fix(access-control): key the copilot schema cache on permission policy

The deferred integration-tool schemas now depend on the viewer's permission
group, but the cache key encoded only identity and block visibility, so an
admin's change to deniedTools took effect only when the entry expired.

Resolve the config before the key and add a gate signature alongside the
existing visibility signature, mirroring how block visibility already keys the
same cache. The read moves out of the cached section rather than being added:
what the entry caches is a user-tool schema per exposed integration tool, which
dominates it.

Author: waleedlatif1

apps/sim/lib/copilot/chat/payload.test.ts

@@ -299,6 +299,34 @@ describe('buildIntegrationToolSchemas', () => {
     expect(second[0].input_schema).not.toHaveProperty('mutated')
     expect(second[0].outputs).not.toHaveProperty('mutated')
   })
+
+  it('rebuilds instead of serving a cache entry from the previous policy', async () => {
+    mockGetHighestPrioritySubscription.mockResolvedValue({ plan: 'pro', status: 'active' })
+    mockGetUserPermissionConfig.mockResolvedValue({ allowedIntegrations: null, deniedTools: [] })
+
+    const before = await buildIntegrationToolSchemas(
+      'user-policy',
+      undefined,
+      { schemaSurface: 'copilot' },
+      'workspace-policy'
+    )
+    expect(before.map((tool) => tool.name)).toContain('gmail_send')
+
+    // An admin denies the tool. The viewer and surface are unchanged, so only
+    // the policy component of the key can force a rebuild.
+    mockGetUserPermissionConfig.mockResolvedValue({
+      allowedIntegrations: null,
+      deniedTools: ['gmail_send'],
+    })
+
+    const after = await buildIntegrationToolSchemas(
+      'user-policy',
+      undefined,
+      { schemaSurface: 'copilot' },
+      'workspace-policy'
+    )
+    expect(after.map((tool) => tool.name)).not.toContain('gmail_send')
+  })
 })
 
 describe('buildCopilotRequestPayload', () => {

apps/sim/lib/copilot/chat/payload.ts

@@ -9,6 +9,7 @@ import { getBlockVisibilityForCopilot, visibilitySignature } from '@/lib/copilot
 import type { VfsSnapshotV1 } from '@/lib/copilot/generated/vfs-snapshot-v1'
 import {
   type IntegrationGateConfig,
+  integrationGateSignature,
   projectIntegrationToolsForViewer,
 } from '@/lib/copilot/integration-tool-projection'
 import { buildTaggedMcpToolSchemas } from '@/lib/copilot/mcp-tools'
@@ -110,11 +111,14 @@ function getIntegrationToolSchemaCacheKey(
   userId: string,
   workspaceId: string | undefined,
   schemaSurface: string,
-  visSignature: string
+  visSignature: string,
+  gateSignature: string
 ): string {
   // The visibility signature keys the entry to the viewer's gated projection —
   // two users in one workspace with different preview reveals must not share.
-  return JSON.stringify([userId, workspaceId ?? null, schemaSurface, visSignature])
+  // The gate signature does the same for permission-group policy, so an admin's
+  // change takes effect on the next build rather than when the entry expires.
+  return JSON.stringify([userId, workspaceId ?? null, schemaSurface, visSignature, gateSignature])
 }
 
 function cloneToolSchemas(toolSchemas: ToolSchema[]): ToolSchema[] {
@@ -151,11 +155,20 @@ export async function buildIntegrationToolSchemas(
 ): Promise<ToolSchema[]> {
   const schemaSurface = options.schemaSurface ?? 'copilot'
   const vis = await getBlockVisibilityForCopilot(userId, workspaceId)
+  // Resolved before the key, not inside the cached build, so the entry is keyed
+  // to the policy it was produced under. The read this adds is cheap next to
+  // what the entry caches: a user-tool schema per exposed integration tool.
+  let permissionConfig: IntegrationGateConfig | null = null
+  if (workspaceId) {
+    const { getUserPermissionConfig } = await import('@/ee/access-control/utils/permission-check')
+    permissionConfig = await getUserPermissionConfig(userId, workspaceId)
+  }
   const cacheKey = getIntegrationToolSchemaCacheKey(
     userId,
     workspaceId,
     schemaSurface,
-    visibilitySignature(vis)
+    visibilitySignature(vis),
+    integrationGateSignature(permissionConfig)
   )
   const cached = integrationToolSchemaCache.get(cacheKey)
   if (cached) {
@@ -167,7 +180,8 @@ export async function buildIntegrationToolSchemas(
     messageId,
     { schemaSurface },
     workspaceId,
-    vis
+    vis,
+    permissionConfig
   ).catch((error) => {
     integrationToolSchemaCache.delete(cacheKey)
     throw error
@@ -185,15 +199,11 @@ async function buildIntegrationToolSchemasUncached(
   messageId: string | undefined,
   options: Required<BuildIntegrationToolSchemasOptions>,
   workspaceId?: string,
-  vis: BlockVisibilityState | null = null
+  vis: BlockVisibilityState | null = null,
+  permissionConfig: IntegrationGateConfig | null = null
 ): Promise<ToolSchema[]> {
   const reqLogger = logger.withMetadata({ messageId })
   const integrationTools: ToolSchema[] = []
-  let permissionConfig: IntegrationGateConfig | null = null
-  if (workspaceId) {
-    const { getUserPermissionConfig } = await import('@/ee/access-control/utils/permission-check')
-    permissionConfig = await getUserPermissionConfig(userId, workspaceId)
-  }
 
   try {
     const { createUserToolSchema } = await import('@/tools/params')

apps/sim/lib/copilot/integration-tool-projection.ts

@@ -74,6 +74,22 @@ export function projectIntegrationToolsForViewer(
   return { tools, allowedBlockTypes, isToolAllowed }
 }
 
+/**
+ * Stable signature of the policy {@link projectIntegrationToolsForViewer} reads,
+ * for keying caches whose contents depend on the projection.
+ *
+ * The projection is only as fresh as what keys it: an entry cached under a
+ * viewer's identity alone outlives the policy that produced it, so an admin's
+ * change would not take effect until the entry expired. Mirrors
+ * `visibilitySignature`, which does the same job for block visibility.
+ */
+export function integrationGateSignature(config: IntegrationGateConfig | null | undefined): string {
+  return JSON.stringify([
+    config?.allowedIntegrations ? [...config.allowedIntegrations].sort() : null,
+    config?.deniedTools?.length ? [...config.deniedTools].sort() : null,
+  ])
+}
+
 /** What a viewer's `deniedTools` denylist costs the block schemas they are shown. */
 export interface DeniedBlockOperations {
   /**