fix(permission-groups): gate selector execution on allowedIntegrations, apply the personal-key policy on v2 chat

Three cubic findings on the enforcement PR.

`POST /api/selectors/execute` reaches a provider's API with the caller's
credential, so it is a use of the integration and not a neutral picker. The
authorization funnel cannot apply `allowedIntegrations` because it never sees
which integration a selector key stands for, so the decision is asserted from
the use case, after credential binding and ahead of the provider call. The
integration identity comes from the selector attachment's declared OAuth
services, narrowed by the resolved credential's provider id so a two-service
selector is judged as the half the caller actually reaches.

`/api/v2/chat` only ever runs for a personal API key, and `admitV2Request`
authenticates without authorizing, so neither half of the funnel's personal-key
policy applied there. Both now run after the workspace access check, the group
half through the shared `requirePersonalApiKeysAllowed`.

The raw copilot chat route's `copilot.use` refusal now renders through
`capabilityRefusalResponse`, so it carries the same detail code as every other
capability refusal.

Author: waleedlatif1

apps/sim/app/api/selectors/execute/route.test.ts

@@ -77,6 +77,7 @@ import {
   SelectorOptionsUnavailableError,
 } from '@/lib/selectors/server/errors'
 import { POST } from '@/app/api/selectors/execute/route'
+import { IntegrationNotAllowedError } from '@/ee/access-control/utils/permission-check'
 
 function project(error: unknown) {
   const result = mocks.errorPolicy?.project(error)
@@ -126,6 +127,22 @@ describe('POST /api/selectors/execute', () => {
     })
   })
 
+  /**
+   * The one selector failure that names itself. The other three are normalized
+   * so a caller cannot probe a scope or a credential through them; this one
+   * reports the caller's own permission group against their own workspace and
+   * names the remedy, which "Connection unavailable" would hide.
+   */
+  it('projects an integration-allowlist refusal as its own 403', () => {
+    expect(project(new IntegrationNotAllowedError('gmail_v2'))).toEqual({
+      status: 403,
+      body: {
+        error: 'Integration "gmail_v2" is not allowed based on your permission group settings',
+      },
+      headers: { 'Cache-Control': 'private, no-store' },
+    })
+  })
+
   it('preserves same-workspace forbidden errors', () => {
     expect(
       project(new OrchestrationError('forbidden', 'Insufficient workspace permissions'))

apps/sim/app/api/selectors/execute/route.ts

@@ -17,6 +17,7 @@ import {
   SelectorContextUnavailableError,
   SelectorOptionsUnavailableError,
 } from '@/lib/selectors/server/errors'
+import { IntegrationNotAllowedError } from '@/ee/access-control/utils/permission-check'
 
 const PRIVATE_NO_STORE = { 'Cache-Control': 'private, no-store' } as const
 const SELECTOR_SCOPE_NOT_FOUND = 'Selector scope not found'
@@ -34,6 +35,17 @@ const selectorOperationErrorPolicy = extendInternalErrorPolicy(
         PRIVATE_NO_STORE
       )
     }
+    /**
+     * The integration allowlist refusal, which is deliberately the one selector
+     * failure that names itself. The other three are normalized so a caller
+     * cannot probe a scope or a credential through them; this one reports the
+     * caller's OWN permission group against their own workspace, tells them the
+     * remedy is an admin changing the allowlist rather than a broken connection,
+     * and reveals nothing they could not read off the block toolbar.
+     */
+    if (error instanceof IntegrationNotAllowedError) {
+      return internalErrorResponse(403, { error: error.message }, PRIVATE_NO_STORE)
+    }
     if (error instanceof SelectorOptionsUnavailableError) {
       return internalErrorResponse(
         error.status,

apps/sim/app/api/v2/chat/route.test.ts

@@ -252,7 +252,10 @@ describe('POST /api/v2/chat', () => {
     mockAuthenticateV2ApiKey.mockResolvedValue(personalAuth)
     mockCheckPreAuthRate.mockResolvedValue({ allowed: true, remaining: 10, resetAt: new Date() })
     mockCheckOperationRate.mockResolvedValue({ allowed: true, remaining: 10, resetAt: new Date() })
-    mockAssertActiveWorkspaceAccess.mockResolvedValue({ permission: 'admin' })
+    mockAssertActiveWorkspaceAccess.mockResolvedValue({
+      permission: 'admin',
+      workspace: { organizationId: null, allowPersonalApiKeys: true },
+    })
     mockResolvePermissionGroupConfig.mockResolvedValue(null)
     mockResolveBillingAttribution.mockResolvedValue(billingAttributionSnapshot)
     mockRequestExplicitStreamAbort.mockResolvedValue(undefined)
@@ -331,6 +334,77 @@ describe('POST /api/v2/chat', () => {
     expect(mockRunHeadlessCopilotLifecycle).not.toHaveBeenCalled()
   })
 
