We distribute our app in the form of a managed package. We have found that, in some cases, customers create their own integration (triggers, flows...) that have harmful effects on our application (mostly concurrency issues).
- Our application makes a web service call into Salesforce and creates a task and relates it to a record that the end user is viewing/editing. It's done with a pre-configured Salesforce user.
- Customer's trigger on task creation finds the record that the task is related to, and updates a custom field on it (like, number of tasks created against it). The record that the user is viewing is now stale. All of this happens in the context of the Salesforce user assigned to us for our integration.
- End user saves the record.
- End user gets an error that the record cannot be saved because it's stale (and has been modified by the user assigned to us).
The example above shows that the concurrency issue is caused by the customer's trigger, however the error message shows our user name.
We have other, similar cases in which the customer's customisation will either break our application or have harmful effects. This causes a lot of time spent debugging the customers' integrations and may lead to difficult conversations with our customers.
Is there a set of 'best practices' on how to design your app, or how to make the integrations, to protect our app from those harmful side effects?
This question may be considered too wide or general, but any insight will be helpful.