fix(access-requests): recheck rollout and retain public models

Author: waleedlatif1

apps/sim/lib/permission-access-requests/catalog-registry.ts

@@ -26,7 +26,7 @@ import {
 import { getBlockRegistry } from '@/blocks/registry'
 import { isHiddenUnder } from '@/blocks/visibility/context'
 import { CONNECTOR_META_REGISTRY } from '@/connectors/registry'
-import { DYNAMIC_MODEL_PROVIDERS, PROVIDER_DEFINITIONS } from '@/providers/models'
+import { getStaticProviderModels, PROVIDER_DEFINITIONS } from '@/providers/models'
 import { filterBlacklistedModels } from '@/providers/utils'
 import { getToolMetadata } from '@/tools/metadata'
 
@@ -36,8 +36,6 @@ export interface AccessRequestCatalogContext {
   workspaceId: string | null
 }
 
-const DYNAMIC_PROVIDERS: ReadonlySet<string> = new Set(DYNAMIC_MODEL_PROVIDERS)
-
 function isProviderDeploymentAvailable(providerId: string): boolean {
   if (providerId === 'ollama') return !isHosted || isOllamaUrlConfigured()
   if (providerId === 'vllm') return Boolean(env.VLLM_BASE_URL?.trim())
@@ -128,10 +126,9 @@ export async function loadAccessRequestRegistryCatalog(
       continue
     }
     providers.push({ id: provider.id, label: provider.name })
-    /** Dynamic arrays may contain private names populated by another credential's discovery. */
-    if (targetKind === 'provider' || DYNAMIC_PROVIDERS.has(provider.id)) continue
+    if (targetKind === 'provider') continue
     const availableModelIds = filterBlacklistedModels(
-      provider.models
+      getStaticProviderModels(provider.id)
         .filter((model) => model.sunset?.status !== 'deprecated')
         .map((model) => model.id)
     )

apps/sim/lib/permission-access-requests/catalog.test.ts

@@ -42,25 +42,37 @@ vi.mock('@/lib/integrations/availability.server', () => ({
 }))
 vi.mock('@/providers/utils', () => ({ filterBlacklistedModels: mocks.filterModels }))
 vi.mock('@/tools/metadata', () => ({ getToolMetadata: mocks.toolMetadata }))
-vi.mock('@/providers/models', () => ({
-  DYNAMIC_MODEL_PROVIDERS: ['ollama', 'vllm', 'litellm', 'openrouter'],
-  PROVIDER_DEFINITIONS: {
-    openai: {
-      id: 'openai',
-      name: 'OpenAI',
-      models: [
-        { id: 'public-model' },
-        { id: 'blocked-model' },
-        { id: 'retired-model', sunset: { status: 'deprecated' } },
-      ],
+vi.mock('@/providers/models', () => {
+  const publicModels = {
+    openai: [
+      { id: 'public-model' },
+      { id: 'blocked-model' },
+      { id: 'retired-model', sunset: { status: 'deprecated' } },
+    ],
+    fireworks: [{ id: 'fireworks/public-model' }],
+  }
+  return {
+    getStaticProviderModels: (providerId: string) =>
+      publicModels[providerId as keyof typeof publicModels] ?? [],
+    PROVIDER_DEFINITIONS: {
+      openai: { id: 'openai', name: 'OpenAI', models: publicModels.openai },
+      anthropic: { id: 'anthropic', name: 'Anthropic', models: [{ id: 'anthropic-model' }] },
+      ollama: { id: 'ollama', name: 'Ollama', models: [{ id: 'private-local' }] },
+      vllm: { id: 'vllm', name: 'vLLM', models: [] },
+      litellm: { id: 'litellm', name: 'LiteLLM', models: [] },
+      openrouter: {
+        id: 'openrouter',
+        name: 'OpenRouter',
+        models: [{ id: 'private-tenant-model' }],
+      },
+      fireworks: {
+        id: 'fireworks',
+        name: 'Fireworks',
+        models: [...publicModels.fireworks, { id: 'fireworks/private-model' }],
+      },
     },
-    anthropic: { id: 'anthropic', name: 'Anthropic', models: [{ id: 'anthropic-model' }] },
-    ollama: { id: 'ollama', name: 'Ollama', models: [{ id: 'private-local' }] },
-    vllm: { id: 'vllm', name: 'vLLM', models: [] },
-    litellm: { id: 'litellm', name: 'LiteLLM', models: [] },
-    openrouter: { id: 'openrouter', name: 'OpenRouter', models: [{ id: 'private-tenant-model' }] },
-  },
-}))
+  }
+})
 vi.mock('@/connectors/registry', () => ({
   CONNECTOR_META_REGISTRY: {
     available: {
@@ -187,11 +199,23 @@ describe('access request catalog deployment ceilings', () => {
 
