fix(integrations): one integration-access verdict across the catalog, @ menus and search, enforced by an audit by waleedlatif1 · Pull Request #9457 · simstudioai/sim

waleedlatif1 · 2026-10-29T23:03:35Z

Summary

One integration-access verdict for every surface that lists integrations: resolveIntegrationAccess (lib/integrations/access.ts) returns available | unconfigured | requestable | denied from the permission group ∩ deployment ALLOWED_INTEGRATIONS, then deployment OAuth configuration (policy judged first, so a restricted integration is never advertised as merely unconfigured)
useIntegrationAccess(workspaceId) returns that verdict, or none until both policies load, so listings fail closed by construction; takes the workspace explicitly because groups can target individual workspaces. usePermissionConfig delegates to the same policy and keeps its fail-open isBlockAllowed/filterBlocks for the toolbar and tool pickers unchanged
Integrations catalog: hides denied integrations, shows requestable ones as locked rows that open the request modal (when access requests are on), keeps unconfigured ones as "Unavailable"; Connected lists only credentials for a permitted integration; emptied categories drop out and fall back to All
Detail page: a restricted integration renders "Access required" (+ Request access when requestable) instead of the connect actions
Mothership @/+ menu, the markdown editor's @ mentions (previously ungated) and sidebar search only offer usable integrations — matching the server, which drops mentions of restricted or unconfigured ones; org-level chat offers an integration only when every workspace permits it
check:integration-access: a module that imports a raw integration catalog must also read useIntegrationAccess (or be exempt with a reason; stale exemptions fail), and the fail-open useIntegrationAccessPolicy is refused outside usePermissionConfig. Guidance added to CLAUDE.md/AGENTS.md

Type of Change

Bug fix
Improvement (consolidation + enforcement)

Testing

lib/integrations/access.test.ts: six failure modes (deployment ceiling, policy-before-unconfigured ordering, unconfigured, successor ids in either policy, exempt entry point, credential-group gate); each verified red by reverting its guard
hooks/use-permission-config.test.tsx: no verdict before the permission group loads while the legacy gate stays fail-open; existing requestable tests pass through the new path
organization-resource-inventory.test.ts: cross-workspace intersection and missing-workspace cases (red first)
scripts/check-integration-access.test.ts: 8 cases incl. renamed/namespace imports, type-only imports, stale exemptions, fail-open hook outside its reader; audit verified to fail when a real gate is removed
Local: biome on changed files, comment-hygiene, test-patterns, file-names, utils, source-text, import-specifiers, client-boundary; type-check and full suite in CI

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing (new tests pass the test-audit authoring gate)
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

🤖 Generated with Claude Code

vercel · 2026-10-29T23:03:37Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Ignored	Preview	Oct 30, 2026 12:15am UTC

greptile-apps · 2026-10-29T23:07:41Z

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking issues remain.

Summary

The PR gives integration listings one shared access decision across permission groups, deployment restrictions, and OAuth setup.

Integration surfaces now share one workspace access verdict.
The integration catalog shows rows that match workspace access.
Restricted integration detail pages show an access-required state.
Integration menus and search show only usable integrations.
Builds now check that integration listings use the shared verdict.

_{Reviews (7) · Last reviewed commit: "fix(integrations): treat an untraceable ..." · Reviewed by Greptile}

cubic-dev-ai

All reported issues were addressed across 6 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-29T23:12:40Z

@greptile

waleedlatif1 · 2026-10-29T23:12:41Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-29T23:12:46Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 6 files

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-29T23:20:10Z

@greptile

waleedlatif1 · 2026-10-29T23:20:11Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-29T23:20:17Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 6 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{Turn on auto-fix | Re-trigger cubic}

waleedlatif1 · 2026-10-29T23:31:12Z

@greptile

waleedlatif1 · 2026-10-29T23:31:14Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-29T23:31:20Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

1 issue found across 10 files

Confidence score: 5/5

available-resources.ts fetches deployment availability even when the menu is closed or integrations aren’t included, bypassing the hook’s lazy-loading behavior. Gate the fetch on the effective enabled and included configuration.

Prompt for AI agents (unresolved issues)


Check if these issues are valid — if so, understand the root cause of each and fix them. When an issue isn't valid or won't be fixed in this PR, reply in its thread with the reason and then resolve the thread. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/available-resources.ts">

<violation number="1" location="apps/sim/app/workspace/[workspaceId]/home/components/mothership-view/components/add-resource-dropdown/available-resources.ts:194">
P3: This unconditionally fetches deployment availability even for closed menus and inventories that do not include integrations, defeating the hook's documented lazy-loading behavior. Pass the effective enabled/included condition to the availability query and preserve the existing cache semantics.</violation>
</file>

_{Reply with feedback, questions, or to request a fix.