+  /**
+   * The route only ever runs for a personal API key, and `admitV2Request` never
+   * authorizes, so both halves of the funnel's personal-key policy have to be
+   * repeated here. The workspace column is the first half.
+   */
+  it('answers 403 when the workspace has switched personal API keys off', async () => {
+    mockAssertActiveWorkspaceAccess.mockResolvedValue({
+      permission: 'admin',
+      workspace: { organizationId: null, allowPersonalApiKeys: false },
+    })
+
+    const response = await callChat({ workspaceId: 'workspace-1', message: 'hi' })
+
+    expect(response.status).toBe(403)
+    await expect(response.json()).resolves.toEqual({
+      error: {
+        code: 'FORBIDDEN',
+        message: 'Personal API keys are not allowed for this workspace',
+        details: { code: 'PERSONAL_API_KEYS_DISABLED' },
+      },
+    })
+    expect(mockResolveOrCreateChat).not.toHaveBeenCalled()
+    expect(mockRunHeadlessCopilotLifecycle).not.toHaveBeenCalled()
+  })
+
+  /**
+   * The group half. The column and the key combine with AND, so a workspace
+   * that allows personal keys still refuses the cohort whose group withholds
+   * them — the case `copilot.use` alone could never see.
+   */
+  it('answers 403 when the permission group withholds personal_api_key.use', async () => {
+    mockAssertActiveWorkspaceAccess.mockResolvedValue({
+      permission: 'admin',
+      workspace: { organizationId: 'org-1', allowPersonalApiKeys: true },
+    })
+    mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      disablePersonalApiKeys: true,
+    })
+
+    const response = await callChat({ workspaceId: 'workspace-1', message: 'hi' })
+
+    expect(response.status).toBe(403)
+    await expect(response.json()).resolves.toEqual({
+      error: {
+        code: 'FORBIDDEN',
+        message: 'Personal API keys are not allowed for this workspace',
+        details: { code: 'PERSONAL_API_KEYS_DISABLED' },
+      },
+    })
+    expect(mockResolveOrCreateChat).not.toHaveBeenCalled()
+    expect(mockRunHeadlessCopilotLifecycle).not.toHaveBeenCalled()
+  })
+
+  /** A workspace with no organization resolves no group, so the key passes. */
+  it('runs one turn for a personal key in a workspace no group governs', async () => {
+    mockAssertActiveWorkspaceAccess.mockResolvedValue({
+      permission: 'admin',
+      workspace: { organizationId: null, allowPersonalApiKeys: true },
+    })
+    mockResolvePermissionGroupConfig.mockResolvedValue({
+      ...DEFAULT_PERMISSION_GROUP_CONFIG,
+      disablePersonalApiKeys: true,
+    })
+
+    const response = await callChat({ workspaceId: 'workspace-1', message: 'hi' })
+
+    expect(response.status).toBe(200)
+    expect(mockRunHeadlessCopilotLifecycle).toHaveBeenCalledTimes(1)
+  })
+
   /** Workspace reach is decided first, so the refusal cannot name a group to an outsider. */
   it('refuses an inaccessible workspace before consulting a permission group', async () => {
     mockAssertActiveWorkspaceAccess.mockRejectedValue(new MockWorkspaceAccessDeniedError('denied'))

