Skip to content

feat: add package trust link deny command - #1279

Open
btrn11 wants to merge 2 commits into
packaging-distribution/spifrom
t/packaging-distribution/link-deny
Open

feat: add package trust link deny command#1279
btrn11 wants to merge 2 commits into
packaging-distribution/spifrom
t/packaging-distribution/link-deny

Conversation

@btrn11

@btrn11 btrn11 commented Aug 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • add beta sf package trust link deny for verified PBO admins
  • require exactly one of --request <2vt...> or --authoring-org <00D...> and delegate to PackageTrustLink.deny
  • decline pending VerifiedDev requests (Tooling Status = Declined); JSON schema and command snapshot coverage

Library: forcedotcom/packaging#922. Plugin CI needs that library on npm (next 5.0.9-spi.* after packaging#921 / 5.0.9-spi.4) before the pin can be bumped the way approve used 5.0.9-spi.4.

Also stacks on plugin-packaging#1277 (approve command). Extra approve commits drop out once that PR merges.

Test plan

  • yarn mocha test/commands/package/packageTrustLinkDeny.test.ts
  • request-ID and authoring-org selector unit tests
  • missing, conflicting, and wrong-prefix selector validation
  • bump @salesforce/packaging to the published SPI build that includes deny

btrn11 added 2 commits August 28, 2026 13:56
Allow verified PBO admins to accept a pending trust link by request ID or
authoring org through the published packaging API.
Let a Verified PBO decline a pending Public Secure trust request by request
ID or authoring org ID.

@jshackell-sfdc jshackell-sfdc left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please see my questions.

@@ -0,0 +1,29 @@
# summary

Approve a Public Secure trust link request.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do customers know what a Public Secure trust link request is? Add a brief blurb about it if not.


# description

Run this command against a verified packaging org (PBO) to accept a pending VerifiedDev trust request from an authoring org. Identify the request with either --request or --authoring-org.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is a pending VerifiedDev trust request the same thing as a Public Secure trust link request?

If so, can you keep to one term? And explain what it is all is?

@@ -0,0 +1,31 @@
# summary

Deny a Public Secure trust link request.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same comments as the approve command above.

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I noticed you have a number of PRs around these same commands. So same comments for those PRs too.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants