fix(self-host): reconcile storage and allowlists

TheodoreSpeaks · TheodoreSpeaks · commit fd4c580b87e1 · 2026-08-04T12:17:24.000-07:00
diff --git a/apps/sim/hooks/use-permission-config.ts b/apps/sim/hooks/use-permission-config.ts
@@ -15,6 +15,7 @@ import {
   resolveIntegrationAvailabilityStateForVisibility,
 } from '@/lib/integrations/availability'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import {
   DEFAULT_PERMISSION_GROUP_CONFIG,
   type PermissionGroupConfig,
@@ -51,16 +52,6 @@ function useAllowedIntegrationsFromEnv() {
   })
 }
 
-/**
- * Intersects two allowlists. If either is null (unrestricted), returns the other.
- * If both are set, returns only items present in both.
- */
-function intersectAllowlists(a: string[] | null, b: string[] | null): string[] | null {
-  if (a === null) return b
-  if (b === null) return a.map((i) => i.toLowerCase())
-  return a.map((i) => i.toLowerCase()).filter((i) => b.includes(i))
-}
-
 export function usePermissionConfig(): PermissionConfigResult {
   const params = useParams()
   const workspaceId = typeof params?.workspaceId === 'string' ? params.workspaceId : undefined
@@ -84,7 +75,7 @@ export function usePermissionConfig(): PermissionConfigResult {
 
   const mergedAllowedIntegrations = useMemo(() => {
     const envAllowlist = envAllowlistData?.allowedIntegrations ?? null
-    return intersectAllowlists(config.allowedIntegrations, envAllowlist)
+    return intersectIntegrationAllowlists(config.allowedIntegrations, envAllowlist)
   }, [config.allowedIntegrations, envAllowlistData])
 
   const integrationAvailability = useMemo(() => {
diff --git a/apps/sim/lib/copilot/chat/payload.test.ts b/apps/sim/lib/copilot/chat/payload.test.ts
@@ -1,7 +1,7 @@
 /**
  * @vitest-environment node
  */
-import { workflowsUtilsMock } from '@sim/testing'
+import { envFlagsMockFns, resetEnvFlagsMock, workflowsUtilsMock } from '@sim/testing'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 const {
@@ -146,6 +146,7 @@ import {
 describe('buildIntegrationToolSchemas', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    resetEnvFlagsMock()
     clearIntegrationToolSchemaCacheForTests()
     mockCreateUserToolSchema.mockReturnValue({ type: 'object', properties: {} })
     mockIsIntegrationDeploymentAvailable.mockReturnValue(true)
@@ -239,6 +240,24 @@ describe('buildIntegrationToolSchemas', () => {
     expect(toolSchemas.some((tool) => tool.name === 'brandfetch_search')).toBe(true)
   })
 
+  it('intersects workspace and deployment integration allowlists', async () => {
+    mockGetHighestPrioritySubscription.mockResolvedValue({ plan: 'pro', status: 'active' })
+    mockGetUserPermissionConfig.mockResolvedValue({
+      allowedIntegrations: ['gmail', 'brandfetch'],
+    })
+    envFlagsMockFns.getAllowedIntegrationsFromEnv.mockReturnValue(['brandfetch'])
+
+    const toolSchemas = await buildIntegrationToolSchemas(
+      'user-intersection',
+      undefined,
+      { schemaSurface: 'copilot' },
+      'workspace-1'
+    )
+
+    expect(toolSchemas.some((tool) => tool.name === 'gmail_send')).toBe(false)
+    expect(toolSchemas.some((tool) => tool.name === 'brandfetch_search')).toBe(true)
+  })
+
   it('keeps a limited integration callable without advertising OAuth', async () => {
     mockGetHighestPrioritySubscription.mockResolvedValue({ plan: 'pro', status: 'active' })
     mockIsOAuthServiceDeploymentAvailable.mockImplementation(
diff --git a/apps/sim/lib/copilot/chat/payload.ts b/apps/sim/lib/copilot/chat/payload.ts
@@ -26,6 +26,7 @@ import {
   isIntegrationDeploymentAvailableForVisibility,
   isOAuthServiceDeploymentAvailable,
 } from '@/lib/integrations/availability.server'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { trackChatUpload } from '@/lib/uploads/contexts/workspace/workspace-file-manager'
 import { buildArchiveExtractGuidance, isArchiveFileName } from '@/lib/uploads/utils/file-utils'
 
