Merge branch 'wip/fix-zone-wiring' into wip/platform-org-wiring

Author: waleedlatif1

apps/desktop/src/main/app-routes.test.ts

@@ -9,6 +9,13 @@ describe('settingsRoute', () => {
     expect(settingsRoute('/o/org-1/search?q=x')).toBe('/o/org-1/settings/general')
   })
 
+  it.each(['/org', '/org/search?q=x', '/org/settings/usage'])(
+    'stays in the organization from its Platform page %s',
+    (lastRoute) => {
+      expect(settingsRoute(lastRoute)).toBe('/org/settings/general')
+    }
+  )
+
   it('keeps the desktop settings of the workspace the user was last in', () => {
     expect(settingsRoute('/workspace/ws-1/home')).toBe('/workspace/ws-1/settings/desktop')
   })
@@ -18,6 +25,7 @@ describe('settingsRoute', () => {
     ['the app entry', '/home'],
     ['no saved route', undefined],
     ['a route that only starts like an organization', '/oauth/o/org-1'],
+    ['a route that only starts like the Platform', '/organizations/x'],
     ['an unsafe route', '//evil.example/o/org-1'],
   ])('resolves settings through the web app from %s', (_label, lastRoute) => {
     expect(settingsRoute(lastRoute)).toBe('/workspace?redirect=settings')

apps/desktop/src/main/app-routes.ts

@@ -43,6 +43,11 @@ function organizationIdFromRoute(lastRoute: string | undefined): string | null {
   return null
 }
 
+/** The organization's Platform pages, mounted at `/org`, which name no organization in the path. */
+function isOrganizationZoneRoute(lastRoute: string | undefined): boolean {
+  return isSafeInternalPath(lastRoute) && /^\/org(?:[/?#]|$)/.test(lastRoute)
+}
+
 /**
  * Route for "New Chat": the home (chat) surface of the workspace the user was
  * last in, falling back to the app entry when the last route carries no
@@ -63,5 +68,8 @@ export function settingsRoute(lastRoute: string | undefined): string {
     return `/workspace/${workspaceId}/settings/desktop`
   }
   const organizationId = organizationIdFromRoute(lastRoute)
-  return organizationId ? `/o/${organizationId}/settings/general` : SETTINGS_ENTRY_ROUTE
+  if (organizationId) {
+    return `/o/${organizationId}/settings/general`
+  }
+  return isOrganizationZoneRoute(lastRoute) ? '/org/settings/general' : SETTINGS_ENTRY_ROUTE
 }

apps/sim/app/api/organizations/[id]/home/workspace-activity/route.ts

@@ -1,24 +1,29 @@
 import { getOrganizationHomeWorkspaceActivityContract } from '@/lib/api/contracts/organization-home'
 import {
+  createInternalResourceConcealmentPolicy,
   defineInternalJsonRoute,
+  internalErrorResponse,
+  internalOrchestrationErrorPolicy,
   internalRateLimits,
   internalSessionAuth,
 } from '@/lib/api/server/routes'
 import {
   organizationHomeWorkspaceOperations,
   readOrganizationHomeWorkspaceActivity,
 } from '@/lib/organizations/application/home-workspaces'
-import { createCredentialGroupInternalErrorPolicy } from '@/app/api/workspaces/[id]/credential-groups/error-policy'
 
 export const GET = defineInternalJsonRoute({
   contract: getOrganizationHomeWorkspaceActivityContract,
   auth: internalSessionAuth,
   operation: organizationHomeWorkspaceOperations.readActivity,
   rateLimit: internalRateLimits.user({ bucketName: 'organization-home-workspace-activity' }),
-  errorPolicy: createCredentialGroupInternalErrorPolicy(
-    'Failed to load workspace activity',
-    'Organization not found'
-  ),
+  errorPolicy: createInternalResourceConcealmentPolicy({
+    base: {
+      project: internalOrchestrationErrorPolicy.project,
+      unhandled: () => internalErrorResponse(500, { error: 'Failed to load workspace activity' }),
+    },
+    notFoundMessage: 'Organization not found',
+  }),
   mapInput: ({ params }) => ({ organizationId: params.id }),
   useCase: readOrganizationHomeWorkspaceActivity,
   staticResponseHeaders: { 'Cache-Control': 'private, no-store' },

