fix(atlassian): reject mixed All scopes and run permission tests in CI

Author: waleedlatif1

.github/workflows/test-build.yml

@@ -240,6 +240,19 @@ jobs:
           lib/knowledge/__integration__/connector-upload.integration.ts
           lib/uploads/contexts/organization-logo/application.integration.ts
 
+      - name: Verify Confluence audiences and permission queries in PostgreSQL
+        working-directory: apps/sim
+        env:
+          KNOWLEDGE_ACL_TEST_DATABASE_URL: postgresql://postgres:postgres@127.0.0.1:5432/sim_auth_scim
+        run: |
+          bunx vitest run --mode integration \
+            lib/knowledge/access/group-membership.integration.ts \
+            lib/knowledge/__integration__/confluence-identity.integration.ts \
+            lib/knowledge/__integration__/directory-sync.integration.ts
+          bunx vitest run \
+            lib/knowledge/access/predicate.postgres.test.ts \
+            lib/knowledge/connectors/external-directory.postgres.test.ts
+
   test-build:
     name: Lint and Test
     runs-on: ${{ (vars.CI_PROVIDER == '' || vars.CI_PROVIDER == 'blacksmith') && 'blacksmith-8vcpu-ubuntu-2404' || 'ubuntu-latest' }}

apps/sim/connectors/all-selection.test.ts

@@ -17,6 +17,42 @@ beforeEach(() => {
 afterEach(() => vi.unstubAllGlobals())
 
 describe('dynamic All source validation', () => {
+  describe.each([
+    { name: 'Jira', connector: jiraConnector, field: 'projectKey' },
+    { name: 'Confluence', connector: confluenceConnector, field: 'spaceKey' },
+  ])('$name mixed All selection', ({ connector, field }) => {
+    const error = 'Use "*" by itself for All, or remove it to select individual items.'
+
+    it.each([{ value: '*, ENG' }, { value: ['*', 'ENG'] }, { value: ['ENG', ' * '] }])(
+      'rejects mixed keys before validation requests (%j)',
+      async ({ value }) => {
+        await expect(
+          connector.validateConfig('token', { domain: DOMAIN, [field]: value })
+        ).resolves.toEqual({ valid: false, error })
+        expect(fetchMock).not.toHaveBeenCalled()
+      }
+    )
+
+    it.each([false, true])(
+      'rejects mixed keys before listing or splitting the scope (per member: %s)',
+      async (perMemberListing) => {
+        await expect(
+          connector.listDocuments('token', { domain: DOMAIN, [field]: ['*', 'ENG'] }, undefined, {
+            perMemberListing,
+          })
+        ).rejects.toThrow(error)
+        expect(fetchMock).not.toHaveBeenCalled()
+      }
+    )
+
+    it('rejects mixed keys during resumed hydration before reading the provider', async () => {
+      await expect(
+        connector.getDocument('token', { domain: DOMAIN, [field]: 'ENG, *' }, 'document-1')
+      ).rejects.toThrow(error)
+      expect(fetchMock).not.toHaveBeenCalled()
+    })
+  })
+
   it.each([{ value: '*' }, { value: ['*'] }])(
     'validates Confluence All without enumerating or submitting literal space keys (%j)',
     async ({ value: spaceKey }) => {

apps/sim/connectors/confluence/confluence.ts

@@ -34,7 +34,7 @@ import {
   openConfluenceDirectory,
   validateConfluencePermissionAccess,
 } from '@/connectors/confluence/permissions'
-import { isAllSourceItems } from '@/connectors/selection'
+import { getSourceSelectionError, isAllSourceItems } from '@/connectors/selection'
 import type {
   ConnectorAclContext,
   ConnectorConfig,
@@ -637,6 +637,8 @@ async function resolveConfluenceAcls(
   syncContext?: Record<string, unknown>,
   aclContext?: ConnectorAclContext
 ): Promise<Record<string, MirroredDocumentAcl>> {
+  const selectionError = getSourceSelectionError(sourceConfig.spaceKey)
+  if (selectionError) throw new Error(selectionError)
   const cloudId = await resolveCloudId(accessToken, sourceConfig, syncContext)
 
   const spaceIdForKey = memoizeAsync((spaceKey: string) =>
@@ -836,6 +838,8 @@ export const confluenceConnector: ConnectorConfig = {
   ...confluenceConnectorMeta,
 
   listDocuments: async (accessToken, sourceConfig, cursor, syncContext) => {
+    const selectionError = getSourceSelectionError(sourceConfig.spaceKey)
+    if (selectionError) throw new Error(selectionError)
     const cloudId = await resolveCloudId(accessToken, sourceConfig, syncContext)
     return listConfluenceAttachments({
       accessToken,
@@ -864,6 +868,8 @@ export const confluenceConnector: ConnectorConfig = {
     externalId: string,
     syncContext?: Record<string, unknown>
   ): Promise<ExternalDocument | null> => {
+    const selectionError = getSourceSelectionError(sourceConfig.spaceKey)
+    if (selectionError) throw new Error(selectionError)
     const domain = normalizeConfluenceDomainHost(sourceConfig.domain as string)
     const cloudId = await resolveCloudId(accessToken, sourceConfig, syncContext)
 
@@ -946,6 +952,8 @@ export const confluenceConnector: ConnectorConfig = {
     sourceConfig: Record<string, unknown>,
     syncContext?: Record<string, unknown>
   ): Promise<{ valid: boolean; error?: string }> => {
+    const selectionError = getSourceSelectionError(sourceConfig.spaceKey)
+    if (selectionError) return { valid: false, error: selectionError }
     const domain = sourceConfig.domain as string
     const allSpaces = isAllSourceItems(sourceConfig.spaceKey)
     const spaceKeys = parseMultiValue(sourceConfig.spaceKey)

apps/sim/connectors/jira/jira.ts

@@ -10,7 +10,7 @@ import {
 import { fetchWithRetry } from '@/lib/knowledge/documents/secure-fetch.server'
 import { type RetryOptions, VALIDATE_RETRY_OPTIONS } from '@/lib/knowledge/documents/utils'
 import { jiraConnectorMeta } from '@/connectors/jira/meta'
-import { isAllSourceItems } from '@/connectors/selection'
+import { getSourceSelectionError, isAllSourceItems } from '@/connectors/selection'
 import type { ConnectorConfig, ExternalDocument, ExternalDocumentList } from '@/connectors/types'
 import {
   computeContentHash,
@@ -303,6 +303,8 @@ export const jiraConnector: ConnectorConfig = {
     cursor?: string,
     syncContext?: Record<string, unknown>
   ): Promise<ExternalDocumentList> => {
+    const selectionError = getSourceSelectionError(sourceConfig.projectKey)
+    if (selectionError) throw new Error(selectionError)
     const domain = sourceConfig.domain as string
     const siteUrl = normalizeAtlassianSiteUrl(domain)
     const projectKeys = parseMultiValue(sourceConfig.projectKey)
@@ -527,6 +529,8 @@ export const jiraConnector: ConnectorConfig = {
     externalId: string,
     syncContext?: Record<string, unknown>
   ): Promise<ExternalDocument | null> => {
+    const selectionError = getSourceSelectionError(sourceConfig.projectKey)
+    if (selectionError) throw new Error(selectionError)
     const domain = sourceConfig.domain as string
     const siteUrl = normalizeAtlassianSiteUrl(domain)
     const cloudId = await resolveCloudId(accessToken, domain, syncContext)
@@ -573,6 +577,8 @@ export const jiraConnector: ConnectorConfig = {
     sourceConfig: Record<string, unknown>,
     syncContext?: Record<string, unknown>
   ): Promise<{ valid: boolean; error?: string }> => {
+    const selectionError = getSourceSelectionError(sourceConfig.projectKey)
+    if (selectionError) return { valid: false, error: selectionError }
     const domain = sourceConfig.domain as string
     const projectKeys = parseMultiValue(sourceConfig.projectKey)
 

apps/sim/connectors/selection.ts

@@ -1,3 +1,4 @@
+import type { ConnectorMeta } from '@/connectors/types'
 import { parseMultiValue } from '@/connectors/utils'
 
 /** Persisted scope marker; providers resolve the accessible set during each listing. */
@@ -7,3 +8,27 @@ export function isAllSourceItems(value: unknown): boolean {
   const items = parseMultiValue(value)
   return items.length === 1 && items[0] === ALL_SOURCE_ITEMS
 }
+
+export function getSourceSelectionError(
+  value: unknown,
+  allValue = ALL_SOURCE_ITEMS
+): string | undefined {
+  const items = parseMultiValue(value)
+  if (items.length > 1 && items.includes(allValue)) {
+    return `Use "${allValue}" by itself for All, or remove it to select individual items.`
+  }
+}
+
+export function findSourceSelectionError(
+  connector: Pick<ConnectorMeta, 'configFields'>,
+  sourceConfig: Record<string, unknown>
+): string | undefined {
+  for (const field of connector.configFields) {
+    if (!field.selectAllValue) continue
+    const error = getSourceSelectionError(
+      sourceConfig[field.canonicalParamId ?? field.id],
+      field.selectAllValue
+    )
+    if (error) return error
+  }
+}

apps/sim/lib/knowledge/application/personal-source-setup.test.ts

@@ -90,6 +90,17 @@ const runConnect = (changes = {}) =>
   personalSourceSetup.execute({ principal, input: { ...connect, keys: ['PROJECT'], ...changes } })
 
 describe('personal source setup', () => {
+  it.each(['confluence', 'jira'] as const)(
+    'rejects mixed All and explicit %s keys before discovery or saving',
+    async (connectorType) => {
+      await expect(runConnect({ connectorType, keys: ['*', 'ENG'] })).rejects.toThrow(
+        'Use "*" by itself for All, or remove it to select individual items.'
+      )
+      expect(mocks.selector).not.toHaveBeenCalled()
+      expect(mocks.configure).not.toHaveBeenCalled()
+    }
+  )
+
   it.each(['confluence', 'jira'] as const)(
     'authorizes %s All without freezing the available keys',
     async (connectorType) => {

apps/sim/lib/knowledge/application/personal-source-setup.ts

@@ -28,7 +28,7 @@ import { MAX_SELECTOR_PAGES } from '@/lib/selectors/limits'
 import type { SelectorExecutionResult, SelectorRequest } from '@/lib/selectors/types'
 import { MAX_PERSONAL_SOURCE_SETUP_KEYS } from '@/lib/sim-search/personal-source-setup'
 import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
-import { isAllSourceItems } from '@/connectors/selection'
+import { getSourceSelectionError, isAllSourceItems } from '@/connectors/selection'
 
 const logger = createLogger('PersonalSourceSetup')
 const VALIDATION_PHASE_TIMEOUT_MS = 30_000
@@ -178,6 +178,8 @@ export const personalSourceSetup = defineAuthorizedKnowledgeUseCase({
       throw new OrchestrationError('validation', 'Select between 1 and 1,000 projects or spaces')
     }
     const keys = [...new Set(input.keys.map((key) => key.trim()))]
+    const selectionError = getSourceSelectionError(keys)
+    if (selectionError) throw new OrchestrationError('validation', selectionError)
     const remaining = new Set(keys)
     const cursors = new Set<string>()
     const timeout = AbortSignal.timeout(VALIDATION_PHASE_TIMEOUT_MS)

apps/sim/lib/knowledge/orchestration/connectors.test.ts

@@ -101,8 +101,23 @@ vi.mock('@/connectors/registry.server', () => ({
     },
     notion: {
       auth: { mode: 'apiKey', optional: true },
+      configFields: [],
       validateConfig: vi.fn().mockResolvedValue({ valid: true }),
     },
+    jira: {
+      name: 'Jira',
+      auth: { mode: 'oauth', provider: 'jira' },
+      permissionScopedListing: { capFieldIds: [] },
+      configFields: [
+        { id: 'projectSelector', canonicalParamId: 'projectKey', selectAllValue: '*' },
+      ],
+    },
+    confluence: {
+      name: 'Confluence',
+      auth: { mode: 'oauth', provider: 'confluence' },
+      permissionScopedListing: { capFieldIds: [] },
+      configFields: [{ id: 'spaceSelector', canonicalParamId: 'spaceKey', selectAllValue: '*' }],
+    },
     google_drive: {
       name: 'Google Drive',
       auth: { mode: 'oauth', provider: 'google-drive' },
@@ -155,6 +170,30 @@ describe('performCreateKnowledgeConnector', () => {
     resolveAccessToken: vi.fn(),
   }
 
+  it.each([
+    { connectorType: 'jira', field: 'projectKey' },
+    { connectorType: 'confluence', field: 'spaceKey' },
+  ])(
+    'rejects mixed All keys for credentialless $connectorType members',
+    async ({ connectorType, field }) => {
+      const outcome = await performCreateKnowledgeConnector({
+        ...createParams,
+        connectorType,
+        sourceConfig: { domain: 'example.atlassian.net', [field]: ['*', 'ENG'] },
+        accessMode: 'members',
+        membersBinding: { credentialGroupId: 'group-1', credentialGroupOptionId: 'option-1' },
+      })
+      expect(outcome).toMatchObject({
+        success: false,
+        errorCode: 'validation',
+        error: 'Use "*" by itself for All, or remove it to select individual items.',
+      })
+      expect(dbChainMockFns.insert).not.toHaveBeenCalled()
+      expect(mockGrant).not.toHaveBeenCalled()
+      expect(createParams.resolveAccessToken).not.toHaveBeenCalled()
+    }
+  )
+
   it('validates and encrypts a GitHub PAT without resolving an OAuth account or returning the secret', async () => {
     dbChainMockFns.limit.mockResolvedValueOnce([{ id: 'kb-1' }])
     dbChainMockFns.returning.mockResolvedValueOnce([
@@ -481,6 +520,41 @@ describe('performUpdateKnowledgeConnector', () => {
 
