fix(oracle-fusion): address SCM review findings

Author: Bill Leoutsakos

apps/sim/app/(landing)/integrations/(shell)/[slug]/page.tsx

@@ -108,6 +108,8 @@ function getRelatedSlugs(
 const AUTH_STEP: Record<AuthType, (name: string) => string> = {
   oauth: (name) =>
     `Connect your ${name} account with one-click OAuth, with no credentials to copy.`,
+  'service-account': (name) =>
+    `Select or add a reusable ${name} service-account credential in your workspace.`,
   'api-key': (name) =>
     `Paste your ${name} API key to authenticate. You can find it in your ${name} account settings.`,
   none: () => 'No authentication is needed, so the block works as soon as you drop it in.',
@@ -501,9 +503,11 @@ export default async function IntegrationPage({ params }: { params: Promise<{ sl
           that AI agents can use inside Sim&apos;s visual workflow builder.{' '}
           {authType === 'oauth'
             ? `${name} connects with one-click OAuth.`
-            : authType === 'api-key'
-              ? `${name} connects with an API key.`
-              : `${name} requires no authentication.`}{' '}
+            : authType === 'service-account'
+              ? `${name} connects with a reusable service-account credential.`
+              : authType === 'api-key'
+                ? `${name} connects with an API key.`
+                : `${name} requires no authentication.`}{' '}
           Free to start at sim.ai.
         </p>
 
@@ -656,9 +660,11 @@ export default async function IntegrationPage({ params }: { params: Promise<{ sl
                 body:
                   authType === 'oauth'
                     ? `Open your workspace, drag ${articleFor(name)} ${name} block onto the workflow builder, and connect your account with one-click OAuth.`
-                    : authType === 'api-key'
-                      ? `Open your workspace, drag ${articleFor(name)} ${name} block onto the workflow builder, and paste in your ${name} API key.`
-                      : `Open your workspace, drag ${articleFor(name)} ${name} block onto the workflow builder. No authentication is needed.`,
+                    : authType === 'service-account'
+                      ? `Open your workspace, drag ${articleFor(name)} ${name} block onto the workflow builder, and select or add a reusable service-account credential.`
+                      : authType === 'api-key'
+                        ? `Open your workspace, drag ${articleFor(name)} ${name} block onto the workflow builder, and paste in your ${name} API key.`
+                        : `Open your workspace, drag ${articleFor(name)} ${name} block onto the workflow builder. No authentication is needed.`,
               },
               {
                 step: '03',

apps/sim/app/(landing)/integrations/(shell)/page.tsx

@@ -21,6 +21,7 @@ const allIntegrations = INTEGRATIONS
 const integrationSummaries = allIntegrations.map(toIntegrationSummary)
 const INTEGRATION_COUNT = allIntegrations.length
 const OAUTH_COUNT = allIntegrations.filter((i) => i.authType === 'oauth').length
+const SERVICE_ACCOUNT_COUNT = allIntegrations.filter((i) => i.authType === 'service-account').length
 const TRIGGER_INTEGRATION_COUNT = allIntegrations.filter((i) => i.triggerCount > 0).length
 const TOTAL_TOOL_COUNT = allIntegrations.reduce((sum, i) => sum + i.operationCount, 0)
 
@@ -31,7 +32,7 @@ const TOTAL_TOOL_COUNT = allIntegrations.reduce((sum, i) => sum + i.operationCou
 const CATALOG_FAQS: FAQItem[] = [
   {
     question: 'How do integrations work in Sim?',
-    answer: `Each integration is a block you drag onto Sim's workflow builder. Together, Sim's ${INTEGRATION_COUNT} integrations expose ${TOTAL_TOOL_COUNT}+ tools that AI agents can call. ${OAUTH_COUNT} connect with one-click OAuth, and the rest use an API key or no authentication at all. Wire blocks together, add an AI agent block for reasoning, and run.`,
+    answer: `Each integration is a block you drag onto Sim's workflow builder. Together, Sim's ${INTEGRATION_COUNT} integrations expose ${TOTAL_TOOL_COUNT}+ tools that AI agents can call. ${OAUTH_COUNT} connect with one-click OAuth, ${SERVICE_ACCOUNT_COUNT} use reusable service-account credentials, and the rest use an API key or no authentication at all. Wire blocks together, add an AI agent block for reasoning, and run.`,
   },
   {
     question: 'Are Sim integrations free to use?',

