Salesforce Connector

1. Go to Setup > Users > Permission Sets
2. Click QuantaSeal_User
3. Click Manage Assignments > Add Assignments
4. Select the users who need access, then click Assign

1. Go to Setup > Security > Named Credentials
2. Find QuantaSeal_API in the list
3. Confirm:
   URL:              https://api.quantaseal.io
   Authentication:   Named Principal
   Protocol:         OAuth 2.0 (JWT Bearer)
   Auth. Provider:   QuantaSeal
4. Click Authenticate to run the JWT Bearer exchange
   → Browser should redirect back with "Success"

// Execute in Developer Console > Execute Anonymous
HttpRequest req = new HttpRequest();
req.setEndpoint('callout:QuantaSeal_API/api/v2/health');
req.setMethod('GET');
Http h = new Http();
HttpResponse res = h.send(req);
System.debug('QuantaSeal health: ' + res.getBody());
// Expected: {"status":"healthy","version":"2.x.x"}

1. Go to Setup > Apps > App Manager > New Connected App
2. Fill in:
   Connected App Name:  QuantaSeal Integration
   API Name:            QuantaSeal_Integration
   Contact Email:       your-admin@example.com
3. Check "Enable OAuth Settings"
4. Callback URL:        https://login.salesforce.com/services/oauth2/callback
5. Selected OAuth Scopes:
     - Full access (full)
     - Perform requests at any time (refresh_token, offline_access)
6. Check "Use digital signatures"
7. Upload your certificate file (quantaseal.crt - see Authentication section)
8. Save - note the Consumer Key (client_id)

1. Go to Setup > Security > Auth. Providers > New
2. Provider Type:  Apex Class
3. Apex Class:     QuantaSealAuthProvider
4. Name:           QuantaSeal
5. URL Suffix:     QuantaSeal
6. Custom Parameters (key=value pairs):
     tenant_id    = <your QuantaSeal Tenant UUID>
     client_id    = <Connected App Consumer Key>
     endpoint     = https://api.quantaseal.io
7. Save

1. Go to Setup > Security > Named Credentials
2. Click QuantaSeal_API > Edit
3. Authentication Protocol: OAuth 2.0
4. Authentication Provider:  QuantaSeal  (the Auth. Provider created above)
5. Scope: full refresh_token
6. Check "Start Authentication Flow on Save"
7. Save - complete the OAuth flow in the popup window

# Generate a 2048-bit RSA key pair (private key stays local - never uploaded to QuantaSeal)
openssl req -x509 -newkey rsa:2048 -keyout quantaseal.key -out quantaseal.crt \
  -days 365 -nodes -subj "/CN=QuantaSeal Salesforce Connector"

# The .crt file → upload to Salesforce Connected App > Use Digital Signatures
# The .crt file → also upload to QuantaSeal Admin Console > Settings > Salesforce Connected App
# The .key file → stays on your local machine, loaded into Salesforce Certificate and Key Management

# Verify the certificate
openssl x509 -in quantaseal.crt -text -noout | grep -E "(Subject|Not After|Public Key)"

// QuantaSealAuthProvider.cls (excerpt - full source in package)
global class QuantaSealAuthProvider implements Auth.AuthProvider {

    // Called by Salesforce to exchange the JWT for an access token
    global Auth.AuthProviderTokenResponse handleCallback(
        Map<String,String> config,
        Auth.AuthProviderCallbackState state
    ) {
        // 1. Build JWT claims
        String tenantId  = config.get('tenant_id');
        String clientId  = config.get('client_id');
        String endpoint  = config.get('endpoint');
        Long   expiry    = Datetime.now().addSeconds(180).getTime() / 1000;

        Map<String,Object> claims = new Map<String,Object>{
            'iss' => clientId,
            'sub' => UserInfo.getUserName(),
            'aud' => endpoint,
            'exp' => expiry,
            'iat' => Datetime.now().getTime() / 1000,
            'tenant_id' => tenantId
        };

        // 2. Sign JWT with the Connected App private key (via Salesforce Auth.JWT)
        Auth.JWT jwt = new Auth.JWT();
        jwt.setAdditionalClaims(claims);
        Auth.JWS jws = new Auth.JWS(jwt, 'QuantaSeal_Certificate');
        String signedJwt = jws.getCompactSerialization();

