improvement(integrations): one access verdict for every integration listing, enforced by check:integration-access

Author: waleedlatif1

AGENTS.md

@@ -127,6 +127,8 @@ Build order: **Tools** → **Block** → **Icon** → optional **Trigger**, star
 - **Tool IDs are `snake_case`** (`service_action`), registered in `tools/registry.ts`; blocks register in `blocks/registry-maps.ts` (`BLOCK_REGISTRY` + `BLOCK_META_REGISTRY`, alphabetically).
 - **Type coercions go in `tools.config.params`** (runs at execution, after variable resolution), never in `tools.config.tool` (runs at serialization, where `Number()` destroys dynamic `<Block.output>` references).
 
+A surface that lists integrations to a viewer (a catalog, picker, or `@` menu) reads `useIntegrationAccess` (`hooks/use-integration-access.ts`): the one verdict across permission group, deployment allowlist, and deployment OAuth configuration, which fails closed until the viewer's policy loads. Never map over a raw catalog (`INTEGRATIONS`, `listIntegrations()`, `INTEGRATION_METADATA`) there; `check:integration-access` fails the build.
+
 Remaining block/tool/trigger rules: `.claude/rules/sim-integrations.md`. Canvas sentences: `apps/sim/blocks/AGENTS.md`.
 
 ## Tables

CLAUDE.md

@@ -127,6 +127,8 @@ Build order: **Tools** → **Block** → **Icon** → optional **Trigger**, star
 - **Tool IDs are `snake_case`** (`service_action`), registered in `tools/registry.ts`; blocks register in `blocks/registry-maps.ts` (`BLOCK_REGISTRY` + `BLOCK_META_REGISTRY`, alphabetically).
 - **Type coercions go in `tools.config.params`** (runs at execution, after variable resolution), never in `tools.config.tool` (runs at serialization, where `Number()` destroys dynamic `<Block.output>` references).
 
+A surface that lists integrations to a viewer (a catalog, picker, or `@` menu) reads `useIntegrationAccess` (`hooks/use-integration-access.ts`): the one verdict across permission group, deployment allowlist, and deployment OAuth configuration, which fails closed until the viewer's policy loads. Never map over a raw catalog (`INTEGRATIONS`, `listIntegrations()`, `INTEGRATION_METADATA`) there; `check:integration-access` fails the build.
+
 Remaining block/tool/trigger rules: `.claude/rules/sim-integrations.md`. Canvas sentences: `apps/sim/blocks/AGENTS.md`.
 
 ## Tables

apps/sim/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/use-markdown-mentions.ts

@@ -1,4 +1,5 @@
 import { useMemo } from 'react'
+import { isIntegrationUsable } from '@/lib/integrations/access'
 import type { MentionMenuData } from '@/app/workspace/[workspaceId]/files/components/file-viewer/rich-markdown-editor/mention/mention-store'
 import { listIntegrations } from '@/blocks/integration-matcher'
 import { useKnowledgeBasesQuery } from '@/hooks/queries/kb/knowledge'
@@ -7,6 +8,7 @@ import { useTablesList } from '@/hooks/queries/tables'
 import { useWorkflows } from '@/hooks/queries/workflows'
 import { useWorkspaceFileFolders } from '@/hooks/queries/workspace-file-folders'
 import { useWorkspaceFilePickerOptions } from '@/hooks/queries/workspace-files'
+import { useIntegrationAccess } from '@/hooks/use-integration-access'
 import { mentionIcon } from './mention-icon'
 import type { MentionItem } from './types'
 
@@ -44,18 +46,21 @@ export function useMarkdownMentions(
   const knowledgeBases = useKnowledgeBasesQuery(ws, { enabled: active })
   const workflows = useWorkflows(ws)
   const skills = useSkills(wsStr)
+  const { getAccess: getIntegrationAccess } = useIntegrationAccess(workspaceId, { enabled: active })
 
