#Appexchage Apps18 utenti parlano di questo argomento

Hi @Aira Gutierrez

The "UTAM not defined" and module import errors in 2026 typically stem from missing compiler generation steps or an incomplete link between your testing environment and the generated code.

1. Resolve "UTAM is not defined"

In 2026, the global utam object is not provided by default in standard Node.js scripts; it must be imported or generated via the compiler.

• Ensure Compilation: Your wdio.config.js and tests depend on JavaScript files that are compiled from .utam.json files. Run the compiler command you added to your package.json:

npm run test:ui:compile

• Manual npx check: If the script fails, try running it directly to see specific error messages:

npx utam -c utam.config.js

• WDIO Global Hooks: Ensure your wdio.config.js properly exports the UtamWdioService. If you are trying to use utam in a test script, you must use the utam object injected by the service. In your test file, you typically don't import a global "utam"; you use the browser object or the injected loader: 
  javascript-

// Instead of calling a global utam 

const loader = browser.utam; // The service adds this to the browser object 

2. Fix "Module not found" for Salesforce Page Objects

The salesforce-pageobjects package contains JSON definitions that must be compiled into JavaScript before they can be imported. 

• Correct Import Paths: In 2026, the standard package structure for salesforce-pageobjects does not always require the /dist/ path in the import string. Try importing from the package root: 
  javascript-

// Use this 

import { DesktopLayoutContainer } from 'salesforce-pageobjects/pageObjects/desktopLayoutContainer'; 

// Instead of 

import { DesktopLayoutContainer } from '/salesforce-pageobjects/dist/navex/...';

• Update Package Version: Ensure you are using a version compatible with the current Salesforce release (Winter '26). Check for updates:

npm install salesforce-pageobjects@latest --save-dev

• Check utam.config.js: Ensure your configuration file explicitly lists salesforce-pageobjects in the injectionConfigs. An empty or missing configuration will prevent the generator from finding the Salesforce definitions. 

3. Verify WebDriverIO Configuration

If you recently upgraded to WebDriverIO v8 or v9 (standard in 2026), ensure your wdio.conf.js is using the newer object-based service definition. 

• Service Configuration: Ensure the UtamWdioService is properly imported and added: 
  javascript-

const { UtamWdioService } = require('wdio-utam-service'); 

exports.config = { 

    // ... 

    services: [ 

        [UtamWdioService, { 

            implicitTimeout: 0, 

            injectionConfigs: ['salesforce-pageobjects/ui-global-components.config.json'] 

        }] 

    ], 

};

Final Troubleshooting Step: If imports still fail, check your node_modules folder manually to confirm the file path salesforce-pageobjects/pageObjects/desktopLayoutContainer.js exists. If only .json files exist there, the package was not compiled correctly.

Hi Anuj!

For an AppExchange Security Review, having the pen-test and documentation already prepared should give you a good starting point. For the remaining work, I’d look for someone who has hands-on experience with Salesforce’s security review questionnaire, code/security remediation, and the reviewer communication process. 

It may also be worth having the consultant do a pre-submission review of the package and security documentation before the June 9 submission, so any gaps can be addressed beforehand. 

If anyone here has recently supported an AppExchange Security Review end-to-end, their experience with the questionnaire and review process would be especially useful for Anuj.

Hi Aron!

Based on Salesforce’s current AppExchange security-review guidance, your use case appears to fall under the packaging requirement.

For an Authorization Code/Web Server flow where the callback URL is controlled by the ISV partner, Salesforce currently lists the integration as requiring packaging. The fact that the SaaS application itself isn’t installed in subscriber orgs doesn’t by itself remove that requirement. 

Also, Salesforce is moving new integrations toward External Client Apps (ECA). Existing Connected Apps can continue to operate, but Salesforce recommends ECAs for new integrations. 

So I would clarify with the reviewer whether they specifically require the existing Connected App to be migrated to an ECA, rather than assuming the four requested controls can all be enabled on the existing Connected App. Salesforce documents ECA-specific OAuth security controls such as refresh-token rotation and IP restrictions.

For the security-review response, I’d also explicitly describe your OAuth flow, who owns the callback URL, where refresh tokens are stored, and how PKCE/refresh-token protection is implemented. That should make it easier for the reviewer to confirm the expected configuration.

Hi Jeff!