        // 3. Exchange JWT for QuantaSeal access token
        HttpRequest req = new HttpRequest();
        req.setEndpoint(endpoint + '/api/v2/auth/oauth2-token');
        req.setMethod('POST');
        req.setHeader('Content-Type', 'application/x-www-form-urlencoded');
        req.setBody(
            'grant_type=' + EncodingUtil.urlEncode(
                'urn:ietf:params:oauth:grant-type:jwt-bearer', 'UTF-8'
            ) + '&assertion=' + EncodingUtil.urlEncode(signedJwt, 'UTF-8')
        );

        Http h = new Http();
        HttpResponse res = h.send(req);

        Map<String,Object> body = (Map<String,Object>)
            JSON.deserializeUntyped(res.getBody());

        return new Auth.AuthProviderTokenResponse(
            'QuantaSeal',
            null,                                         // no OAuth state here
            (String) body.get('access_token'),
            (String) body.get('refresh_token')
        );
    }
}

// Encrypt a single field value - typically called from a trigger or flow
@AuraEnabled
public static String encryptFieldValue(String plaintext) {
    // Build request to QuantaSeal Encryption API
    HttpRequest req = new HttpRequest();
    req.setEndpoint('callout:QuantaSeal_API/api/v2/encryption/encrypt');
    req.setMethod('POST');
    req.setHeader('Content-Type', 'application/json');

    Map<String,Object> payload = new Map<String,Object>{
        'data'      => plaintext,
        'algorithm' => 'ML-KEM-768'
    };
    req.setBody(JSON.serialize(payload));

    Http h = new Http();
    HttpResponse res = h.send(req);

    if (res.getStatusCode() != 200) {
        throw new CalloutException(
            'QuantaSeal encryption failed: ' + res.getStatusCode()
        );
    }

    Map<String,Object> body = (Map<String,Object>)
        JSON.deserializeUntyped(res.getBody());
    Map<String,Object> data = (Map<String,Object>) body.get('data');

    // Store the entire envelope as a JSON string in your Text (Long) field
    return JSON.serialize(data);
}

// Decrypt a previously encrypted field value
@AuraEnabled
public static String decryptFieldValue(String encryptedEnvelope) {
    Map<String,Object> envelope = (Map<String,Object>)
        JSON.deserializeUntyped(encryptedEnvelope);

    HttpRequest req = new HttpRequest();
    req.setEndpoint('callout:QuantaSeal_API/api/v2/encryption/decrypt');
    req.setMethod('POST');
    req.setHeader('Content-Type', 'application/json');
    req.setBody(JSON.serialize(envelope));

    Http h = new Http();
    HttpResponse res = h.send(req);

    if (res.getStatusCode() != 200) {
        throw new CalloutException(
            'QuantaSeal decryption failed: ' + res.getStatusCode()
        );
    }

    Map<String,Object> body = (Map<String,Object>)
        JSON.deserializeUntyped(res.getBody());
    Map<String,Object> data = (Map<String,Object>) body.get('data');
    return (String) data.get('data');
}

<!-- In your custom LWC component -->
<template>
  <!-- Use the packaged FieldEncryption component -->
  <c-quanta-seal-field-encryption
    record-id={recordId}
    object-api-name="Contact"
    field-api-name="TaxFileNumber__c"
    label="Tax File Number"
    onencrypted={handleEncrypted}
    ondecrypted={handleDecrypted}>
  </c-quanta-seal-field-encryption>
</template>

// In your LWC controller
import { LightningElement, api } from 'lwc';

export default class MyContactForm extends LightningElement {
    @api recordId;

    handleEncrypted(event) {
        // event.detail.ciphertext contains the encrypted envelope JSON string
        // Save it to the field using uiRecordApi or a custom Apex action
        const ciphertext = event.detail.ciphertext;
        console.log('Encrypted:', ciphertext.substring(0, 40) + '...');
    }

    handleDecrypted(event) {
        // event.detail.plaintext contains the decrypted value
        // Display it in a masked input - do not persist plaintext back to Salesforce
        const plaintext = event.detail.plaintext;
        this.template.querySelector('.secret-field').value = plaintext;
    }
}

