feat(search): enforce organization integration approvals

Persist admin approval independently of integration setup, wire the existing settings controls, and allow members to connect approved integrations. Enforce approval through shared search access checks and preserve indexed data for reapproval.

Fix organization scope handling in member sync and connector sync analytics. Include migration and coverage for approval authorization, member setup, and PostgreSQL access predicates.

Author: icecrasher321

apps/sim/app/api/knowledge/sim-search/integrations/route.ts

@@ -0,0 +1,40 @@
+import {
+  listSearchIntegrationsContract,
+  updateSearchIntegrationContract,
+} from '@/lib/api/contracts/knowledge/search-integrations'
+import {
+  defineInternalJsonRoute,
+  internalRateLimits,
+  internalSessionAuth,
+} from '@/lib/api/server/routes'
+import { internalKnowledgeErrorPolicies } from '@/lib/knowledge/api/route-policies'
+import { knowledgeOperations } from '@/lib/knowledge/application/operations'
+import {
+  approveSearchIntegration,
+  listSearchIntegrations,
+} from '@/lib/knowledge/application/search-integrations'
+
+export const GET = defineInternalJsonRoute({
+  contract: listSearchIntegrationsContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.listSearchIntegrations,
+  rateLimit: internalRateLimits.user({ bucketName: 'knowledge.search.integrations.list' }),
+  errorPolicy: internalKnowledgeErrorPolicies.connectors,
+  mapInput: ({ query }) => query,
+  useCase: listSearchIntegrations,
+  present: (data) => ({ success: true as const, data }),
+})
+
+export const PUT = defineInternalJsonRoute({
+  contract: updateSearchIntegrationContract,
+  auth: internalSessionAuth,
+  operation: knowledgeOperations.approveSearchIntegration,
+  rateLimit: internalRateLimits.user({ bucketName: 'knowledge.search.integrations.approve' }),
+  errorPolicy: internalKnowledgeErrorPolicies.connectors,
+  mapInput: ({ body }) => body,
+  useCase: approveSearchIntegration,
+  present: ({ connectorType, approved }) => ({
+    success: true as const,
+    data: { connectorType, approved },
+  }),
+})

apps/sim/app/o/[organizationId]/integrations/integrations.test.tsx

@@ -7,11 +7,22 @@ import type { SearchSourceSummary } from '@/lib/api/contracts/knowledge/connecto
 const mocks = vi.hoisted(() => ({
   context: vi.fn(),
   sources: vi.fn(),
+  integrations: vi.fn(),
   filters: vi.fn(),
   setSource: vi.fn(),
   connect: vi.fn(),
 }))
 
+vi.mock('@/hooks/queries/search-integrations', () => ({
+  useSearchIntegrations: mocks.integrations,
+}))
+vi.mock('@/hooks/use-permission-config', () => ({
+  usePermissionConfig: () => ({
+    integrationAvailability: new Map(),
+    oauthServiceAvailability: new Map([['google-email', true]]),
+    isIntegrationAvailabilityReady: true,
+  }),
+}))
 vi.mock('nuqs', () => ({
   useQueryState: () => [null, mocks.setSource],
   parseAsString: { withOptions: () => ({}) },
@@ -45,6 +56,7 @@ vi.mock('@/hooks/use-member-enrollment', () => ({
   CONNECTABLE_MEMBERSHIPS: new Set(['invited', 'not_enrolled', 'needs_reauth']),
   useMemberEnrollment: () => ({
     connect: mocks.connect,
+    connectSearchSource: mocks.connect,
     isAwaiting: () => false,
     isPending: false,
     error: null,
@@ -97,6 +109,7 @@ describe('organization integrations role and source paths', () => {
       viewer: { isAdmin: false },
       searchAccess: { memberScoped: true, sourceMirrored: true },
     })
+    mocks.integrations.mockReturnValue({ data: [], isPending: false })
     mocks.sources.mockReturnValue({ data: [memberSource, centralSource], isPending: false })
     mocks.filters.mockReturnValue({ tab: null, search: '', setSearch: vi.fn() })
     container = document.createElement('div')
@@ -131,6 +144,31 @@ describe('organization integrations role and source paths', () => {
     expect(mocks.connect).toHaveBeenCalledExactlyOnceWith('search-index', 'member-source')
   })
 
