Merge latest connector-service-account-auth approval changes

Keep upstream Search approvals at migration 0326 and regenerate connected accounts as 0327 with the existing reviewed SQL.

Author: TheodoreSpeaks

apps/sim/app/api/knowledge/sim-search/integrations/route.ts

@@ -0,0 +1,40 @@
+import {
+  listSearchIntegrationsContract,
+  updateSearchIntegrationContract,
+} from '@/lib/api/contracts/knowledge/search-integrations'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalKnowledgeErrorPolicies } from '@/lib/knowledge/api/route-policies'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import {
+  approveSearchIntegration,
+  listSearchIntegrations,
+} from '@/lib/knowledge/application/search-integrations'
+
+export const GET = defineInternalJsonRoute({
+  contract: listSearchIntegrationsContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.listSearchIntegrations,
+  rateLimit: internalRateLimits.user({ bucketName: 'knowledge.search.integrations.list' }),
+  errorPolicy: internalKnowledgeErrorPolicies.connectors,
+  mapInput: ({ query }) => query,
+  useCase: listSearchIntegrations,
+  present: (data) => ({ success: true as const, data }),
+})
+
+export const PUT = defineInternalJsonRoute({
+  contract: updateSearchIntegrationContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.approveSearchIntegration,
+  rateLimit: internalRateLimits.user({ bucketName: 'knowledge.search.integrations.approve' }),
+  errorPolicy: internalKnowledgeErrorPolicies.connectors,
+  mapInput: ({ body }) => body,
+  useCase: approveSearchIntegration,
+  present: ({ connectorType, approved }) => ({
+    success: true as const,
+    data: { connectorType, approved },
+  }),
+})

apps/sim/app/o/[organizationId]/integrations/integrations.test.tsx

@@ -7,11 +7,22 @@ import type { SearchSourceSummary } from '@/lib/api/contracts/knowledge/connecto
 const mocks = vi.hoisted(() => ({
   context: vi.fn(),
   sources: vi.fn(),
+  integrations: vi.fn(),
   filters: vi.fn(),
   setSource: vi.fn(),
   connect: vi.fn(),
 }))
 
+vi.mock('@/hooks/queries/search-integrations', () => ({
+  useSearchIntegrations: mocks.integrations,
+}))
+vi.mock('@/hooks/use-permission-config', () => ({
+  usePermissionConfig: () => ({
+    integrationAvailability: new Map(),
+    oauthServiceAvailability: new Map([['google-email', true]]),
+    isIntegrationAvailabilityReady: true,
+  }),
+}))
 vi.mock('nuqs', () => ({
   useQueryState: () => [null, mocks.setSource],
   parseAsString: { withOptions: () => ({}) },
@@ -45,6 +56,7 @@ vi.mock('@/hooks/use-member-enrollment', () => ({
   CONNECTABLE_MEMBERSHIPS: new Set(['invited', 'not_enrolled', 'needs_reauth']),
   useMemberEnrollment: () => ({
     connect: mocks.connect,
+    connectSearchSource: mocks.connect,
     isAwaiting: () => false,
     isPending: false,
     error: null,
@@ -97,6 +109,7 @@ describe('organization integrations role and source paths', () => {
       viewer: { isAdmin: false },
       searchAccess: { memberScoped: true, sourceMirrored: true },
     })
+    mocks.integrations.mockReturnValue({ data: [], isPending: false })
     mocks.sources.mockReturnValue({ data: [memberSource, centralSource], isPending: false })
     mocks.filters.mockReturnValue({ tab: null, search: '', setSearch: vi.fn() })
     container = document.createElement('div')
@@ -131,6 +144,31 @@ describe('organization integrations role and source paths', () => {
     expect(mocks.connect).toHaveBeenCalledExactlyOnceWith('search-index', 'member-source')
   })
 
