fix(integrations): preserve field values and tighten credential lifecycle

Author: waleedlatif1

apps/docs/content/docs/integrations/flow.mdx

@@ -283,7 +283,7 @@ Set one field on a Flow entity using a key from the data model and a JSON value
 | `entityId` | string | Yes | Entity ID returned by Search Entities or List Entities |
 | `branchId` | string | No | Branch ID; omit or use master for Base |
 | `fieldKey` | string | Yes | Stored field key returned by Get Data Model |
-| `value` | json | Yes | Field value as JSON, matching the data model: string, number, boolean, array, object, or null |
+| `value` | string | Yes | JSON-encoded field value matching the data model. Use "text" for a string, 123 for a number, true or false for a boolean, an array or object, or null to clear the field. Use "" for an empty string. |
 
 #### Output
 

apps/sim/blocks/blocks/flow.ts

@@ -888,13 +888,6 @@ export const FlowBlock: BlockConfig = {
       tool: (params) => `flow_${params.operation || 'search_entities'}`,
       params: (params) => {
         const result: Record<string, unknown> = {}
-        if (params.operation === 'set_value' && typeof params.value === 'string') {
-          try {
-            result.value = JSON.parse(params.value)
-          } catch {
-            throw new Error('Value must be valid JSON; wrap text values in double quotes')
-          }
-        }
         if (params.limit != null && params.limit !== '') result.limit = Number(params.limit)
         for (const key of ['includeResolved', 'resolved', 'isVariant']) {
           if (params[key] != null && params[key] !== '')
@@ -976,7 +969,7 @@ export const FlowBlock: BlockConfig = {
       description: 'Stored field key returned by Get Data Model',
     },
     value: {
-      type: 'json',
+      type: 'string',
       description:
         'Field value as JSON, matching the data model: string, number, boolean, array, object, or null',
     },

apps/sim/blocks/blocks/jama.ts

@@ -708,7 +708,7 @@ export const JamaBlock: BlockConfig = {
     items: {
       type: 'json',
       description:
-        'List Baseline Items result (id, documentKey, globalId, itemType, project, createdDate, modifiedDate, lastActivityDate, createdBy, modifiedBy, fields, version)',
+        'List Items, Search Items, or List Baseline Items results (id, documentKey, globalId, itemType, project, createdDate, modifiedDate, lastActivityDate, createdBy, modifiedBy, fields, version)',
     },
     item: {
       type: 'json',

apps/sim/executor/handlers/generic/handler.test.ts

@@ -3,6 +3,7 @@ import '@sim/testing/mocks/executor'
 import { beforeEach, describe, expect, it, type Mock, vi } from 'vitest'
 import { executeBufferTool } from '@/lib/internal/buffer/execute-tool'
 import { BufferBlock } from '@/blocks/blocks/buffer'
+import { FlowBlock } from '@/blocks/blocks/flow'
 import { HarmonicBlock } from '@/blocks/blocks/harmonic'
 import { McpBlock } from '@/blocks/blocks/mcp'
 import { getBlock } from '@/blocks/index'
@@ -15,6 +16,8 @@ import bufferPostFixture from '@/tools/buffer/__fixtures__/post.json'
 import { bufferCreatePostTool } from '@/tools/buffer/create_post'
 import { bufferEditPostTool } from '@/tools/buffer/edit_post'
 import type { BufferCreatePostParams, BufferEditPostParams } from '@/tools/buffer/types'
+import { flowSetValueTool } from '@/tools/flow/set-value'
+import type { FlowSetValueParams } from '@/tools/flow/types'
 import { mcpRunOperationTool } from '@/tools/mcp/run-operation'
 import type { ToolConfig } from '@/tools/types'
 import { getTool } from '@/tools/utils'
@@ -82,6 +85,70 @@ describe('GenericBlockHandler', () => {
     mockExecuteTool.mockResolvedValue({ success: true, output: { customResult: 'OK' } })
   })
 
+  describe('Flow field values', () => {
+    const writes: unknown[] = []
+
+    beforeEach(async () => {
+      writes.length = 0
+      mockGetBlock.mockReturnValue(FlowBlock)
+      mockGetTool.mockReturnValue(flowSetValueTool)
+      const { validateRequiredParametersAfterMerge } =
+        await vi.importActual<typeof import('@/tools/utils')>('@/tools/utils')
+      mockExecuteTool.mockImplementation(async (toolId: string, params: FlowSetValueParams) => {
+        validateRequiredParametersAfterMerge(toolId, flowSetValueTool, params)
+        writes.push(await Response.json(flowSetValueTool.request.body?.(params)).json())
+        return { success: true, output: {} }
+      })
+    })
+
+    const values = ['123', 'true', '{"key":1}', '', null, 123, false, [1, '2'], { key: 1 }]
+    it.each(values.map((value) => ({ value, encoded: JSON.stringify(value) })))(
+      'preserves the JSON value $encoded on the provider wire',
+      async ({ value, encoded }) => {
+        await handler.execute(
+          mockContext,
+          {
+            ...mockBlock,
+            metadata: { id: 'flow', name: 'Flow' },
+            config: { tool: 'flow_set_value', params: {} },
+          },
+          {
+            operation: 'set_value',
+            projectId: 'project',
+            entityId: 'entity',
+            fieldKey: 'name',
+            value: encoded,
+          }
+        )
+        expect(writes).toEqual([{ key: 'name', value }])
+      }
+    )
+
+    it.each([undefined, '', '{"broken":', 'unquoted text'])(
+      'rejects omitted or malformed JSON before sending a field write (%s)',
+      async (value) => {
+        await expect(
+          handler.execute(
+            mockContext,
+            {
+              ...mockBlock,
+              metadata: { id: 'flow', name: 'Flow' },
+              config: { tool: 'flow_set_value', params: {} },
+            },
+            {
+              operation: 'set_value',
+              projectId: 'project',
+              entityId: 'entity',
+              fieldKey: 'name',
+              value,
+            }
+          )
+        ).rejects.toThrow()
+        expect(writes).toEqual([])
+      }
+    )
+  })
+
   it.each([
     {
       selection: 'keep-current scheduling',

