fix(oracle-fusion): harden SCM integration boundaries

Author: Bill Leoutsakos

apps/sim/app/(landing)/integrations/(shell)/page.tsx

@@ -32,7 +32,7 @@ const TOTAL_TOOL_COUNT = allIntegrations.reduce((sum, i) => sum + i.operationCou
 const CATALOG_FAQS: FAQItem[] = [
   {
     question: 'How do integrations work in Sim?',
-    answer: `Each integration is a block you drag onto Sim's workflow builder. Together, Sim's ${INTEGRATION_COUNT} integrations expose ${TOTAL_TOOL_COUNT}+ tools that AI agents can call. ${OAUTH_COUNT} connect with one-click OAuth, ${SERVICE_ACCOUNT_COUNT} use reusable service-account credentials, and the rest use an API key or no authentication at all. Wire blocks together, add an AI agent block for reasoning, and run.`,
+    answer: `Each integration is a block you drag onto Sim's workflow builder. Together, Sim's ${INTEGRATION_COUNT} integrations expose ${TOTAL_TOOL_COUNT}+ tools that AI agents can call. ${OAUTH_COUNT} connect with one-click OAuth, ${SERVICE_ACCOUNT_COUNT} use reusable service-account credentials, and the rest are configured directly in the block with an API key, other connection details, or no credentials as applicable. Wire blocks together, add an AI agent block for reasoning, and run.`,
   },
   {
     question: 'Are Sim integrations free to use?',

apps/sim/app/workspace/[workspaceId]/home/components/suggested-actions/suggested-actions.test.tsx

@@ -5,10 +5,12 @@ import { act } from 'react'
 import { createRoot, type Root } from 'react-dom/client'
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCaptureEvent, modeState } = vi.hoisted(() => ({
+const { credentialsState, mockCaptureEvent, modeState, oauthServicesState } = vi.hoisted(() => ({
+  credentialsState: { data: [] as unknown[] },
   mockCaptureEvent: vi.fn(),
   /** The URL `mode` param as the nuqs mock serves it; `set` is the live setter once mounted. */
   modeState: { initial: 'build', set: (_next: string) => {} },
+  oauthServicesState: { data: [] as unknown[] },
 }))
 
 vi.mock('nuqs', async () => {
@@ -30,10 +32,10 @@ vi.mock('@/lib/posthog/client', () => ({ captureEvent: mockCaptureEvent }))
 vi.mock('@sim/utils/random', () => ({ randomFloat: () => 0 }))
 
 vi.mock('@/hooks/queries/credentials', () => ({
-  useWorkspaceCredentials: () => ({ data: [] }),
+  useWorkspaceCredentials: () => ({ data: credentialsState.data }),
 }))
 vi.mock('@/hooks/queries/oauth/oauth-connections', () => ({
-  useOAuthConnections: () => ({ data: [] }),
+  useOAuthConnections: () => ({ data: oauthServicesState.data }),
 }))
 vi.mock('@/hooks/queries/tables', () => ({
   useTablesList: () => ({ data: [] }),
@@ -114,6 +116,8 @@ beforeEach(() => {
   onSelectPrompt.mockClear()
   mockCaptureEvent.mockClear()
   modeState.initial = 'build'
+  credentialsState.data = []
+  oauthServicesState.data = []
 })
 
 afterEach(() => {
@@ -150,4 +154,36 @@ describe('SuggestedActions', () => {
     expect(document.querySelector('[data-testid="search-sources"]')).not.toBeNull()
     expect(rows()).toHaveLength(0)
   })
+
+  it('does not offer a service-account-only integration through the OAuth modal', () => {
+    const OracleIcon = () => null
+    credentialsState.data = [
+      {
+        id: 'existing-oauth',
+        type: 'oauth',
+        providerId: 'slack',
+      },
+    ]
+    oauthServicesState.data = [
+      {
+        id: 'oracle_fusion_scm',
+        name: 'Oracle Fusion Cloud SCM',
+        description: 'Read Oracle Fusion Cloud SCM data.',
+        providerId: 'oracle_fusion_scm',
+        icon: OracleIcon,
+        baseProviderIcon: OracleIcon,
+        scopes: [],
+        authType: 'service_account',
+        serviceAccountProviderId: 'oracle-fusion-service-account',
+        isConnected: false,
+      },
+    ]
+
+    mount()
+
+    expect(rows().map((row) => row.textContent)).not.toContain(
+      'Integrate with Oracle Fusion Cloud SCM'
+    )
+    expect(document.querySelector('[data-testid="connect-modal"]')).toBeNull()
+  })
 })

apps/sim/app/workspace/[workspaceId]/home/components/suggested-actions/suggested-actions.tsx

