fix(copilot): resolve resource context through shared readers (#7627)

Author: waleedlatif1

apps/sim/lib/copilot/application/execute-knowledge-use-case.ts

@@ -5,7 +5,7 @@ import {
   COPILOT_APPLICATION_DELEGATION_TTL_MS,
   type CopilotExecutionContext,
   createCopilotApplicationPrincipal,
-  createTrustedCopilotPrincipal,
+  createCopilotChatPrincipal,
   createTrustedOrganizationCopilotPrincipal,
   requireTrustedCopilotExecutionContext,
   requireTrustedOrganizationCopilotContext,
@@ -61,15 +61,7 @@ export function resolveCopilotKnowledgePrincipal(
 export function createCopilotChatKnowledgePrincipal(
   context: CopilotChatKnowledgeDelegationContext
 ): DelegatedPrincipal {
-  return createTrustedCopilotPrincipal(
-    {
-      userId: context.userId,
-      workspaceId: context.workspaceId,
-      delegationId: `copilot-chat:${context.chatId ?? context.workspaceId}`,
-      chatId: context.chatId,
-    },
-    knowledgeDelegation
-  )
+  return createCopilotChatPrincipal(context, knowledgeDelegationPolicy.audience)
 }
 
 /** Enters a registered knowledge application use case with trusted Copilot identity. */

apps/sim/lib/copilot/auth/application-delegation.ts

@@ -64,6 +64,24 @@ interface CreateTrustedCopilotPrincipalOptions {
   resourceScope?: CopilotResourceScope
 }
 
+export interface CopilotChatDelegationContext {
+  userId: string
+  workspaceId: string
+  chatId?: string
+}
+
+/** Creates request-scoped authority for resource reads during an authenticated chat turn. */
+export function createCopilotChatPrincipal(
+  context: CopilotChatDelegationContext,
+  audience: string,
+  resourceScope?: CopilotResourceScope
+): DelegatedPrincipal {
+  return createTrustedCopilotPrincipal(
+    { ...context, delegationId: `copilot-chat:${context.chatId ?? context.workspaceId}` },
+    { audience, ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS, resourceScope }
+  )
+}
+
 function requireNonEmpty(value: string | undefined, field: string): asserts value is string {
   if (!value?.trim()) throw new Error(`Copilot execution context requires ${field}`)
 }

apps/sim/lib/copilot/auth/file-delegation.ts

@@ -4,6 +4,7 @@ import {
   COPILOT_APPLICATION_DELEGATION_TTL_MS,
   type CopilotExecutionContext,
   createCopilotApplicationPrincipal,
+  createCopilotChatPrincipal,
   createTrustedCopilotPrincipal,
   requireTrustedCopilotExecutionContext,
 } from '@/lib/copilot/auth/application-delegation'
@@ -44,15 +45,7 @@ export function resolveCopilotFilePrincipal(
 export function createCopilotChatFilePrincipal(
   context: CopilotChatFileDelegationContext
 ): DelegatedPrincipal {
-  return createTrustedCopilotPrincipal(
-    {
-      userId: context.userId,
-      workspaceId: context.workspaceId,
-      delegationId: `copilot-chat:${context.chatId ?? context.workspaceId}`,
-      chatId: context.chatId,
-    },
-    fileDelegation
-  )
+  return createCopilotChatPrincipal(context, workspaceFileDelegationPolicy.audience)
 }
 
 /** Creates the principal used while materializing the Copilot workspace index. */

apps/sim/lib/copilot/auth/table-delegation.ts

@@ -1,8 +1,7 @@
 import { messageForCopilotApplicationError } from '@/lib/copilot/application/error'
 import {
-  COPILOT_APPLICATION_DELEGATION_TTL_MS,
   type CopilotExecutionContext,
-  createTrustedCopilotPrincipal,
+  createCopilotChatPrincipal,
 } from '@/lib/copilot/auth/application-delegation'
 import { tableDelegationPolicy } from '@/lib/table/application/authorization'
 
@@ -13,14 +12,7 @@ export function createCopilotChatTablePrincipal(
   context: { userId: string; workspaceId: string; chatId?: string },
   tableId: string
 ) {
-  return createTrustedCopilotPrincipal(
-    { ...context, delegationId: `copilot-chat:${context.chatId ?? context.workspaceId}` },
-    {
-      audience: tableDelegationPolicy.audience,
-      ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
-      resourceScope: { tableId },
-    }
-  )
+  return createCopilotChatPrincipal(context, tableDelegationPolicy.audience, { tableId })
 }
 
 export function messageForCopilotTableError(

apps/sim/lib/copilot/chat/folder-context.ts

@@ -1,8 +1,5 @@
 import { createLogger } from '@sim/logger'
-import {
-  COPILOT_APPLICATION_DELEGATION_TTL_MS,
-  createTrustedCopilotPrincipal,
-} from '@/lib/copilot/auth/application-delegation'
+import { createCopilotChatPrincipal } from '@/lib/copilot/auth/application-delegation'
 import { createCopilotChatFilePrincipal } from '@/lib/copilot/auth/file-delegation'
 import { buildVfsFolderPathMap, encodeVfsPathSegments } from '@/lib/copilot/vfs/path-utils'
 import { knowledgeDelegationPolicy } from '@/lib/knowledge/application/authorization'
@@ -17,9 +14,17 @@ import { parseWorkspaceFileFolderDisplayPath } from '@/lib/workspace-files/folde
 const logger = createLogger('ChatFolderContext')
 