apps/sim/hooks/queries/organization-accounts.test.tsx

@@ -16,15 +16,24 @@ vi.mock('next/navigation', () => nextNavigationMock)
 
 import { ApiClientError } from '@/lib/api/client/errors'
 import { listOrganizationAccountPeopleContract } from '@/lib/api/contracts/organization-accounts'
+import { resourceScopeKey } from '@/lib/core/resource-scope'
 import { useOrganizationAccountPeople } from '@/hooks/queries/organization-accounts'
+import { useRemovePersonalSearchCredential } from '@/hooks/queries/personal-search-integrations'
+import { knowledgeKeys } from '@/hooks/queries/utils/knowledge-keys'
 
 const mockRequestJson = apiClientRequestMockFns.mockRequestJson
 
-describe('organization people search pagination', () => {
+describe('organization accounts', () => {
   let root: Root
   let container: HTMLDivElement
   let client: QueryClient
   let result: ReturnType<typeof useOrganizationAccountPeople>
+  let removal: ReturnType<typeof useRemovePersonalSearchCredential>
+
+  function RemovalProbe() {
+    removal = useRemovePersonalSearchCredential()
+    return null
+  }
 
   function Probe({
     search,
@@ -130,6 +139,37 @@ describe('organization people search pagination', () => {
     expect(result.data?.pages).toHaveLength(1)
   })
 
+  it('clears disconnected Search content while preserving another organization’s results', async () => {
+    const search = knowledgeKeys.search(
+      resourceScopeKey({ kind: 'organization', organizationId: 'org-1' }),
+      'private content'
+    )
+    const otherSearch = knowledgeKeys.search(
+      resourceScopeKey({ kind: 'organization', organizationId: 'org-2' }),
+      'private content'
+    )
+    const document = knowledgeKeys.document('knowledge-1', 'document-1')
+    client.setQueryData(search, [{ content: 'disconnected source content' }])
+    client.setQueryData(otherSearch, [{ content: 'other organization content' }])
+    client.setQueryData(document, { content: 'disconnected document content' })
+    mockRequestJson.mockResolvedValueOnce({ success: true })
+
+    await act(async () =>
+      root.render(
+        <QueryClientProvider client={client}>
+          <RemovalProbe />
+        </QueryClientProvider>
+      )
+    )
+    await act(async () => {
+      await removal.mutateAsync({ organizationId: 'org-1', credentialId: 'credential-1' })
+    })
+
+    expect(client.getQueryData(search)).toBeUndefined()
+    expect(client.getQueryData(document)).toBeUndefined()
+    expect(client.getQueryData(otherSearch)).toEqual([{ content: 'other organization content' }])
+  })
+
   it.each([400, 401, 403, 404, 409, 422])(
     'does not retry a non-retryable %s response',
     async (status) => {

apps/sim/hooks/queries/personal-search-integrations.ts

@@ -17,6 +17,7 @@ import {
 import { isDesktopApp } from '@/lib/desktop'
 import { connectDesktopSource } from '@/lib/desktop/source-connect'
 import { organizationAccountsKeys } from '@/hooks/queries/utils/organization-accounts-keys'
+import { resetOrganizationSearchAccess } from '@/hooks/queries/utils/reset-organization-search-access'
 import { searchSourceKeys } from '@/hooks/queries/utils/search-source-keys'
 
 export const PERSONAL_SEARCH_INTEGRATIONS_STALE_TIME = 15_000
@@ -102,12 +103,7 @@ export function useRemovePersonalSearchCredential() {
           queryKey: organizationAccountsKeys.detail(body.organizationId),
         }),
         client.invalidateQueries({ queryKey: personalSearchIntegrationKeys.lists() }),
-        client.invalidateQueries({
-          queryKey: searchSourceKeys.list({
-            kind: 'organization',
-            organizationId: body.organizationId,
-          }),
-        }),
+        resetOrganizationSearchAccess(client, body.organizationId),
       ]),
   })
 }

