fix(self-host): preserve capability compatibility

Author: TheodoreSpeaks

apps/sim/.env.example

@@ -100,7 +100,7 @@ CRON_SECRET=your_cron_secret # Use `openssl rand -hex 32` to generate. Authentic
 # OCR_PROVIDER=local                              # One of: local, mistral, azure-mistral
 
 # File Storage (Optional - defaults to local disk; use S3, Azure Blob, or Google Cloud Storage for production)
-# STORAGE_PROVIDER=local                          # One of: local, s3, azure, gcs. Required when cloud storage is configured
+# STORAGE_PROVIDER=local                          # Optional override: local, s3, azure, or gcs. Unset preserves Azure → S3 → GCS → local precedence
 # AWS_REGION=us-east-1                            # Required with S3_BUCKET_NAME to enable S3. Use "auto" for Cloudflare R2
 # AWS_ACCESS_KEY_ID=                              # Omit to use the instance/IRSA credential chain
 # AWS_SECRET_ACCESS_KEY=                          # Omit to use the instance/IRSA credential chain

apps/sim/app/api/auth/instagram/authorize/route.ts

@@ -4,7 +4,6 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { authorizeInstagramContract } from '@/lib/api/contracts/oauth-connections'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { env } from '@/lib/core/config/env'
 import { requireConfiguredOAuthClient } from '@/lib/core/config/env-capabilities.server'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { isSameOrigin } from '@/lib/core/utils/validation'
@@ -29,13 +28,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    requireConfiguredOAuthClient('instagram')
-
-    const clientId = env.INSTAGRAM_CLIENT_ID
-    if (!clientId) {
-      logger.error('INSTAGRAM_CLIENT_ID not configured')
-      return NextResponse.json({ error: 'Instagram client ID not configured' }, { status: 500 })
-    }
+    const {
+      values: { INSTAGRAM_CLIENT_ID: clientId },
+    } = requireConfiguredOAuthClient('instagram')
 
     const parsed = await parseRequest(authorizeInstagramContract, request, {})
     if (!parsed.success) return parsed.response

apps/sim/app/api/auth/oauth2/callback/instagram/route.ts

@@ -7,7 +7,8 @@ import { type NextRequest, NextResponse } from 'next/server'
 import { instagramCallbackContract } from '@/lib/api/contracts/oauth-connections'
 import { parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
-import { env } from '@/lib/core/config/env'
+import { EnvCapabilityConfigurationError } from '@/lib/core/config/env-capabilities'
+import { requireConfiguredOAuthClient } from '@/lib/core/config/env-capabilities.server'
 import {
   DEFAULT_MAX_ERROR_BODY_BYTES,
   readResponseJsonWithLimit,
@@ -76,14 +77,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       )
     }
 
-    const clientId = env.INSTAGRAM_CLIENT_ID
-    const clientSecret = env.INSTAGRAM_CLIENT_SECRET
-    if (!clientId || !clientSecret) {
-      logger.error('Instagram credentials not configured')
-      return clearOAuthCookies(
-        NextResponse.redirect(`${baseUrl}/workspace?error=instagram_config_error`)
-      )
-    }
+    const {
+      values: { INSTAGRAM_CLIENT_ID: clientId, INSTAGRAM_CLIENT_SECRET: clientSecret },
+    } = requireConfiguredOAuthClient('instagram')
 
     if (!code) {
       logger.error('No authorization code received from Instagram')
@@ -318,8 +314,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     return clearOAuthCookies(NextResponse.redirect(finalUrl.toString()))
   } catch (error) {
     logger.error('Error in Instagram OAuth callback', { error })
-    return clearOAuthCookies(
-      NextResponse.redirect(`${baseUrl}/workspace?error=instagram_callback_error`)
-    )
+    const errorCode =
+      error instanceof EnvCapabilityConfigurationError && error.capabilityId === 'oauth'
+        ? 'instagram_config_error'
+        : 'instagram_callback_error'
+    return clearOAuthCookies(NextResponse.redirect(`${baseUrl}/workspace?error=${errorCode}`))
   }
 })

apps/sim/app/api/auth/oauth2/callback/shopify/route.ts

@@ -7,7 +7,8 @@ import {
   shopifyShopDomainSchema,
 } from '@/lib/api/contracts/oauth-connections'
 import { getSession } from '@/lib/auth'
-import { env } from '@/lib/core/config/env'
+import { EnvCapabilityConfigurationError } from '@/lib/core/config/env-capabilities'
+import { requireConfiguredOAuthClient } from '@/lib/core/config/env-capabilities.server'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
@@ -61,13 +62,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     const storedState = request.cookies.get('shopify_oauth_state')?.value
     const storedShop = request.cookies.get('shopify_shop_domain')?.value
 