+  it('offers an approved integration before any source is configured', async () => {
+    mocks.sources.mockReturnValue({ data: [], isPending: false })
+    mocks.integrations.mockReturnValue({
+      data: [{ connectorType: 'gmail', approved: true }],
+      isPending: false,
+    })
+    await render()
+    expect(document.body.textContent).toContain('Approved')
+    expect(buttons('Connect account')).toHaveLength(1)
+    await act(async () => buttons('Connect account')[0].click())
+    expect(mocks.connect).toHaveBeenCalledWith(
+      scope,
+      expect.objectContaining({ type: 'gmail' }),
+      undefined
+    )
+  })
+  it('withholds connection when an integration is deactivated', async () => {
+    mocks.sources.mockReturnValue({
+      data: [{ ...memberSource, approved: false }],
+      isPending: false,
+    })
+    await render()
+    expect(buttons('Connect account')).toHaveLength(0)
+    expect(document.body.textContent).toContain('Deactivated by an organization admin')
+  })
   it('shows an organization admin exactly what a member sees, with no setup or management', async () => {
     mocks.context.mockReturnValue({
       organization: { id: scope.organizationId },

apps/sim/app/o/[organizationId]/integrations/integrations.tsx

@@ -1,20 +1,33 @@
 'use client'
 
 import { useMemo } from 'react'
+import { Chip } from '@sim/emcn'
 import type { ResourceScope } from '@/lib/core/resource-scope'
-import { connectorDisplayName } from '@/lib/sim-search/connectors'
+import {
+  connectorDisplayName,
+  getConnectorAccessAvailability,
+  SEARCH_CONNECTORS,
+  SEARCH_SOURCE_TYPES,
+} from '@/lib/sim-search/connectors'
 import { OrganizationPage } from '@/app/o/[organizationId]/components/organization-page'
 import { useOrganizationPageFilters } from '@/app/o/[organizationId]/components/organization-page/use-organization-page-filters'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
+import { SourceSetupModal } from '@/app/workspace/[workspaceId]/home/components/search-sources/source-setup-modal'
+import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
 import { SearchSourceRow } from '@/app/workspace/[workspaceId]/search/components/search-source-row'
 import {
   SettingsEmptyState,
   SettingsQueryErrorState,
 } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
-import { RESOURCE_LIST_STACK } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
+import {
+  RESOURCE_LIST_STACK,
+  SettingsResourceRow,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { searchSourceKeys, useSearchSources } from '@/hooks/queries/kb/connectors'
+import { useSearchIntegrations } from '@/hooks/queries/search-integrations'
 import { useMemberEnrollment } from '@/hooks/use-member-enrollment'
 import { useDesktopOAuthConnectListener, useOAuthReturnRouter } from '@/hooks/use-oauth-return'
+import { usePermissionConfig } from '@/hooks/use-permission-config'
 
 /** Every source the organization searches, or only the ones the viewer has connected. */
 const TABS = [
@@ -33,6 +46,8 @@ export function OrganizationIntegrations() {
   const { organization, searchAccess } = useOrganizationContext()
   const scope: ResourceScope = { kind: 'organization', organizationId: organization.id }
   const sources = useSearchSources(scope)
+  const integrations = useSearchIntegrations(organization.id)
+  const availability = usePermissionConfig()
   const { tab, search } = useOrganizationPageFilters()
   const membershipQueryKeys = useMemo(
     () => [searchSourceKeys.list({ kind: 'organization', organizationId: organization.id })],
@@ -59,40 +74,96 @@ export function OrganizationIntegrations() {
           .includes(query)
     ) ?? []
 
