fix(access-control): gate the seeded model too, and collapse the seed rule

Block creation seeds `model` the same way it seeds `operation`: `agent`,
`router` and `evaluator` all declare `defaultValue: 'claude-sonnet-5'`, and
`prepareBlockState` wrote it unconditionally. The model combobox only fills a
field that is empty, so a group denying that model (or the Anthropic provider)
got an Agent block pre-filled with a model it cannot run — the same bug as the
operation one, on the other axis the permission group governs.

Rather than a second bespoke gate, `prepareBlockState` now takes one veto,
`isSeededValueAllowed(subBlockId, value)`, and seeds nothing when a declared
default is denied. Nothing substitutes a replacement there any more: the
editor's own permission-aware pickers already resolve the right one and only
fill an empty field, and substituting in the store would drift from
`getDefaultBlockName`, which names a block after its *declared* default. That
also deletes `firstAllowedOperation` and its copy of subblock-option
enumeration.

Review follow-ups:

- `usePermissionConfig` gains `isModelUsable` (denylist AND provider allowlist);
  the combobox's two hand-rolled copies of that pair now call it
- `isToolAllowed`/`isModelAllowed` index their denylists — the gate calls them
  once per option of every block offered, so a linear scan made a check's cost
  scale with denylist length (measured 3.2ms -> 0.30ms per search-index build
  at 500 denied tools)
- `useOperationAccess` had three members with three different loading
  semantics, one documented as unsafe alone; it now exposes one withholding
  `resolveOperationGate`
- the agent tool picker derived its option list twice with the empty-id filter
  on only one path; both callers now share one `{ options, denied }` result
- `OPERATION_SUBBLOCK_ID` was a verbatim copy of the private constant in
  `canvas-sentence.ts`, doc comment included; that file now imports it

Author: waleedlatif1

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/combobox/combobox.tsx

@@ -15,7 +15,6 @@ import { useAccessibleReferencePrefixes } from '@/app/workspace/[workspaceId]/w/
 import type { SubBlockConfig } from '@/blocks/types'
 import { getDependsOnFields } from '@/blocks/utils'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
-import { getProviderFromModel } from '@/providers/utils'
 import { useSubBlockStore } from '@/stores/workflows/subblock/store'
 
 /**
@@ -108,30 +107,18 @@ export const ComboBox = memo(function ComboBox({
   const value = isPreview ? previewValue : propValue !== undefined ? propValue : storeValue
 
   // Permission-based filtering for model dropdowns
-  const {
-    isProviderAllowed,
-    isModelAllowed,
-    isLoading: isPermissionLoading,
-  } = usePermissionConfig()
+  const { isModelUsable, isLoading: isPermissionLoading } = usePermissionConfig()
 
   // Evaluate static options if provided as a function
   const staticOptions = useMemo(() => {
     const opts = typeof options === 'function' ? options() : options
 
     if (subBlockId === 'model') {
-      return opts.filter((opt) => {
-        const modelId = typeof opt === 'string' ? opt : opt.id
-        if (!isModelAllowed(modelId)) return false
-        try {
-          return isProviderAllowed(getProviderFromModel(modelId))
-        } catch {
-          return true
-        }
-      })
+      return opts.filter((opt) => isModelUsable(typeof opt === 'string' ? opt : opt.id))
     }
 
     return opts
-  }, [options, subBlockId, isProviderAllowed, isModelAllowed])
+  }, [options, subBlockId, isModelUsable])
 
   const {
     fetchedOptions,
@@ -210,15 +197,7 @@ export const ComboBox = memo(function ComboBox({
       fetchOptions && normalizedFetchedOptions.length > 0 ? normalizedFetchedOptions : staticOptions
 
     if (subBlockId === 'model' && fetchOptions && normalizedFetchedOptions.length > 0) {
-      opts = opts.filter((opt) => {
-        const modelId = typeof opt === 'string' ? opt : opt.id
-        if (!isModelAllowed(modelId)) return false
-        try {
-          return isProviderAllowed(getProviderFromModel(modelId))
-        } catch {
-          return true
-        }
-      })
+      opts = opts.filter((opt) => isModelUsable(typeof opt === 'string' ? opt : opt.id))
     }
 