apps/sim/lib/core/config/env.ts

@@ -614,7 +614,7 @@ export const env = createEnv({
     SIM_LINKS:                             z.boolean().optional(),                 // Fallback for the `sim-links` feature flag off AppConfig
     PEOPLE:                                z.boolean().optional(),                 // Fallback for the `people` feature flag off AppConfig
     PLATFORM_ORG_UI:                       z.boolean().optional(),                 // Fallback for the `platform-org-ui` feature flag off AppConfig
-    SIM_PLATFORM_ORIGIN:                   z.string().url().optional(),            // Internal origin of the Platform zone. Set at build and runtime: adds the /platform rewrite and arms the organization redirect
+    SIM_PLATFORM_ORIGIN:                   z.string().url().optional(),            // Internal origin of the Platform zone. Set at build and runtime: adds the /org rewrite and arms the organization redirect
     MSHIP_MODEL_SELECTOR: z.boolean().optional(),
     INBOX_ENABLED:                         z.boolean().optional(),                 // Enable inbox (Sim Mailer) on self-hosted (bypasses hosted requirements)
     SANDBOXES_ENABLED:                     z.boolean().optional(),                 // Enable custom sandboxes on self-hosted (bypasses hosted requirements)

apps/sim/lib/organizations/home/workspace-activity.ts

@@ -53,8 +53,8 @@ export function readRunningWorkflows(
 
 /**
  * Per workspace, one workflow waiting on a person and the newest retained run. Each is a `LIMIT 1`
- * probe, so a workspace with thousands of unanswered pauses costs what one does. The waiting workflow
- * is therefore any of them rather than the newest, since finding the newest would read them all.
+ * probe, so many unanswered pauses cost what one does once a match exists. The waiting workflow is
+ * therefore any of them rather than the newest. With no match, the probe reads every live pause.
  */
 export function readReviewAndLastRun(workspaceIds: readonly string[]) {
   const logs = workflowExecutionLogs

apps/sim/lib/organizations/settings-sections.ts

@@ -2,17 +2,16 @@ import {
   ACCOUNT_SETTINGS_ITEMS,
   type AccountSettingsSection,
   getSettingsSectionMeta,
-  isOrganizationSettingsSectionAvailable,
   ORGANIZATION_SETTINGS_GROUPS,
   ORGANIZATION_SETTINGS_ITEMS,
   type OrganizationSettingsFeatures,
   type OrganizationSettingsSection,
   parseSettingsPathSection,
-  resolveOrganizationSectionAccess,
   type SettingsNavigationItem,
   toSettingsHeaderMeta,
 } from '@/components/settings/navigation'
 import type { SettingsHeaderMeta } from '@/components/settings/settings-header'
+import { organizationSupportsSettingsSection } from '@/lib/settings/section-availability'
 
 /**
  * A section on the organization surface's settings, tagged with the plane that
@@ -84,18 +83,8 @@ export function organizationSettingsNavigation(
   features: OrganizationSettingsFeatures,
   availability: { connectedAccounts: boolean; search: boolean; knowledgeGraphs?: boolean }
 ) {
-  return ORGANIZATION_SETTINGS_ITEMS.filter(
-    (item) =>
-      (item.id !== 'knowledge-graphs' || availability.knowledgeGraphs === true) &&
-      (item.id !== 'connected-accounts' || availability.connectedAccounts) &&
-      ((item.id !== 'search-mcp' && item.id !== 'search-slack' && item.id !== 'integrations') ||
-        availability.search) &&
-      resolveOrganizationSectionAccess({
-        section: item.id,
-        isTargetOrganizationMember: true,
-        isTargetOrganizationAdmin: isAdmin,
-      }) !== 'unavailable' &&
-      isOrganizationSettingsSectionAvailable(item.id, features)
+  return ORGANIZATION_SETTINGS_ITEMS.filter((item) =>
+    organizationSupportsSettingsSection(item.id, features, availability, isAdmin)
   )
 }
 