-  // The integration registry is static — materialize it once rather than on every resource refetch.
+  // Rebuilt only when the access policy changes, never on a resource refetch.
   const integrationItems = useMemo<MentionItem[]>(() => {
     if (!active) return []
-    return listIntegrations().map((integration) => ({
-      kind: 'integration',
-      id: integration.blockType,
-      label: integration.name,
-      group: 'Integrations',
-      icon: mentionIcon('integration', integration.blockType),
-    }))
-  }, [active])
+    return listIntegrations()
+      .filter((integration) => isIntegrationUsable(getIntegrationAccess(integration.blockType)))
+      .map((integration) => ({
+        kind: 'integration',
+        id: integration.blockType,
+        label: integration.name,
+        group: 'Integrations',
+        icon: mentionIcon('integration', integration.blockType),
+      }))
+  }, [active, getIntegrationAccess])
 
   const items = useMemo(() => {
     if (!active) return NO_MENTION_ITEMS

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/available-resources.ts

@@ -1,8 +1,7 @@
 import { useMemo, useSyncExternalStore } from 'react'
 import { isBrowserAgentAvailable } from '@/lib/browser-agent/transport'
 import { subscribeDesktopPreferences } from '@/lib/desktop'
-import { isBlockTypePermittedByAllowlist } from '@/lib/permission-groups/block-access'
-import { intersectAccessControlAllowlists } from '@/lib/permission-groups/integration-allowlist'
+import { isIntegrationUsable } from '@/lib/integrations/access'
 import { isTerminalAvailable } from '@/lib/terminal/transport'
 import type { AvailableItem } from '@/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/resource-folder-tree'
 import {
@@ -12,14 +11,9 @@ import {
 import type { MothershipResourceType } from '@/app/workspace/[workspaceId]/home/types'
 import { formatDate } from '@/app/workspace/[workspaceId]/logs/utils'
 import { useFeatureFlag } from '@/app/workspace/[workspaceId]/providers/feature-flags-provider'
-import {
-  type IntegrationDescriptor,
-  listIntegrationsByPopularity,
-} from '@/blocks/integration-matcher'
-import { useUserPermissionConfig } from '@/ee/access-control/hooks/permission-groups'
+import { listIntegrationsByPopularity } from '@/blocks/integration-matcher'
 import { useWorkspaceDashboard } from '@/hooks/queries/dashboards'
 import { useFolders } from '@/hooks/queries/folders'
-import { useIntegrationAvailability } from '@/hooks/queries/integration-availability'
 import { useKnowledgeBasesQuery } from '@/hooks/queries/kb/knowledge'
 import { useLogsList } from '@/hooks/queries/logs'
 import { useMothershipChats } from '@/hooks/queries/mothership-chats'
@@ -28,6 +22,7 @@ import { useWorkflowTests } from '@/hooks/queries/workflow-tests'
 import { useWorkflows } from '@/hooks/queries/workflows'
 import { useWorkspaceFileFolders } from '@/hooks/queries/workspace-file-folders'
 import { useWorkspaceFilePickerOptions } from '@/hooks/queries/workspace-files'
+import { useIntegrationAccess } from '@/hooks/use-integration-access'
 
 /**
  * Placeholder id for the Browser launcher row. It never names a resource: the
@@ -100,7 +95,6 @@ interface UseAvailableResourcesOptions {
 
 /** Stable identity for the disabled result, so downstream memos never bust. */
 const NO_RESOURCE_GROUPS: AvailableItemsByType[] = []
-const NO_INTEGRATIONS: readonly IntegrationDescriptor[] = []
 
 const LOG_DROPDOWN_LIMIT = 50
 
@@ -187,28 +181,22 @@ export function useAvailableResources(
     enabled: enabled && Boolean(workspaceId),
   })
   const integrationsIncluded = !excludeTypes?.includes('integration')
-  const { data: permissionConfig, isPending: permissionConfigPending } = useUserPermissionConfig(
-    enabled && integrationsIncluded && workspaceId ? workspaceId : undefined
-  )
-  const { data: integrationAvailability, isPending: integrationAvailabilityPending } =
-    useIntegrationAvailability()
+  const integrationAccess = useIntegrationAccess(workspaceId, {
+    enabled: enabled && integrationsIncluded,
+  })
+  const { getAccess: getIntegrationAccess } = integrationAccess
 