@@ -199,7 +200,10 @@ async function buildIntegrationToolSchemasUncached(
   if (workspaceId) {
     const { getUserPermissionConfig } = await import('@/ee/access-control/utils/permission-check')
     const permissionConfig = await getUserPermissionConfig(userId, workspaceId)
-    allowedIntegrations = permissionConfig?.allowedIntegrations ?? allowedIntegrations
+    allowedIntegrations = intersectIntegrationAllowlists(
+      permissionConfig?.allowedIntegrations ?? null,
+      allowedIntegrations
+    )
   }
   const allowedIntegrationTypes = allowedIntegrations
     ? new Set(allowedIntegrations.map((integration) => integration.toLowerCase()))
diff --git a/apps/sim/lib/copilot/chat/process-contents.ts b/apps/sim/lib/copilot/chat/process-contents.ts
@@ -31,6 +31,7 @@ import type { TraceSpan } from '@/lib/logs/types'
 import { mcpService } from '@/lib/mcp/service'
 import { createMcpToolId } from '@/lib/mcp/utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { getColumnId } from '@/lib/table/column-keys'
 import { getRowsByIds } from '@/lib/table/rows/service'
 import { getTableById } from '@/lib/table/service'
@@ -606,8 +607,10 @@ async function processBlockMetadata(
       userId && workspaceId ? getUserPermissionConfig(userId, workspaceId) : null,
       userId ? getBlockVisibilityForCopilot(userId, workspaceId) : null,
     ])
-    const allowedIntegrations =
-      permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const allowedIntegrations = intersectIntegrationAllowlists(
+      permissionConfig?.allowedIntegrations ?? null,
+      getAllowedIntegrationsFromEnv()
+    )
     if (!isIntegrationDeploymentAvailableForVisibility(blockId, visibility)) {
       logger.debug('Block unavailable for this deployment', { blockId })
       return null
diff --git a/apps/sim/lib/copilot/tools/handlers/integration-tools.ts b/apps/sim/lib/copilot/tools/handlers/integration-tools.ts
@@ -6,6 +6,7 @@ import {
 import type { ExecutionContext, ToolCallResult } from '@/lib/copilot/request/types'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
 import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
 import { stripVersionSuffix } from '@/tools/utils'
 
@@ -24,8 +25,10 @@ export async function executeListIntegrationTools(
   const permissionConfig = context.workspaceId
     ? await getUserPermissionConfig(context.userId, context.workspaceId)
     : null
-  const allowedIntegrations =
-    permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+  const allowedIntegrations = intersectIntegrationAllowlists(
+    permissionConfig?.allowedIntegrations ?? null,
+    getAllowedIntegrationsFromEnv()
+  )
   const all = filterExposedIntegrationTools(
     getExposedIntegrationTools(),
     vis,
diff --git a/apps/sim/lib/copilot/tools/handlers/oauth.ts b/apps/sim/lib/copilot/tools/handlers/oauth.ts
@@ -8,6 +8,7 @@ import { isServiceAccountProviderId } from '@/lib/credentials/service-account-pr
 import { isOAuthServiceAllowedByIntegrationTypes } from '@/lib/integrations/availability'
 import { isOAuthServiceDeploymentAvailable } from '@/lib/integrations/availability.server'
 import { getAllOAuthServices } from '@/lib/oauth/utils'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import type { WorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
 
@@ -48,8 +49,10 @@ export async function executeOAuthGetAuthLink(
       'write'
     )
     const permissionConfig = await getUserPermissionConfig(context.userId, context.workspaceId)
-    const configuredAllowedIntegrations =
-      permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const configuredAllowedIntegrations = intersectIntegrationAllowlists(
+      permissionConfig?.allowedIntegrations ?? null,
+      getAllowedIntegrationsFromEnv()
+    )
     const allowedIntegrationTypes = configuredAllowedIntegrations
       ? new Set(configuredAllowedIntegrations.map((type) => type.toLowerCase()))
       : null
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts b/apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts
@@ -9,6 +9,7 @@ import { getAllowedIntegrationsFromEnv, isHosted } from '@/lib/core/config/env-f
 import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { getServiceAccountProviderForProviderId } from '@/lib/oauth/utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { isCustomBlockType } from '@/blocks/custom/build-config'
 import { getBlock } from '@/blocks/registry'
 import { AuthMode, type BlockConfig, isHiddenFromDisplay } from '@/blocks/types'
@@ -126,8 +127,10 @@ export const getBlocksMetadataServerTool: BaseServerTool<
       context?.userId && context?.workspaceId
         ? await getUserPermissionConfig(context.userId, context.workspaceId)
         : null
-    const allowedIntegrations =
-      permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const allowedIntegrations = intersectIntegrationAllowlists(
+      permissionConfig?.allowedIntegrations ?? null,
+      getAllowedIntegrationsFromEnv()
+    )
     const visibility = overlayVisibility()
 