   it('omits blacklisted/retired models, unconfigured endpoints, and private dynamic names', async () => {
     const catalog = await loadAccessRequestCatalog(context)
-    expect([...catalog.providers.keys()]).toEqual(['openai', 'openrouter'])
-    expect([...catalog.models.keys()]).toEqual(['public-model'])
+    expect([...catalog.providers.keys()]).toEqual(['openai', 'openrouter', 'fireworks'])
+    expect([...catalog.models.keys()]).toEqual(['public-model', 'fireworks/public-model'])
     expect([...catalog.knowledgeConnectors.keys()]).toEqual(['available', 'token', 'fallback'])
   })
 
+  it('keeps public models of dynamic providers requestable without exposing private names', async () => {
+    const catalog = await loadAccessRequestCatalog(context, 'model')
+
+    expect(catalog.models.get('fireworks/public-model')).toEqual({
+      id: 'fireworks/public-model',
+      label: 'fireworks/public-model',
+      providerId: 'fireworks',
+    })
+    expect(catalog.models.has('fireworks/private-model')).toBe(false)
+    expect(catalog.models.has('private-tenant-model')).toBe(false)
+  })
+
   it('refuses ambiguous tool parent policies instead of choosing one silently', async () => {
     mocks.blocks.mockReturnValue({
       first: { type: 'first', name: 'First', tools: { access: ['shared_tool'] } },

apps/sim/lib/permission-access-requests/settings.test.ts

@@ -50,6 +50,31 @@ describe('permission access request settings', () => {
     await expect(isAccessRequestEnabled('organization-one')).resolves.toBe(true)
   })
 
+  it('rechecks rollout after an enabled admission snapshot', async () => {
+    mockIsFeatureEnabled.mockResolvedValue(false)
+
+    await expect(isAccessRequestEnabled('organization-one', undefined, true)).resolves.toBe(false)
+
+    expect(mockIsFeatureEnabled).toHaveBeenCalledExactlyOnceWith('permission-access-requests')
+    expect(dbChainMockFns.select).not.toHaveBeenCalled()
+  })
+
+  it('keeps a disabled admission snapshot denied even if rollout is now enabled', async () => {
+    await expect(isAccessRequestEnabled('organization-one', undefined, false)).resolves.toBe(false)
+
+    expect(mockIsFeatureEnabled).not.toHaveBeenCalled()
+    expect(dbChainMockFns.select).not.toHaveBeenCalled()
+  })
+
+  it('requires the current organization preference after an enabled admission snapshot', async () => {
+    queueTableRows(organizationAccessRequestSettings, [{ allowRequests: false }])
+
+    await expect(isAccessRequestEnabled('organization-one', undefined, true)).resolves.toBe(false)
+
+    expect(mockIsFeatureEnabled).toHaveBeenCalledExactlyOnceWith('permission-access-requests')
+    expect(dbChainMockFns.select).toHaveBeenCalledTimes(1)
+  })
+
   it('honors an organization opt-out while global rollout is active', async () => {
     queueTableRows(organizationAccessRequestSettings, [{ allowRequests: false }])
 