Turn on auto-fix | Re-trigger cubic}

…on detail gate

…lowlist loads

… gate @ mentions by policy

…isting, enforced by check:integration-access

waleedlatif1 · 2026-10-29T23:54:46Z

@greptile

waleedlatif1 · 2026-10-29T23:54:47Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-29T23:54:53Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

All reported issues were addressed across 21 files

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

…space imports in check:integration-access

waleedlatif1 · 2026-10-30T00:05:00Z

@greptile

waleedlatif1 · 2026-10-30T00:05:01Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T00:05:06Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 21 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

…ry export in check:integration-access

waleedlatif1 · 2026-10-30T00:14:56Z

@greptile

waleedlatif1 · 2026-10-30T00:14:57Z

@cubic-dev-ai review this PR

cubic-dev-ai · 2026-10-30T00:15:02Z

@cubic-dev-ai review this PR

@waleedlatif1 I have started the AI code review. It will take a few minutes to complete.

cubic-dev-ai

No issues found across 21 files

Confidence score: 5/5

Automated review surfaced no issues in the provided summaries.
No files require special attention.

_{You've manually re-run cubic several times on this PR. Each manual re-review checks the full PR again and counts toward your usage quota. To preserve your usage limits, we recommend letting cubic automatically review new commits.

Turn on auto-fix | Re-trigger cubic}

vercel Bot temporarily deployed to Preview October 29, 2026 23:03 Inactive

greptile-apps Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx Outdated

cubic-dev-ai Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx Outdated

Comment thread apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx Outdated

vercel Bot temporarily deployed to Preview October 29, 2026 23:12 Inactive

cubic-dev-ai Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx Outdated

greptile-apps Bot reviewed Oct 29, 2026

View reviewed changes

Comment thread apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx Outdated

vercel Bot temporarily deployed to Preview October 29, 2026 23:20 Inactive

cubic-dev-ai Bot reviewed Oct 29, 2026

View reviewed changes

waleedlatif1 changed the title ~~fix(integrations): hide integrations the permission group disallows~~ fix(integrations): reflect permission-group integration policy across the catalog and @ menu Oct 29, 2026

vercel Bot temporarily deployed to Preview October 29, 2026 23:31 Inactive

cubic-dev-ai Bot reviewed Oct 29, 2026

View reviewed changes

waleedlatif1 added 5 commits October 29, 2026 16:53

fix(integrations): hide integrations the permission group disallows

ed05d9c

fix(integrations): fall back from emptied categories and fail closed …

5f7d6c9

…on detail gate

fix(integrations): fail closed on the catalog until the deployment al…

379bd5a

…lowlist loads

feat(integrations): offer requestable integrations in the catalog and…

951bf66

… gate @ mentions by policy

improvement(integrations): one access verdict for every integration l…

47fc03c

…isting, enforced by check:integration-access

waleedlatif1 force-pushed the feat/integrations-permission-filter branch from a6ba85a to 47fc03c Compare October 29, 2026 23:54

waleedlatif1 requested a review from a team as a code owner October 29, 2026 23:54

waleedlatif1 changed the title ~~fix(integrations): reflect permission-group integration policy across the catalog and @ menu~~ fix(integrations): one integration-access verdict across the catalog, @ menus and search, enforced by an audit Oct 29, 2026

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread scripts/check-integration-access.ts Outdated

Comment thread scripts/check-integration-access.ts Outdated

vercel Bot deployed to Preview October 30, 2026 00:03

View deployment

fix(integrations): require the access hook to be called and read name…

84a9b82

…space imports in check:integration-access

greptile-apps Bot reviewed Oct 30, 2026

View reviewed changes

Comment thread scripts/check-integration-access.ts Outdated

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

fix(integrations): treat an untraceable namespace read as reading eve…

bff7a4c

…ry export in check:integration-access

cubic-dev-ai Bot reviewed Oct 30, 2026

View reviewed changes

waleedlatif1 merged commit 2698438 into staging Oct 30, 2026
68 checks passed

waleedlatif1 deleted the feat/integrations-permission-filter branch October 30, 2026 00:19

Conversation

waleedlatif1 commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

greptile-apps Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Confidence Score: 5/5

Summary

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

waleedlatif1 commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 29, 2026

Uh oh!

cubic-dev-ai Bot left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

waleedlatif1 commented Oct 30, 2026

Uh oh!

cubic-dev-ai Bot commented Oct 30, 2026

Uh oh!

Uh oh!

cubic-dev-ai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

waleedlatif1 commented Oct 29, 2026 •

edited

Loading

vercel Bot commented Oct 29, 2026 •

edited

Loading

greptile-apps Bot commented Oct 29, 2026 •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading

cubic-dev-ai Bot left a comment •

edited

Loading