fix(custom-block): allow cross-workspace exec, org-scope authority, keep field ids, hide disabled

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/providers/custom-blocks-loader.tsx

@@ -21,22 +21,27 @@ export function CustomBlocksLoader() {
 
   useEffect(() => {
     hydrateClientCustomBlocks(
-      (data ?? []).map((block) =>
-        buildCustomBlockConfig(
-          {
-            type: block.type,
-            name: block.name,
-            description: block.description,
-            workflowId: block.workflowId,
-            exposedOutputs: block.exposedOutputs,
-          },
-          block.inputFields,
-          {
-            icon: getCustomBlockIcon(block.iconUrl),
-            bgColor: block.iconUrl ? 'transparent' : undefined,
-          }
+      // Only enabled blocks are resolvable/executable server-side, so the client
+      // overlay (toolbar, canvas, palette) must exclude disabled ones too — else
+      // the block is offered but every run fails.
+      (data ?? [])
+        .filter((block) => block.enabled)
+        .map((block) =>
+          buildCustomBlockConfig(
+            {
+              type: block.type,
+              name: block.name,
+              description: block.description,
+              workflowId: block.workflowId,
+              exposedOutputs: block.exposedOutputs,
+            },
+            block.inputFields,
+            {
+              icon: getCustomBlockIcon(block.iconUrl),
+              bgColor: block.iconUrl ? 'transparent' : undefined,
+            }
+          )
         )
-      )
     )
   }, [data])
 

apps/sim/executor/handlers/workflow/workflow-handler.ts

@@ -113,7 +113,7 @@ export class WorkflowBlockHandler implements BlockHandler {
     let loadUserId = ctx.userId
     let exposedOutputs: CustomBlockOutput[] = []
     if (isCustomBlock) {
-      const authority = await getCustomBlockAuthority(blockTypeId as string)
+      const authority = await getCustomBlockAuthority(blockTypeId as string, ctx.workspaceId)
       if (!authority) {
         throw new Error('This custom block is no longer available')
       }
@@ -163,7 +163,14 @@ export class WorkflowBlockHandler implements BlockHandler {
         throw new Error(`Child workflow ${workflowId} not found`)
       }
 
-      this.assertChildWorkflowInWorkspace(workflowId, childWorkflow.workspaceId, ctx.workspaceId)
+      // Custom blocks are org-scoped and deliberately cross-workspace: the source
+      // workflow lives in the publisher's workspace, not the consumer's. Their
+      // boundary is the org overlay + `getCustomBlockAuthority`, so the
+      // same-workspace assert (which guards regular workflow blocks) must be
+      // skipped or every custom-block invocation from another workspace throws.
+      if (!isCustomBlock) {
+        this.assertChildWorkflowInWorkspace(workflowId, childWorkflow.workspaceId, ctx.workspaceId)
+      }
 
       childWorkflowName = childWorkflow.name || 'Unknown Workflow'
 

apps/sim/lib/api/contracts/custom-blocks.ts

@@ -3,6 +3,9 @@ import { workflowIdSchema, workspaceIdSchema } from '@/lib/api/contracts/primiti
 import { defineRouteContract } from '@/lib/api/contracts/types'
 
 const inputFieldSchema = z.object({
+  /** Stable per-field id — preserved so client block configs key sub-blocks on it
+   *  (rename-safe wiring) instead of the display name. Absent on legacy fields. */
+  id: z.string().optional(),
   name: z.string(),
   type: z.string(),
   description: z.string().optional(),

apps/sim/lib/workflows/custom-blocks/operations.ts

@@ -140,12 +140,22 @@ export async function getCustomBlockById(id: string) {
  * deletes the workflow → the custom_block row, so there is never an orphaned block.
  * `null` when no enabled block matches the type.
  */
-export async function getCustomBlockAuthority(type: string): Promise<{
+export async function getCustomBlockAuthority(
+  type: string,
+  consumerWorkspaceId: string | undefined
+): Promise<{
   workflowId: string
   organizationId: string
   ownerUserId: string
   exposedOutputs: CustomBlockOutput[]
 } | null> {
+  // Scope resolution to the consumer's org: `(organizationId, type)` is the unique
+  // key, so without the org filter a `custom_block_*` type smuggled in from another
+  // org's serialized workflow could resolve and run that org's block.
+  if (!consumerWorkspaceId) return null
+  const consumerWs = await getWorkspaceWithOwner(consumerWorkspaceId)
+  if (!consumerWs?.organizationId) return null
+
   const [row] = await db
     .select({
       workflowId: customBlock.workflowId,
@@ -156,7 +166,9 @@ export async function getCustomBlockAuthority(type: string): Promise<{
     })
     .from(customBlock)
     .innerJoin(workflow, eq(workflow.id, customBlock.workflowId))
-    .where(eq(customBlock.type, type))
+    .where(
+      and(eq(customBlock.type, type), eq(customBlock.organizationId, consumerWs.organizationId))
+    )
     .limit(1)
 
   if (!row || !row.enabled) return null