apps/sim/lib/permission-access-requests/settings.ts

@@ -18,8 +18,9 @@ export async function readAccessRequestSettings(organizationId: string, executor
 export async function isAccessRequestEnabled(
   organizationId: string,
   executor: DbOrTx = db,
-  globalEnabled?: boolean
+  enabledAtAdmission?: boolean
 ): Promise<boolean> {
-  if (!(globalEnabled ?? (await isFeatureEnabled('permission-access-requests')))) return false
+  if (enabledAtAdmission === false || !(await isFeatureEnabled('permission-access-requests')))
+    return false
   return (await readAccessRequestSettings(organizationId, executor)).allowRequests
 }

apps/sim/providers/models.test.ts

@@ -11,6 +11,7 @@ import {
   getModelsWithPromptCaching,
   getPromptCachingMinimumTokens,
   getProviderModels,
+  getStaticProviderModels,
   getThinkingStreamVisibility,
   isCustomModelId,
   isKnownModelId,
@@ -632,6 +633,37 @@ describe('fireworks static catalog (the sim-auto pool)', () => {
   })
 })
 
+describe('getStaticProviderModels', () => {
+  it('retains public built-in models after private models are discovered', () => {
+    const originalModels = PROVIDER_DEFINITIONS.fireworks.models
+    const publicModels = getStaticProviderModels('fireworks')
+    try {
+      updateFireworksModels(['fireworks/private-test-model'])
+
+      expect(publicModels.length).toBeGreaterThan(0)
+      expect(getProviderModels('fireworks')).toContain('fireworks/private-test-model')
+      expect(getStaticProviderModels('fireworks')).toEqual(publicModels)
+    } finally {
+      PROVIDER_DEFINITIONS.fireworks.models = originalModels
+    }
+  })
+
+  it("excludes discovered names even when they match another provider's public model", () => {
+    const originalModels = PROVIDER_DEFINITIONS.ollama.models
+    try {
+      updateOllamaModels(['private-local-model', 'fireworks/glm-5.2'])
+
+      expect(getStaticProviderModels('ollama')).toEqual([])
+    } finally {
+      PROVIDER_DEFINITIONS.ollama.models = originalModels
+    }
+  })
+
+  it('returns no models for an unknown provider', () => {
+    expect(getStaticProviderModels('unknown-provider')).toEqual([])
+  })
+})
+
 describe('isModelDeprecated', () => {
   it('returns true for a catalogued deprecated model (case-insensitive)', () => {
     const id = firstDeprecatedModelId()

apps/sim/providers/models.ts

@@ -4989,9 +4989,8 @@ interface ModelCatalogEntry {
 
 /**
  * Lowercased model ID → catalog position metadata, built once from the static
- * provider catalog. Dynamic providers contribute nothing here because their model
- * lists are populated at runtime (not at module load), and only catalog models are
- * ever reordered by release date.
+ * provider catalog, including built-in models of dynamic providers. Models added
+ * by runtime discovery are excluded.
  */
 const MODEL_CATALOG_INDEX: Map<string, ModelCatalogEntry> = new Map(
   Object.entries(PROVIDER_DEFINITIONS).flatMap(([providerId, provider]) =>
@@ -5009,6 +5008,13 @@ const MODEL_CATALOG_INDEX: Map<string, ModelCatalogEntry> = new Map(
   )
 )
 
+/** Returns built-in public models, excluding names added by runtime discovery. */
+export function getStaticProviderModels(providerId: string): ModelDefinition[] {
+  return (PROVIDER_DEFINITIONS[providerId]?.models ?? []).filter(
+    (model) => MODEL_CATALOG_INDEX.get(model.id.toLowerCase())?.providerId === providerId
+  )
+}
+
 /**
  * Reorders model IDs so that, within each provider, newer models (by release date)
  * come first — while preserving the caller's existing provider grouping order. The