that an org changes their token life spans.

joeauyeung · 2026-01-27T03:40:20Z

packages/app-store/salesforce/lib/CrmService.ts

+    };
+  };
+
+  private getClient = async (credential: CredentialPayload) => {


Same method as before to get the jsforce client

joeauyeung · 2026-01-27T03:40:47Z

packages/app-store/salesforce/lib/CrmService.ts

+
+    // Check if token is still valid
+    // issued_at is in milliseconds (string), token_lifetime is in seconds
+    const BUFFER_MS = 5 * 60 * 1000; // 5 minutes buffer before expiry


Added new check to see if the token is still valid to avoid making a token call on every request. All access tokens are still valid until they are expired. Issuing a new token does not invalidate any existing tokens.

joeauyeung · 2026-01-27T03:41:32Z

packages/app-store/salesforce/lib/CrmService.ts

      instanceUrl: credentialKey.instance_url,
      accessToken: credentialKey.access_token,
      refreshToken: credentialKey.refresh_token,
+      refreshFn: async (conn, callback) => {


New addition to the jsforce.connection if we get an token error then retry to refetch the token only once

joeauyeung · 2026-01-27T03:41:53Z

packages/app-store/salesforce/lib/CrmService.ts

+        this.hasAttemptedRefresh = true;
+
+        try {
+          // Force introspection to recalibrate token_lifetime after unexpected expiry


While we handle this case. It will be very unlikely.

joeauyeung · 2026-01-27T03:42:13Z

packages/app-store/salesforce/lib/getSalesforceTokenLifetime.ts

+}): Promise<number> {
+  const { consumer_key, consumer_secret } = await getSalesforceAppKeys();
+
+  const response = await fetch(`${instanceUrl}/services/oauth2/introspect`, {


We need to hit this introspection endpoint to calculate if a token is still valid after it was issued.

github-actions · 2026-01-27T03:53:15Z

E2E results are ready!

Workflow #101141.2 latest results

cubic-dev-ai

1 issue found across 5 files

Prompt for AI agents (all issues)


Check if these issues are valid — if so, understand the root cause of each and fix them.


<file name="packages/app-store/salesforce/lib/CrmService.ts">

<violation number="1" location="packages/app-store/salesforce/lib/CrmService.ts:262">
P1: `hasAttemptedRefresh` is set the first time `refreshFn` runs and never cleared, so every later token expiry immediately fails with “Token refresh already attempted.” Reset the flag after the refresh attempt so the connection can refresh tokens again while still preventing concurrent refresh loops.</violation>
</file>

_{Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.}

packages/app-store/salesforce/lib/CrmService.ts

github-actions · 2026-01-27T03:56:37Z

Devin AI is addressing Cubic AI's review feedback

A Devin session has been created to address the issues identified by Cubic AI.

View Devin Session

devin-ai-integration · 2026-01-27T03:58:04Z

I reviewed the Cubic AI feedback regarding the hasAttemptedRefresh flag issue. The confidence score for this issue is 8/10, which is below the 9/10 threshold required for automated fixes.

Issue summary: The hasAttemptedRefresh flag is set when refreshFn runs but never cleared, which could cause subsequent token refresh attempts to fail with "Token refresh already attempted."

Why this is being skipped: Per the review guidelines, only issues with confidence scores of 9/10 or higher should be automatically fixed. This issue has a confidence score of 8/10.

Recommendation: A human reviewer should evaluate whether this is a valid concern. If the SalesforceCRMService instance is reused across multiple requests where tokens expire at different times, the flag would need to be reset after a successful refresh to allow future refreshes. However, if a new service instance is created for each request, this may not be an issue in practice.

Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>

emrysal

Looks good to me, happy to merge & release.

joeauyeung added 3 commits January 26, 2026 17:13

Create getSalesforceTokenLifetime

cf0b8d9

When connecting salesforce, add token_lifetime

c6b55a8

Migrate token_lifetime and refetch if token expiry doesn't match

336aa63

pull-request-size bot added the size/L label Jan 26, 2026

pull-request-size bot added size/XL and removed size/L labels Jan 26, 2026

joeauyeung commented Jan 27, 2026

View reviewed changes

Merge branch 'main' into salesforce-get-token-expiry

0d83165

joeauyeung marked this pull request as ready for review January 27, 2026 03:42

graphite-app bot added the enterprise area: enterprise, audit log, organisation, SAML, SSO label Jan 27, 2026

graphite-app bot requested a review from a team January 27, 2026 03:42

graphite-app bot added the core area: core, team members only label Jan 27, 2026

joeauyeung added ready-for-e2e and removed enterprise area: enterprise, audit log, organisation, SAML, SSO labels Jan 27, 2026

cubic-dev-ai bot reviewed Jan 27, 2026

View reviewed changes

packages/app-store/salesforce/lib/CrmService.ts Show resolved Hide resolved

chore: re-trigger CI

8e5f38b

Co-Authored-By: joe@cal.com <j.auyeung419@gmail.com>

emrysal approved these changes Jan 27, 2026

View reviewed changes

emrysal merged commit 01ae6f1 into main Jan 27, 2026
51 checks passed

emrysal deleted the salesforce-get-token-expiry branch January 27, 2026 13:00

Comments

Conversation

joeauyeung commented Jan 26, 2026 • edited by devin-ai-integration bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What does this PR do?

Visual Demo (For contributors especially)

Mandatory Tasks (DO NOT REMOVE)

How should this be tested?

Human Review Checklist

Checklist

Updates since last revision

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

joeauyeung Jan 27, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jan 27, 2026

E2E results are ready!

Uh oh!

cubic-dev-ai bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

github-actions bot commented Jan 27, 2026

Devin AI is addressing Cubic AI's review feedback

Uh oh!

devin-ai-integration bot commented Jan 27, 2026

Uh oh!

emrysal left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

joeauyeung commented Jan 26, 2026 •

edited by devin-ai-integration bot

Loading