apps/sim/app/api/settings/allowed-integrations/route.ts

@@ -13,7 +13,12 @@ export const GET = withRouteHandler(async () => {
   return NextResponse.json({
     allowedIntegrations: getAllowedIntegrationsFromEnv(),
     integrationAvailability: getIntegrationAvailability().map(
-      ({ type, state, oauthAvailable }) => ({ type, state, oauthAvailable })
+      ({ type, state, oauthAvailable, serviceAccountAvailable }) => ({
+        type,
+        state,
+        oauthAvailable,
+        serviceAccountAvailable,
+      })
     ),
   })
 })

apps/sim/app/workspace/[workspaceId]/integrations/integrations.tsx

@@ -362,7 +362,11 @@ export function Integrations() {
                       name={integration.name}
                       description={integration.description}
                       icon={Icon}
-                      unavailable={integration.authType === 'oauth' && deploymentUnavailable}
+                      unavailable={
+                        (integration.authType === 'oauth' ||
+                          integration.authType === 'service-account') &&
+                        deploymentUnavailable
+                      }
                     />
                   )
                 })}

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/integration-search-items.test.ts

@@ -0,0 +1,32 @@
+import { describe, expect, it } from 'vitest'
+import { CONNECT_MODE } from '@/app/workspace/[workspaceId]/integrations/connect-route'
+import { resolveIntegrationSearchConnectMode } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/integration-search-items'
+
+describe('resolveIntegrationSearchConnectMode', () => {
+  it('opens the service-account picker for a ready service-account-only integration', () => {
+    expect(
+      resolveIntegrationSearchConnectMode({
+        oauthAvailable: false,
+        serviceAccountAvailable: true,
+      })
+    ).toBe(CONNECT_MODE.serviceAccount)
+  })
+
+  it('prefers OAuth when both stored-credential paths are available', () => {
+    expect(
+      resolveIntegrationSearchConnectMode({
+        oauthAvailable: true,
+        serviceAccountAvailable: true,
+      })
+    ).toBe(CONNECT_MODE.oauth)
+  })
+
+  it('does not request a connection dialog when neither path is available', () => {
+    expect(
+      resolveIntegrationSearchConnectMode({
+        oauthAvailable: false,
+        serviceAccountAvailable: false,
+      })
+    ).toBeNull()
+  })
+})

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/integration-search-items.ts

@@ -1,5 +1,6 @@
 import type { ComponentType } from 'react'
 import { blockTypeToIconMap, INTEGRATIONS, resolveCredentialDisplay } from '@/lib/integrations'
+import type { IntegrationAvailability } from '@/lib/integrations/availability'
 import {
   CONNECT_MODE,
   CONNECT_QUERY_PARAM,
@@ -10,6 +11,16 @@ import type { WorkspaceCredential } from '@/hooks/queries/credentials'
 /** Fallback brand color for credentials whose integration metadata cannot be resolved. */
 const FALLBACK_BG_COLOR = '#6B7280'
 
+/** Selects the credential dialog that a catalog search result should open. */
+export function resolveIntegrationSearchConnectMode(
+  availability: Pick<IntegrationAvailability, 'oauthAvailable' | 'serviceAccountAvailable'> | null
+): (typeof CONNECT_MODE)[keyof typeof CONNECT_MODE] | null {
+  if (!availability) return CONNECT_MODE.oauth
+  if (availability.oauthAvailable) return CONNECT_MODE.oauth
+  if (availability.serviceAccountAvailable) return CONNECT_MODE.serviceAccount
+  return null
+}
+
 /**
  * Module-level base array of resolvable integrations (entries without a
  * registered icon are dropped, matching the catalog's `if (!Icon) return null`
@@ -41,9 +52,9 @@ const INTEGRATION_BASES: readonly {
 
 /**
  * Builds the full integration catalog as search items for a given workspace.
- * OAuth integrations link directly to the detail page with `?connect=oauth` so
- * the connect modal auto-opens (via the detail page's `useEffect` on
- * `CONNECT_QUERY_PARAM`). Non-OAuth integrations link to the plain detail page.
+ * Stored-credential integrations link directly to the detail page with a connect mode so the
+ * matching modal auto-opens (via the detail page's `useEffect` on `CONNECT_QUERY_PARAM`). Other
+ * integrations link to the plain detail page.
  */
 export function buildIntegrationSearchItems(
   workspaceId: string,
@@ -53,7 +64,10 @@ export function buildIntegrationSearchItems(
   ) => (typeof CONNECT_MODE)[keyof typeof CONNECT_MODE] | null = () => CONNECT_MODE.oauth
 ): IntegrationSearchItem[] {
   return INTEGRATION_BASES.filter((base) => isBlockAllowed(base.blockType)).map((base) => {
-    const connectMode = base.authType === 'oauth' ? getConnectMode(base.blockType) : null
+    const connectMode =
+      base.authType === 'oauth' || base.authType === 'service-account'
+        ? getConnectMode(base.blockType)
+        : null
     const connectSuffix = connectMode ? `?${CONNECT_QUERY_PARAM}=${connectMode}` : ''
     return {
       id: base.id,