-    const clientId = env.SHOPIFY_CLIENT_ID
-    const clientSecret = env.SHOPIFY_CLIENT_SECRET
-
-    if (!clientId || !clientSecret) {
-      logger.error('Shopify credentials not configured')
-      return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_config_error`)
-    }
+    const {
+      values: { SHOPIFY_CLIENT_ID: clientId, SHOPIFY_CLIENT_SECRET: clientSecret },
+    } = requireConfiguredOAuthClient('shopify')
 
     if (!validateHmac(searchParams, clientSecret)) {
       logger.error('HMAC validation failed in Shopify OAuth callback')
@@ -164,6 +161,10 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
     return response
   } catch (error) {
     logger.error('Error in Shopify OAuth callback:', error)
-    return NextResponse.redirect(`${baseUrl}/workspace?error=shopify_callback_error`)
+    const errorCode =
+      error instanceof EnvCapabilityConfigurationError && error.capabilityId === 'oauth'
+        ? 'shopify_config_error'
+        : 'shopify_callback_error'
+    return NextResponse.redirect(`${baseUrl}/workspace?error=${errorCode}`)
   }
 })

apps/sim/app/api/auth/shopify/authorize/route.ts

@@ -6,7 +6,6 @@ import {
   shopifyShopDomainSchema,
 } from '@/lib/api/contracts/oauth-connections'
 import { getSession } from '@/lib/auth'
-import { env } from '@/lib/core/config/env'
 import { requireConfiguredOAuthClient } from '@/lib/core/config/env-capabilities.server'
 import { getBaseUrl } from '@/lib/core/utils/urls'
 import { isSameOrigin } from '@/lib/core/utils/validation'
@@ -26,13 +25,9 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
     }
 
-    requireConfiguredOAuthClient('shopify')
-
-    const clientId = env.SHOPIFY_CLIENT_ID
-    if (!clientId) {
-      logger.error('SHOPIFY_CLIENT_ID not configured')
-      return NextResponse.json({ error: 'Shopify client ID not configured' }, { status: 500 })
-    }
+    const {
+      values: { SHOPIFY_CLIENT_ID: clientId },
+    } = requireConfiguredOAuthClient('shopify')
 
     const query = shopifyAuthorizeQuerySchema.parse({
       shop: request.nextUrl.searchParams.get('shop') || undefined,

apps/sim/app/workspace/[workspaceId]/integrations/[block]/integration-block-detail.tsx

@@ -13,7 +13,6 @@ import {
   resolveCredentialDisplay,
   resolveOAuthServiceForIntegration,
 } from '@/lib/integrations'
-import { getServiceAccountMetadata } from '@/lib/integrations/service-account-metadata'
 import { credentialProviderMatchesService } from '@/lib/oauth'
 import { ConnectOAuthModal } from '@/app/workspace/[workspaceId]/components/connect-oauth-modal'
 import { RESOURCE_TILE_BASE } from '@/app/workspace/[workspaceId]/components/resource-tile'
@@ -98,14 +97,8 @@ export function IntegrationBlockDetail({ integration, workspaceId }: Integration
     serviceName: oauthService?.serviceName,
     serviceIcon: oauthService?.serviceIcon,
   })
-  const serviceAccountMetadata = integration.oauthServiceId
-    ? getServiceAccountMetadata(integration.oauthServiceId)
-    : undefined
   const serviceAccountDeploymentAvailable =
-    availability?.state === 'ready' ||
-    availability?.state === 'limited' ||
-    (availability?.state === 'unavailable' &&
-      serviceAccountMetadata?.deploymentRequirement === 'preview-gated')
+    availability?.state === 'ready' || availability?.state === 'limited'
   const hasServiceAccount =
     serviceAccountDeploymentAvailable &&
     Boolean(serviceAccountTarget) &&

apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx

@@ -13,15 +13,13 @@ import {
 } from '@sim/emcn'
 import { useParams } from 'next/navigation'
 import { useQueryStates } from 'nuqs'
-import { getServiceAccountGatingBlockType } from '@/lib/credentials/service-account-provider-ids'
 import {
   blockTypeToIconMap,
   formatIntegrationType,
   INTEGRATIONS,
   type Integration,
   resolveCredentialDisplay,
 } from '@/lib/integrations'
-import { getServiceAccountMetadata } from '@/lib/integrations/service-account-metadata'
 import { IntegrationSection } from '@/app/workspace/[workspaceId]/integrations/components/integration-section'
 import { IntegrationTabsHeader } from '@/app/workspace/[workspaceId]/integrations/components/integration-tabs-header'
 import { IntegrationTile } from '@/app/workspace/[workspaceId]/integrations/components/integrations-showcase'
@@ -36,8 +34,6 @@ import {
 } from '@/app/workspace/[workspaceId]/integrations/search-params'
 import { SettingsEmptyState } from '@/app/workspace/[workspaceId]/settings/components/settings-empty-state'
 import { SettingsResourceRow } from '@/app/workspace/[workspaceId]/settings/components/settings-resource-row'
-import { useCustomBlockOverlayVersion } from '@/blocks/custom/client-overlay'
-import { overlayVisibility } from '@/blocks/visibility/context'
 import { useWorkspaceCredentials, type WorkspaceCredential } from '@/hooks/queries/credentials'
 import { useDebouncedSearchSetter } from '@/hooks/use-debounced-search-setter'
 import { usePermissionConfig } from '@/hooks/use-permission-config'
@@ -66,31 +62,6 @@ const ALL_CATEGORY_SECTIONS: readonly { label: string; integrations: Integration
   })).sort((a, b) => a.label.localeCompare(b.label))
 })()
 
-/** Resolves preview-gated service-account paths revealed for the current viewer. */
-function useRevealedServiceAccountIntegrationTypes(): ReadonlySet<string> {
-  const overlayVersion = useCustomBlockOverlayVersion()
-  return useMemo(() => {
-    const visibility = overlayVisibility()
-    return new Set(
-      INTEGRATIONS.flatMap((integration) => {
-        if (!integration.oauthServiceId) return []
-        const metadata = getServiceAccountMetadata(integration.oauthServiceId)
-        if (metadata?.deploymentRequirement !== 'preview-gated') return []
-        const gatingBlockType = getServiceAccountGatingBlockType(metadata.providerId)
-        if (!gatingBlockType) {
-          throw new Error(
-            `Preview-gated service account ${metadata.providerId} has no gating block type`
-          )
-        }
-        return visibility?.revealed.has(gatingBlockType) &&
-          !visibility.disabled.has(gatingBlockType)
-          ? [integration.type.toLowerCase()]
-          : []
-      })
-    )
-  }, [overlayVersion])
-}
-
 interface IntegrationItemProps {
   blockType: string
   slug: string
@@ -167,7 +138,6 @@ export function Integrations() {
   const params = useParams()
   const workspaceId = (params?.workspaceId as string) || ''
   const { integrationAvailability } = usePermissionConfig()
-  const revealedServiceAccountIntegrationTypes = useRevealedServiceAccountIntegrationTypes()
 
   const [{ category: selectedCategory, search: urlSearchTerm }, setIntegrationFilters] =
     useQueryStates(integrationsParsers, integrationsUrlKeys)
@@ -379,9 +349,6 @@ export function Integrations() {
                   const availability = integrationAvailability.get(integration.type.toLowerCase())
                   const deploymentUnavailable =
                     availability?.state === 'unavailable' || availability?.state === 'misconfigured'
-                  const previewServiceAccountAvailable = revealedServiceAccountIntegrationTypes.has(
-                    integration.type.toLowerCase()
-                  )
                   return (
                     <IntegrationItem
                       key={integration.type}
@@ -391,11 +358,7 @@ export function Integrations() {
                       name={integration.name}
                       description={integration.description}
                       icon={Icon}
-                      unavailable={
-                        integration.authType === 'oauth' &&
-                        !previewServiceAccountAvailable &&
-                        deploymentUnavailable
-                      }
+                      unavailable={integration.authType === 'oauth' && deploymentUnavailable}
                     />
                   )
                 })}

apps/sim/hooks/use-permission-config.ts

@@ -10,12 +10,17 @@ import {
   type IntegrationAvailabilityResponse,
 } from '@/lib/api/contracts/common'
 import { getEnv, isTruthy } from '@/lib/core/config/env'
-import { isDeploymentGatedIntegrationType } from '@/lib/integrations/availability'
+import {
+  isDeploymentGatedIntegrationType,
+  resolveIntegrationAvailabilityStateForVisibility,
+} from '@/lib/integrations/availability'
 import { isBlockTypeAccessControlExempt } from '@/lib/permission-groups/block-access'
 import {
   DEFAULT_PERMISSION_GROUP_CONFIG,
   type PermissionGroupConfig,
 } from '@/lib/permission-groups/types'
+import { useCustomBlockOverlayVersion } from '@/blocks/custom/client-overlay'
+import { overlayVisibility } from '@/blocks/visibility/context'
 import { useUserPermissionConfig } from '@/ee/access-control/hooks/permission-groups'
 
 export interface PermissionConfigResult {
@@ -59,6 +64,7 @@ function intersectAllowlists(a: string[] | null, b: string[] | null): string[] |
 export function usePermissionConfig(): PermissionConfigResult {
   const params = useParams()
   const workspaceId = typeof params?.workspaceId === 'string' ? params.workspaceId : undefined
+  const blockOverlayVersion = useCustomBlockOverlayVersion()
 
   const { data: permissionData, isLoading: isPermissionLoading } =
     useUserPermissionConfig(workspaceId)
@@ -81,16 +87,18 @@ export function usePermissionConfig(): PermissionConfigResult {
     return intersectAllowlists(config.allowedIntegrations, envAllowlist)
   }, [config.allowedIntegrations, envAllowlistData])
 