     const result: Record<string, CopilotBlockMetadata> = {}
diff --git a/apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.ts b/apps/sim/lib/copilot/tools/server/blocks/get-trigger-blocks.ts
@@ -4,6 +4,7 @@ import type { BaseServerTool } from '@/lib/copilot/tools/server/base-tool'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/env-flags'
 import { isIntegrationDeploymentAvailableForVisibility } from '@/lib/integrations/availability.server'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { getAllBlocks } from '@/blocks/registry'
 import { overlayVisibility } from '@/blocks/visibility/context'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
@@ -28,8 +29,10 @@ export const getTriggerBlocksServerTool: BaseServerTool<
       context?.userId && context?.workspaceId
         ? await getUserPermissionConfig(context.userId, context.workspaceId)
         : null
-    const allowedIntegrations =
-      permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const allowedIntegrations = intersectIntegrationAllowlists(
+      permissionConfig?.allowedIntegrations ?? null,
+      getAllowedIntegrationsFromEnv()
+    )
     const visibility = overlayVisibility()
 
     const triggerBlockIds: string[] = []
diff --git a/apps/sim/lib/copilot/tools/server/user/get-credentials.ts b/apps/sim/lib/copilot/tools/server/user/get-credentials.ts
@@ -11,6 +11,7 @@ import { getAccessibleOAuthCredentials } from '@/lib/credentials/environment'
 import { getPersonalAndWorkspaceEnv } from '@/lib/environment/utils'
 import { createIntegrationCredentialVisibility } from '@/lib/integrations/credential-visibility.server'
 import { getAllOAuthServices } from '@/lib/oauth'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { checkWorkspaceAccess, type WorkspaceAccess } from '@/lib/workspaces/permissions/utils'
 import { overlayVisibility } from '@/blocks/visibility/context'
 import { getUserPermissionConfig } from '@/ee/access-control/utils/permission-check'
@@ -74,8 +75,10 @@ export const getCredentialsServerTool: BaseServerTool<GetCredentialsParams, any>
     const userEmail = userRecord.length > 0 ? userRecord[0]?.email : null
 
     const permissionConfig = workspaceId ? await getUserPermissionConfig(userId, workspaceId) : null
-    const configuredAllowedIntegrations =
-      permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+    const configuredAllowedIntegrations = intersectIntegrationAllowlists(
+      permissionConfig?.allowedIntegrations ?? null,
+      getAllowedIntegrationsFromEnv()
+    )
     const allowedIntegrationTypes = configuredAllowedIntegrations
       ? new Set(configuredAllowedIntegrations.map((type) => type.toLowerCase()))
       : null
diff --git a/apps/sim/lib/copilot/vfs/workspace-vfs.ts b/apps/sim/lib/copilot/vfs/workspace-vfs.ts
@@ -107,6 +107,7 @@ import { createIntegrationCredentialVisibility } from '@/lib/integrations/creden
 import { getKnowledgeBases } from '@/lib/knowledge/service'
 import { validateMermaidSource } from '@/lib/mermaid/validate'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import { getWorkspaceShares } from '@/lib/public-shares/share-manager'
 import { listTables } from '@/lib/table/service'
 import { listWorkspaceFileFolders } from '@/lib/uploads/contexts/workspace/workspace-file-folder-manager'
@@ -804,8 +805,10 @@ export class WorkspaceVFS {
 