Your setup looks close to the supported packaged-ECA model. Salesforce documents that a packaged External Client App can either generate its own OAuth global settings in the subscriber org or reference the global OAuth settings from the source/packaging org. In the latter model, the subscriber ECA’s OAuth link should reference the source org and its consumer ID. 

So I wouldn’t expect the subscriber to automatically need a separate consumer key just because the package is installed. Salesforce specifically documents the source-org global-settings association for OAuth. 

One thing I’d verify is the actual ExtlClntAppOauthSettings OAuth link in the installed subscriber app and confirm it points to the source org/global OAuth settings exactly as documented. If the subscriber instead has its own global settings, then it will have its own OAuth consumer credentials. 

Also, the source org needs to remain available because subscriber ECAs that reference its global OAuth settings depend on that source configuration. 

Given that your OAuth request is reaching the consent page and then specifically fails with OAUTH_AUTHORIZATION_BLOCKED, I’d focus on the ECA association/global OAuth configuration rather than the subscriber policy alone. 

If you can share the ExtlClntAppOauthSettings OAuth link value from the packaged ECA/subscriber, that would be the next thing I’d check.

For an AppExchange Security Review, I’d avoid designing around the assumption that an API-only user automatically bypasses every authentication control. The safer approach is to confirm the current review-team requirements for integration credentials and test the exact OAuth/API flow in the submitted environment beforehand. If automated scanners require interactive authentication, Salesforce Partner Support or the Security Review team should clarify the supported testing arrangement rather than relying on manual OTP handling.  Visit here for more information.

This looks like a mismatch created by Salesforce's own PKCE enforcement rollout rather than something wrong in your org's configuration. The SalesforceDX Namespace Registry connected app is a Salesforce-owned system connected app used by the Namespace Registries Link Namespace flow, and its PKCE requirement is locked because Salesforce has been moving connected apps and External Client Apps toward mandatory PKCE, with no admin opt-out on system apps like this one. Your org-level Require PKCE toggle being off is not relevant here, since that setting only affects apps that inherit the org default, and this one has its own requirement baked in. 

The "invalid_request / missing required code challenge" error means the client side of this OAuth exchange, the Link Namespace popup itself, is not sending a code_challenge parameter even though the connected app now demands one. Since that popup is Salesforce's own UI and not something you control from Setup, you cannot fix this from your Dev Hub or Namespace org settings. Other admins have hit the same "missing required code challenge" wall on various Salesforce-owned OAuth flows since PKCE enforcement tightened, so this is worth logging as a Salesforce Support case, quoting the exact error and the Dev Hub and Namespace org IDs, so they can confirm whether it is a tracked regression tied to the PKCE rollout on that specific connected app. 

Background on PKCE enforcement:

Assumption: I cannot reproduce your Dev Hub, so I cannot fully confirm this is a Salesforce-side defect versus something specific to your org's Namespace Registry setup. This is inferred from the well-documented PKCE enforcement pattern and other reports of the same error on Salesforce-managed connected apps once PKCE became mandatory without an opt-out.

@Usman Khan

You might be right, but in my last communication with the Security Review team, they clearly mentioned that we need to have the waiver code.  

Please keep us update; As Usman suggested please raise a case from your partner account.  

Hi @Janaki Reddi

A few native options actually cover garden style ticketing well timed/dated admission tickets, guest checkout (no login needed for buyers), and Salesforce native data (no sync lag or external ticketing database). Here's how the leading ones stack up:

Two things worth confirming before you commit, since they change the recommendation: 

• Ticket volume/pattern is this timed/dated admission (e.g. "Saturday 10am garden entry") with capacity caps, or more traditional single events (fundraisers, classes, weddings)? Blackthorn and AC Events both handle capacity based timed tickets; EventSpark leans more toward simple RSVP/registration.
• Budget tier Blackthorn is licensed per-org and sits mid-to-high; EventSpark is the lower cost native option if this is a smaller garden with modest ticket volume.

If you want, I can pull current AppExchange reviews/pricing details for whichever one fits your volume, or scope out what a native build/config would take if you'd rather not add a managed package at all worth knowing that's also an option here, since garden ticketing with capacity limits is buildable on standard Salesforce (Flow + Experience Cloud + a payment gateway like Stripe) if you want full control instead of a packaged app. 

I hope you find the above information helpful. If it does, please mark it as Best Answer to help others too.