fix(self-host): preserve integration availability paths

Author: TheodoreSpeaks

apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx

@@ -86,7 +86,11 @@ function IntegrationItem({
       iconVariant='custom'
       icon={<IntegrationTile blockType={blockType} icon={Icon} />}
       title={name}
-      description={unavailable ? 'Unavailable in this deployment' : description || undefined}
+      description={
+        unavailable
+          ? 'Unavailable in this deployment. Contact your administrator.'
+          : description || undefined
+      }
       href={`/workspace/${workspaceId}/integrations/${slug}`}
       clickLabel={`Open ${name}`}
       navigable={!unavailable}

apps/sim/lib/core/config/env-flags.ts

@@ -1,18 +1,15 @@
 /**
- * Environment utility functions for consistent environment detection across the application
+ * Loaded by `next.config.ts` before the `@/` alias is available, so
+ * config-boundary dependencies in this module must use relative imports.
  */
 
-import {
-  hasEnvCapabilityValue,
-  inspectCapability,
-  SANDBOX_CAPABILITY,
-} from '@/lib/core/config/env-capabilities'
 import {
   ENTERPRISE_FEATURE_LEGACY_DEFAULTS,
   type EnterpriseFeature,
   resolveEnterpriseEntitlement,
 } from './enterprise-entitlements'
 import { env, envBoolean, getEnv, isFalsy, isTruthy } from './env'
+import { hasEnvCapabilityValue, inspectCapability, SANDBOX_CAPABILITY } from './env-capabilities'
 
 /**
  * Is the application running in production mode

apps/sim/lib/integrations/availability.server.test.ts

@@ -64,6 +64,15 @@ describe('integration availability', () => {
     })
   })
 
+  it('keeps an ungated service-account path available when OAuth is partial', () => {
+    expect(availabilityFor('notion_v2', { NOTION_CLIENT_ID: 'client' })).toMatchObject({
+      state: 'limited',
+      oauthAvailable: false,
+      serviceAccountAvailable: true,
+      missingFields: ['NOTION_CLIENT_SECRET'],
+    })
+  })
+
   it('marks an unconfigured OAuth-only integration unavailable', () => {
     expect(availabilityFor('x')).toMatchObject({
       state: 'unavailable',

apps/sim/lib/integrations/availability.ts

@@ -132,10 +132,10 @@ function resolveOAuthIntegrationAvailability(
   const state: IntegrationAvailabilityState =
     oauth.state === 'ready'
       ? 'ready'
-      : oauth.state === 'partial' || oauth.state === 'invalid'
-        ? 'misconfigured'
-        : serviceAccountAvailable
-          ? 'limited'
+      : serviceAccountAvailable
+        ? 'limited'
+        : oauth.state === 'partial' || oauth.state === 'invalid'
+          ? 'misconfigured'
           : 'unavailable'
 
   return {

apps/sim/lib/integrations/credential-visibility.server.test.ts

@@ -126,6 +126,40 @@ describe('integration credential visibility', () => {
     expect(revealed.isCredentialVisible(credential)).toBe(true)
   })
 
+  it('projects partial OAuth state through a revealed service-account preview', () => {
+    getIntegrationAvailabilityMock.mockReturnValue([
+      availability('slack', 'misconfigured', {
+        oauthAvailable: false,
+        serviceAccountAvailable: false,
+      }),
+    ])
+    const visibility = createIntegrationCredentialVisibility({
+      allowedIntegrationTypes: new Set(['slack']),
+      blockVisibility: {
+        revealed: new Set(['slack_v2']),
+        disabled: new Set(),
+        previewTagged: new Set(['slack_v2']),
+      },
+      oauthServices: SERVICES,
+    })
+    const disabled = createIntegrationCredentialVisibility({
+      allowedIntegrationTypes: new Set(['slack']),
+      blockVisibility: {
+        revealed: new Set(['slack_v2']),
+        disabled: new Set(['slack_v2']),
+        previewTagged: new Set(['slack_v2']),
+      },
+      oauthServices: SERVICES,
+    })
+
+    const credential = {
+      providerId: 'slack-custom-bot',
+      type: 'service_account',
+    } as const
+    expect(visibility.isCredentialVisible(credential)).toBe(true)
+    expect(disabled.isCredentialVisible(credential)).toBe(false)
+  })
+
   it('leaves non-integration credentials visible', () => {
     const visibility = createIntegrationCredentialVisibility({
       allowedIntegrationTypes: new Set(),

apps/sim/lib/integrations/credential-visibility.server.ts

@@ -3,6 +3,7 @@ import { getServiceAccountGatingBlockType } from '@/lib/credentials/service-acco
 import {
   getIntegrationTypesForOAuthServiceId,
   isOAuthServiceAllowedByIntegrationTypes,
+  resolveIntegrationAvailabilityStateForVisibility,
 } from '@/lib/integrations/availability'
 import {
   getIntegrationAvailability,
@@ -102,9 +103,13 @@ export function createIntegrationCredentialVisibility({
       return owners.some(
         (service) =>
           isServiceAllowed(service) &&
-          visibleAvailability(service).some(
-            (availability) => availability.state !== 'misconfigured'
-          )
+          visibleAvailability(service).some((availability) => {
+            const state = resolveIntegrationAvailabilityStateForVisibility(
+              availability,
+              blockVisibility
+            )
+            return state === 'ready' || state === 'limited'
+          })
       )
     }