Skyflow JIT Detokenization for Salesforce

A production-ready Salesforce integration that demonstrates bidirectional tokenization and detokenization with Skyflow. This project provides role-based access control for viewing sensitive data with different redaction levels, data persistence through custom Salesforce objects, and dynamic permission management capabilities.

🏗️ Architecture Overview

graph TB
    subgraph "Salesforce Org"
        subgraph "Lightning Web Components"
            LWC[revealPii Component]
        end
        
        subgraph "Apex Layer"
            DS[DetokenizationService]
            SC[SkyflowClient]
            RC[RoleContextProvider]
            CF[SkyflowConfig]
        end
        
        subgraph "Salesforce Security"
            PS1["Skyflow_Manager<br/>Permission Set"]
            PS2["Skyflow_Analyst<br/>Permission Set"]
            RSS[Remote Site Setting]
        end
        
        subgraph "Custom Objects"
            DCO["Demo_Customer__c<br/>Persistent Sample Data"]
        end
    end
    
    subgraph "Skyflow"
        API_DETOK["Skyflow Detokenization API<br/>/v1/vaults/vault_id/detokenize"]
        API_TOK["Skyflow Tokenization API<br/>/v1/vaults/vault_id/pii"]
        VAULT["Skyflow Vault<br/>Encrypted PII Storage"]
    end
    
    %% Data Flow
    LWC --> DS
    DS --> RC
    DS --> SC
    SC --> CF
    SC --> API_DETOK
    SC --> API_TOK
    API_DETOK --> VAULT
    API_TOK --> VAULT
    
    %% Security Flow  
    RC --> PS1
    RC --> PS2
    SC --> RSS
    
    %% Data Storage
    DCO --> LWC
    
    %% Styling
    classDef salesforce fill:#1589ee,stroke:#0d5691,color:#fff
    classDef skyflow fill:#4c51bf,stroke:#3730a3,color:#fff
    classDef security fill:#f59e0b,stroke:#d97706,color:#fff
    classDef data fill:#10b981,stroke:#059669,color:#fff
    
    class LWC,DS,SC,RC,CF salesforce
    class API_DETOK,API_TOK,VAULT skyflow
    class PS1,PS2,RSS security
    class DCO data

🔄 Tokenization & Detokenization Flow

sequenceDiagram
    participant User
    participant LWC as revealPii LWC
    participant DS as DetokenizationService
    participant RC as RoleContextProvider
    participant SC as SkyflowClient
    participant TOK_API as Skyflow Tokenization API
    participant DETOK_API as Skyflow Detokenization API
    
    User->>LWC: Click "Tokenize PII"
    LWC->>LWC: Extract plain text values from records
    LWC->>DS: tokenizeData(plainTextValues)
    DS->>SC: tokenizeValues(values)
    SC->>TOK_API: POST /v1/vaults/vault_id/pii
    TOK_API-->>SC: Return tokens
    SC-->>DS: Map<String,String> tokenMap
    DS-->>LWC: Token mapping
    LWC->>LWC: Update UI with tokenized data
    LWC->>DS: updateCustomers(tokenizedData)
    DS->>DS: Persist tokenized data to Demo_Customer__c
    LWC-->>User: Display tokenized data (persisted)
    
    User->>LWC: Click "Reveal PII"
    LWC->>LWC: Extract tokens from rows
    LWC->>DS: detokenize(tokens, fields)
    
    DS->>RC: getRedactionLevel()
    RC->>RC: Query user permission sets
    
    alt Has Skyflow_Manager
        RC-->>DS: PLAIN_TEXT
    else Has Skyflow_Analyst  
        RC-->>DS: MASKED
    else No special permissions
        RC-->>DS: REDACTED
    end
    
    DS->>SC: detokenize(tokens, redactionLevel)
    SC->>SC: Build detokenization request
    
    Note over SC: Request Format:<br/>{"detokenizationParameters":[<br/>  {"token":"tkn:abc", "redaction":"PLAIN_TEXT"}<br/>]}
    