 const FOLDER_DOMAINS = {
-  workflow: { root: 'workflows', policy: workflowDelegationPolicy },
-  table: { root: 'tables', policy: tableDelegationPolicy },
-  knowledge_base: { root: 'knowledgebases', policy: knowledgeDelegationPolicy },
+  workflow: {
+    root: 'workflows',
+    policy: workflowDelegationPolicy,
+    list: listWorkflowFolders,
+  },
+  table: { root: 'tables', policy: tableDelegationPolicy, list: listTableFoldersUseCase },
+  knowledge_base: {
+    root: 'knowledgebases',
+    policy: knowledgeDelegationPolicy,
+    list: listKnowledgeFolders,
+  },
 } as const
 
 type FolderDomain = keyof typeof FOLDER_DOMAINS
@@ -35,24 +40,12 @@ export function createChatFolderResolver(userId: string, workspaceId: string, ch
   const filePaths = new Map<string, Promise<string | null>>()
 
   async function loadPaths(domain: FolderDomain): Promise<Map<string, string>> {
-    const principal = createTrustedCopilotPrincipal(
-      { userId, workspaceId, chatId, delegationId: `copilot-chat:${chatId ?? workspaceId}` },
-      {
-        audience: FOLDER_DOMAINS[domain].policy.audience,
-        ttlMs: COPILOT_APPLICATION_DELEGATION_TTL_MS,
-      }
+    const principal = createCopilotChatPrincipal(
+      { userId, workspaceId, chatId },
+      FOLDER_DOMAINS[domain].policy.audience
     )
     const input = { workspaceId, sortBy: 'name', sortOrder: 'asc' } as const
-    const { folders } = await (() => {
-      switch (domain) {
-        case 'workflow':
-          return listWorkflowFolders.execute({ principal, input })
-        case 'table':
-          return listTableFoldersUseCase.execute({ principal, input })
-        case 'knowledge_base':
-          return listKnowledgeFolders.execute({ principal, input })
-      }
-    })()
+    const { folders } = await FOLDER_DOMAINS[domain].list.execute({ principal, input })
     return buildVfsFolderPathMap(
       folders.map((folder) => ({
         folderId: folder.id,
@@ -93,7 +86,7 @@ export function createChatFolderResolver(userId: string, workspaceId: string, ch
       }
       return pending
     }
-    const domains: FolderDomain[] = ['workflow', 'table', 'knowledge_base']
+    const domains = Object.keys(FOLDER_DOMAINS) as FolderDomain[]
     const results = await Promise.allSettled(
       domains.map(async (domain) => {
         const path = await folderPath(folderId, domain)

apps/sim/lib/copilot/chat/post.test.ts

@@ -801,6 +801,32 @@ describe('handleUnifiedChatPost', () => {
     expect(processContextsServer).not.toHaveBeenCalled()
   })
 
+  it('preserves the selected integration identifier through request parsing', async () => {
+    const context = { kind: 'integration', blockType: 'slack', label: 'Slack' }
+    const response = await handleUnifiedChatPost(
+      new NextRequest('http://localhost/api/copilot/chat', {
+        method: 'POST',
+        body: JSON.stringify({
+          message: '@Slack help me use this integration',
+          workspaceId: 'ws-1',
+          createNewChat: true,
+          contexts: [context],
+          resourceAttachments: [{ type: 'integration', id: 'slack', title: 'Slack', active: true }],
+        }),
+      })
+    )
+
+    expect(response.status).toBe(200)
+    expect(processContextsServer.mock.calls[0]?.[0]).toEqual([context])
+    expect(resolveActiveResourceContext).toHaveBeenCalledWith(
+      'integration',
+      'slack',
+      'ws-1',
+      'user-1',
+      expect.any(String)
+    )
+  })
+
   it('forwards slash-selected MCP server ids to the request-local tool builder', async () => {
     const response = await handleUnifiedChatPost(
       new NextRequest('http://localhost/api/copilot/chat', {

apps/sim/lib/copilot/chat/post.ts

@@ -109,6 +109,7 @@ const ResourceAttachmentSchema = z.object({
     'table',
     'file',
     'knowledgebase',
+    'integration',
     'folder',
     'filefolder',
     'task',
@@ -142,6 +143,7 @@ const GENERIC_RESOURCE_TITLE: Record<z.infer<typeof ResourceAttachmentSchema>['t
   table: 'Table',
   file: 'File',
   knowledgebase: 'Knowledge Base',
+  integration: 'Integration',
   folder: 'Folder',
   filefolder: 'File Folder',
   task: 'Task',
@@ -240,6 +242,7 @@ const ChatContextSchema = z
     knowledgeId: z.string().optional(),
     blockId: z.string().optional(),
     blockIds: z.array(z.string()).optional(),
+    blockType: z.string().min(1).max(200).optional(),
     executionId: z.string().optional(),
     tableId: z.string().optional(),
     fileId: z.string().optional(),