fix(ee): case-fold the stored integration allowlist

ee/access-control re-implemented the allowlist intersection instead of calling
intersectIntegrationAllowlists, and lost the case-folding: normalization only
happened on the envAllowlist !== null branch, so with ALLOWED_INTEGRATIONS
unset a stored config went through untouched. Callers compare against
blockType.toLowerCase(), so a stored 'Slack' failed to match 'slack' and the
block was denied.

The access-control UI writes block.type directly and block types are lowercase,
so this is not reachable from the UI — but allowedIntegrations is a bare
z.array(z.string()) on the wire, so any API client can store mixed case.

Replaces the fork with the shared helper. Adds two tests; the first fails
against the old code.

Author: waleedlatif1

apps/sim/ee/access-control/utils/permission-check.test.ts

@@ -446,6 +446,20 @@ describe('validateBlockType', () => {
     it('always allows start_trigger', async () => {
       await validateBlockType(undefined, undefined, 'start_trigger')
     })
+
+    it('case-folds a stored allowlist so a mixed-case entry still matches', async () => {
+      queueGroupResolution([{ config: { allowedIntegrations: ['Slack'] } }])
+
+      await validateBlockType('user-123', 'workspace-1', 'slack')
+    })
+
+    it('still rejects a block absent from a mixed-case stored allowlist', async () => {
+      queueGroupResolution([{ config: { allowedIntegrations: ['Slack'] } }])
+
+      await expect(validateBlockType('user-123', 'workspace-1', 'discord')).rejects.toThrow(
+        IntegrationNotAllowedError
+      )
+    })
   })
 
   describe('when env allowlist is configured', () => {

apps/sim/ee/access-control/utils/permission-check.ts

@@ -12,6 +12,7 @@ import {
   isPublicApiDisabled,
 } from '@/lib/core/config/env-flags'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
+import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import {
   DEFAULT_PERMISSION_GROUP_CONFIG,
   type PermissionGroupConfig,
@@ -108,29 +109,22 @@ export class ChatDeployAuthNotAllowedError extends Error {
 
 /**
  * Merges the env allowlist into a permission config.
- * If `config` is null and no env allowlist is set, returns null.
- * If `config` is null but env allowlist is set, returns a default config with only allowedIntegrations set.
- * If both are set, intersects the two allowlists.
+ *
+ * Returns null only when neither layer restricts anything. Otherwise the group's
+ * own allowlist is intersected with the env one by
+ * {@link intersectIntegrationAllowlists}, which case-folds both sides — callers
+ * compare against a lowercased block type, and a stored config reaches here
+ * straight off the wire, where the contract permits any casing.
  */
 function mergeEnvAllowlist(config: PermissionGroupConfig | null): PermissionGroupConfig | null {
   const envAllowlist = getAllowedIntegrationsFromEnv()
+  if (config === null && envAllowlist === null) return null
 
-  if (envAllowlist === null) {
-    return config
-  }
-
-  if (config === null) {
-    return { ...DEFAULT_PERMISSION_GROUP_CONFIG, allowedIntegrations: envAllowlist }
+  const base = config ?? DEFAULT_PERMISSION_GROUP_CONFIG
+  return {
+    ...base,
+    allowedIntegrations: intersectIntegrationAllowlists(base.allowedIntegrations, envAllowlist),
   }
-
-  const merged =
-    config.allowedIntegrations === null
-      ? envAllowlist
-      : config.allowedIntegrations
-          .map((i) => i.toLowerCase())
-          .filter((i) => envAllowlist.includes(i))
-
-  return { ...config, allowedIntegrations: merged }
 }
 
 /**