Install & setup

1. Setup → App Manager → New Connected App → Create a Connected App.
2. Basic Information: Name = Training Dashboard, API Name = Training_Dashboard, Contact Email = your admin email.
3. Enable OAuth Settings ✓. Callback URL = https://<your-dashboard-domain>/auth/callback (one per line; add http://localhost:3000/auth/callback for dev).
4. OAuth scopes: api, refresh_token, offline_access, id, profile, openid.
5. Check: Require Secret for Web Server Flow, Require Secret for Refresh Token Flow, Require PKCE. Leave Use digital signatures unchecked.
6. Save. Wait 2-10 minutes for it to propagate.
7. Manage → Edit Policies: Permitted Users = Admin approved users are pre-authorized. Save. Then back on the Connected App page, scroll to "Profiles" or "Permission Sets" and add Training Dashboard Schema (so users with the perm set can authorize).
8. Copy the Consumer Key and Consumer Secret (Manage Consumer Details). You'll paste these into AWS Secrets Manager next.

Deeper walkthrough with screenshots: ../solutioner_ai/sf/salesforce-connected-app-setup.md in your local checkout.

Resources needed (per lambda/README.md):

• Secrets Manager secret salesforce-connected-app/training-dashboard with JSON: { "client_id": "...", "client_secret": "...", "cookie_key": "<32-byte hex>" }. Generate cookie_key with openssl rand -hex 32.
• S3 bucket for the static frontend. Bucket Owner Enforced. Block all public access. Origin Access Control (OAC) for CloudFront read.
• Lambda function training-dashboard-backend, Node 20.x, ESM, code from lambda/. Function URL with auth_type=NONE (auth happens via cookie inside the function).
• IAM role for the Lambda: secretsmanager:GetSecretValue on the one secret + CloudWatch logs.
• ACM certificate in us-east-1 for your dashboard domain.
• CloudFront distribution: behaviors /auth/* and /api/* → Lambda Function URL origin; default /* → S3. Alternate domain name = your dashboard subdomain. Attach the cert.
• Route 53 record aliasing your dashboard subdomain to the CloudFront distribution.

The portable framework guide is at ../solutioner_ai/sf/salesforce-oauth-framework.md — full architecture, IAM policies, and gotchas (cookie chunking, cache behavior order, refresh-on-401).

1. Sync the static frontend:

   aws s3 sync mockups/ s3://<your-bucket>/ --exclude ".DS_Store"

2. Package and deploy the Lambda:

   cd lambda && zip -r ../lambda.zip . -x "*.md" "node_modules/*"
   aws lambda update-function-code --function-name training-dashboard-backend --zip-file fileb://../lambda.zip
   cd ..

3. Invalidate CloudFront:

   aws cloudfront create-invalidation --distribution-id <dist-id> --paths "/*"

4. Update _sf_admin.js: edit the DEFAULT_INSTANCE constant to your org's My Domain (e.g. https://j2rsolutions.my.salesforce.com). Re-sync to S3.

Fires for individuals as their personal training expires or as the org-level deadline approaches and they have no compliant training. Configured entirely in Salesforce; no AWS required.

Recipe: schedule-triggered flow on Compliance_Requirement__c

1. Setup → Flows → New Flow → Schedule-Triggered Flow.
2. Frequency = Daily, Start Time = early AM. Object = Compliance_Requirement__c. Filter: Active = TRUE AND Compliance_Deadline__c within the next 60 days AND not in the past.
3. Inside the flow, for each Compliance Requirement: Get Records on Contact filtered by Training_Role__c (or all employees, depending on Applicability__c). Then for each contact, Get Records on Training__c filtered by Program__c = the requirement's program AND Credential_Issued__c = true AND (Effective_Start_Date is null OR Completion_Date >= Effective_Start_Date) AND Expiry_Date >= TODAY.
4. Decision element: if the Training__c collection is empty, this contact is non-compliant.
5. Action: Send Email to the contact + their manager (or a fixed distribution list). Subject: "Training due — {!CR.Name} by {!CR.Compliance_Deadline__c}". Body: link back to the dashboard.
6. For rolling per-person expiry alerts (the 90/60/30/7 day cadence on individual completions), build a separate Record-Triggered Flow on Training__c using a scheduled path that fires N days before Expiry_Date__c.