+  it('offers an approved integration before any source is configured', async () => {
+    mocks.sources.mockReturnValue({ data: [], isPending: false })
+    mocks.integrations.mockReturnValue({
+      data: [{ connectorType: 'gmail', approved: true }],
+      isPending: false,
+    })
+    await render()
+    expect(document.body.textContent).toContain('Approved')
+    expect(buttons('Connect account')).toHaveLength(1)
+    await act(async () => buttons('Connect account')[0].click())
+    expect(mocks.connect).toHaveBeenCalledWith(
+      scope,
+      expect.objectContaining({ type: 'gmail' }),
+      undefined
+    )
+  })
+  it('withholds connection when an integration is deactivated', async () => {
+    mocks.sources.mockReturnValue({
+      data: [{ ...memberSource, approved: false }],
+      isPending: false,
+    })
+    await render()
+    expect(buttons('Connect account')).toHaveLength(0)
+    expect(document.body.textContent).toContain('Deactivated by an organization admin')
+  })
   it('shows an organization admin exactly what a member sees, with no setup or management', async () => {
     mocks.context.mockReturnValue({
       organization: { id: scope.organizationId },

apps/sim/app/o/[organizationId]/integrations/integrations.tsx

@@ -1,20 +1,33 @@
 'use client'
 
 import { useMemo } from 'react'
+import { Chip } from '@sim/emcn'
 import type { ResourceScope } from '@/lib/core/resource-scope'
-import { connectorDisplayName } from '@/lib/sim-search/connectors'
+import {
+  connectorDisplayName,
+  getConnectorAccessAvailability,
+  SEARCH_CONNECTORS,
+  SEARCH_SOURCE_TYPES,
+} from '@/lib/sim-search/connectors'
 import { OrganizationPage } from '@/app/o/[organizationId]/components/organization-page'
 import { useOrganizationPageFilters } from '@/app/o/[organizationId]/components/organization-page/use-organization-page-filters'
 import { useOrganizationContext } from '@/app/o/[organizationId]/providers/organization-provider'
+import { SourceSetupModal } from '@/app/workspace/[workspaceId]/home/components/search-sources/source-setup-modal'
+import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
 import { SearchSourceRow } from '@/app/workspace/[workspaceId]/search/components/search-source-row'
 import {
   SettingsEmptyState,
   SettingsQueryErrorState,
 } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
-import { RESOURCE_LIST_STACK } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
+import {
+  RESOURCE_LIST_STACK,
+  SettingsResourceRow,
+} from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
 import { searchSourceKeys, useSearchSources } from '@/hooks/queries/kb/connectors'
+import { useSearchIntegrations } from '@/hooks/queries/search-integrations'
 import { useMemberEnrollment } from '@/hooks/use-member-enrollment'
 import { useDesktopOAuthConnectListener, useOAuthReturnRouter } from '@/hooks/use-oauth-return'
+import { usePermissionConfig } from '@/hooks/use-permission-config'
 
 /** Every source the organization searches, or only the ones the viewer has connected. */
 const TABS = [
@@ -33,6 +46,8 @@ export function OrganizationIntegrations() {
   const { organization, searchAccess } = useOrganizationContext()
   const scope: ResourceScope = { kind: 'organization', organizationId: organization.id }
   const sources = useSearchSources(scope)
+  const integrations = useSearchIntegrations(organization.id)
+  const availability = usePermissionConfig()
   const { tab, search } = useOrganizationPageFilters()
   const membershipQueryKeys = useMemo(
     () => [searchSourceKeys.list({ kind: 'organization', organizationId: organization.id })],
@@ -59,40 +74,96 @@ export function OrganizationIntegrations() {
           .includes(query)
     ) ?? []
 
