Release r202620

What's new

This release contains the following new features:

• Webhook verification using OpenID Connect discovery
• Token request parameters for OAuth accounts
• Deep comparisons in assert_equal

Webhook verification using OpenID Connect discovery

Inbound webhooks from Xurrent can be secured with a webhook policy: Xurrent signs each message with a JWT, and the automator verifies the signature before triggering a package. Until now, this required configuring the policy's public key on the account manually, and updating it by hand whenever the key rotated.

This release adds a new authentication option to the webhook configuration of Xurrent accounts: JWT - Policy based authorization using OpenID Connect discovery.

With this option, the automator retrieves the current signing keys automatically from the JSON Web Key Set (JWKS) published by Xurrent, so key rotations no longer require any manual updates.

note

This option did not work on the Xurrent demo environment when this release was published. It has been fixed in release r202622.

Token request parameters for OAuth accounts

Accounts that obtain an access token through OAuth, such as HTTP accounts using an OAuth application and Microsoft Graph accounts, can now include additional parameters in the request to the token endpoint, such as scope, resource or audience.

For example, Microsoft Graph accounts request the scope https://graph.microsoft.com/.default by default. A different scope can be requested by adding a scope parameter, as shown in the screenshot above for Microsoft Dynamics.

Deep comparisons in assert_equal

The assert_equal function in test packages previously compared values by strict identity: two objects or arrays were only considered equal when they were the very same instance, which made it awkward to verify structured results.

The function now performs a deep, strict comparison. Objects and arrays are compared by their contents, and types must match exactly:

test("builds the expected order", () => {
  const order = { id: 7, lines: [{ product: "Laptop", quantity: 2 }] };
  assert_equal(order, { id: 7, lines: [{ product: "Laptop", quantity: 2 }] }); // Passes

  assert_equal([1, 2, 3], [1, 2, 3]); // Passes
  assert_equal({ id: "7" }, { id: 7 }); // Fails: strict comparison, "7" is not 7
});

See assert_equal for details.

Other changes

This release contains a number of smaller changes:

• The auto-retry mechanism now supports retry-after headers that contain a date instead of a number of seconds. Also, a call is no longer retried when the requested delay is longer than 1 hour; the call fails immediately instead.

• Package executions that exceed the maximum execution time of 4 hours are now aborted. Previously, such an execution was marked as failed, but the package silently continued running to completion. The abort is recorded as an error message in the package log and, if the package has an error notification configured, a notification is sent.

• The error message shown when a package uses an account that does not exist has been improved.

• The runtime environment of the automator has been upgraded to the latest version. This upgrade can have an impact on outbound email: when an email contains resources that are retrieved from an external server, such as images or attachments referenced by URL, that server must now present a valid TLS certificate. Emails referencing resources on servers with an invalid certificate will fail to send.

Timeline

The expected deployment dates for this release are:

Environment	Date
Demo	Friday, August 21
Production	Tuesday, August 25

The deployment to the Production environment will be conducted outside of office hours (Central European Time Zone), usually between 8 and 10pm.