apps/sim/app/api/v2/chat/route.ts

@@ -2,7 +2,7 @@ import { createLogger } from '@sim/logger'
 import { getErrorMessage, toError } from '@sim/utils/errors'
 import { generateId } from '@sim/utils/id'
 import { truncate } from '@sim/utils/string'
-import type { NextRequest } from 'next/server'
+import type { NextRequest, NextResponse } from 'next/server'
 import { v2ChatContract } from '@/lib/api/contracts/v2/chat'
 import { parseRequest } from '@/lib/api/server'
 import {
@@ -36,6 +36,12 @@ import { runHeadlessCopilotLifecycle } from '@/lib/copilot/request/lifecycle/hea
 import { requestExplicitStreamAbort } from '@/lib/copilot/request/session/explicit-abort'
 import type { OrchestratorResult, StreamEvent } from '@/lib/copilot/request/types'
 import { normalizeSecretMountPolicy } from '@/lib/copilot/secret-mount-policy'
+import {
+  forbiddenErrorDetails,
+  PersonalApiKeysDisabledError,
+  requirePersonalApiKeysAllowed,
+  type WorkspaceAuthorizationContext,
+} from '@/lib/core/application'
 import { isDocSandboxEnabled } from '@/lib/core/config/env-flags'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { getPersonalAndWorkspaceEnv } from '@/lib/environment/utils'
@@ -79,6 +85,34 @@ function deriveConversationTitle(message: string): string | undefined {
   return truncate(normalized, CHAT_TITLE_MAX_LENGTH)
 }
 
+/**
+ * The two personal-API-key checks `authorizeWorkspaceOperation` applies, for the
+ * one route that never reaches it, or `null` when the key may proceed.
+ *
+ * The group half runs through the same {@link requirePersonalApiKeysAllowed} the
+ * funnel and the billing reads call, so a third wording of the same refusal
+ * cannot drift in. Its error is projected rather than thrown because this route
+ * renders its own v2 envelope, and the detail code is read off the error so the
+ * column refusal and the group refusal answer with one code.
+ */
+async function personalApiKeyPolicyRefusal(
+  userId: string,
+  context: WorkspaceAuthorizationContext
+): Promise<NextResponse | null> {
+  const refuse = (error: PersonalApiKeysDisabledError) =>
+    v2Error('FORBIDDEN', error.message, { details: forbiddenErrorDetails(error) })
+
+  if (!context.allowPersonalApiKeys) return refuse(new PersonalApiKeysDisabledError())
+
+  try {
+    await requirePersonalApiKeysAllowed(userId, context)
+  } catch (error) {
+    if (error instanceof PersonalApiKeysDisabledError) return refuse(error)
+    throw error
+  }
+  return null
+}
+
 function isAbortError(error: unknown): boolean {
   return error instanceof Error && error.name === 'AbortError'
 }
@@ -169,6 +203,31 @@ export const POST = withRouteHandler(
       const workspaceAccess = await assertActiveWorkspaceAccess(workspaceId, userId)
       const userPermission = workspaceAccess.permission
 
+      /**
+       * permission-group-enforced: personal_api_key.use — this route only ever
+       * runs for a personal API key, and `admitV2Request` authenticates one
+       * without authorizing it, so the funnel's personal-key policy has to be
+       * repeated here or the same key `authorizeWorkspaceOperation` refuses
+       * still starts a chat turn.
+       *
+       * Both halves, because they combine with AND: the workspace column is the
+       * coarse switch every workspace has, and the group key narrows it further
+       * for one cohort inside an enterprise organization. Either one saying no
+       * is a no, and checking only `copilot.use` applied neither.
+       *
+       * Both run after workspace access rather than before it, unlike the
+       * funnel, which can afford to check the column first because its caller
+       * has already loaded the workspace. Here the access check is what loads
+       * it, and answering later only ever conceals more: a caller with no reach
+       * into the workspace is refused without learning how it is configured.
+       */
+      const personalKeyRefusal = await personalApiKeyPolicyRefusal(userId, {
+        workspaceId,
+        workspaceOrganizationId: workspaceAccess.workspace?.organizationId ?? null,
+        allowPersonalApiKeys: workspaceAccess.workspace?.allowPersonalApiKeys ?? false,
+      })
+      if (personalKeyRefusal) return personalKeyRefusal
+
       /**
        * permission-group-enforced: copilot.use — read off the operation so this
        * route and the funnel can never name different capabilities.

