fix(access-control): only gate a model field the provider allowlist is about

The seed gate ran `isModelUsable` on every subblock named `model`, but
`getProviderFromModel` resolves chat models and falls back to `ollama` for
everything else. 28 of the 44 seeded model defaults in the registry are
embedding, speech, image, video or search ids — so for any group with a
provider allowlist that omits Ollama, those blocks were created with an empty
model.

Adds `findProviderFromModel`, the non-guessing half of `getProviderFromModel`,
which returns `null` where the registry declares nothing. `isModelUsable` now
treats an unresolved id as not-a-provider-choice and leaves it alone, matching
the rule the operation gate already follows: never guess, and let the server
stay authoritative. `getProviderFromModel` delegates to it, so there is one
resolution path and its ollama fallback is unchanged.

This also repairs the same misjudgement where it predates the branch: the model
combobox filtered its options through the identical provider check, so those 28
defaults were already being hidden from their own pickers for allowlisted
groups.

The dead `try/catch` around the old call went with it — `getProviderFromModel`
returns a fallback rather than throwing for an unknown id.

Author: waleedlatif1

apps/sim/hooks/use-permission-config.ts

@@ -24,7 +24,7 @@ import { useOptionalWorkspaceHostContext } from '@/app/workspace/[workspaceId]/p
 import { useCustomBlockOverlayVersion } from '@/blocks/custom/client-overlay'
 import { overlayVisibility } from '@/blocks/visibility/context'
 import { useUserPermissionConfig } from '@/ee/access-control/hooks/permission-groups'
-import { getProviderFromModel } from '@/providers/utils'
+import { findProviderFromModel } from '@/providers/utils'
 
 export interface PermissionConfigResult {
   config: PermissionGroupConfig
@@ -138,13 +138,13 @@ export function usePermissionConfig(): PermissionConfigResult {
   const isModelUsable = useMemo(() => {
     return (model: string) => {
       if (!isModelAllowed(model)) return false
-      try {
-        return isProviderAllowed(getProviderFromModel(model))
-      } catch {
-        /* A model whose provider cannot be derived is left to the server gate
-           rather than hidden on a parse failure. */
-        return true
-      }
+      const providerId = findProviderFromModel(model)
+      /* Only chat models resolve to a provider. A `model` field holding an
+         embedding, speech, image or video id is not a provider choice, so the
+         provider allowlist has nothing to say about it — judging it anyway
+         would read every such id as Ollama and reject it. */
+      if (!providerId) return true
+      return isProviderAllowed(providerId)
     }
   }, [isModelAllowed, isProviderAllowed])
 

apps/sim/providers/utils.test.ts

@@ -16,6 +16,7 @@ import {
   describeModelLevel,
   extractAndParseJSON,
   filterBlacklistedModels,
+  findProviderFromModel,
   formatCost,
   generateStructuredOutputInstructions,
   getAllModelProviders,
@@ -2045,3 +2046,27 @@ describe('describeModelLevel', () => {
     expect(describeModelLevel('')).toBe('(unset)')
   })
 })
+
+describe('findProviderFromModel', () => {
+  it('resolves a chat model to its declaring provider', () => {
+    expect(findProviderFromModel('claude-sonnet-5')).toBe('anthropic')
+    expect(findProviderFromModel('gpt-5.2')).toBe('openai')
+  })
+
+  it('is case-insensitive, like getProviderFromModel', () => {
+    expect(findProviderFromModel('Claude-Sonnet-5')).toBe('anthropic')
+  })
+
+  it('returns null for ids the registry does not declare, instead of guessing ollama', () => {
+    /* The registry holds chat models only. Speech, image, video and embedding
+       ids reach `model` subblocks too, and a permission gate must not read them
+       as Ollama models — see isModelUsable. */
+    for (const id of ['whisper-1', 'dall-e-3', 'veo-3.1', 'embed-v4.0', 'tts-1']) {
+      expect(findProviderFromModel(id)).toBeNull()
+    }
+  })
+
+  it('still lets getProviderFromModel fall back to ollama for those ids', () => {
+    expect(getProviderFromModel('whisper-1')).toBe('ollama')
+  })
+})

apps/sim/providers/utils.ts

@@ -286,27 +286,35 @@ export function getAllModelProviders(): Record<string, ProviderId> {
   )
 }
 
-export function getProviderFromModel(model: string): ProviderId {
+/**
+ * The provider that declares `model`, or `null` when none does.
+ *
+ * The non-guessing half of {@link getProviderFromModel}. A caller that *gates*
+ * on the answer needs "unknown" to stay distinct from "ollama": this registry
+ * holds chat models only, so every embedding, speech, image and video model id
+ * would otherwise read as an Ollama model and be judged against an allowlist
+ * that was never about it.
+ */
+export function findProviderFromModel(model: string): ProviderId | null {
   const normalizedModel = model.toLowerCase()
 
-  let providerId: ProviderId | null = null
+  const declared = getAllModelProviders()[normalizedModel]
+  if (declared) return declared
 
-  if (normalizedModel in getAllModelProviders()) {
-    providerId = getAllModelProviders()[normalizedModel]
-  } else {
-    for (const [id, config] of Object.entries(providers)) {
-      if (config.modelPatterns) {
-        for (const pattern of config.modelPatterns) {
-          if (pattern.test(normalizedModel)) {
-            providerId = id as ProviderId
-            break
-          }
-        }
-      }
-      if (providerId) break
+  for (const [id, config] of Object.entries(providers)) {
+    for (const pattern of config.modelPatterns ?? []) {
+      if (pattern.test(normalizedModel)) return id as ProviderId
     }
   }
 
+  return null
+}
+
+export function getProviderFromModel(model: string): ProviderId {
+  const normalizedModel = model.toLowerCase()
+
+  let providerId = findProviderFromModel(model)
+
   if (!providerId) {
     logger.warn(`No provider found for model: ${model}, defaulting to ollama`)
     providerId = 'ollama'