apps/sim/lib/credential-groups/member-integrations.ts

@@ -122,7 +122,13 @@ export function memberIntegrationEntries(
         permissionAccountIds: [],
         reconnectAccountIds: ready ? savedAccounts.map((account) => account.credentialId) : [],
         connectionTarget: ready ? { savedProviderId } : undefined,
-        description: ready ? 'Search with your own account' : 'Disabled by your organization',
+        description: !policies
+          ? undefined
+          : approval?.available === false
+            ? 'Currently unavailable'
+            : ready
+              ? 'Search with your own account'
+              : 'Disabled by your organization',
       })
       continue
     }

apps/sim/lib/credentials/application/crud.test.ts

@@ -32,6 +32,7 @@ const hoisted = vi.hoisted(() => ({
   createRecord: vi.fn(),
   personalAccounts: vi.fn(),
   createPersonalToken: vi.fn(),
+  updatePersonalToken: vi.fn(),
 }))
 
 const resolveGroupConfigMock = permissionGroupScopeMockFns.mockResolvePermissionGroupConfig
@@ -54,7 +55,7 @@ vi.mock('@/lib/credentials/application/workspace-personal-accounts', () => ({
 }))
 vi.mock('@/lib/credentials/personal-tokens', () => ({
   createPersonalTokenCredential: hoisted.createPersonalToken,
-  updatePersonalTokenCredential: vi.fn(),
+  updatePersonalTokenCredential: hoisted.updatePersonalToken,
 }))
 vi.mock('@/lib/core/config/block-visibility', () => blockVisibilityMock)
 vi.mock('@/lib/integrations/principal-scope.server', () => ({ allowedIntegrationTypes: vi.fn() }))
@@ -237,6 +238,40 @@ describe('updateWorkspaceCredentialUseCase', () => {
     ).rejects.toMatchObject({ detailCode: 'CREDENTIAL_ADMIN_ACCESS_REQUIRED' })
     expect(mocks.updateRecord).not.toHaveBeenCalled()
   })
+
+  it('rejects provider workspace changes that a personal token cannot persist', async () => {
+    const personalToken = {
+      ...credential,
+      type: 'personal_token' as const,
+      providerId: 'gitlab',
+      workspaceId: null,
+      organizationId: 'organization-1',
+    }
+    mocks.loadWorkspace.mockResolvedValue({
+      ...workspace,
+      workspaceOrganizationId: personalToken.organizationId,
+    })
+    mocks.getWorkspaceCredential.mockResolvedValue(personalToken)
+    mocks.getActor.mockResolvedValue({
+      credential: personalToken,
+      member: { role: 'admin' },
+      hasWorkspaceAccess: true,
+      isAdmin: true,
+    })
+    mocks.updatePersonalToken.mockResolvedValue({ success: true, updatedFields: [] })
+
+    await expect(
+      updateWorkspaceCredentialUseCase.execute({
+        principal: sessionPrincipal,
+        input: {
+          credentialId: personalToken.id,
+          assertedWorkspaceId: WORKSPACE_ID,
+          providerWorkspaceId: 'another-provider-workspace',
+        },
+      })
+    ).rejects.toMatchObject({ code: 'validation' })
+    expect(mocks.updatePersonalToken).not.toHaveBeenCalled()
+  })
 })
 
 describe('personal-credential capability', () => {

apps/sim/lib/credentials/application/crud.ts

@@ -329,7 +329,6 @@ export const updateWorkspaceCredentialUseCase = defineAuthorizedCredentialUseCas
         'description',
         'apiToken',
         'domain',
-        'providerWorkspaceId',
       ])
       if (
         Object.entries(fields).some(

apps/sim/lib/credentials/client-credential-accounts/minters/jama.test.ts

@@ -0,0 +1,33 @@
+import {
+  inputValidationMock,
+  inputValidationMockFns,
+} from '@sim/testing/mocks/input-validation.mock'
+import { describe, expect, it, vi } from 'vitest'
+import { mintJamaServiceAccountToken } from '@/lib/credentials/client-credential-accounts/minters/jama'
+
+vi.mock('@/lib/core/security/input-validation.server', () => inputValidationMock)
+
+describe('Jama credential validation', () => {
+  it.each([
+    ['ENOTFOUND', 'site_not_found', 400],
+    ['EAI_AGAIN', 'provider_unavailable', 502],
+    ['ETIMEDOUT', 'provider_unavailable', 502],
+  ])(
+    'classifies %s without treating transient failures as a wrong instance',
+    async (code, expectedCode, status) => {
+      inputValidationMockFns.mockSecureFetchWithValidation.mockRejectedValueOnce(
+        new Error('url hostname could not be resolved', {
+          cause: Object.assign(new Error('DNS lookup failed'), { code }),
+        })
+      )
+
+      await expect(
+        mintJamaServiceAccountToken({
+          orgId: 'https://example.jamacloud.com',
+          clientId: 'client-id',
+          clientSecret: 'client-secret',
+        })
+      ).rejects.toMatchObject({ code: expectedCode, status })
+    }
+  )
+})