feat(access-control): per-group chat-deploy auth modes + polish by waleedlatif1 · Pull Request #5818 · simstudioai/sim

waleedlatif1 · 2026-07-21T21:09:50Z

Summary

Add a per-permission-group "Auth modes chat deployments may use" control in the Access Control group's Platform tab, mirroring the existing public-file-share auth-mode control. Admins can now restrict which chat auth modes are allowed (i.e. disable Public, Password, Email, or SSO).
Enforced server-side on chat create (POST /api/chat) and update (PATCH /api/chat/manage/[id]) via a new validateChatDeployAuth (throws ChatDeployAuthNotAllowedError → 403), reusing the same getUserPermissionConfig resolver the file-share gate uses.
The chat deploy modal's "Access control" options are filtered to the allowed set (the currently-saved mode stays visible so existing state always shows; the route remains the source of truth).
Remove the dead Template deploy option (hideDeployTemplate had no consumer anywhere).
Shrink the Access Control block permission icons (size-[9px]) so they no longer touch their tile borders, and normalize the tiles to the size-[16px] shorthand.

Implementation notes

New config field allowedChatDeployAuthTypes (ShareAuthType[] | null, null = all allowed) added to permissionGroupConfigSchema, PermissionGroupConfig, DEFAULT_PERMISSION_GROUP_CONFIG, parsePermissionGroupConfig, and the permissionGroupFullConfigSchema contract. No DB migration — config is a JSONB blob and the parser defaults the field for existing rows.
Enforcement mirrors validatePublicFileSharing; no-ops for non-enterprise / access-control-disabled orgs.

Type of Change

Feature + cleanup

Testing

Added unit tests for validateChatDeployAuth (allow-list hit/miss, null = all, non-enterprise no-op) and 403 enforcement tests on both chat create and update routes. Full suite: 87 passing.
tsc, biome, and check:api-validation all clean.

Checklist

Code follows project style guidelines
Self-reviewed my changes
Tests added/updated and passing
No new warnings introduced
I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

- Add a per-permission-group 'Auth modes chat deployments may use' control, mirroring the existing public-file-share auth-mode control, so admins can disable specific chat auth modes (Public, Password, ...) - Enforce it server-side on chat create/update via validateChatDeployAuth (ChatDeployAuthNotAllowedError -> 403), and filter the chat deploy UI's Access-control options to the allowed set (keeping the saved mode visible) - Remove the dead 'Template' deploy option (hideDeployTemplate had no consumer) - Shrink access-control block permission icons (size-[9px]) so they no longer touch their tile borders; normalize the tiles to size-[16px]

vercel · 2026-07-21T21:09:56Z

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 21, 2026 9:39pm

cursor · 2026-07-21T21:10:01Z

PR Summary

Medium Risk
Changes chat deployment authentication policy on create/update and in copilot deploy paths; misconfiguration could block deployments or leave grandfathered modes in place, but behavior mirrors existing file-share gates with tests.

Overview
Adds per-permission-group control over which chat deployment auth modes (Public, Password, Email, SSO) members may use, parallel to the existing public file-share auth allow-list.

Config & admin UI: New allowedChatDeployAuthTypes on permission group config (replaces unused hideDeployTemplate). Access Control’s Platform tab gets a Chat section with a multi-select for allowed modes; empty selections are blocked so admins must use Hide Chat to disable deploy entirely. File-share auth picker gets the same “at least one mode” guard.

Enforcement: New validateChatDeployAuth / ChatDeployAuthNotAllowedError gates chat create (POST /api/chat), update (PATCH /api/chat/manage/[id]) when authType changes, and copilot chat deploy—unchanged saved modes stay editable (grandfathered). Blocked modes return 403.

Deploy modal: Access control options are filtered via usePermissionConfig; the chat’s saved auth type stays visible/selectable even if newly disallowed.

Minor UI polish: smaller block icons in permission group tiles (size-[9px]).

^{Reviewed by Cursor Bugbot for commit 97b8db6. Configure here.}

greptile-apps · 2026-07-21T21:12:00Z

Greptile Summary

This PR adds per-group controls for chat deployment authentication modes. The main changes are:

Adds configuration and admin UI for allowed chat authentication modes.
Enforces the allow-list in create, update, and Copilot deployment paths.
Filters deployment modal options while preserving saved modes.
Removes the unused template deployment option and adjusts permission icons.

Confidence Score: 5/5

This looks safe to merge.

The latest fixes cover REST and Copilot deployment paths.
First deployments and changed authentication modes are checked against the effective permission configuration.
No blocking issue remains within the follow-up scope.

