v3.4: Rule Configuration Wizard

Lightning Flow Scanner App —

Configure rules the way that suits you — the new wizard, a config file, or inline edits — then save it to the org so everyone gets it. The Setup tab now verifies itself.

✨ Configure Rules wizard

The in-app counterpart of the VS Code extension's Configure Scanner command.

• Four steps:
  1. Mode — merged or isolated, plus a beta-rules opt-in
  2. Rules — searchable multi-select with descriptions and Beta badges
  3. Options — thresholds and expressions; core defaults shown as placeholders, empty keeps the default
  4. Review
• Applying re-scans open results.
• Produces the same .flow-scanner.json as everything else, so the wizard, import and inline edits can't drift apart.

📄 Import a config file

Load config reads .flow-scanner.json and .flow-scanner.yml — the same files the CLI reads and the VS Code extension writes.

• Per-rule settings: severity, enabled, expression, threshold, message and messageUrl
• Top-level settings: threshold, categories, exceptions and ignoreFlows
• Rule keys work as ids (excessive-cyclomatic-complexity) or legacy names (CyclomaticComplexity)
• ruleMode: "isolated" runs only the rules the file names
• Parse errors report the line

✏️ Edit rule options inline

• Rules with configurable options — the naming expression, complexity threshold — now have an editor in the Options column.
• Press Enter or click away to apply and re-scan.
• Generated from the core's rule metadata, so new configurable rules appear on their own.

☁️ Save to the org

Configuration no longer dies with the browser session. Save to Org stores the current configuration in the new Flow_Scanner_Saved_Config__mdt custom metadata type, and it loads automatically for every user.

• Requires Customize Application. Deploys via the Metadata API, 10–30 seconds.
• Layers, in order: core defaults → ScanRuleConfiguration__mdt → saved org configuration → the user's session edits.
• It's custom metadata, so it moves between environments with your other deployments.

📤 Export and reset

• Export downloads the current configuration as .flow-scanner.json, ready for the CLI and VS Code. Isolated mode exports only active rules; merged marks disabled ones with enabled: false.
• Reset returns to core defaults plus custom metadata overrides. Previously that needed a page reload.

✅ Setup tab verifies itself

• Five numbered steps in the order you do them: permission set → certificate → External Client App → pre-authorize users → Consumer Key.
• Steps 3 and 4 complete themselves. The JWT connection test runs when the tab opens and after each Consumer Key save. A successful token exchange proves the app and its policies are right. If authorization breaks later, the checklist shows it instead of a stale checkmark.
• OAuth errors say how to fix them: missing pre-authorization (invalid_app_access), missing refresh_token scope, wrong Consumer Key (invalid_client_id), certificate mismatch (invalid_grant).
• Open Installation Guide links to the guide, restructured to match. Pre-authorizing users is now documented as required — it never was optional, the JWT Bearer Flow has no consent screen.

🔧 Other improvements

• ScanRuleConfiguration__mdt Rule Name accepts rule ids (invalid-naming-convention) as well as legacy names (FlowName).
• Severity is validated: Error, Warning and Note apply, anything else is ignored. Info is no longer valid.
• The Configuration toolbar wraps on narrow screens instead of running off the edge.

v3.3 — External Client App Support & In-App Setup

External Client App support (new default setup)

Salesforce is phasing out the creation of new Connected Apps in favor of External Client Apps. Starting with v3.3, the post-installation setup uses an External Client App for the JWT authentication that powers Flow Scanner's Tooling API access. New installs should follow the updated instructions: create a self-signed certificate, create an External Client App with the JWT Bearer Flow enabled, and save its Consumer Key in the app.

Already using a Connected App? You don't need to change anything. Flow Scanner only stores a Consumer Key, and Salesforce accepts JWT authentication from Connected Apps and External Client Apps identically. Upgrading the package does not touch your existing Connected App, certificate, or stored key — everything keeps working. If you'd like to migrate anyway, a step-by-step guide is in the installation guide.

New in-app Setup tab

Setup no longer requires the Developer Console. The app now includes a Setup tab with a live checklist (permission set, certificate, Consumer Key), a field to save the Consumer Key directly, and a Test Connection button to verify JWT authentication end to end. On first run, the app lands on this tab automatically if authentication isn't configured yet.