+  const approvedTypes = new Set(
+    integrations.data
+      ?.filter((integration) => integration.approved)
+      .map((integration) => integration.connectorType)
+  )
+  const configuredTypes = new Set(sources.data?.map((source) => source.connectorType))
+  const unconfigured = mineOnly
+    ? []
+    : SEARCH_SOURCE_TYPES.filter(
+        ([type, meta]) =>
+          approvedTypes.has(type) &&
+          !configuredTypes.has(type) &&
+          meta.name.toLowerCase().includes(query)
+      )
+  const failedQuery = sources.isError ? sources : integrations.isError ? integrations : null
+
   return (
     <OrganizationPage
       title='Integrations'
       description='Connect your tools for Sim Search'
       tabs={TABS}
     >
       <div className={RESOURCE_LIST_STACK}>
-        {sources.isError ? (
+        {failedQuery ? (
           <SettingsQueryErrorState
-            error={sources.error}
+            error={failedQuery.error}
             fallback='Could not load sources'
-            isRetrying={sources.isFetching}
-            onRetry={() => void sources.refetch()}
+            isRetrying={failedQuery.isFetching}
+            onRetry={() => void failedQuery.refetch()}
             variant='inline'
           />
-        ) : visibleSources.length > 0 ? (
-          visibleSources.map((source) => (
-            <SearchSourceRow
-              key={source.connectorId}
-              source={source}
-              scope={scope}
-              canAdmin={false}
-              available={
-                source.accessMode === 'members'
-                  ? searchAccess.memberScoped
-                  : searchAccess.sourceMirrored &&
-                    (!source.connectionRequired || searchAccess.memberScoped)
-              }
-              waiting={enrollment.isAwaiting(source.connectorId)}
-              isPending={enrollment.isPending}
-              onConnect={() => enrollment.connect(source.knowledgeBaseId, source.connectorId)}
-            />
-          ))
-        ) : sources.isPending ? null : (
+        ) : visibleSources.length > 0 || unconfigured.length > 0 ? (
+          <>
+            {unconfigured.map(([type, meta]) => {
+              const connector = SEARCH_CONNECTORS.find((item) => item.type === type)
+              const access = getConnectorAccessAvailability(
+                meta,
+                availability.integrationAvailability,
+                {
+                  memberAccessAvailable: searchAccess.memberScoped,
+                  mirroredAccessAvailable: searchAccess.sourceMirrored,
+                  oauthServiceAvailability: availability.oauthServiceAvailability,
+                  isIntegrationAvailabilityReady: availability.isIntegrationAvailabilityReady,
+                }
+              )
+              const canConnect = connector && access.members
+              return (
+                <SettingsResourceRow
+                  key={type}
+                  iconVariant='custom'
+                  icon={<IntegrationTile blockType={type} icon={meta.icon} />}
+                  title={meta.name}
+                  description={
+                    canConnect
+                      ? 'Approved · Connect your account to search this source'
+                      : 'Approved · An admin needs to finish source setup'
+                  }
+                  trailing={
+                    canConnect ? (
+                      <Chip
+                        variant='primary'
+                        disabled={enrollment.isPending}
+                        onClick={() => enrollment.connectSearchSource(scope, connector, undefined)}
+                      >
+                        Connect account
+                      </Chip>
+                    ) : undefined
+                  }
+                />
+              )
+            })}
+            {visibleSources.map((source) => (
+              <SearchSourceRow
+                key={source.connectorId}
+                source={source}
+                scope={scope}
+                canAdmin={false}
+                available={
+                  source.accessMode === 'members'
+                    ? searchAccess.memberScoped
+                    : searchAccess.sourceMirrored &&
+                      (!source.connectionRequired || searchAccess.memberScoped)
+                }
+                waiting={enrollment.isAwaiting(source.connectorId)}
+                isPending={enrollment.isPending}
+                onConnect={() => enrollment.connect(source.knowledgeBaseId, source.connectorId)}
+              />
+            ))}
+          </>
+        ) : sources.isPending || integrations.isPending ? null : (
           <SettingsEmptyState variant='inline'>
             {query
               ? 'No matching sources.'
@@ -105,6 +176,15 @@ export function OrganizationIntegrations() {
           <p className='text-[var(--text-error)] text-caption'>{enrollment.error}</p>
         )}
       </div>
+      {enrollment.setupConnector && (
+        <SourceSetupModal
+          connector={enrollment.setupConnector}
+          onClose={enrollment.closeSetup}
+          onConnect={(config) =>
+            enrollment.connectSource(scope, enrollment.setupConnector!.type, config)
+          }
+        />
+      )}
     </OrganizationPage>
   )
 }