// ContactEncryptTrigger.trigger
trigger ContactEncryptTrigger on Contact (before insert, before update) {
    for (Contact c : Trigger.new) {
        // Only encrypt if the field changed (avoid double-encryption)
        if (c.TaxFileNumber__c != null && !c.TaxFileNumber__c.startsWith('{"ciphertext_kem"')) {
            // Encrypt the TFN before it is written to the database
            c.TaxFileNumber__c =
                QuantaSealFieldEncryptionController.encryptFieldValue(c.TaxFileNumber__c);
        }
    }
}

// To decrypt on read, use a trigger on after query (API 55.0+) or a helper Apex action:
trigger ContactDecryptTrigger on Contact (after query) {
    for (Contact c : Trigger.new) {
        if (c.TaxFileNumber__c != null && c.TaxFileNumber__c.startsWith('{"ciphertext_kem"')) {
            // Decrypt only for users with the QuantaSeal_User permission set
            if (hasQuantaSealPermission()) {
                c.TaxFileNumber__c =
                    QuantaSealFieldEncryptionController.decryptFieldValue(c.TaxFileNumber__c);
            } else {
                c.TaxFileNumber__c = '••••••••'; // masked for unauthorised users
            }
        }
    }
}

private static Boolean hasQuantaSealPermission() {
    return [
        SELECT Id FROM PermissionSetAssignment
        WHERE AssigneeId = :UserInfo.getUserId()
          AND PermissionSet.Name = 'QuantaSeal_User'
        LIMIT 1
    ].size() > 0;
}

// Execute in Developer Console > Execute Anonymous
// Encrypt all Contacts where TaxFileNumber__c is not yet encrypted
Id jobId = Database.executeBatch(
    new QuantaSealBulkEncryptBatch(
        'Contact',           // SObject API name
        'TaxFileNumber__c',  // Field API name
        'encrypt',           // Operation: 'encrypt' or 'decrypt'
        'WHERE TaxFileNumber__c != null AND TaxFileNumber__c NOT LIKE '{"ciphertext_kem"%''
    ),
    200  // batch size - max 200 for callout batches
);
System.debug('Bulk encrypt job started: ' + jobId);

// QuantaSealBulkEncryptScheduler.cls
global class QuantaSealBulkEncryptScheduler implements Schedulable {
    global void execute(SchedulableContext ctx) {
        Database.executeBatch(
            new QuantaSealBulkEncryptBatch(
                'Contact',
                'TaxFileNumber__c',
                'encrypt',
                'WHERE TaxFileNumber__c != null AND TaxFileNumber__c NOT LIKE '{"ciphertext_kem"%''
            ),
            200
        );
    }
}

// Schedule to run every night at midnight (CRON: Seconds Minutes Hours Day Month Week Year)
String cronExp = '0 0 0 * * ?';
System.schedule('QuantaSeal Nightly TFN Encrypt', cronExp, new QuantaSealBulkEncryptScheduler());

// QuantaSealBulkEncryptBatch.cls (excerpt - full source in package)
global class QuantaSealBulkEncryptBatch
    implements Database.Batchable<SObject>, Database.AllowsCallouts {

    private String objectName;
    private String fieldName;
    private String operation;   // 'encrypt' or 'decrypt'
    private String whereClause;

    global QuantaSealBulkEncryptBatch(
        String objectName, String fieldName, String operation, String whereClause
    ) {
        this.objectName  = objectName;
        this.fieldName   = fieldName;
        this.operation   = operation;
        this.whereClause = whereClause;
    }

    global Database.QueryLocator start(Database.BatchableContext bc) {
        String query = 'SELECT Id, ' + fieldName + ' FROM ' + objectName
                     + ' ' + whereClause;
        return Database.getQueryLocator(query);
    }

    global void execute(Database.BatchableContext bc, List<SObject> scope) {
        List<SObject> toUpdate = new List<SObject>();

        for (SObject record : scope) {
            String fieldValue = (String) record.get(fieldName);
            if (fieldValue == null) continue;