Beta rules (opt-in)

Beta rules from the scanner core now appear in the Configuration tab with a Beta badge. They're disabled by default and can be enabled per rule; a toolbar toggle shows or hides them in the list.

Other improvements

• Cleaner UI: unified toolbars, tables, and footers across the Flows, Results, and Configuration tabs.
• Clearer error messages when authentication isn't configured
• Updated bundled scanner core with security patches.

Protected Custom Metadata for Consumer Ke

Protected Custom Metadata for Consumer Key
The Consumer Key can now stored in a protected custom metadata type (Flow_Scanner_OAuth_Config_Protected__mdt) instead of the previous normal one. We now also provide simplified Setup via Apex Utility Class by introducing LFSSetup.configure(consumerKey) method to handle deployment of the protected custom metadata, with built-in validation and namespace support.

Additional Post-Installation Steps
Run the updated anonymous Apex script that calls LFSSetup.configure() with your consumer key to set up the app.

OAuth Authentication

v3.0.0 Authentication Upgrade

To upgrade to Flow Scanner v3.0.0, you must follow the new post-installation instructions provided below after uninstalling any previous versions. This release introduces a new package name and namespace, requiring a clean setup to ensure compatibility and avoid conflicts.

Authentication Upgrade

• Replaced Visualforce page and token-based authentication with a Connected App using JWT Bearer Flow for server-to-server Tooling API access.
• Leverages a self-signed certificate (Flow_Scanner) and Consumer Key stored in Custom Metadata (Flow_Scanner_OAuth_Config_Protected__mdt).
• New Apex class ToolingAPI handles JWT generation, token caching, and Tooling API queries with enhanced error handling.

Post-Installation Setup

• Steps include:
  • Creating a Connected App (Flow_Scanner_JWT) with specific OAuth settings (scopes: api, refresh_token, offline_access).
  • Generating and uploading a self-signed certificate (Flow_Scanner).
  • Copying the Consumer Key to Custom Metadata.
  • Pre-authorizing via Profiles (optional) and assigning the Flow Scanner User permission set.
• Process takes ~3–5 minutes; detailed instructions provided in README.

New Package Name and Namespace

• Package name changed to flow-scanner (ID: 0HogK0000000ZFVSA2) to avoid conflicts with prior lightning-flow-scanner installations.
• Namespace changed to lfscanner for the same reason.
• Recommendation: Uninstall previous versions before installing v3.0.0 to prevent any conflicts.

UI Makeover

• Adds all results by navigation
• Adds overall styling improvements
• Adds sorting capabitlities to tables

Adds namespace for isolated development

• Adds Flow_Scanner namespace
• Changes deploy button to deploy managed solution

Admin Rule Overrides

V2.8.0, Admin Rule Overrides
Introduces ScanRuleConfiguration__mdt Custom Metadata Type for org-wide configuration of rule severities (Error, Warning, Info, Note), custom expressions (e.g., regex for FlowName), and disabled states. Overrides load automatically on app startup, enabling centralized governance while preserving user session-only customizations.

Setup: Navigate to Setup > Custom Metadata Types > ScanRuleConfiguration > Manage Records > New.
Fields: Rule Name (e.g., FlowName), Severity, Expression (optional), Disabled (checkbox).
Example: Override FlowName regex to [A-Za-z]+_[0-9]+ for stricter naming conventions.

See the full readme documentation for an example

Flow Overview Filters

• Adds Filters for flow type and activation status
• The toolbar rows now use scoped css

Rule Configurations

This release fixes a previous bug in flow selection and enables users to view and toggle rules for flow analysis.

New Features

1. Configuration Tab - Added a new tab (Configuration) to the main Flow Scanner interface.

The MissingFaultPath rule now correctly ignores "Wait for Amount of Time" and "Wait Until Date" nodes

Upgraded to lightning-flow-scanner-core v5.9.0. This release fixes the MissingFaultPath rule to correctly ignore "Wait for Amount of Time" and "Wait Until Date" nodes, checking fault paths only for relevant nodes like "Wait for Conditions". Resolves Issue #272 (contributed by @chazwatkins). See v5.9.0 release notes for full details.