   /**
-   * Integrations this workspace's policy permits: the viewer's permission group
-   * intersected with the deployment allowlist. Fails closed — nothing is offered
-   * until both have loaded — because the server drops a mention of an
-   * integration either policy disallows.
+   * Only integrations the workspace can use now: the server drops a mention of
+   * one its policy restricts or whose OAuth this deployment has not configured.
    */
-  const permittedIntegrations = useMemo(() => {
-    if (!permissionConfig || !integrationAvailability) return NO_INTEGRATIONS
-    const allowlist = intersectAccessControlAllowlists(
-      permissionConfig.config?.allowedIntegrations ?? null,
-      integrationAvailability.allowedIntegrations
-    )
-    return listIntegrationsByPopularity().filter((integration) =>
-      isBlockTypePermittedByAllowlist(allowlist, integration.blockType)
-    )
-  }, [permissionConfig, integrationAvailability])
+  const usableIntegrations = useMemo(
+    () =>
+      listIntegrationsByPopularity().filter((integration) =>
+        isIntegrationUsable(getIntegrationAccess(integration.blockType))
+      ),
+    [getIntegrationAccess]
+  )
   const { data: logsData, isPending: logsPending } = useLogsList(
     workspaceId,
     LOG_DROPDOWN_FILTERS,
@@ -240,7 +228,7 @@ export function useAvailableResources(
       fileFoldersPending ||
       tasksPending ||
       logsPending ||
-      (integrationsIncluded && (permissionConfigPending || integrationAvailabilityPending)))
+      (integrationsIncluded && integrationAccess.isPending))
 
   const groups = useMemo(() => {
     if (!enabled) return NO_RESOURCE_GROUPS
@@ -311,7 +299,7 @@ export function useAvailableResources(
       },
       {
         type: 'integration' as const,
-        items: permittedIntegrations.map((integration) => ({
+        items: usableIntegrations.map((integration) => ({
           id: integration.blockType,
           name: integration.name,
           iconComponent: integration.icon,
@@ -387,7 +375,7 @@ export function useAvailableResources(
     knowledgeBases,
     tasks,
     logs,
-    permittedIntegrations,
+    usableIntegrations,
     excludeTypes,
     dashboardsEnabled,
     testsEnabled,

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/organization-resource-inventory.test.ts

@@ -49,6 +49,16 @@ describe('organization mention inventory', () => {
       { type: 'integration', items: [{ id: 'gmail_v2', name: 'gmail_v2' }] },
     ])
   })
+  it('offers no integration while a workspace policy has not arrived', () => {
+    const result = mergeOrganizationResourceInventories(
+      [
+        { id: 'sales', name: 'Sales' },
+        { id: 'finance', name: 'Finance' },
+      ],
+      { sales: inventory }
+    )
+    expect(result.groups.find((group) => group.type === 'integration')?.items ?? []).toEqual([])
+  })
   it('keeps mention confirmation pending until every accessible workspace settles', () => {
     expect(
       mergeOrganizationResourceInventories([{ id: 'sales', name: 'Sales' }], {}).isHydrating

apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/organization-resource-inventory.tsx