            String result = (operation == 'encrypt')
                ? QuantaSealFieldEncryptionController.encryptFieldValue(fieldValue)
                : QuantaSealFieldEncryptionController.decryptFieldValue(fieldValue);

            record.put(fieldName, result);
            toUpdate.add(record);
        }

        if (!toUpdate.isEmpty()) {
            update toUpdate;
        }
    }

    global void finish(Database.BatchableContext bc) {
        AsyncApexJob job = [
            SELECT Id, Status, NumberOfErrors, TotalJobItems
            FROM AsyncApexJob WHERE Id = :bc.getJobId()
        ];
        System.debug(
            'Bulk ' + operation + ' complete. '
            + job.TotalJobItems + ' batches, '
            + job.NumberOfErrors + ' errors.'
        );
    }
}

// Route a callout through QuantaSeal to an external REST API
// The target API credentials are stored in the QuantaSeal Vault (not in Salesforce)
public class ExternalAPIService {

    public static Map<String,Object> fetchCustomerData(String customerId) {
        // Build the proxy request
        Map<String,Object> proxyPayload = new Map<String,Object>{
            'integration_id' => '550e8400-e29b-41d4-a716-446655440001',  // QuantaSeal Integration UUID
            'operation'      => 'GET_CUSTOMER',
            'payload'        => new Map<String,Object>{
                'customer_id' => customerId
            }
        };

        HttpRequest req = new HttpRequest();
        req.setEndpoint('callout:QuantaSeal_API/api/v2/proxy/outbound');
        req.setMethod('POST');
        req.setHeader('Content-Type', 'application/json');
        req.setBody(JSON.serialize(proxyPayload));

        Http h = new Http();
        HttpResponse res = h.send(req);

        if (res.getStatusCode() != 200) {
            throw new CalloutException(
                'QuantaSeal proxy failed [' + res.getStatusCode() + ']: ' + res.getBody()
            );
        }

        // Response contains an encrypted envelope - QuantaSeal decrypts on the client side
        // or you can return the envelope to be decrypted client-side via the SDK
        Map<String,Object> body = (Map<String,Object>) JSON.deserializeUntyped(res.getBody());
        Map<String,Object> data = (Map<String,Object>) body.get('data');

        // If decryption is handled server-side, 'payload' contains the decrypted response
        return (Map<String,Object>) data.get('payload');
    }
}

// SAPIntegrationService.cls
public class SAPIntegrationService {

    private static final String SAP_INTEGRATION_ID = '7c9e6679-7425-40de-944b-e07fc1f90ae7';

    // Called from OpportunityTrigger.trigger on after insert
    public static void syncOpportunityToSAP(List<Opportunity> opportunities) {
        for (Opportunity opp : opportunities) {
            try {
                syncSingle(opp);
            } catch (Exception e) {
                System.debug('SAP sync failed for ' + opp.Id + ': ' + e.getMessage());
                // Log failure to QuantaSeal_Error__c custom object
                createErrorLog(opp.Id, e.getMessage());
            }
        }
    }

    private static void syncSingle(Opportunity opp) {
        // Payload that SAP expects (mapped from Salesforce fields)
        Map<String,Object> sapPayload = new Map<String,Object>{
            'SalesDocument'   => opp.Name,
            'SoldToParty'     => opp.AccountId,
            'NetAmount'       => opp.Amount,
            'Currency'        => opp.CurrencyIsoCode,
            'SalesOrg'        => 'AU01',
            'RequestedDate'   => String.valueOf(opp.CloseDate)
        };

        Map<String,Object> proxyRequest = new Map<String,Object>{
            'integration_id' => SAP_INTEGRATION_ID,
            'operation'      => 'CREATE_SALES_ORDER',
            'payload'        => sapPayload,
            'target_object'  => 'SalesOrder'
        };

        HttpRequest req = new HttpRequest();
        req.setEndpoint('callout:QuantaSeal_API/api/v2/proxy/outbound');
        req.setMethod('POST');
        req.setHeader('Content-Type', 'application/json');
        req.setBody(JSON.serialize(proxyRequest));
        req.setTimeout(30000);  // 30s - SAP can be slow