Important Files Changed

Filename	Overview
apps/sim/app/api/chat/route.ts	Enforces the configured authentication-mode allow-list before creating a chat deployment.
apps/sim/app/api/chat/manage/[id]/route.ts	Validates authentication-mode changes while allowing unrelated edits to saved deployments.
apps/sim/lib/copilot/tools/handlers/deployment/deploy.ts	Applies the same authentication-mode enforcement to Copilot-driven chat deployments.
apps/sim/ee/access-control/utils/permission-check.ts	Adds the shared validator for effective permission-group chat authentication settings.
apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx	Filters selectable authentication modes and keeps a saved mode visible for existing deployments.
apps/sim/lib/permission-groups/types.ts	Adds the new allow-list to permission configuration types, defaults, and parsing.

_{Reviews (4): Last reviewed commit: "fix(access-control): never leave a new c..." | Re-trigger Greptile}

…auth - Enforce validateChatDeployAuth on the copilot executeDeployChat path (it called performChatDeploy directly, bypassing the HTTP-route gate) - Enforce on update only when the auth mode actually changes, so a grandfathered saved mode can be re-saved (e.g. title-only edits) - Chat deploy UI now grandfathers only the saved mode, not the unsaved 'public' default; snap a new chat off a disallowed default to the first allowed mode so it can't submit a value the server rejects

waleedlatif1 · 2026-07-21T21:21:34Z

@greptile

waleedlatif1 · 2026-07-21T21:21:35Z

@cursor review

…nv is off Treat savedAuthType === 'sso' as SSO-enabled when building auth options so an existing SSO chat isn't dropped and silently downgraded by the snap effect. Mirrors the file-share modal.

waleedlatif1 · 2026-07-21T21:27:47Z

@greptile

waleedlatif1 · 2026-07-21T21:27:48Z

@cursor review

Guard the chat-deploy and file-share auth-mode multiselects so the last allowed mode can't be removed while the feature is enabled — an empty allow-list would silently block every deployment/share. Disabling the feature entirely stays the job of the Hide Chat toggle / Public Sharing checkbox.

… modes Surface SSO in the chat deploy options whenever the permission group explicitly allows it (not only when the env flag is on or the chat is saved as SSO), so a group whose only allowed mode is SSO can't produce an empty option set that strands a new chat on a disallowed default. Also drop a redundant trailing comment in the copilot deploy handler.

waleedlatif1 · 2026-07-21T21:39:44Z

@greptile

waleedlatif1 · 2026-07-21T21:39:46Z

@cursor review

cursor

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 97b8db6. Configure here.}

cursor Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread apps/sim/app/api/chat/route.ts

Comment thread ...kflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

vercel Bot temporarily deployed to Preview July 21, 2026 21:21 Inactive

cursor Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread ...kflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

fix(access-control): keep a saved SSO chat mode selectable when SSO e…

25985a8

…nv is off Treat savedAuthType === 'sso' as SSO-enabled when building auth options so an existing SSO chat isn't dropped and silently downgraded by the snap effect. Mirrors the file-share modal.

vercel Bot temporarily deployed to Preview July 21, 2026 21:27 Inactive

cursor Bot reviewed Jul 21, 2026

View reviewed changes

Comment thread ...kflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

vercel Bot temporarily deployed to Preview July 21, 2026 21:33 Inactive

vercel Bot temporarily deployed to Preview July 21, 2026 21:39 Inactive

cursor Bot reviewed Jul 21, 2026

View reviewed changes

waleedlatif1 merged commit 7ee8f46 into staging Jul 21, 2026
20 checks passed

waleedlatif1 deleted the feat/chat-deploy-auth-modes branch July 21, 2026 21:46

waleedlatif1 mentioned this pull request Jul 22, 2026

v0.7.41: email fixes, MCP fixes, gemini 3.6 flash, GitHub runners fallback, mothership experience improvements, soft delete chats #5835

Merged

Uh oh!

Conversation

waleedlatif1 commented Jul 21, 2026

Summary

Implementation notes

Type of Change

Testing

Checklist

Uh oh!

vercel Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Summary

Uh oh!

Uh oh!

Uh oh!

greptile-apps Bot commented Jul 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

waleedlatif1 commented Jul 21, 2026

Uh oh!

cursor Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

vercel Bot commented Jul 21, 2026 •

edited

Loading

cursor Bot commented Jul 21, 2026 •

edited

Loading

greptile-apps Bot commented Jul 21, 2026 •

edited

Loading