    SC->>DETOK_API: POST /v1/vaults/vault_id/detokenize
    DETOK_API->>DETOK_API: Process tokens based on redaction level
    
    alt Success
        DETOK_API-->>SC: {"records":[{"token":"tkn:abc", "value":"Alice"}]}
        SC-->>DS: Map<String,String> values
        DS-->>LWC: Detokenized values
        LWC->>LWC: Update UI with revealed data
        LWC-->>User: Display detokenized data
    else API Error
        DETOK_API-->>SC: HTTP Error + Error Message
        SC->>SC: throw CalloutException
        DS->>DS: Exception propagated
        LWC->>LWC: catch exception
        LWC-->>User: Show error alert
    end

📁 Project Structure

skyflow-jit-detokenization/
├── sfdx-project.json                    # SFDX project configuration
├── setup.py                            # Automated setup script
├── requirements.txt                     # Python dependencies
├── .env.local.template                  # Environment variables template
│
├── force-app/main/default/
│   ├── classes/                        # Apex Classes
│   │   ├── SkyflowConfig.cls           # Configuration constants
│   │   ├── SkyflowClient.cls           # HTTP client for Skyflow APIs
│   │   ├── RoleContextProvider.cls     # Role-based access control
│   │   ├── DetokenizationService.cls   # Main service (LWC callable)
│   │   └── DetokenizationServiceTest.cls # Unit tests
│   │
│   ├── lwc/revealPii/                  # Lightning Web Component
│   │   ├── revealPii.html              # Component template
│   │   ├── revealPii.js                # Component logic
│   │   └── revealPii.js-meta.xml       # Component metadata
│   │
│   ├── objects/Demo_Customer__c/       # Custom Object for Demo Data
│   │   ├── Demo_Customer__c.object-meta.xml     # Object definition
│   │   └── fields/                     # Custom fields
│   │       ├── Customer_ID__c.field-meta.xml
│   │       ├── First_Name__c.field-meta.xml
│   │       ├── Last_Name__c.field-meta.xml
│   │       └── Email__c.field-meta.xml
│   │
│   ├── permissionsets/                 # Role-based permissions
│   │   ├── Skyflow_Manager.permissionset-meta.xml
│   │   └── Skyflow_Analyst.permissionset-meta.xml
│   │
│   └── remoteSiteSettings/             # Salesforce security
│       └── Skyflow_API.remoteSite-meta.xml

🚀 Quick Start

Automated Setup

Install dependencies:
```
pip install -r requirements.txt
```

Configure environment:

cp .env.local.template .env.local
# Edit .env.local with your Skyflow and Salesforce details

Run automated setup:
```
python setup.py create
```

The setup script will automatically:

Validate your Salesforce CLI installation
Update configuration files with your environment variables
Deploy the project to your Salesforce org (including custom objects)
Run tests to verify the installation

Note: Permission sets are not automatically assigned. Use the role management buttons in the component UI to assign/revoke permissions dynamically.

⚙️ Configuration

Environment Variables

Variable	Required	Description
`SKYFLOW_VAULT_URL`	✅	Your Skyflow vault URL (e.g., `https://vault123.vault.skyflowapis.com`)
`SKYFLOW_VAULT_ID`	✅	Your Skyflow vault ID
`SKYFLOW_PAT_TOKEN`	✅	Skyflow Personal Access Token
`SALESFORCE_ORG_ALIAS`	✅	Salesforce CLI org alias
`SKYFLOW_TIMEOUT_MS`	❌	HTTP timeout in milliseconds (default: `10000`)
`SKYFLOW_BATCH_SIZE`	❌	Tokens per API call batch (default: `25`)
`SKYFLOW_TABLE`	❌	Tokenization table name (default: `pii`)
`SKYFLOW_TABLE_COLUMN`	❌	Tokenization column name (default: `pii_values`)

Skyflow API Endpoints

Tokenization Endpoint:

POST {SKYFLOW_VAULT_URL}/v1/vaults/{SKYFLOW_VAULT_ID}/pii

Detokenization Endpoint:

POST {SKYFLOW_VAULT_URL}/v1/vaults/{SKYFLOW_VAULT_ID}/detokenize

Tokenization Request Format:

{
  "records": [
    {
      "fields": {
        "pii_values": "Alice"
      }
    }
  ],
  "tokenization": true
}

Detokenization Request Format:

{
  "detokenizationParameters": [
    {
      "token": "tkn:abc123",
      "redaction": "PLAIN_TEXT"
    }
  ]
}

Redaction Levels

Level	Permission Set	Data Visibility
`PLAIN_TEXT`	`Skyflow_Manager`	Full unredacted data
`MASKED`	`Skyflow_Analyst`	Partially masked (A***e)
`REDACTED`	Default users	Fully redacted (***)

🔧 Core Components

Apex Classes

SkyflowConfig: Configuration constants and redaction level enum
SkyflowClient: HTTP client handling both tokenization and detokenization APIs with batch processing
RoleContextProvider: Determines user redaction level based on permission sets
DetokenizationService: Main service exposed to Lightning Web Components

Lightning Web Component

revealPii: Complete tokenization/detokenization demo with persistent sample data
Features "Tokenize PII", "Reveal PII", and "Reset Records" buttons
Dynamic permission management with "Assign/Revoke Role" buttons for testing
Persistent data storage using Demo_Customer__c custom object
Shows different data levels based on user permissions (refreshes required after role changes)
Respects SKYFLOW_BATCH_SIZE configuration for efficient API processing

Custom Objects

Demo_Customer__c: Stores persistent demo customer data
- Customer_ID__c: External ID (C001, C002, etc.)
- First_Name__c: Customer first name (required)
- Last_Name__c: Customer last name (required)
- Email__c: Customer email address (required)

🔄 Component Workflow

Initial Load: Component loads existing Demo_Customer__c records or creates 50 sample records if none exist
Tokenize: Click "Tokenize PII" to convert data to Skyflow tokens and persist to database
Reveal: Click "Reveal PII" to detokenize with role-based redaction (UI-only, doesn't modify records)
Reset: Click "Reset Records" to delete all records and recreate with original plain text data
Role Management: Use "Assign/Revoke Role" buttons to dynamically test different permission levels
Permission Testing: After role changes, refresh browser and click "Reveal PII" to see redaction effects
Data Persistence: Tokenized data survives page refreshes until explicitly reset

🧪 Testing

Tests are automatically run by the setup script. To run tests manually:

sf apex run test --test-level RunSpecifiedTests --class-names DetokenizationServiceTest --target-org your-org-alias

Test Coverage:

Role context validation
Permission set mapping
Empty input handling
Tokenization and detokenization service methods
Batch processing logic

📄 License

This project is licensed under the MIT License - see the LICENSE file for details.

Navigation Menu

Uh oh!

Repository files navigation

Skyflow JIT Detokenization for Salesforce

🏗️ Architecture Overview

🔄 Tokenization & Detokenization Flow

📁 Project Structure

🚀 Quick Start

⚙️ Configuration

Environment Variables

Skyflow API Endpoints

Redaction Levels

🔧 Core Components

Apex Classes

Lightning Web Component

Custom Objects

🔄 Component Workflow

🧪 Testing

📄 License

About

Releases

Packages

Contributors

Languages

Name		Name	Last commit message	Last commit date
force-app/main/default		force-app/main/default
tokenTestGrid.temp		tokenTestGrid.temp
.env.local.template		.env.local.template
.gitignore		.gitignore
README.md		README.md
TokenTestService.cls-meta.xml.temp		TokenTestService.cls-meta.xml.temp
TokenTestService.cls.temp		TokenTestService.cls.temp
requirements.txt		requirements.txt
setup.py		setup.py
sfdx-project.json		sfdx-project.json

Uh oh!

Latest commit

History

Folders and files

Repository files navigation

Skyflow JIT Detokenization for Salesforce

🏗️ Architecture Overview

🔄 Tokenization & Detokenization Flow

📁 Project Structure

🚀 Quick Start

⚙️ Configuration

Environment Variables

Skyflow API Endpoints

Redaction Levels

🔧 Core Components

Apex Classes

Lightning Web Component

Custom Objects

🔄 Component Workflow

🧪 Testing

📄 License

About

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages