fix(integrations): never answer with a sibling's tile

waleedlatif1 · waleedlatif1 · commit b724b08cbd80 · 2026-08-13T17:10:41.000-07:00
Two integrations can share one OAuth id: Google Slides is authenticated by
Drive's `google-drive` service and Jira Service Management by Jira's `jira`.
Indexing first-write-wins made those ids resolve to whichever sorted first, so
the dialog connecting Slides could wear Drive's brand.

An id claimed by more than one block type now resolves to neither, and the
caller keeps the service-specific mark it already had. A wrong brand is worse
than no tile.
diff --git a/apps/sim/lib/integrations/oauth-service.test.ts b/apps/sim/lib/integrations/oauth-service.test.ts
@@ -185,6 +185,13 @@ describe('resolveServiceAccountIntegration', () => {
   })
 })
 
+/**
+ * Integrations whose `oauthServiceId` is shared with a sibling, so the id names
+ * a pair rather than a block: Google Slides rides Drive's service, Jira Service
+ * Management rides Jira's. The bridge deliberately resolves none of them.
+ */
+const SHARED_OAUTH_ID_SLUGS = ['google-drive', 'google-slides', 'jira', 'jira-service-management']
+
 /** Resolved block type with any version suffix dropped, for stable assertions. */
 function baseTypeFor(...keys: (string | undefined)[]): string | undefined {
   const blockType = resolveIntegrationBlockTypeForOAuth(...keys)
@@ -223,18 +230,27 @@ describe('resolveIntegrationBlockTypeForOAuth', () => {
     expect(resolveIntegrationBlockTypeForOAuth(undefined, '')).toBeUndefined()
   })
 
-  it.concurrent('resolves every OAuth integration in the catalog to a block type', () => {
+  it.concurrent('refuses to guess when one OAuth id names more than one block', () => {
+    // Google Slides is authenticated by Drive's service and JSM by Jira's, so
+    // these ids name a pair. Answering with either member would put the wrong
+    // brand on the other's connect dialog, so the bridge declines.
+    expect(resolveIntegrationBlockTypeForOAuth('google-drive')).toBeUndefined()
+    expect(resolveIntegrationBlockTypeForOAuth('jira')).toBeUndefined()
+  })
+
+  it.concurrent('resolves every OAuth integration whose id names it alone', () => {
     // A credential surface that cannot reach a block type falls back to the
     // colourless OAUTH_PROVIDERS mark, which is the bug this bridge exists to
-    // close — so no OAuth integration may be missing from the index.
+    // close — so every unambiguous integration must be in the index, and the
+    // only permitted misses are the shared ids above.
     const unresolved = INTEGRATIONS.filter(
       (integration) =>
         integration.authType === 'oauth' &&
         integration.oauthServiceId &&
         !resolveIntegrationBlockTypeForOAuth(integration.oauthServiceId)
     ).map((integration) => integration.slug)
 
-    expect(unresolved).toEqual([])
+    expect(unresolved.sort()).toEqual(SHARED_OAUTH_ID_SLUGS)
   })
 })
 
@@ -244,7 +260,10 @@ describe('the OAuth bridge reaches a renderable tile', () => {
     // A type that resolves but has no registered icon or colour would paint an
     // empty square in the connect dialog — worse than the grey mark it replaced.
     const broken = INTEGRATIONS.filter(
-      (integration) => integration.authType === 'oauth' && integration.oauthServiceId
+      (integration) =>
+        integration.authType === 'oauth' &&
+        integration.oauthServiceId &&
+        !SHARED_OAUTH_ID_SLUGS.includes(integration.slug)
     ).flatMap((integration) => {
       const blockType = resolveIntegrationBlockTypeForOAuth(integration.oauthServiceId)
       if (!blockType) return [`${integration.slug}: unresolved`]
diff --git a/apps/sim/lib/integrations/oauth-service.ts b/apps/sim/lib/integrations/oauth-service.ts
@@ -72,28 +72,38 @@ export function resolveOAuthServiceForSlug(slug: string): OAuthServiceMatch | nu
  * dialog. This is the bridge back: given any OAuth id, the block whose config
  * owns the icon and `bgColor`.
  *
- * First write wins, so a family provider resolves to the same member every
- * time rather than flipping with catalog order.
+ * A key two integrations both claim resolves to neither. Google Slides is
+ * authenticated by Drive's `google-drive` service and Jira Service Management
+ * by Jira's `jira`, so those ids name a pair, not a block — and picking the
+ * one that happens to sort first would put Drive's tile on the dialog opening
+ * Slides. Dropping the key falls the caller back to the service-specific mark
+ * it already had, which is the honest answer: no wrong brand.
  */
 const BLOCK_TYPE_BY_OAUTH_KEY: ReadonlyMap<string, string> = (() => {
-  const index = new Map<string, string>()
-  const add = (key: string | undefined, blockType: string) => {
+  const claims = new Map<string, Set<string>>()
+  const claim = (key: string | undefined, blockType: string) => {
     if (!key) return
     const normalized = key.toLowerCase()
-    if (!index.has(normalized)) index.set(normalized, blockType)
+    const owners = claims.get(normalized)
+    if (owners) owners.add(blockType)
+    else claims.set(normalized, new Set([blockType]))
   }
 
   for (const integration of INTEGRATIONS_DATA) {
     if (integration.authType !== 'oauth' || !integration.oauthServiceId) continue
     const service = getServiceConfigByServiceId(integration.oauthServiceId)
     if (!service) continue
-    add(integration.oauthServiceId, integration.type)
-    add(service.providerId, integration.type)
+    claim(integration.oauthServiceId, integration.type)
+    claim(service.providerId, integration.type)
     for (const extraProviderId of service.additionalProviderIds ?? []) {
-      add(extraProviderId, integration.type)
+      claim(extraProviderId, integration.type)
     }
   }
 
+  const index = new Map<string, string>()
+  for (const [key, owners] of claims) {
+    if (owners.size === 1) index.set(key, owners.values().next().value as string)
+  }
   return index
 })()
 