@@ -178,6 +178,7 @@ function toIntegrationAction(service: ServiceInfo, slug: string): Action {
  */
 function computeActions(services: readonly ServiceInfo[], signals: Signals): Action[] {
   const connectCandidates = services.flatMap((s) => {
+    if ((s.authType ?? 'oauth') !== 'oauth') return []
     if (signals.connectedProviders.has(s.providerId)) return []
     const slug = SLUG_BY_LOWER_NAME.get(s.name.toLowerCase())
     return slug ? [{ service: s, slug }] : []

apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx

@@ -27,6 +27,7 @@ import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/comp
 import {
   CONNECT_MODE,
   resolveAvailableConnectMode,
+  resolveOAuthAvailability,
 } from '@/app/workspace/[workspaceId]/integrations/connect-route'
 import { useScrollRestoration } from '@/app/workspace/[workspaceId]/integrations/hooks/use-scroll-restoration'
 import {
@@ -70,7 +71,9 @@ export function IntegrationBlockDetail({ integration, workspaceId }: Integration
   const oauthService = resolveOAuthServiceForIntegration(integration)
   const { integrationAvailability, isLoading: permissionConfigLoading } = usePermissionConfig()
   const availability = integrationAvailability.get(integration.type.toLowerCase())
-  const oauthAvailable = Boolean(oauthService) && (availability?.oauthAvailable ?? true)
+  const oauthAvailable =
+    Boolean(oauthService) &&
+    resolveOAuthAvailability(availability?.oauthAvailable, integration.authType)
   const [oauthOpen, setOAuthOpen] = useState(false)
 
   const { data: credentials = [], isPending: credentialsLoading } = useWorkspaceCredentials({

apps/sim/app/workspace/[workspaceId]/integrations/connect-route.test.ts

@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest'
 import {
   CONNECT_MODE,
   resolveAvailableConnectMode,
+  resolveOAuthAvailability,
 } from '@/app/workspace/[workspaceId]/integrations/connect-route'
 
 describe('resolveAvailableConnectMode', () => {
@@ -36,4 +37,11 @@ describe('resolveAvailableConnectMode', () => {
       })
     ).toBe(CONNECT_MODE.oauth)
   })
+
+  it('uses the catalog auth type until deployment availability hydrates', () => {
+    expect(resolveOAuthAvailability(undefined, 'service-account')).toBe(false)
+    expect(resolveOAuthAvailability(undefined, 'oauth')).toBe(true)
+    expect(resolveOAuthAvailability(true, 'service-account')).toBe(true)
+    expect(resolveOAuthAvailability(false, 'oauth')).toBe(false)
+  })
 })

apps/sim/app/workspace/[workspaceId]/integrations/connect-route.ts

@@ -4,6 +4,8 @@
  * the detail page's `?connect=oauth|service-account` query handler.
  */
 
+import type { AuthType } from '@/lib/integrations/types'
+
 export const CONNECT_QUERY_PARAM = 'connect' as const
 
 export const CONNECT_MODE = {
@@ -29,3 +31,11 @@ export function resolveAvailableConnectMode(
   }
   return null
 }
+
+/** Prevents service-account-only integrations from advertising OAuth before availability loads. */
+export function resolveOAuthAvailability(
+  deployedOAuthAvailable: boolean | undefined,
+  catalogAuthType: AuthType
+): boolean {
+  return deployedOAuthAvailable ?? catalogAuthType === 'oauth'
+}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/integration-search-items.test.ts

@@ -5,28 +5,44 @@ import { resolveIntegrationSearchConnectMode } from '@/app/workspace/[workspaceI
 describe('resolveIntegrationSearchConnectMode', () => {
   it('opens the service-account picker for a ready service-account-only integration', () => {
     expect(
-      resolveIntegrationSearchConnectMode({
-        oauthAvailable: false,
-        serviceAccountAvailable: true,
-      })
+      resolveIntegrationSearchConnectMode(
+        {
+          oauthAvailable: false,
+          serviceAccountAvailable: true,
+        },
+        'service-account'
+      )
     ).toBe(CONNECT_MODE.serviceAccount)
   })
 
   it('prefers OAuth when both stored-credential paths are available', () => {
     expect(
-      resolveIntegrationSearchConnectMode({
-        oauthAvailable: true,
-        serviceAccountAvailable: true,
-      })
+      resolveIntegrationSearchConnectMode(
+        {
+          oauthAvailable: true,
+          serviceAccountAvailable: true,
+        },
+        'oauth'
+      )
     ).toBe(CONNECT_MODE.oauth)
   })
 
   it('does not request a connection dialog when neither path is available', () => {
     expect(
-      resolveIntegrationSearchConnectMode({
-        oauthAvailable: false,
-        serviceAccountAvailable: false,
-      })
+      resolveIntegrationSearchConnectMode(
+        {
+          oauthAvailable: false,
+          serviceAccountAvailable: false,
+        },
+        'oauth'
+      )
     ).toBeNull()
   })
+
+  it('uses the catalog auth type before deployment availability hydrates', () => {
+    expect(resolveIntegrationSearchConnectMode(null, 'service-account')).toBe(
+      CONNECT_MODE.serviceAccount
+    )
+    expect(resolveIntegrationSearchConnectMode(null, 'oauth')).toBe(CONNECT_MODE.oauth)
+  })
 })

