fix(selectors): gate raw-context and api-key selectors on their integration

Author: waleedlatif1

apps/sim/lib/selectors/application/execute-selector.test.ts

@@ -275,6 +275,64 @@ describe('executeSelector', () => {
     expect(mocks.executeAttachment).not.toHaveBeenCalled()
   })
 
+  /**
+   * The hole this closes: a selector authenticated from raw context fields
+   * (CloudWatch's AWS keys, IMAP's host and password) carries no credential
+   * policy, so the gate used to resolve it to an empty service list and return
+   * without checking — reaching the third party with the caller's keys under an
+   * allowlist that never named it.
+   */
+  it('refuses a raw-context selector whose declared integration is excluded', async () => {
+    mocks.getAttachment.mockReturnValue({
+      destination: 'fixed',
+      integrationBlockTypes: ['cloudwatch'],
+      execute: mocks.executeAttachment,
+    })
+    mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      allowedIntegrations: ['slack_v2'],
+    })
+
+    await expect(execute()).rejects.toBeInstanceOf(IntegrationNotAllowedError)
+    expect(mocks.executeAttachment).not.toHaveBeenCalled()
+  })
+
+  it('executes a raw-context selector whose declared integration is permitted', async () => {
+    mocks.getAttachment.mockReturnValue({
+      destination: 'fixed',
+      integrationBlockTypes: ['cloudwatch'],
+      execute: mocks.executeAttachment,
+    })
+    mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      allowedIntegrations: ['cloudwatch'],
+    })
+
+    await expect(execute()).resolves.toMatchObject({ kind: 'list' })
+    expect(mocks.executeAttachment).toHaveBeenCalledTimes(1)
+  })
+
+  /**
+   * An API-key integration owns no OAuth catalog entry, so its service id maps
+   * to no block type. The declaration is what gives the allowlist something to
+   * judge, and it must win over the catalog.
+   */
+  it('refuses an api-key selector whose declared integration is excluded', async () => {
+    mocks.getAttachment.mockReturnValue({
+      destination: 'fixed',
+      credential: { kind: 'stored', field: 'oauthCredential', serviceIds: ['snowflake'] },
+      integrationBlockTypes: ['snowflake'],
+      execute: mocks.executeAttachment,
+    })
+    mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      allowedIntegrations: ['slack_v2'],
+    })
+
+    await expect(execute()).rejects.toBeInstanceOf(IntegrationNotAllowedError)
+    expect(mocks.executeAttachment).not.toHaveBeenCalled()
+  })
+
   /**
    * A selector with no integration identity is not an integration: an internal
    * selector declares no credential policy at all, so an allowlist that names

apps/sim/lib/selectors/application/execute-selector.ts

@@ -20,7 +20,7 @@ import {
 } from '@/lib/selectors/server/errors'
 import {
   assertSelectorIntegrationAllowed,
-  selectorResourceServiceIds,
+  selectorIntegrationBlockTypes,
 } from '@/lib/selectors/server/integration-access'
 import { createSelectorProtectedValues } from '@/lib/selectors/server/protected-values'
 import { resolveSelectorReferences } from '@/lib/selectors/server/references'
@@ -171,12 +171,15 @@ async function executeAuthorizedSelector(args: {
      *
      * Judged against the selector's own resource — the API it calls — not the
      * set of credentials it accepts, and not the bound credential's provider.
-     * Placed before the provider call so a denied integration is never reached.
+     * A selector the OAuth catalog cannot identify (raw-context credentials, an
+     * API-key integration) declares its block types instead of resolving to
+     * none and passing untested. Placed before the provider call so a denied
+     * integration is never reached.
      */
     await assertSelectorIntegrationAllowed({
       principal: args.principal,
       workspaceId: args.context.workspaceId,
-      serviceIds: attachment.credential ? selectorResourceServiceIds(attachment.credential) : [],
+      blockTypes: selectorIntegrationBlockTypes(attachment),
     })
 
