fix(permission-groups): read the successor map by its own keys only

Author: waleedlatif1

apps/sim/lib/permission-groups/integration-allowlist.test.ts

@@ -40,6 +40,18 @@ describe('resolveAccessControlBlockType', () => {
   it('accepts the dashed spelling the registry also normalizes', () => {
     expect(resolveAccessControlBlockType('google-sheets')).toBe('google_sheets_v2')
   })
+
+  /**
+   * `allowedIntegrations` is admin-supplied jsonb and `ALLOWED_INTEGRATIONS` is
+   * hand-written, so an arbitrary string reaches the successor map. An
+   * inherited key must stay an ordinary unresolved id rather than answering
+   * with `Object.prototype`'s function.
+   */
+  it('leaves an object-prototype key alone', () => {
+    expect(resolveAccessControlBlockType('constructor')).toBe('constructor')
+    expect(resolveAccessControlBlockType('toString')).toBe('toString')
+    expect(resolveAccessControlBlockType('__proto__')).toBe('__proto__')
+  })
 })
 
 describe('toAccessControlAllowlist', () => {
@@ -61,6 +73,18 @@ describe('toAccessControlAllowlist', () => {
   it('denies everything for an empty allowlist', () => {
     expect(toAccessControlAllowlist([])?.size).toBe(0)
   })
+
+  /**
+   * A prototype key used to resolve to an inherited function and throw on
+   * `.toLowerCase()`, turning one configured string into a 500 on every
+   * enforcement path that read the group.
+   */
+  it('indexes an object-prototype entry as an ordinary block type', () => {
+    const allowlist = toAccessControlAllowlist(['constructor', 'slack'])
+
+    expect(allowlist?.has('constructor')).toBe(true)
+    expect(allowlist?.has('slack_v2')).toBe(true)
+  })
 })
 
 describe('intersectAccessControlAllowlists', () => {

apps/sim/lib/permission-groups/integration-allowlist.ts

@@ -17,11 +17,25 @@ import { BLOCK_ACCESS_SUCCESSORS } from '@/lib/permission-groups/block-successor
  * `check:block-successors` fails the build when the projection drifts.
  */
 export function resolveAccessControlBlockType(blockType: string): string {
-  return (
-    BLOCK_ACCESS_SUCCESSORS[blockType] ??
-    BLOCK_ACCESS_SUCCESSORS[blockType.replace(/-/g, '_')] ??
-    blockType
-  )
+  return ownSuccessor(blockType) ?? ownSuccessor(blockType.replace(/-/g, '_')) ?? blockType
+}
+
+/**
+ * Reads the successor map by its own keys only.
+ *
+ * The generated map is an object literal with an intact prototype, so a bare
+ * bracket lookup answers `constructor`, `toString`, `valueOf` and friends with
+ * an inherited function. The ids reaching here come from admin-supplied jsonb
+ * (`allowedIntegrations`) and from `ALLOWED_INTEGRATIONS`, so a group naming
+ * `constructor` made {@link toAccessControlAllowlist} call `.toLowerCase()` on
+ * a function and throw — an unclassified 500 on every enforcement path that
+ * read that group. `getBlock` guards the registry the same way for the same
+ * reason.
+ */
+function ownSuccessor(blockType: string): string | undefined {
+  return Object.hasOwn(BLOCK_ACCESS_SUCCESSORS, blockType)
+    ? BLOCK_ACCESS_SUCCESSORS[blockType]
+    : undefined
 }
 
 /**