fix: enhance error handling in canvas controller and update fullscreen parameter comment

Author: paustint

apps/api/src/app/controllers/canvas.controller.ts

@@ -139,15 +139,36 @@ const appHandler = createRoute(routeDefinition.appHandler.validators, async ({ b
         },
         '[CANVAS][SIGNED_REQUEST_VERIFIED]',
       );
+    } else {
+      res.status(400).send({
+        status: 'error',
+        message: 'Missing required Canvas parameters. Expected either a signed_request or user_approval_required auth flow.',
+      });
+      return;
+    }
+
+    const canvasScriptBaseUrl = (envelope as any)?.client?.instanceUrl || loginUrl;
+    if (!canvasScriptBaseUrl) {
+      res.status(400).send({
+        status: 'error',
+        message: 'Unable to determine Salesforce instance URL for Canvas SDK.',
+      });
+      return;
+    }
+
+    const canvasScriptUrl = new URL(`${canvasScriptBaseUrl}/canvas/sdk/js/${ENV.SFDC_API_VERSION}/canvas-all.js`);
+
+    if (!canvasScriptUrl.hostname.endsWith('.salesforce.com')) {
+      res.status(400).send({
+        status: 'error',
+        message: 'Invalid Salesforce instance URL for Canvas SDK.',
+      });
+      return;
     }
 
-    // we could also use login.salesforce.com
     const fileContents = await getCanvasIndexFile().then((file) =>
       file
-        .replace(
-          '<%=canvasImportScriptUrl%>',
-          `${(envelope as any)?.client?.instanceUrl || loginUrl}/canvas/sdk/js/${ENV.SFDC_API_VERSION}/canvas-all.js`,
-        )
+        .replace('<%=canvasImportScriptUrl%>', canvasScriptUrl.toString())
         .replace('<%=signedRequestJson%>', escapeJsonForScript(JSON.stringify(envelope))),
     );
 

apps/jetstream-canvas/src/app/app.tsx

@@ -12,7 +12,7 @@ import './core/monaco-loader';
 
 const Sfdc = window.Sfdc;
 
-// The fullscreen VF page passes { isFullscreen: true } via the apex:canvasApp parameters attribute
+// The fullscreen VF page passes { isFullScreen: true } via the apex:canvasApp parameters attribute
 const isFullscreen = z.coerce.boolean().default(true).parse(sr.context?.environment?.parameters?.isFullScreen);
 
 export const App = () => {

apps/jetstream-canvas/src/controllers/sf-bulk-api.canvas.controller.ts

@@ -185,8 +185,6 @@ const downloadResults = createRoute(routeDefinition.downloadResults.validators,
     const type = query.type;
     const isQuery = ensureBoolean(query.isQuery);
 
-    // IN THE MIDDLE OF THIS - giving some issues
-
     let results: ReadableStream<Uint8Array>;
     if (isQuery) {
       const resultIds = await jetstreamConn!.bulk.getQueryResultsJobIds(jobId, batchId);