-  const integrationAvailability = useMemo(
-    () =>
-      new Map(
-        (envAllowlistData?.integrationAvailability ?? []).map((availability) => [
-          availability.type.toLowerCase(),
-          availability,
-        ])
-      ),
-    [envAllowlistData?.integrationAvailability]
-  )
+  const integrationAvailability = useMemo(() => {
+    const visibility = overlayVisibility()
+    return new Map(
+      (envAllowlistData?.integrationAvailability ?? []).map((availability) => [
+        availability.type.toLowerCase(),
+        {
+          ...availability,
+          state: resolveIntegrationAvailabilityStateForVisibility(availability, visibility),
+        },
+      ])
+    )
+  }, [envAllowlistData?.integrationAvailability, blockOverlayVersion])
 
   const isBlockAllowed = useMemo(() => {
     return (blockType: string) => {

apps/sim/lib/core/config/env-capabilities.server.test.ts

@@ -0,0 +1,75 @@
+/**
+ * @vitest-environment node
+ */
+import { resetEnvMock, setEnv } from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, expectTypeOf, it } from 'vitest'
+import {
+  inspectConfiguredOAuthClient,
+  requireConfiguredOAuthClient,
+} from '@/lib/core/config/env-capabilities.server'
+
+describe('server environment capabilities', () => {
+  beforeEach(() => {
+    setEnv({
+      SHOPIFY_CLIENT_ID: undefined,
+      SHOPIFY_CLIENT_SECRET: undefined,
+      SLACK_CLIENT_ID: undefined,
+      SLACK_CLIENT_SECRET: undefined,
+    })
+  })
+
+  afterAll(resetEnvMock)
+
+  it('inspects partial OAuth configuration without throwing', () => {
+    setEnv({ SLACK_CLIENT_ID: 'slack-client' })
+
+    expect(inspectConfiguredOAuthClient('slack')).toEqual({
+      state: 'partial',
+      missingFields: ['SLACK_CLIENT_SECRET'],
+      setupCommand: 'bun run setup integration slack',
+    })
+  })
+
+  it('fails fast when an OAuth client is absent', () => {
+    expect(() => requireConfiguredOAuthClient('shopify')).toThrow(
+      'OAuth client shopify is not configured. Run bun run setup integration shopify.'
+    )
+  })
+
+  it('fails fast when an OAuth client is partially configured', () => {
+    setEnv({ SLACK_CLIENT_ID: 'slack-client' })
+
+    expect(() => requireConfiguredOAuthClient('slack')).toThrow(
+      'OAuth client slack is partially configured — missing SLACK_CLIENT_SECRET. Run bun run setup integration slack.'
+    )
+  })
+
+  it('does not expose non-string OAuth values as configured credentials', () => {
+    setEnv({
+      SHOPIFY_CLIENT_ID: true,
+      SHOPIFY_CLIENT_SECRET: 'shopify-secret',
+    })
+
+    expect(inspectConfiguredOAuthClient('shopify')).toMatchObject({
+      state: 'partial',
+      missingFields: ['SHOPIFY_CLIENT_ID'],
+    })
+    expect(() => requireConfiguredOAuthClient('shopify')).toThrow(/SHOPIFY_CLIENT_ID/)
+  })
+
+  it('returns the validated values with capability-specific field types', () => {
+    setEnv({
+      SHOPIFY_CLIENT_ID: 'shopify-client',
+      SHOPIFY_CLIENT_SECRET: 'shopify-secret',
+    })
+
+    const configured = requireConfiguredOAuthClient('shopify')
+
+    expect(configured.values).toEqual({
+      SHOPIFY_CLIENT_ID: 'shopify-client',
+      SHOPIFY_CLIENT_SECRET: 'shopify-secret',
+    })
+    expectTypeOf(configured.values.SHOPIFY_CLIENT_ID).toEqualTypeOf<string>()
+    expectTypeOf(configured.values.SHOPIFY_CLIENT_SECRET).toEqualTypeOf<string>()
+  })
+})