        Http h = new Http();
        HttpResponse res = h.send(req);

        if (res.getStatusCode() == 200) {
            Map<String,Object> body = (Map<String,Object>) JSON.deserializeUntyped(res.getBody());
            Map<String,Object> data = (Map<String,Object>) body.get('data');
            String sapOrderId = (String) ((Map<String,Object>) data.get('payload')).get('SalesDocument');
            // Write SAP order ID back to Salesforce
            opp.SAP_Order_Id__c = sapOrderId;
        } else {
            throw new CalloutException('SAP proxy error: ' + res.getStatusCode());
        }
    }

    private static void createErrorLog(Id oppId, String errorMsg) {
        insert new QuantaSeal_Error__c(
            Related_Record_Id__c = oppId,
            Error_Message__c     = errorMsg.left(255),
            Timestamp__c         = Datetime.now()
        );
    }
}

// QuantaSealWebhookReceiver.cls
// Expose this as a Salesforce Site.com endpoint: https://<your-site>.force.com/services/apexrest/quantaseal/webhook
@RestResource(urlMapping='/quantaseal/webhook/*')
global class QuantaSealWebhookReceiver {

    @HttpPost
    global static void handleInbound() {
        RestRequest  req = RestContext.request;
        RestResponse res = RestContext.response;

        try {
            // QuantaSeal has already verified signatures before forwarding
            // The X-QuantaSeal-Verified header confirms verification passed
            String verified = req.headers.get('X-QuantaSeal-Verified');
            if (verified != 'true') {
                res.statusCode = 403;
                res.responseBody = Blob.valueOf('{"error":"Signature verification required"}');
                return;
            }

            // Payload is the decrypted plaintext JSON from QuantaSeal
            String body = req.requestBody.toString();
            Map<String,Object> event = (Map<String,Object>)
                JSON.deserializeUntyped(body);

            String eventType = (String) event.get('event_type');
            Map<String,Object> payload = (Map<String,Object>) event.get('payload');

            // Route to the correct handler based on event type
            if (eventType == 'payment.succeeded') {
                handlePaymentSucceeded(payload);
            } else if (eventType == 'customer.created') {
                handleCustomerCreated(payload);
            } else {
                System.debug('Unhandled QuantaSeal event type: ' + eventType);
            }

            res.statusCode = 200;
            res.responseBody = Blob.valueOf('{"received":true}');

        } catch (Exception e) {
            System.debug('QuantaSeal webhook error: ' + e.getMessage());
            res.statusCode = 500;
            // Return generic error - do not expose internal details
            res.responseBody = Blob.valueOf('{"error":"Internal error"}');
        }
    }

    private static void handlePaymentSucceeded(Map<String,Object> payload) {
        String accountId = (String) payload.get('salesforce_account_id');
        Decimal amount   = Decimal.valueOf(String.valueOf(payload.get('amount')));

        insert new Payment__c(
            Account__c = accountId,
            Amount__c  = amount,
            Status__c  = 'Received',
            Source__c  = 'QuantaSeal Webhook'
        );
    }

    private static void handleCustomerCreated(Map<String,Object> payload) {
        String email = (String) payload.get('email');
        String name  = (String) payload.get('name');

        // Check for existing Contact by email before inserting
        List<Contact> existing = [
            SELECT Id FROM Contact WHERE Email = :email LIMIT 1
        ];
        if (existing.isEmpty()) {
            insert new Contact(
                LastName = name.contains(' ') ? name.substringAfterLast(' ') : name,
                FirstName = name.contains(' ') ? name.substringBeforeLast(' ') : '',
                Email    = email,
                LeadSource = 'QuantaSeal Integration'
            );
        }
    }
}

# Register your Salesforce Site endpoint as a webhook_adapter integration in QuantaSeal
curl -X POST https://api.quantaseal.io/api/v2/integrations \
  -H "X-API-Key: qs_live_..." \
  -H "Content-Type: application/json" \
  -d '{
    "name": "Salesforce Webhook Receiver",
    "system_type": "webhook_adapter",
    "config": {
      "endpoint_url": "https://your-site.force.com/services/apexrest/quantaseal/webhook",
      "method": "POST",
      "headers": {
        "Content-Type": "application/json",
        "X-QuantaSeal-Verified": "true"
      }
    },
    "allowed_operations": ["RECEIVE_WEBHOOK"]
  }'