apps/sim/lib/copilot/chat/post.test.ts

@@ -911,6 +911,15 @@ describe('handleUnifiedChatPost', () => {
 
 describe('handleUnifiedChatPost copilot.use capability gate', () => {
   const REFUSAL = "Chat is not available under your organization's permission group"
+  /**
+   * The body every raw capability refusal renders, detail code included. This
+   * route builds it through the shared `capabilityRefusalResponse`, so a client
+   * cannot tell a group refusal here apart from one raised by the funnel.
+   */
+  const REFUSAL_BODY = {
+    error: REFUSAL,
+    details: { code: 'PERMISSION_GROUP_CAPABILITY_BLOCKED' },
+  }
 
   function chatRequest(body: Record<string, unknown> = {}) {
     return new NextRequest('http://localhost/api/copilot/chat', {
@@ -978,7 +987,7 @@ describe('handleUnifiedChatPost copilot.use capability gate', () => {
     const response = await handleUnifiedChatPost(chatRequest({ createNewChat: true }))
 
     expect(response.status).toBe(403)
-    await expect(response.json()).resolves.toEqual({ error: REFUSAL })
+    await expect(response.json()).resolves.toEqual(REFUSAL_BODY)
     expect(resolveOrCreateChat).not.toHaveBeenCalled()
     expect(createSSEStream).not.toHaveBeenCalled()
     expect(releaseChatSendClaim).toHaveBeenCalledTimes(1)
@@ -1003,7 +1012,7 @@ describe('handleUnifiedChatPost copilot.use capability gate', () => {
     )
 
     expect(response.status).toBe(403)
-    await expect(response.json()).resolves.toEqual({ error: REFUSAL })
+    await expect(response.json()).resolves.toEqual(REFUSAL_BODY)
     expect(resolvePermissionGroupConfig).toHaveBeenCalledWith('user-1', 'ws-1', undefined)
     expect(createSSEStream).not.toHaveBeenCalled()
   })
@@ -1021,7 +1030,7 @@ describe('handleUnifiedChatPost copilot.use capability gate', () => {
     )
 
     expect(response.status).toBe(403)
-    await expect(response.json()).resolves.toEqual({ error: REFUSAL })
+    await expect(response.json()).resolves.toEqual(REFUSAL_BODY)
     expect(resolvePermissionGroupConfig).not.toHaveBeenCalledWith(
       'user-1',
       'ws-unrestricted',

apps/sim/lib/copilot/chat/post.ts

@@ -46,11 +46,7 @@ import {
 import { TraceAttr } from '@/lib/copilot/generated/trace-attributes-v1'
 import { TraceSpan } from '@/lib/copilot/generated/trace-spans-v1'
 import type { VfsSnapshotV1 } from '@/lib/copilot/generated/vfs-snapshot-v1'
-import {
-  createBadRequestResponse,
-  createForbiddenResponse,
-  createUnauthorizedResponse,
-} from '@/lib/copilot/request/http'
+import { createBadRequestResponse, createUnauthorizedResponse } from '@/lib/copilot/request/http'
 import { createSSEStream, SSE_RESPONSE_HEADERS } from '@/lib/copilot/request/lifecycle/start'
 import { startCopilotOtelRoot, withCopilotSpan } from '@/lib/copilot/request/otel'
 import {
@@ -68,10 +64,8 @@ import {
 import { prepareExecutionContext } from '@/lib/copilot/tools/handlers/context'
 import type { AtomicClaimResult } from '@/lib/core/idempotency'
 import { chatSendIdempotency } from '@/lib/core/idempotency'
-import {
-  capabilityRefusal,
-  isWorkspaceCapabilityWithheld,
-} from '@/lib/permission-groups/capability-assertions'
+import { isWorkspaceCapabilityWithheld } from '@/lib/permission-groups/capability-assertions'
+import { capabilityRefusalResponse } from '@/lib/permission-groups/capability-response'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { resolveWorkflowIdForUser } from '@/lib/workflows/utils'
 import {
@@ -1156,7 +1150,7 @@ export async function handleUnifiedChatPost(req: NextRequest) {
       ) {
         activeOtelRoot.span.setAttribute(TraceAttr.HttpStatusCode, 403)
         activeOtelRoot.finish('error')
-        return createForbiddenResponse(capabilityRefusal('copilot.use'))
+        return capabilityRefusalResponse('copilot.use')
       }
 
       let currentChat: ChatLoadResult['chat'] = null