fix(access-control): close two denied-tool leaks in copilot discovery

The VFS stamped every integration schema from the shared static map before the
per-viewer loop re-authored the permitted subset, so a denied operation's schema
stayed published. Skip the shared copy for integration paths; the viewer loop is
the only projection that knows the denylist.

Block metadata resolved denied operations from the catalog's `operation.toolId`,
which the projection fills only from `tools.config.tool` — a block whose
operation ids are its tool ids left it undefined and read as fully permitted.
Resolve through the shared operation gate instead.

Author: waleedlatif1

apps/sim/lib/copilot/integration-tools-invariants.test.ts

@@ -0,0 +1,29 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { getExposedIntegrationTools } from '@/lib/copilot/integration-tools'
+import { BLOCK_REGISTRY } from '@/blocks/registry-maps'
+
+/**
+ * Sweeps the real registry for the invariant the permission gate depends on.
+ *
+ * A permission group's `deniedTools` holds the ids an admin sees in the access
+ * control grid, which are exactly the owning block's `tools.access` entries.
+ * The gate compares ids verbatim, so if an exposed tool were ever published
+ * under an id its block does not declare — a `_v2` superseding a still-declared
+ * v1, say — denying the declared id would leave the exposed one advertised and
+ * callable. Pin it here so that authoring mistake fails at CI rather than
+ * silently widening what a governed workspace can reach.
+ */
+describe('exposed integration tool invariants', () => {
+  it('publishes every tool under an id its owning block declares', () => {
+    const drift = getExposedIntegrationTools()
+      .filter(
+        (tool) => !(BLOCK_REGISTRY[tool.blockType]?.tools?.access ?? []).includes(tool.toolId)
+      )
+      .map((tool) => `${tool.blockType} publishes ${tool.toolId}, which it does not declare`)
+
+    expect(drift).toEqual([])
+  })
+})

apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.test.ts

@@ -153,6 +153,50 @@ describe('get blocks metadata', () => {
     expect(Object.keys(slack.operations).sort()).toEqual(['canvas', 'send'])
   })
 
+  /**
+   * A block whose operation ids ARE its tool ids, declaring no
+   * `tools.config.tool`. The catalog projection cannot fill `operation.toolId`
+   * for it, so gating on that field alone would publish every denied operation.
+   */
+  const selectorlessBlock = {
+    type: 'sqs',
+    name: 'SQS',
+    description: 'Queue.',
+    category: 'tools',
+    bgColor: '#000000',
+    icon: () => null,
+    subBlocks: [
+      {
+        id: 'operation',
+        title: 'Operation',
+        type: 'dropdown',
+        options: [
+          { label: 'Send', id: 'sqs_send' },
+          { label: 'Receive', id: 'sqs_receive' },
+        ],
+      },
+    ],
+    tools: { access: ['sqs_send', 'sqs_receive'] },
+    inputs: {},
+    outputs: {},
+  } as unknown as BlockConfig
+
+  it('withholds a denied operation on a block that declares no tool selector', async () => {
+    mockGetUserPermissionConfig.mockResolvedValue({
+      allowedIntegrations: ['sqs'],
+      deniedTools: ['sqs_receive'],
+    })
+    vi.mocked(getBlock).mockReturnValue(selectorlessBlock)
+
+    const result = await getBlocksMetadataServerTool.execute(
+      { blockIds: ['sqs'] },
+      { userId: 'user-1', workspaceId: 'workspace-1' }
+    )
+
+    const sqs = result.metadata.sqs as { operations: Record<string, unknown> }
+    expect(Object.keys(sqs.operations)).toEqual(['sqs_send'])
+  })
+
   it('withholds a block whose every operation the group denies', async () => {
     mockGetUserPermissionConfig.mockResolvedValue({
       allowedIntegrations: ['slack'],

apps/sim/lib/copilot/tools/server/blocks/get-blocks-metadata-tool.ts

@@ -20,9 +20,11 @@ import { getServiceAccountProviderForProviderId } from '@/lib/oauth/utils'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
 import { intersectIntegrationAllowlists } from '@/lib/permission-groups/integration-allowlist'
 import {
+  collectDeniedOperationIds,
   createToolAccessGate,
   type IsToolAllowed,
   OPERATION_SUBBLOCK_ID,
+  type OperationGateBlock,
 } from '@/lib/permission-groups/operation-access'
 import { getBlock } from '@/blocks/registry'
 import { AuthMode, type BlockConfig, type SubBlockConfig } from '@/blocks/types'
@@ -134,13 +136,15 @@ function toCopilotBlockMetadata(detail: CatalogBlockDetail): CopilotBlockMetadat
  */
 function withDeniedToolsRemoved(
   metadata: CopilotBlockMetadata,
+  block: OperationGateBlock,
   isToolAllowed: IsToolAllowed
 ): CopilotBlockMetadata | null {
   const operations = metadata.operations ?? {}
-  const deniedOperations = new Set<string>()
-  for (const [operationId, operation] of Object.entries(operations)) {
-    if (operation.toolId && !isToolAllowed(operation.toolId)) deniedOperations.add(operationId)
-  }
+  /* Resolved through the shared operation gate rather than `operation.toolId`:
+     the catalog projection fills that field only from `tools.config.tool`, so a
+     block whose operation ids ARE its tool ids leaves it undefined and every one
+     of its operations would read as permitted. */
+  const deniedOperations = collectDeniedOperationIds(block, Object.keys(operations), isToolAllowed)
   const tools = metadata.tools.filter((tool) => isToolAllowed(tool.id))
   if (deniedOperations.size === 0 && tools.length === metadata.tools.length) return metadata
 
@@ -278,7 +282,7 @@ export const getBlocksMetadataServerTool: BaseServerTool<
           continue
         }
 
-        const permitted = withDeniedToolsRemoved(metadata, isToolAllowed)
+        const permitted = withDeniedToolsRemoved(metadata, blockConfig, isToolAllowed)
         if (!permitted) {
           logger.debug('Block has no operation this permission group allows', { blockId })
           continue

apps/sim/lib/copilot/vfs/workspace-vfs.ts

@@ -455,6 +455,7 @@ function getStaticToolConfigs(): ReadonlyMap<string, ToolConfig> {
 }
 
 const BLOCK_SCHEMA_PATH_PREFIX = 'components/blocks/'
+const INTEGRATION_SCHEMA_PATH_PREFIX = 'components/integrations/'
 
 /** The per-viewer projections applied to a shared static component file. */
 interface StaticFileProjection {
@@ -1049,6 +1050,13 @@ export class WorkspaceVFS {
               isToolAllowed,
             }
             for (const [path, content] of getStaticComponentFiles()) {
+              /* Integration schemas are authored per viewer from
+                 `viewerIntegrationTools` immediately below, which is the only
+                 projection that knows the group's per-tool denylist. Stamping
+                 the shared copy first would publish a denied operation's schema
+                 that the loop below never overwrites, because it only writes the
+                 operations the viewer may use. */
+              if (path.startsWith(INTEGRATION_SCHEMA_PATH_PREFIX)) continue
               if (isStaticFileHidden(path, blockVisibility, staticFileGate)) continue
               this.files.set(path, projectStaticComponentFile(path, content, staticFileProjection))
             }