     const credentialAccess = credential?.access

apps/sim/lib/selectors/server/integration-access.test.ts

@@ -0,0 +1,69 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { selectorManifest } from '@/lib/selectors/manifest'
+import { selectorIntegrationBlockTypes } from '@/lib/selectors/server/integration-access'
+import { serverSelectorRegistry } from '@/lib/selectors/server/registry'
+
+describe('selectorIntegrationBlockTypes', () => {
+  /**
+   * The gate passes a selector with no integration identity, so an identity it
+   * cannot derive is a silent hole: `POST /api/selectors/execute` reaches the
+   * third party with the caller's credentials and the group's
+   * `allowedIntegrations` never gets a say. Every selector the manifest calls
+   * `provider-server` must therefore resolve to at least one block type, either
+   * through the OAuth credential catalog or by declaring one.
+   */
+  it('gives every provider selector an integration identity', () => {
+    const ungated = Object.entries(serverSelectorRegistry)
+      .filter(([key]) => selectorManifest[key as keyof typeof selectorManifest])
+      .filter(
+        ([key, attachment]) =>
+          selectorManifest[key as keyof typeof selectorManifest].classification ===
+            'provider-server' && selectorIntegrationBlockTypes(attachment).length === 0
+      )
+      .map(([key]) => key)
+
+    expect(ungated).toEqual([])
+  })
+
+  /**
+   * The other half of the same rule: an internal selector reads Sim's own
+   * workspace data, so it is not an integration and nothing gates it.
+   */
+  it('gives an internal selector no integration identity', () => {
+    const internal = Object.entries(serverSelectorRegistry).filter(
+      ([key]) =>
+        selectorManifest[key as keyof typeof selectorManifest]?.classification === 'internal-server'
+    )
+
+    expect(internal.length).toBeGreaterThan(0)
+    for (const [key, attachment] of internal) {
+      expect([key, selectorIntegrationBlockTypes(attachment)]).toEqual([key, []])
+    }
+  })
+
+  /** A declaration wins over the catalog, which is what an API-key selector needs. */
+  it('prefers a declared block type over the credential catalog', () => {
+    expect(
+      selectorIntegrationBlockTypes({
+        credential: { kind: 'stored', field: 'oauthCredential', serviceIds: ['gmail'] },
+        integrationBlockTypes: ['snowflake'],
+      })
+    ).toEqual(['snowflake'])
+  })
+
+  it('derives the block type from the credential resource when none is declared', () => {
+    expect(
+      selectorIntegrationBlockTypes({
+        credential: {
+          kind: 'stored',
+          field: 'oauthCredential',
+          serviceIds: ['google-drive', 'google-sheets'],
+          resourceServiceId: 'google-drive',
+        },
+      })
+    ).toContain('google_drive')
+  })
+})

apps/sim/lib/selectors/server/integration-access.ts

@@ -6,7 +6,10 @@ import {
   isBlockTypeAccessControlExempt,
   resolveAccessControlBlockType,
 } from '@/lib/permission-groups/block-access'
-import type { SelectorCredentialPolicy } from '@/lib/selectors/server/types'
+import type {
+  SelectorCredentialPolicy,
+  ServerSelectorAttachment,
+} from '@/lib/selectors/server/types'
 import { IntegrationNotAllowedError } from '@/ee/access-control/utils/permission-check'
 
 const logger = createLogger('SelectorIntegrationAccess')
@@ -32,6 +35,34 @@ export function selectorResourceServiceIds(policy: SelectorCredentialPolicy): re
   return policy.resourceServiceId ? [policy.resourceServiceId] : policy.serviceIds
 }
 
+/**
+ * The block types an allowlist decision about this selector is made against.
+ *
+ * Two independent sources, because the OAuth credential catalog cannot identify
+ * every selector that reaches a third-party API. A selector authenticated from
+ * raw context fields (CloudWatch's AWS keys, IMAP's host and password) carries
+ * no credential policy, and an API-key integration (Snowflake, NetSuite,
+ * Harmonic) owns no OAuth catalog entry, so its service id maps to no block
+ * type — both used to yield an empty list and pass the gate untested. They
+ * declare `integrationBlockTypes` instead, and it wins over the catalog when
+ * both are present.
+ *
+ * An empty result means "no integration identity", which is a pass. That is
+ * reserved for the internal selectors — workspace files, knowledge bases,
+ * tables — which read only Sim's own data;
+ * `selectorIntegrationCoverage` in the manifest test keeps every
+ * `provider-server` selector out of it.
+ */
+export function selectorIntegrationBlockTypes(
+  attachment: Pick<ServerSelectorAttachment, 'credential' | 'integrationBlockTypes'>
+): readonly string[] {
+  if (attachment.integrationBlockTypes?.length) return attachment.integrationBlockTypes
+  if (!attachment.credential) return []
+  return selectorResourceServiceIds(attachment.credential).flatMap((serviceId) =>
+    getIntegrationTypesForOAuthServiceId(serviceId)
+  )
+}
+
 /**
  * Refuses a selector execution whose integration the caller's permission group
  * does not permit.
@@ -54,13 +85,12 @@ export function selectorResourceServiceIds(policy: SelectorCredentialPolicy): re
  * bound to `slack_v2` match.
  *
  * A `null` allowlist, a caller no group governs, and a selector with no
- * integration identity all pass through. The last covers two real shapes: an
- * internal selector (workspace files, knowledge bases) declares no credential
- * policy at all, and an API-key integration — Snowflake, NetSuite, Harmonic —
- * owns no OAuth entry in the deployment integration catalog and therefore maps
- * to no block type. Treating an unmapped service as allowed is deliberate and
- * is what the credential catalog already does; see
- * `isOAuthServiceAllowedByIntegrationTypes`.
+ * integration identity all pass through. The last is now reserved for the
+ * internal selectors — workspace files, knowledge bases, tables — which read
+ * only Sim's own data and are not an integration at all. Every selector that
+ * reaches a third party has an identity, either through the OAuth credential
+ * catalog or through the `integrationBlockTypes` a raw-context or API-key
+ * selector declares; see {@link selectorIntegrationBlockTypes}.
  *
  * One service can still map to several block types — the `google-drive` entry
  * authenticates both `google_drive` and `google_slides_v2` — and any of them
@@ -71,18 +101,14 @@ export function selectorResourceServiceIds(policy: SelectorCredentialPolicy): re
 export async function assertSelectorIntegrationAllowed(input: {
   principal: Principal
   workspaceId: string
-  serviceIds: readonly string[]
+  blockTypes: readonly string[]
 }): Promise<void> {
-  if (input.serviceIds.length === 0) return
+  const blockTypes = input.blockTypes
+  if (blockTypes.length === 0) return
 
   const allowlist = await allowedIntegrationTypes(input.principal, input.workspaceId)
   if (allowlist === null) return
 
-  const blockTypes = input.serviceIds.flatMap((serviceId) =>
-    getIntegrationTypesForOAuthServiceId(serviceId)
-  )
-  if (blockTypes.length === 0) return
-
   const allowed = blockTypes.some(
     (blockType) =>
       isBlockTypeAccessControlExempt(blockType) ||

apps/sim/lib/selectors/server/providers/cloudwatch.ts

@@ -53,8 +53,16 @@ async function executeCloudWatchListing<T>(
   }
 }
 
+/**
+ * The integration this selector reaches. Declared rather than derived: the selector authenticates from raw AWS keys in the request context and
+ * carries no stored connection, so the OAuth credential catalog can identify
+ * nothing to gate it on.
+ */
+const integrationBlockTypes = ['cloudwatch'] as const
+
 export const cloudWatchSelectorAttachments = {
   'cloudwatch.logGroups': {
+    integrationBlockTypes,
     destination: 'fixed',
     async execute(args) {
       const listingCredentials = credentials(args.context)
@@ -94,6 +102,7 @@ export const cloudWatchSelectorAttachments = {
     },
   },
   'cloudwatch.logStreams': {
+    integrationBlockTypes,
     destination: 'fixed',
     async execute(args) {
       const listingCredentials = credentials(args.context)

apps/sim/lib/selectors/server/providers/harmonic.ts

@@ -175,9 +175,16 @@ async function executeSavedSearches(args: ExecuteServerSelectorArgs) {
   )
 }
 
+/**
+ * The integration this selector reaches. Declared rather than derived: Harmonic is an API-key integration with no entry in the deployment OAuth
+ * catalog, so its service id maps to no block type.
+ */
+const integrationBlockTypes = ['harmonic'] as const
+
 export const harmonicSelectorAttachments = {
   'harmonic.savedSearches': {
     credential: { kind: 'stored', field: 'oauthCredential', serviceIds: ['harmonic'] },
+    integrationBlockTypes,
     destination: 'fixed',
     execute: executeSavedSearches,
   },

apps/sim/lib/selectors/server/providers/imap.ts

@@ -19,8 +19,16 @@ function throwPublicImapError(error: unknown): never {
   throw new SelectorConnectionUnavailableError()
 }
 
+/**
+ * The integration this selector reaches. Declared rather than derived: the selector opens an IMAP connection from raw host and password fields in
+ * the request context and carries no stored connection, so the OAuth
+ * credential catalog can identify nothing to gate it on.
+ */
+const integrationBlockTypes = ['imap'] as const
+
 export const imapSelectorAttachments = {
   'imap.mailboxes': definePreparedSelectorAttachment({
+    integrationBlockTypes,
     destination: {
       kind: 'user-controlled',
       async prepare(args) {

apps/sim/lib/selectors/server/providers/managed-agent.ts

@@ -97,27 +97,39 @@ const credential = {
   serviceIds: ['claude-platform'],
 } as const
 
+/**
+ * The integration this selector reaches. Declared rather than derived: The managed-agent platform is an
+ * API-key integration with no entry in the deployment OAuth catalog, so its
+ * service id maps to no block type and the allowlist would have nothing to
+ * judge it on.
+ */
+const integrationBlockTypes = ['managed_agent'] as const
+
 export const managedAgentSelectorAttachments = {
   'managedAgent.agents': {
     credential,
+    integrationBlockTypes,
     destination: 'fixed',
     auditCredentialUse: true,
     execute: (args) => executeResource(args, 'agents'),
   },
   'managedAgent.environments': {
     credential,
+    integrationBlockTypes,
     destination: 'fixed',
     auditCredentialUse: true,
     execute: (args) => executeResource(args, 'environments'),
   },
   'managedAgent.vaults': {
     credential,
+    integrationBlockTypes,
     destination: 'fixed',
     auditCredentialUse: true,
     execute: (args) => executeResource(args, 'vaults'),
   },
   'managedAgent.memoryStores': {
     credential,
+    integrationBlockTypes,
     destination: 'fixed',
     auditCredentialUse: true,
     execute: (args) => executeResource(args, 'memory-stores'),

apps/sim/lib/selectors/server/providers/netsuite.ts

@@ -238,14 +238,24 @@ const credential = {
   serviceIds: ['netsuite'],
 } as const
 
+/**
+ * The integration this selector reaches. Declared rather than derived: NetSuite is an
+ * API-key integration with no entry in the deployment OAuth catalog, so its
+ * service id maps to no block type and the allowlist would have nothing to
+ * judge it on.
+ */
+const integrationBlockTypes = ['netsuite'] as const
+
 export const netsuiteSelectorAttachments = {
   'netsuite.recordTypes': definePreparedSelectorAttachment({
     credential,
+    integrationBlockTypes,
     destination: { kind: 'credential-bound', prepare: prepareNetSuiteDestination },
     execute: executeNetSuite,
   }),
   'netsuite.asyncTasks': definePreparedSelectorAttachment({
     credential,
+    integrationBlockTypes,
     destination: { kind: 'credential-bound', prepare: prepareNetSuiteDestination },
     execute: executeNetSuite,
   }),