Flow is point-and-click; nothing to deploy from this repo. Disable the flow in Setup if you need to mute alerts temporarily.

Daily check that compares each Vendor_Tier_Target__c against its cert prerequisites + revenue threshold + deadline. Sends a single SES email summarizing all triggers when any tier crosses into "at-risk" territory or flips from met to short.

9a. Verify SES sender + recipients

1. SES console (us-east-1) → Verified identities → Create identity. Recommended: verify the domain (e.g. j2rsolutions.io) rather than just the email address — domain verification gives you DKIM signing and DMARC alignment, which dramatically improves deliverability.
2. SES will generate 3 DKIM CNAME records. Add them to your DNS zone (Route 53 if you're using it, or your DNS provider). Wait for verification status to flip to Verified.
3. Add SES to your domain's SPF record. If your current SPF TXT is v=spf1 include:_spf.google.com ~all, change it to v=spf1 include:_spf.google.com include:amazonses.com ~all. SPF allows up to 10 DNS lookups in the chain — adding one is safe for most setups.
4. Optional but recommended: add a DMARC record at _dmarc.<your-domain>: v=DMARC1; p=none; rua=mailto:postmaster@<your-domain>. Start with p=none to monitor before tightening.
5. If your AWS account is still in the SES sandbox, also verify each recipient address (they need to opt in). Request production access via SES → Account dashboard to lift that limit.

9b. Capture a service refresh token

The cron auths to Salesforce using a long-lived refresh token from a designated admin user. JWT Bearer (with a digital cert) is more durable; this is the simpler bootstrap.

1. From the admin browser already logged into the dashboard, open DevTools → Application → Cookies. The session cookie is __sf_session (encrypted; not directly useful for the token).
2. Easier: run the OAuth flow on the command line. sf org login web --alias td-cron --instance-url https://test.salesforce.com against the Connected App's authorize endpoint, then read ~/.sf/<alias>.json — the refreshToken field is what you need.
3. Add it to the existing secret:

   aws secretsmanager get-secret-value --secret-id salesforce-connected-app/training-dashboard --region us-east-1 --query SecretString --output text > /tmp/sec.json
   # edit /tmp/sec.json: add "service_refresh_token": "<token>" and "instance_url": "https://<your-org>.my.salesforce.com"
   aws secretsmanager update-secret --secret-id salesforce-connected-app/training-dashboard --region us-east-1 --secret-string file:///tmp/sec.json
   rm /tmp/sec.json

9c. Drop the recipients config in S3

cat > /tmp/alert-recipients.json <<'EOF'
{
  "sender": "alerts@j2rsolutions.io",
  "recipients": ["jonathan@j2rsolutions.io"]
}
EOF
aws s3 cp /tmp/alert-recipients.json s3://j2r-training-dashboard-mockup-081006927100/config/alert-recipients.json
rm /tmp/alert-recipients.json

9d. Enable the EventBridge rule

The rule was created in DISABLED state during this install (so it doesn't fire before SES + secrets are ready). Once 9a/9b/9c are done:

aws events enable-rule --name training-dashboard-daily-alerts --region us-east-1

9e. Test it manually

aws lambda invoke --function-name training-dashboard-backend \
  --region us-east-1 \
  --cli-binary-format raw-in-base64-out \
  --payload '{"source":"aws.events","detail-type":"Scheduled Event"}' \
  /tmp/cron-out.json
cat /tmp/cron-out.json

Output should be {"triggered": N, "evaluated": M}. CloudWatch Logs has the detailed trace under /aws/lambda/training-dashboard-backend.

Triggers, in plain language

• Cert shortfall + deadline: any tier short ≥1 cert with Tier_Deadline__c ≤ 60 days away.
• Revenue shortfall + deadline: revenue short with Tier_Deadline__c ≤ 90 days away.
• Delta to short: anything that flipped from MET to SHORT since yesterday's run, regardless of deadline. State is kept in s3://<bucket>/state/tier-shortfalls.json.

Tuning

The 60/90 day thresholds live in lambda/lib/cron.mjs as CERT_DEADLINE_DAYS and REV_DEADLINE_DAYS. Change and redeploy the Lambda. To swap SES for Slack, replace sendAlertEmail() with a fetch POST to a webhook URL stored in the same secret.