@@ -37,10 +37,12 @@ export function mergeOrganizationResourceInventories(
   const byType = new Map<string, AvailableResources['groups'][number]>()
   const structureFolders: AvailableResources['structureFolders'] = { table: [], knowledgebase: [] }
   let isHydrating = false
+  let isAnyInventoryMissing = false
   for (const workspace of workspaces) {
     const inventory = inventories[workspace.id]
     if (!inventory) {
       isHydrating = true
+      isAnyInventoryMissing = true
       continue
     }
     isHydrating ||= inventory.isHydrating
@@ -52,7 +54,8 @@ export function mergeOrganizationResourceInventories(
     for (const group of inventory.groups) {
       if (group.type === 'browser' || group.type === 'terminal') continue
       // Integrations are not workspace-owned, but a permission group can target
-      // individual workspaces, so one is offered only where every workspace permits it.
+      // individual workspaces, so one is offered only where every workspace permits it,
+      // and a workspace whose inventory has not arrived permits nothing yet.
       const integrations = group.type === 'integration' ? byType.get(group.type) : undefined
       if (integrations) {
         const permittedHere = new Set(group.items.map((item) => item.id))
@@ -70,5 +73,7 @@ export function mergeOrganizationResourceInventories(
     structureFolders.table.push(...inventory.structureFolders.table.map(owned))
     structureFolders.knowledgebase.push(...inventory.structureFolders.knowledgebase.map(owned))
   }
+  const integrations = byType.get('integration')
+  if (integrations && isAnyInventoryMissing) integrations.items = []
   return { groups, structureFolders, isHydrating }
 }

apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx

@@ -14,6 +14,7 @@ import {
   resolveCredentialDisplay,
   resolveOAuthServiceForIntegration,
 } from '@/lib/integrations'
+import { isIntegrationPermitted } from '@/lib/integrations/access'
 import { credentialProviderMatchesService } from '@/lib/oauth'
 import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/connect-oauth-modal'
 import { RESOURCE_TILE_BASE } from '@/app/workspace/[workspaceId]/components/resource-tile'
@@ -47,6 +48,7 @@ import {
 import { useWorkspaceAccessRequestFeatures } from '@/ee/access-requests/components/permission-access-boundary'
 import { RequestAccessAction } from '@/ee/access-requests/components/request-access-action'
 import { useWorkspaceCredentials } from '@/hooks/queries/credentials'
+import { useIntegrationAccess } from '@/hooks/use-integration-access'
 import { useOAuthReturnRouter } from '@/hooks/use-oauth-return'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
 
@@ -65,41 +67,33 @@ interface IntegrationBlockDetailProps {
 }
 
 /**
- * Integration detail page, shown only when the viewer's integration policy
- * permits the integration. A direct link to a restricted one renders an
- * access-required state instead of the connect actions, and the check fails
- * closed until both the permission group and the deployment allowlist have
- * loaded.
+ * Integration detail page, shown only when the viewer's access policy permits
+ * the integration (an unconfigured one included, which the page presents as
+ * unavailable). A direct link to a restricted one renders an access-required
+ * state instead of the connect actions, and nothing renders until the policy
+ * has loaded.
  */
 export function IntegrationBlockDetail({ integration, workspaceId }: IntegrationBlockDetailProps) {
-  const {
-    isBlockPermitted,
-    isBlockRequestable,
-    isPermissionReady,
-    isIntegrationAvailabilityReady,
-    integrationAvailabilityError,
-    refetchIntegrationAvailability,
-  } = usePermissionConfig()
+  const { getAccess, availabilityError, refetchAvailability } = useIntegrationAccess(workspaceId)
   const accessRequests = useWorkspaceAccessRequestFeatures()
+  const access = getAccess(integration.type)
 
-  if (integrationAvailabilityError) {
+  if (availabilityError) {
     return (
       <IntegrationAccessNotice
         workspaceId={workspaceId}
         title='Unable to check access'
-        description={integrationAvailabilityError.message}
-        action={<Chip onClick={() => void refetchIntegrationAvailability()}>Try again</Chip>}
+        description={availabilityError.message}
+        action={<Chip onClick={() => void refetchAvailability()}>Try again</Chip>}
       />
     )
   }
-  if (!isPermissionReady || !isIntegrationAvailabilityReady) {
-    return <IntegrationBlockDetailFallback workspaceId={workspaceId} />
-  }
-  if (isBlockPermitted(integration.type)) {
+  if (access === undefined) return <IntegrationBlockDetailFallback workspaceId={workspaceId} />
+  if (isIntegrationPermitted(access)) {
     return <IntegrationBlockDetailContent integration={integration} workspaceId={workspaceId} />
   }
 
