fix(integrations): offer an OAuth connect only for a provider id the deployment can complete

The OAuth availability list named each service's primary provider id but not its additional ones,
and the workspace directory read an unlisted id as available. Salesforce's sandbox therefore offered
an OAuth sign-in on deployments with no Salesforce client. The list now covers every provider id a
service signs in through, and the directory offers OAuth only on an explicit yes.

Author: waleedlatif1

apps/sim/lib/integrations/availability.server.oauth-configured.test.ts

@@ -4,12 +4,15 @@ import {
   getIntegrationAvailability,
   getOAuthServiceAvailability,
 } from '@/lib/integrations/availability.server'
+import { getAllOAuthServices } from '@/lib/oauth'
 
 setEnv({
   GITHUB_APP_CLIENT_ID: 'repository-client',
   GITHUB_APP_CLIENT_SECRET: 'repository-secret',
   GOOGLE_CLIENT_ID: undefined,
   GOOGLE_CLIENT_SECRET: undefined,
+  SALESFORCE_CLIENT_ID: 'salesforce-client',
+  SALESFORCE_CLIENT_SECRET: 'salesforce-secret',
 })
 afterAll(resetEnvMock)
 
@@ -37,6 +40,16 @@ describe('OAuth service availability projection', () => {
     ])
   })
 
+  it('judges every provider id a service signs in through, not only its primary one', () => {
+    const salesforce = getAllOAuthServices().filter(
+      (service) => service.providerId === 'salesforce'
+    )
+    expect(getOAuthServiceAvailability(salesforce)).toEqual([
+      { providerId: 'salesforce', available: true },
+      { providerId: 'salesforce-sandbox', available: true },
+    ])
+  })
+
   it('does not expose deployment fields or credentials', () => {
     const result = getOAuthServiceAvailability([
       { providerId: 'github-repositories', authType: 'oauth' },

apps/sim/lib/integrations/availability.server.ts

@@ -24,15 +24,23 @@ export function getIntegrationAvailability() {
   return resolveIntegrationAvailability(env)
 }
 
-/** OAuth clients are independent of the authentication method a workflow block exposes. */
+/**
+ * Whether the deployment can complete each provider id an OAuth service signs in through, its
+ * additional ones (such as Salesforce's sandbox) included. OAuth clients are independent of the
+ * authentication method a workflow block exposes.
+ */
 export function getOAuthServiceAvailability(
-  services: readonly Pick<OAuthServiceMetadata, 'providerId' | 'authType'>[]
+  services: readonly Pick<
+    OAuthServiceMetadata,
+    'providerId' | 'authType' | 'additionalProviderIds'
+  >[]
 ): { providerId: string; available: boolean }[] {
   return services
     .filter((service) => service.authType === 'oauth')
-    .map((service) => ({
-      providerId: service.providerId,
-      available: isOAuthServiceDeploymentAvailable(service.providerId),
+    .flatMap((service) => [service.providerId, ...(service.additionalProviderIds ?? [])])
+    .map((providerId) => ({
+      providerId,
+      available: isOAuthServiceDeploymentAvailable(providerId),
     }))
 }
 

apps/sim/platform/lib/data/workspace-integrations.ts

@@ -65,7 +65,7 @@ async function readWorkspaceApps(workspaceId: string): Promise<WorkspaceAppDetai
   return integrationCatalog.flatMap((entry) => {
     const app = projectWorkspaceApp(entry, {
       access: (blockType) => resolveIntegrationAccess(blockType, policy),
-      oauthAvailable: (providerId) => oauth.get(providerId.toLowerCase()),
+      oauthAvailable: (providerId) => oauth.get(providerId.toLowerCase()) === true,
     })
     return app
       ? [{ ...app, example: entry.example, skills: entry.skills, templates: entry.templates }]

apps/sim/platform/lib/integrations/workspace-catalog.test.ts

@@ -59,7 +59,7 @@ const gmail: IntegrationCatalogEntry = {
 
 function verdicts(
   access: ReturnType<WorkspaceAppVerdicts['access']>,
-  oauth?: boolean
+  oauth = false
 ): WorkspaceAppVerdicts {
   return { access: () => access, oauthAvailable: () => oauth }
 }
@@ -83,9 +83,9 @@ describe('projectWorkspaceApp', () => {
   })
 
   it('offers only the methods this page can complete, a personal token among them', () => {
-    const ids = (oauth?: boolean) =>
+    const ids = (oauth: boolean) =>
       projectWorkspaceApp(gmail, verdicts('available', oauth))?.connections.map(({ id }) => id)
-    expect(ids()).toEqual(['google-email', 'google-service-account'])
+    expect(ids(true)).toEqual(['google-email', 'google-service-account'])
     expect(ids(false)).toEqual(['google-service-account'])
     const gitlab: IntegrationCatalogEntry = {
       ...gmail,

apps/sim/platform/lib/integrations/workspace-catalog.ts

@@ -60,8 +60,8 @@ export interface WorkspaceAppDetail extends WorkspaceApp {
 export interface WorkspaceAppVerdicts {
   /** The integration access verdict for a block type, as `resolveIntegrationAccess` answers it. */
   access: (blockType: string) => 'available' | 'unconfigured' | 'requestable' | 'denied'
-  /** Whether the deployment can complete an OAuth provider's sign-in; absent reads as available. */
-  oauthAvailable: (providerId: string) => boolean | undefined
+  /** Whether the deployment can complete an OAuth provider's sign-in. */
+  oauthAvailable: (providerId: string) => boolean
 }
 
 const ATLASSIAN_SERVICE_ACCOUNT_PROVIDER = 'atlassian-service-account'
@@ -90,8 +90,7 @@ export function projectWorkspaceApp(
       ? entry.connections.filter(
           (connection) =>
             CONNECTABLE_KINDS.has(connection.kind) &&
-            (connection.kind !== 'oauth' ||
-              verdicts.oauthAvailable(connection.providerId) !== false)
+            (connection.kind !== 'oauth' || verdicts.oauthAvailable(connection.providerId))
         )
       : []
   return {

apps/sim/scripts/test-assistant-actions-e2e.ts

@@ -843,9 +843,12 @@ try {
         await expect(
           page.getByRole('region', { name: 'Connected credentials', exact: true }).getByRole('link')
         ).toHaveCount(0)
-        // No member method is left and this deployment configures no Salesforce client for the
-        // workspace, so the page keeps Connect integration only as a disabled control naming why.
-        await expect(connectIntegration).toBeDisabled()
+        // No member method is left and this deployment configures no Salesforce OAuth client, for
+        // production or sandbox, so the workspace offers only its integration-user form.
+        await expect(connectIntegration).toHaveCount(0)
+        await expect(
+          page.getByRole('button', { name: 'Create credential', exact: true })
+        ).toBeEnabled()
         await capture('integration-disabled-app-empty')
       } finally {
         await sql`update credential set managed_oauth_status = 'active' where id = ${nativeCredentialId}`