             // Per-viewer gating happens HERE, not in the shared builder: files
             // owned by blocks hidden for this viewer are skipped at stamp time.
-            const configuredAllowedIntegrations =
-              permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+            const configuredAllowedIntegrations = intersectIntegrationAllowlists(
+              permissionConfig?.allowedIntegrations ?? null,
+              getAllowedIntegrationsFromEnv()
+            )
             const allowedIntegrationTypes = configuredAllowedIntegrations
               ? new Set(configuredAllowedIntegrations.map((type) => type.toLowerCase()))
               : null
@@ -2361,8 +2364,10 @@ export class WorkspaceVFS {
           getPersonalAndWorkspaceEnv(userId, workspaceId),
           permissionConfigPromise,
         ])
-      const configuredAllowedIntegrations =
-        permissionConfig?.allowedIntegrations ?? getAllowedIntegrationsFromEnv()
+      const configuredAllowedIntegrations = intersectIntegrationAllowlists(
+        permissionConfig?.allowedIntegrations ?? null,
+        getAllowedIntegrationsFromEnv()
+      )
       const credentialVisibility = createIntegrationCredentialVisibility({
         allowedIntegrationTypes: configuredAllowedIntegrations
           ? new Set(configuredAllowedIntegrations.map((type) => type.toLowerCase()))
diff --git a/apps/sim/lib/permission-groups/integration-allowlist.test.ts b/apps/sim/lib/permission-groups/integration-allowlist.test.ts
@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
+
+describe('intersectIntegrationAllowlists', () => {
+  it('uses the configured list when the other policy is unrestricted', () => {
+    expect(intersectIntegrationAllowlists(null, ['Slack'])).toEqual(['slack'])
+    expect(intersectIntegrationAllowlists(['Notion'], null)).toEqual(['notion'])
+    expect(intersectIntegrationAllowlists(null, null)).toBeNull()
+  })
+
+  it('keeps only integrations allowed by both policies', () => {
+    expect(intersectIntegrationAllowlists(['Slack', 'Notion'], ['notion', 'gmail'])).toEqual([
+      'notion',
+    ])
+  })
+
+  it('preserves an explicit deny-all list', () => {
+    expect(intersectIntegrationAllowlists([], null)).toEqual([])
+    expect(intersectIntegrationAllowlists(['slack'], [])).toEqual([])
+  })
+})
diff --git a/apps/sim/lib/permission-groups/integration-allowlist.ts b/apps/sim/lib/permission-groups/integration-allowlist.ts
@@ -0,0 +1,17 @@
+/**
+ * Intersects integration allowlists from independent policy layers.
+ * `null` means unrestricted, while an empty array denies every integration.
+ */
+export function intersectIntegrationAllowlists(
+  first: readonly string[] | null,
+  second: readonly string[] | null
+): string[] | null {
+  const normalizedFirst = first?.map((integration) => integration.toLowerCase()) ?? null
+  const normalizedSecond = second?.map((integration) => integration.toLowerCase()) ?? null
+
+  if (normalizedFirst === null) return normalizedSecond
+  if (normalizedSecond === null) return normalizedFirst
+
+  const secondSet = new Set(normalizedSecond)
+  return normalizedFirst.filter((integration) => secondSet.has(integration))
+}
diff --git a/scripts/setup/capability-setup.ts b/scripts/setup/capability-setup.ts
@@ -7,6 +7,7 @@ import {
   EnvCapabilityConfigurationError,
   type EnvCapabilityValue,
   type EnvCapabilityValues,
+  getProviderFields,
   hasEnvCapabilityValue,
   inspectCapability,
   isTruthyEnvCapabilityValue,
@@ -256,7 +257,16 @@ function fieldsToReplace(
   if (setup.definition.strategy === 'fallback' && option.providerId) {
     return providerSetupFields(setup, option.providerId)
   }
-  return getCapabilitySetupFields(setup)
+  const selectedProviderFields = new Set(
+    setup.definition.providers
+      .filter((provider) => provider.id === option.providerId)
+      .flatMap(getProviderFields)
+  )
+  const inactiveProviderFields = setup.definition.providers
+    .filter((provider) => provider.id !== option.providerId)
+    .flatMap(getProviderFields)
+    .filter((field) => !selectedProviderFields.has(field))
+  return [...new Set([...getCapabilitySetupFields(setup), ...inactiveProviderFields])]
 }
 
 function proposedCapabilitySetupValues(
diff --git a/scripts/setup/steps.test.ts b/scripts/setup/steps.test.ts
@@ -147,6 +147,36 @@ describe('setup provider reconciliation', () => {
     expect(requireCapability(STORAGE_CAPABILITY, reconciled).providerId).toBe('s3')
   })
 
+  it('clears specialized S3 bucket overrides when switching to local storage', () => {
+    const result = buildCapabilitySetupTransition(
+      STORAGE_SETUP,
+      'local',
+      {},
+      {
+        AWS_REGION: 'us-east-1',
+        S3_BUCKET_NAME: 'files',
+        S3_KB_BUCKET_NAME: 'knowledge',
+        S3_CHAT_BUCKET_NAME: 'chat',
+      }
+    )
+    const reconciled = applyResult(
+      {
+        AWS_REGION: 'us-east-1',
+        S3_BUCKET_NAME: 'files',
+        S3_KB_BUCKET_NAME: 'knowledge',
+        S3_CHAT_BUCKET_NAME: 'chat',
+      },
+      result
+    )
+
+    expect(result.remove).toEqual(
+      expect.arrayContaining(['S3_KB_BUCKET_NAME', 'S3_CHAT_BUCKET_NAME'])
+    )
+    expect(reconciled).not.toHaveProperty('S3_KB_BUCKET_NAME')
+    expect(reconciled).not.toHaveProperty('S3_CHAT_BUCKET_NAME')
+    expect(requireCapability(STORAGE_CAPABILITY, reconciled).providerId).toBe('local')
+  })
+
   it('clears stale inline GCS credentials when ADC is selected', () => {
     const result = buildCapabilitySetupTransition(
       STORAGE_SETUP,
