fix(access-control): add auth to allowlist endpoint, fix loading state race, use accurate error message

Author: waleedlatif1

apps/sim/app/api/settings/allowed-integrations/route.ts

@@ -1,7 +1,13 @@
 import { NextResponse } from 'next/server'
+import { getSession } from '@/lib/auth'
 import { getAllowedIntegrationsFromEnv } from '@/lib/core/config/feature-flags'
 
 export async function GET() {
+  const session = await getSession()
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
   return NextResponse.json({
     allowedIntegrations: getAllowedIntegrationsFromEnv(),
   })

apps/sim/ee/access-control/utils/permission-check.ts

@@ -27,8 +27,12 @@ export class ProviderNotAllowedError extends Error {
 }
 
 export class IntegrationNotAllowedError extends Error {
-  constructor(blockType: string) {
-    super(`Integration "${blockType}" is not allowed based on your permission group settings`)
+  constructor(blockType: string, reason?: string) {
+    super(
+      reason
+        ? `Integration "${blockType}" is not allowed: ${reason}`
+        : `Integration "${blockType}" is not allowed based on your permission group settings`
+    )
     this.name = 'IntegrationNotAllowedError'
   }
 }
@@ -159,7 +163,7 @@ export async function validateBlockType(
   const envAllowlist = getAllowedIntegrationsFromEnv()
   if (envAllowlist !== null && !envAllowlist.includes(blockType)) {
     logger.warn('Integration blocked by env allowlist', { blockType })
-    throw new IntegrationNotAllowedError(blockType)
+    throw new IntegrationNotAllowedError(blockType, 'blocked by server ALLOWED_INTEGRATIONS policy')
   }
 
   if (!userId) {

apps/sim/hooks/use-permission-config.ts

@@ -53,8 +53,13 @@ export function usePermissionConfig(): PermissionConfigResult {
   const { data: organizationsData } = useOrganizations()
   const activeOrganization = organizationsData?.activeOrganization
 
-  const { data: permissionData, isLoading } = useUserPermissionConfig(activeOrganization?.id)
-  const { data: envAllowlistData } = useAllowedIntegrationsFromEnv()
+  const { data: permissionData, isLoading: isPermissionLoading } = useUserPermissionConfig(
+    activeOrganization?.id
+  )
+  const { data: envAllowlistData, isLoading: isEnvAllowlistLoading } =
+    useAllowedIntegrationsFromEnv()
+
+  const isLoading = isPermissionLoading || isEnvAllowlistLoading
 
   const config = useMemo(() => {
     if (accessControlDisabled) {