+  const approvedTypes = new Set(
+    integrations.data
+      ?.filter((integration) => integration.approved)
+      .map((integration) => integration.connectorType)
+  )
+  const configuredTypes = new Set(sources.data?.map((source) => source.connectorType))
+  const unconfigured = mineOnly
+    ? []
+    : SEARCH_SOURCE_TYPES.filter(
+        ([type, meta]) =>
+          approvedTypes.has(type) &&
+          !configuredTypes.has(type) &&
+          meta.name.toLowerCase().includes(query)
+      )
+  const failedQuery = sources.isError ? sources : integrations.isError ? integrations : null
+
   return (
     <OrganizationPage
       title='Integrations'
       description='Connect your tools for Sim Search'
       tabs={TABS}
     >
       <div className={RESOURCE_LIST_STACK}>
-        {sources.isError ? (
+        {failedQuery ? (
           <SettingsQueryErrorState
-            error={sources.error}
+            error={failedQuery.error}
             fallback='Could not load sources'
-            isRetrying={sources.isFetching}
-            onRetry={() => void sources.refetch()}
+            isRetrying={failedQuery.isFetching}
+            onRetry={() => void failedQuery.refetch()}
             variant='inline'
           />
-        ) : visibleSources.length > 0 ? (
-          visibleSources.map((source) => (
-            <SearchSourceRow
-              key={source.connectorId}
-              source={source}
-              scope={scope}
-              canAdmin={false}
-              available={
-                source.accessMode === 'members'
-                  ? searchAccess.memberScoped
-                  : searchAccess.sourceMirrored &&
-                    (!source.connectionRequired || searchAccess.memberScoped)
-              }
-              waiting={enrollment.isAwaiting(source.connectorId)}
-              isPending={enrollment.isPending}
-              onConnect={() => enrollment.connect(source.knowledgeBaseId, source.connectorId)}
-            />
-          ))
-        ) : sources.isPending ? null : (
+        ) : visibleSources.length > 0 || unconfigured.length > 0 ? (
+          <>
+            {unconfigured.map(([type, meta]) => {
+              const connector = SEARCH_CONNECTORS.find((item) => item.type === type)
+              const access = getConnectorAccessAvailability(
+                meta,
+                availability.integrationAvailability,
+                {
+                  memberAccessAvailable: searchAccess.memberScoped,
+                  mirroredAccessAvailable: searchAccess.sourceMirrored,
+                  oauthServiceAvailability: availability.oauthServiceAvailability,
+                  isIntegrationAvailabilityReady: availability.isIntegrationAvailabilityReady,
+                }
+              )
+              const canConnect = connector && access.members
+              return (
+                <SettingsResourceRow
+                  key={type}
+                  iconVariant='custom'
+                  icon={<IntegrationTile blockType={type} icon={meta.icon} />}
+                  title={meta.name}
+                  description={
+                    canConnect
+                      ? 'Approved · Connect your account to search this source'
+                      : 'Approved · An admin needs to finish source setup'
+                  }
+                  trailing={
+                    canConnect ? (
+                      <Chip
+                        variant='primary'
+                        disabled={enrollment.isPending}
+                        onClick={() => enrollment.connectSearchSource(scope, connector, undefined)}
+                      >
+                        Connect account
+                      </Chip>
+                    ) : undefined
+                  }
+                />
+              )
+            })}
+            {visibleSources.map((source) => (
+              <SearchSourceRow
+                key={source.connectorId}
+                source={source}
+                scope={scope}
+                canAdmin={false}
+                available={
+                  source.accessMode === 'members'
+                    ? searchAccess.memberScoped
+                    : searchAccess.sourceMirrored &&
+                      (!source.connectionRequired || searchAccess.memberScoped)
+                }
+                waiting={enrollment.isAwaiting(source.connectorId)}
+                isPending={enrollment.isPending}
+                onConnect={() => enrollment.connect(source.knowledgeBaseId, source.connectorId)}
+              />
+            ))}
+          </>
+        ) : sources.isPending || integrations.isPending ? null : (
           <SettingsEmptyState variant='inline'>
             {query
               ? 'No matching sources.'
@@ -105,6 +176,15 @@ export function OrganizationIntegrations() {
           <p className='text-[var(--text-error)] text-caption'>{enrollment.error}</p>
         )}
       </div>
+      {enrollment.setupConnector && (
+        <SourceSetupModal
+          connector={enrollment.setupConnector}
+          onClose={enrollment.closeSetup}
+          onConnect={(config) =>
+            enrollment.connectSource(scope, enrollment.setupConnector!.type, config)
+          }
+        />
+      )}
     </OrganizationPage>
   )
 }