     // Merge hydrated option if not already present
@@ -251,8 +230,7 @@ export const ComboBox = memo(function ComboBox({
     hydratedOption,
     createdOption,
     subBlockId,
-    isProviderAllowed,
-    isModelAllowed,
+    isModelUsable,
   ])
 
   // Convert options to Combobox format

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/dropdown/dropdown.tsx

@@ -2,7 +2,10 @@ import { memo, useCallback, useEffect, useMemo, useRef } from 'react'
 import { ChipTag, Combobox, type ComboboxOption } from '@sim/emcn'
 import { generateId } from '@sim/utils/id'
 import { isRecordLike } from '@sim/utils/object'
-import { OPERATION_SUBBLOCK_ID } from '@/lib/permission-groups/operation-access'
+import {
+  NO_DENIED_OPERATIONS,
+  OPERATION_SUBBLOCK_ID,
+} from '@/lib/permission-groups/operation-access'
 import { formatDisplayText } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/formatted-text'
 import { getWorkflowSearchLabelHighlight } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/workflow-search-highlight'
 import { useFetchedOptions } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/hooks/use-fetched-options'
@@ -18,8 +21,6 @@ import { useWorkflowStore } from '@/stores/workflows/workflow/store'
 /** Selected-value badges shown before folding the rest into a "+N" badge. */
 const MAX_VISIBLE_MULTI_SELECT_BADGES = 2
 
-const EMPTY_DENIED_OPERATIONS: ReadonlySet<string> = new Set()
-
 /**
  * Dropdown option type - can be a simple string or an object with label, id, and optional icon.
  * Options with `hidden: true` are excluded from the picker but still resolve for label display,
@@ -197,7 +198,7 @@ export const Dropdown = memo(function Dropdown({
    * authoritative gate regardless.
    */
   const deniedOperationIds = useMemo(() => {
-    if (subBlockId !== OPERATION_SUBBLOCK_ID) return EMPTY_DENIED_OPERATIONS
+    if (subBlockId !== OPERATION_SUBBLOCK_ID) return NO_DENIED_OPERATIONS
     return getDeniedOperations(
       blockConfig,
       allOptions.map((opt) => (typeof opt === 'string' ? opt : opt.id))
@@ -226,8 +227,6 @@ export const Dropdown = memo(function Dropdown({
   const defaultOptionValue = useMemo(() => {
     if (multiSelect) return undefined
 
-    const selectableIds = comboboxOptions.filter((opt) => !opt.hidden).map((opt) => opt.value)
-
     /**
      * The operation field defaults through the permission gate, which withholds
      * a value until the group config has loaded. Seeding the static first
@@ -236,12 +235,13 @@ export const Dropdown = memo(function Dropdown({
      * that arrives with the config would never apply.
      */
     if (subBlockId === OPERATION_SUBBLOCK_ID) {
+      const selectableIds = comboboxOptions.filter((opt) => !opt.hidden).map((opt) => opt.value)
       return resolveDefaultOperation(blockConfig, selectableIds, defaultValue)
     }
 
     if (defaultValue !== undefined) return defaultValue
 
-    return selectableIds[0]
+    return comboboxOptions.find((opt) => !opt.hidden)?.value
   }, [defaultValue, comboboxOptions, multiSelect, subBlockId, blockConfig, resolveDefaultOperation])
 
   useEffect(() => {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/tool-input/tool-input.tsx

@@ -26,7 +26,10 @@ import {
 } from '@/lib/mcp/tool-validation'
 import type { McpToolSchema } from '@/lib/mcp/types'
 import { getProviderIdFromServiceId, type OAuthProvider, type OAuthService } from '@/lib/oauth'
-import { OPERATION_SUBBLOCK_ID } from '@/lib/permission-groups/operation-access'
+import {
+  NO_DENIED_OPERATIONS,
+  OPERATION_SUBBLOCK_ID,
+} from '@/lib/permission-groups/operation-access'
 import { extractInputFieldsFromBlocks } from '@/lib/workflows/input-format'
 import { resolveStoredToolName } from '@/lib/workflows/subblocks/display'
 import { buildToolSubBlockId } from '@/lib/workflows/tool-input/synthetic-subblocks'
@@ -666,18 +669,24 @@ export const ToolInput = memo(function ToolInput({
   const { getDeniedOperations } = useOperationAccess()
 
   /**
-   * A tool block's operations minus the ones the caller's permission group
-   * denies, so this surface never offers — or silently defaults to — an
-   * operation that would be rejected at execution.
+   * A tool block's selectable operations paired with the ones the caller's
+   * permission group denies.
+   *
+   * Both callers derive from this single result so they cannot drift: the
+   * picker *removes* denied operations (it must never offer or default to one),
+   * while the editor's selector *hides* them (a tool already saved on one keeps
+   * showing its name).
    */
-  const getAllowedOperationOptions = useCallback(
+  const getOperationChoices = useCallback(
     (block: BlockConfig | undefined) => {
-      const options = getOperationOptions(block)
-      const denied = getDeniedOperations(
-        block,
-        options.map((option) => option.id)
-      )
-      return denied.size === 0 ? options : options.filter((option) => !denied.has(option.id))
+      const options = getOperationOptions(block).filter((option) => option.id !== '')
+      return {
+        options,
+        denied: getDeniedOperations(
+          block,
+          options.map((option) => option.id)
+        ),
+      }
     },
     [getDeniedOperations]
   )
@@ -688,10 +697,12 @@ export const ToolInput = memo(function ToolInput({
     /* A multi-operation block whose every operation is denied has nothing the
        caller can run, so it leaves the picker alongside the blocks denied
        outright by `filterBlocks`. */
-    return filterBlocks(allToolBlocks).filter(
-      (block) => !hasMultipleOperations(block) || getAllowedOperationOptions(block).length > 0
-    )
-  }, [filterBlocks, customBlockOverlayVersion, getAllowedOperationOptions])
+    return filterBlocks(allToolBlocks).filter((block) => {
+      if (!hasMultipleOperations(block)) return true
+      const { options, denied } = getOperationChoices(block)
+      return options.length === 0 || options.some((option) => !denied.has(option.id))
+    })
+  }, [filterBlocks, customBlockOverlayVersion, getOperationChoices])
 
   const hasBackfilledRef = useRef(false)
   useEffect(() => {
@@ -806,9 +817,10 @@ export const ToolInput = memo(function ToolInput({
     (toolBlock: (typeof toolBlocks)[0]) => {
       if (isPreview || disabled) return
 
-      const hasOperations = hasMultipleOperations(toolBlock)
-      const operationOptions = hasOperations ? getAllowedOperationOptions(toolBlock) : []
-      const defaultOperation = operationOptions.length > 0 ? operationOptions[0].id : undefined
+      const { options, denied } = hasMultipleOperations(toolBlock)
+        ? getOperationChoices(toolBlock ?? undefined)
+        : { options: [], denied: NO_DENIED_OPERATIONS }
+      const defaultOperation = options.find((option) => !denied.has(option.id))?.id
 
       const toolId = getToolIdForOperation(toolBlock.type, defaultOperation, toolBlock)
       if (!toolId) return
@@ -844,14 +856,7 @@ export const ToolInput = memo(function ToolInput({
 
       setOpen(false)
     },
-    [
-      isPreview,
-      disabled,
-      isToolAlreadySelected,
-      selectedTools,
-      setStoreValue,
-      getAllowedOperationOptions,
-    ]
+    [isPreview, disabled, isToolAlreadySelected, selectedTools, setStoreValue, getOperationChoices]
   )
 
   const handleAddCustomTool = useCallback(
@@ -1830,7 +1835,7 @@ export const ToolInput = memo(function ToolInput({
             : []
 
           const hasOperations =
-            !isCustomTool && !isMcpTool && hasMultipleOperations(getBlock(tool.type))
+            !isCustomTool && !isMcpTool && hasMultipleOperations(toolBlock ?? undefined)
           const hasParams = useSubBlocks
             ? displaySubBlocks.length > 0
             : displayParams.filter((param) => evaluateParameterCondition(param, tool)).length > 0
@@ -2090,19 +2095,11 @@ export const ToolInput = memo(function ToolInput({
                 <div className='flex flex-col gap-2.5 overflow-visible rounded-b-[4px] border-[var(--border-1)] border-t bg-[var(--surface-2)] p-2'>
                   {/* Operation dropdown for tools with multiple operations */}
                   {(() => {
-                    const block = getBlock(tool.type)
-                    const operationOptions = hasMultipleOperations(block)
-                      ? getOperationOptions(block).filter((option) => option.id !== '')
-                      : []
-                    if (operationOptions.length === 0) return null
-
-                    /* Denied operations are hidden from the picker rather than
-                       dropped, so a tool already saved on one keeps showing its
-                       name; the unset fallback skips to the first allowed. */
-                    const denied = getDeniedOperations(
-                      block,
-                      operationOptions.map((option) => option.id)
+                    if (!hasOperations) return null
+                    const { options: operationOptions, denied } = getOperationChoices(
+                      toolBlock ?? undefined
                     )
+                    if (operationOptions.length === 0) return null
 