-  const requestable = accessRequests.data?.enabled === true && isBlockRequestable(integration.type)
+  const requestable = access === 'requestable' && accessRequests.data?.enabled === true
 
   return (
     <IntegrationAccessNotice

apps/sim/app/workspace/[workspaceId]/integrations/components/integrations-showcase/integrations-showcase.tsx

@@ -85,15 +85,15 @@ export function IntegrationTile({ blockType, icon: Icon, framed = false }: Integ
 
 interface IntegrationsShowcaseProps {
   /** Tiles whose block type fails this check are left out of the grid. */
-  isBlockPermitted: (blockType: string) => boolean
+  isTileVisible: (blockType: string) => boolean
 }
 
 /**
  * Decorative integrations grid: a notched, masked grid background populated
  * with a curated set of brand tiles. The bottom-right notch leaves room for an
  * "Explore in chat" CTA rendered by `ShowcaseWithExplore`.
  */
-export function IntegrationsShowcase({ isBlockPermitted }: IntegrationsShowcaseProps) {
+export function IntegrationsShowcase({ isTileVisible }: IntegrationsShowcaseProps) {
   return (
     <div aria-hidden className='relative h-[144px] w-full overflow-hidden rounded-xl'>
       <div
@@ -115,7 +115,7 @@ export function IntegrationsShowcase({ isBlockPermitted }: IntegrationsShowcaseP
         <div className='absolute inset-0 grid translate-x-[0.5px] translate-y-[0.5px] grid-cols-[repeat(auto-fill,48px)] grid-rows-[repeat(auto-fill,48px)]'>
           {SHOWCASE_TILES.map((tile) => {
             const block = getBlock(tile.id)
-            if (!block || !isBlockPermitted(tile.id)) return null
+            if (!block || !isTileVisible(tile.id)) return null
             return (
               <div
                 key={tile.id}

apps/sim/app/workspace/[workspaceId]/integrations/components/showcase-with-explore/showcase-with-explore.tsx

@@ -4,9 +4,10 @@ import { Chip } from '@sim/emcn'
 import { ArrowRight } from '@sim/emcn/icons'
 import { useParams, useRouter } from 'next/navigation'
 import { useDeploymentShape } from '@/lib/core/config/deployment-shape'
+import { isIntegrationUsable } from '@/lib/integrations/access'
 import { IntegrationsShowcase } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
 import { storeCuratedPrompt } from '@/blocks/integration-matcher'
-import { usePermissionConfig } from '@/hooks/use-permission-config'
+import { useIntegrationAccess } from '@/hooks/use-integration-access'
 
 interface ShowcaseWithExploreProps {
   /**
@@ -27,15 +28,13 @@ export function ShowcaseWithExplore({ prompt }: ShowcaseWithExploreProps) {
   const params = useParams()
   const router = useRouter()
   const { chatEnabled } = useDeploymentShape()
-  const { isBlockPermitted, isIntegrationAvailabilityReady } = usePermissionConfig()
   const workspaceId = (params?.workspaceId as string) || ''
+  const { getAccess } = useIntegrationAccess(workspaceId)
 
   return (
     <div className='relative'>
       <IntegrationsShowcase
-        isBlockPermitted={(blockType) =>
-          isIntegrationAvailabilityReady && isBlockPermitted(blockType)
-        }
+        isTileVisible={(blockType) => isIntegrationUsable(getAccess(blockType))}
       />
       {chatEnabled && (
         <Chip