apps/sim/app/workspace/[workspaceId]/w/components/sidebar/sidebar.tsx

@@ -42,7 +42,6 @@ import { isChatEnabled, isHosted, isStatusNoticePreviewEnabled } from '@/lib/cor
 import { isMacPlatform } from '@/lib/core/utils/platform'
 import { buildFolderTree, getFolderPathNames } from '@/lib/folders/tree'
 import { captureEvent } from '@/lib/posthog/client'
-import { CONNECT_MODE } from '@/app/workspace/[workspaceId]/integrations/connect-route'
 import { useRegisterGlobalCommands } from '@/app/workspace/[workspaceId]/providers/global-commands-provider'
 import { useWorkspaceHostContext } from '@/app/workspace/[workspaceId]/providers/workspace-host-provider'
 import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
@@ -71,6 +70,7 @@ import {
 import {
   buildConnectedAccountSearchItems,
   buildIntegrationSearchItems,
+  resolveIntegrationSearchConnectMode,
 } from '@/app/workspace/[workspaceId]/w/components/sidebar/components/search-modal/integration-search-items'
 import type {
   LogItem,
@@ -1102,10 +1102,7 @@ export const Sidebar = memo(function Sidebar({
         ? []
         : buildIntegrationSearchItems(workspaceId, isBlockAllowed, (blockType) => {
             const availability = integrationAvailability.get(blockType.toLowerCase())
-            if (!availability) return CONNECT_MODE.oauth
-            if (availability?.oauthAvailable) return CONNECT_MODE.oauth
-            if (availability?.state === 'limited') return CONNECT_MODE.serviceAccount
-            return null
+            return resolveIntegrationSearchConnectMode(availability ?? null)
           }),
     [workspaceId, permissionConfig.hideIntegrationsTab, isBlockAllowed, integrationAvailability]
   )

apps/sim/blocks/blocks.test.ts

@@ -670,7 +670,13 @@ describe.concurrent('Blocks Module', () => {
 
   describe('AuthMode Validation', () => {
     it('should have valid authMode when defined', () => {
-      const validAuthModes = [AuthMode.OAuth, AuthMode.ApiKey, AuthMode.BotToken, undefined]
+      const validAuthModes = [
+        AuthMode.OAuth,
+        AuthMode.ServiceAccount,
+        AuthMode.ApiKey,
+        AuthMode.BotToken,
+        undefined,
+      ]
       const blocks = getAllBlocks()
       for (const block of blocks) {
         expect(validAuthModes).toContain(block.authMode)

apps/sim/blocks/blocks/oracle_fusion_scm.test.ts

@@ -3,7 +3,7 @@
  */
 import { describe, expect, it } from 'vitest'
 import { OracleFusionScmBlock, OracleFusionScmBlockMeta } from '@/blocks/blocks/oracle_fusion_scm'
-import type { SubBlockConfig } from '@/blocks/types'
+import { AuthMode, type SubBlockConfig } from '@/blocks/types'
 import * as oracleFusionScmTools from '@/tools/oracle_fusion_scm'
 import type { ToolConfig } from '@/tools/types'
 
@@ -129,6 +129,14 @@ describe('Oracle Fusion SCM block', () => {
   })
 
   it('binds all six project selectors to the stored SCM credential', () => {
+    expect(OracleFusionScmBlock.authMode).toBe(AuthMode.ServiceAccount)
+    expect(subBlocks.find((subBlock) => subBlock.id === 'credential')).toMatchObject({
+      type: 'oauth-input',
+      serviceId: 'oracle_fusion_scm',
+      credentialKind: 'service-account',
+      canonicalParamId: 'oauthCredential',
+      required: true,
+    })
     const selectors = subBlocks.filter((subBlock) => subBlock.type === 'project-selector')
     expect(selectors).toHaveLength(6)
     for (const selector of selectors) {

apps/sim/blocks/blocks/oracle_fusion_scm.ts

@@ -48,7 +48,7 @@ export const OracleFusionScmBlock: BlockConfig = {
   docsLink: 'https://docs.sim.ai/integrations/oracle_fusion_scm',
   category: 'tools',
   integrationType: IntegrationType.Commerce,
-  authMode: AuthMode.ApiKey,
+  authMode: AuthMode.ServiceAccount,
   bgColor: '#FFFFFF',
   icon: OracleIcon,
   canvasPresentation: {