                     return (
                       <div className='relative space-y-1.5'>

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/workflow.tsx

@@ -41,7 +41,7 @@ import { useSession } from '@/lib/auth/auth-client'
 import type { OAuthConnectEventDetail } from '@/lib/copilot/tools/client/base-tool'
 import { consumeOAuthReturnContext, writeOAuthReturnContext } from '@/lib/credentials/client-state'
 import type { OAuthProvider } from '@/lib/oauth'
-import { OPERATION_SUBBLOCK_ID } from '@/lib/permission-groups/operation-access'
+import { MODEL_SUBBLOCK_ID, OPERATION_SUBBLOCK_ID } from '@/lib/permission-groups/operation-access'
 import { getDefaultBlockName } from '@/lib/workflows/blocks/canvas-presentation'
 import { requestNoteImage, requestNoteRename } from '@/lib/workflows/notes/canvas-requests'
 import { TriggerUtils } from '@/lib/workflows/triggers/triggers'
@@ -129,6 +129,7 @@ import { useCanvasViewport } from '@/hooks/use-canvas-viewport'
 import { useCollaborativeWorkflow } from '@/hooks/use-collaborative-workflow'
 import { useOAuthReturnForWorkflow } from '@/hooks/use-oauth-return'
 import { useOperationAccess } from '@/hooks/use-operation-access'
+import { usePermissionConfig } from '@/hooks/use-permission-config'
 import { useCanvasModeStore } from '@/stores/canvas-mode'
 import { useChatStore } from '@/stores/chat/store'
 import {
@@ -870,7 +871,8 @@ const WorkflowContent = React.memo(
      */
     const pendingFocusBlockIdRef = useRef<string | null>(null)
 
-    const { isOperationAllowed, isReady: isOperationAccessReady } = useOperationAccess()
+    const { resolveOperationGate } = useOperationAccess()
+    const { isModelUsable } = usePermissionConfig()
 
     const addBlock = useCallback(
       (
@@ -894,11 +896,17 @@ const WorkflowContent = React.memo(
         if (extent) blockData.extent = extent
 
         /**
-         * Withheld until the permission config has resolved, since it reads as
-         * "nothing denied" in flight and would let a denied default through.
+         * `undefined` until the permission config has resolved, so a declared
+         * default is never vetoed — or let through — on a guess. Blocks pre-fill
+         * two fields the group can restrict; both go through the same gate.
          */
-        const operationGate = isOperationAccessReady
-          ? (operationId: string) => isOperationAllowed(getBlock(type), operationId)
+        const operationGate = resolveOperationGate(getBlock(type))
+        const seedGate = operationGate
+          ? (subBlockId: string, value: string) => {
+              if (subBlockId === OPERATION_SUBBLOCK_ID) return operationGate(value)
+              if (subBlockId === MODEL_SUBBLOCK_ID) return isModelUsable(value)
+              return true
+            }
           : undefined
 
         const block = prepareBlockState({
@@ -910,7 +918,7 @@ const WorkflowContent = React.memo(
           parentId,
           extent,
           triggerMode,
-          isOperationAllowed: operationGate,
+          isSeededValueAllowed: seedGate,
         })
 
         const subBlockValues: Record<string, Record<string, unknown>> = {}
@@ -958,8 +966,8 @@ const WorkflowContent = React.memo(
         collaborativeBatchAddBlocks,
         setSelectedEdges,
         setPendingSelection,
-        isOperationAllowed,
-        isOperationAccessReady,
+        resolveOperationGate,
+        isModelUsable,
       ]
     )