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/integration-search-items.ts

@@ -13,9 +13,12 @@ const FALLBACK_BG_COLOR = '#6B7280'
 
 /** Selects the credential dialog that a catalog search result should open. */
 export function resolveIntegrationSearchConnectMode(
-  availability: Pick<IntegrationAvailability, 'oauthAvailable' | 'serviceAccountAvailable'> | null
+  availability: Pick<IntegrationAvailability, 'oauthAvailable' | 'serviceAccountAvailable'> | null,
+  authType: 'oauth' | 'service-account'
 ): (typeof CONNECT_MODE)[keyof typeof CONNECT_MODE] | null {
-  if (!availability) return CONNECT_MODE.oauth
+  if (!availability) {
+    return authType === 'service-account' ? CONNECT_MODE.serviceAccount : CONNECT_MODE.oauth
+  }
   if (availability.oauthAvailable) return CONNECT_MODE.oauth
   if (availability.serviceAccountAvailable) return CONNECT_MODE.serviceAccount
   return null
@@ -60,13 +63,15 @@ export function buildIntegrationSearchItems(
   workspaceId: string,
   isBlockAllowed: (blockType: string) => boolean = () => true,
   getConnectMode: (
-    blockType: string
-  ) => (typeof CONNECT_MODE)[keyof typeof CONNECT_MODE] | null = () => CONNECT_MODE.oauth
+    blockType: string,
+    authType: 'oauth' | 'service-account'
+  ) => (typeof CONNECT_MODE)[keyof typeof CONNECT_MODE] | null = (_blockType, authType) =>
+    authType === 'service-account' ? CONNECT_MODE.serviceAccount : CONNECT_MODE.oauth
 ): IntegrationSearchItem[] {
   return INTEGRATION_BASES.filter((base) => isBlockAllowed(base.blockType)).map((base) => {
     const connectMode =
       base.authType === 'oauth' || base.authType === 'service-account'
-        ? getConnectMode(base.blockType)
+        ? getConnectMode(base.blockType, base.authType)
         : null
     const connectSuffix = connectMode ? `?${CONNECT_QUERY_PARAM}=${connectMode}` : ''
     return {

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

@@ -1100,9 +1100,9 @@ export const Sidebar = memo(function Sidebar({
     () =>
       permissionConfig.hideIntegrationsTab
         ? []
-        : buildIntegrationSearchItems(workspaceId, isBlockAllowed, (blockType) => {
+        : buildIntegrationSearchItems(workspaceId, isBlockAllowed, (blockType, authType) => {
             const availability = integrationAvailability.get(blockType.toLowerCase())
-            return resolveIntegrationSearchConnectMode(availability ?? null)
+            return resolveIntegrationSearchConnectMode(availability ?? null, authType)
           }),
     [workspaceId, permissionConfig.hideIntegrationsTab, isBlockAllowed, integrationAvailability]
   )

apps/sim/blocks/blocks/oracle_fusion_scm.ts

@@ -472,15 +472,25 @@ Return ONLY the q filter expression - no explanations or extra text.`,
     config: {
       tool: (params) => params.operation,
       params: (params) => {
-        const { operation: _operation, ...rest } = params
+        const {
+          operation: _operation,
+          advancedMode: _advancedMode,
+          q,
+          finder,
+          orderBy,
+          limit,
+          offset,
+          totalResults,
+          ...rest
+        } = params
         return {
           ...rest,
-          q: optionalString(rest.q, 'Filter'),
-          finder: optionalString(rest.finder, 'Finder'),
-          orderBy: optionalString(rest.orderBy, 'Order By'),
-          limit: parseOptionalNumberInput(rest.limit, 'Limit', { integer: true, min: 1, max: 100 }),
-          offset: parseOptionalNumberInput(rest.offset, 'Offset', { integer: true, min: 0 }),
-          totalResults: parseOptionalBooleanInput(rest.totalResults),
+          q: optionalString(q, 'Filter'),
+          finder: optionalString(finder, 'Finder'),
+          orderBy: optionalString(orderBy, 'Order By'),
+          limit: parseOptionalNumberInput(limit, 'Limit', { integer: true, min: 1, max: 100 }),
+          offset: parseOptionalNumberInput(offset, 'Offset', { integer: true, min: 0 }),
+          totalResults: parseOptionalBooleanInput(totalResults),
         }
       },
     },