apps/sim/lib/platform/routes.test.ts

@@ -22,4 +22,25 @@ describe('Platform zone mount', () => {
   it('hands legacy organization routes to the mount', () => {
     expect(mapLegacyOrganizationUrl('/o/org-1/home', 'org-1')).toBe('/org/home')
   })
+
+  it.each([
+    'slack=token',
+    'integration=gmail',
+    'connectorType=gmail',
+    'connectorId=c',
+    'credentialId=c',
+    'connectionMode=member',
+    'optionId=o',
+    'savedProviderId=jama-service-account',
+    'provider=google',
+  ])('keeps the integrations page legacy for a link carrying %s', (query) => {
+    expect(mapLegacyOrganizationUrl(`/o/org-1/integrations?${query}`, 'org-1')).toBeNull()
+  })
+
+  it('still hands a plain or searched integrations page to the mount', () => {
+    expect(mapLegacyOrganizationUrl('/o/org-1/integrations', 'org-1')).toBe('/org/integrations')
+    expect(mapLegacyOrganizationUrl('/o/org-1/integrations?q=mail', 'org-1')).toBe(
+      '/org/integrations?q=mail'
+    )
+  })
 })

apps/sim/lib/platform/routes.ts

@@ -60,11 +60,29 @@ function mapSettingsRoute(rest: readonly string[], query: URLSearchParams): stri
   return target && `/settings/${target}`
 }
 
+/**
+ * Query keys that give the integrations page a job the zone's page cannot do yet: the Slack onboarding
+ * handoff, a connection request, or a jump to one integration. Those links stay on the legacy page.
+ */
+const LEGACY_INTEGRATIONS_QUERY = [
+  'slack',
+  'integration',
+  'connectorType',
+  'connectorId',
+  'credentialId',
+  'connectionMode',
+  'optionId',
+  'savedProviderId',
+  'provider',
+] as const
+
 function mapRoute(rest: readonly string[], query: URLSearchParams): string | null {
   const [head, detail] = rest
   if (head === undefined) return '/'
   if (head === 'settings') return mapSettingsRoute(rest.slice(1), query)
   if (rest.length === 1) {
+    if (head === 'integrations' && LEGACY_INTEGRATIONS_QUERY.some((key) => query.has(key)))
+      return null
     if (head === 'home' || head === 'people' || head === 'integrations' || head === 'search')
       return `/${head}`
     if (head === 'links') return '/settings/links'
@@ -77,8 +95,7 @@ function mapRoute(rest: readonly string[], query: URLSearchParams): string | nul
 
 /**
  * The Platform URL for a legacy URL under `/o/{organizationId}`, keeping its query, or `null` for a
- * route that stays legacy: Benchmark, Skills, Admin, and the Search and credential pages with
- * legacy management links. Null also covers another organization's URL. A fallback must lead to
+ * route that stays legacy: Benchmark, Skills, Admin, and integrations links the zone cannot serve yet. Null also covers another organization's URL. A fallback must lead to
  * an unmapped route so the two surfaces cannot redirect to each other.
  */
 export function mapLegacyOrganizationUrl(url: string, organizationId: string): string | null {

apps/sim/platform/app/(shell)/integrations/_components/integrations-page/live-integrations-route.tsx

@@ -1,3 +1,4 @@
+import { notFound } from 'next/navigation'
 import { IntegrationsRoute } from '@/platform/app/(shell)/integrations/_components/integrations-page/integrations-route'
 import { legacyRoutes } from '@/platform/lib/data/organization-model'
 import { readOrganizationSurface } from '@/platform/lib/data/surface'
@@ -8,6 +9,7 @@ export async function LiveIntegrationsRoute({ section }: { section?: string }) {
   // The layout already rendered this outcome's login, denial or error state.
   if (surface.status !== 'ok') return null
   const { organization } = surface
+  if (!organization.searchAccess.memberScoped) notFound()
   return (
     <IntegrationsRoute
       organizationId={organization.organization.id}

apps/sim/platform/app/(shell)/people/_components/org-chart/org-chart.tsx

@@ -21,12 +21,12 @@ import {
 } from '@/platform/design-system/components'
 import { useScrollEdges } from '@/platform/design-system/components/scroll-area/use-scroll-edges'
 import {
-  isRefusal,
   type SyncSource,
   useOrgChart,
   usePeoplePicker,
   usePeopleViewer,
 } from '@/platform/lib/data/people'
+import { isRefusal } from '@/platform/lib/data/query-view'
 
 function ReportingLinesGraphic() {
   return (