   afterAll(resetDbChainMock)
 
+  it.each([
+    { connectorType: 'jira', field: 'projectKey' },
+    { connectorType: 'confluence', field: 'spaceKey' },
+  ])(
+    'rejects mixed All keys when editing credentialless $connectorType members',
+    async ({ connectorType, field }) => {
+      queueTableRows(schemaMock.knowledgeConnector, [
+        {
+          id: 'conn-1',
+          connectorType,
+          accessMode: 'members',
+          status: 'active',
+          memberSyncStatus: 'idle',
+          credentialId: null,
+        },
+      ])
+      const validateSourceConfig = vi.fn()
+      const outcome = await performUpdateKnowledgeConnector({
+        ...ACTOR,
+        knowledgeBase: KB,
+        connectorId: 'conn-1',
+        updates: { sourceConfig: { domain: 'example.atlassian.net', [field]: '*, ENG' } },
+        resolveBillingAttribution,
+        validateSourceConfig,
+      })
+      expect(outcome).toMatchObject({
+        success: false,
+        errorCode: 'validation',
+        error: 'Use "*" by itself for All, or remove it to select individual items.',
+      })
+      expect(dbChainMockFns.update).not.toHaveBeenCalled()
+      expect(validateSourceConfig).not.toHaveBeenCalled()
+    }
+  )
+
   it('rejects an update that names nothing before reading the connector', async () => {
     const outcome = await performUpdateKnowledgeConnector({
       ...ACTOR,

apps/sim/lib/knowledge/orchestration/connectors.ts

@@ -64,6 +64,7 @@ import { createTagDefinition } from '@/lib/knowledge/tags/service'
 import { captureServerEvent } from '@/lib/posthog/server'
 import { searchSourceIdentity } from '@/lib/sim-search/source-identity'
 import { getConnectorApiKeyConfig } from '@/connectors/auth'
+import { findSourceSelectionError } from '@/connectors/selection'
 import { PER_MEMBER_LISTING_CONTEXT } from '@/connectors/utils'
 
 const logger = createLogger('KnowledgeConnectorOrchestration')
@@ -259,6 +260,9 @@ export async function performCreateKnowledgeConnector(
     return fail(`Unknown connector type: ${connectorType}`, 'validation')
   }
 
+  const selectionError = findSourceSelectionError(connectorConfig, sourceConfig)
+  if (selectionError) return fail(selectionError, 'validation')
+
   try {
     await assertLiveSyncAllowed(resourceScopeFromOwner(kb), syncIntervalMinutes)
   } catch (error) {
@@ -825,11 +829,13 @@ export async function performUpdateKnowledgeConnector(
     let nextSourceConfig = params.prepareSourceConfig
       ? await params.prepareSourceConfig(existing, updates.sourceConfig)
       : updates.sourceConfig
-    if (aclIsDerived(accessMode)) {
-      /** A derived-ACL mode has no listing cap; a save may refuse one, never store one. */
-      const { CONNECTOR_REGISTRY } = await import('@/connectors/registry.server')
-      const connectorConfig = CONNECTOR_REGISTRY[existing.connectorType]
-      if (connectorConfig) {
+    const { CONNECTOR_REGISTRY } = await import('@/connectors/registry.server')
+    const connectorConfig = CONNECTOR_REGISTRY[existing.connectorType]
+    if (connectorConfig) {
+      const selectionError = findSourceSelectionError(connectorConfig, nextSourceConfig)
+      if (selectionError) return fail(selectionError, 'validation')
+      if (aclIsDerived(accessMode)) {
+        /** A derived-ACL mode has no listing cap; a save may refuse one, never store one. */
         const capViolation = findListingCapViolation(connectorConfig, nextSourceConfig)
         if (capViolation) return fail(capViolation, 'validation')
         nextSourceConfig = stripListingCapFields(connectorConfig, nextSourceConfig)