fix(tools): exempt variable references that resolve to the caller's own key

Author: waleedlatif1

apps/sim/lib/tool-execution/application/execute-tool.test.ts

@@ -26,6 +26,7 @@ import {
   customBlockOperationsMockFns,
 } from '@sim/testing/mocks/custom-block-operations.mock'
 import { resetEnvFlagsMock, setEnvFlags } from '@sim/testing/mocks/env-flags.mock'
+import { environmentUtilsMockFns } from '@sim/testing/mocks/environment-utils.mock'
 import {
   integrationsAvailabilityMock,
   integrationsAvailabilityMockFns,
@@ -253,6 +254,7 @@ describe('executeToolForCaller', () => {
     mocks.executeRegistryTool.mockResolvedValue({ success: true, output: { markdown: '# Hi' } })
     mocks.resolveBillingAttribution.mockResolvedValue({ workspaceId: WORKSPACE_ID })
     mocks.checkUsageLimits.mockResolvedValue({ isExceeded: false })
+    environmentUtilsMockFns.mockGetEffectiveDecryptedEnv.mockResolvedValue({})
   })
 
   it.each<PersonalApiKeyPrincipal | SessionPrincipal>([principal, createSessionPrincipal()])(
@@ -512,23 +514,31 @@ describe('executeToolForCaller', () => {
   it.each([
     ['the key is omitted', { input: { url: 'https://a.co' } }],
     [
-      'the key is a variable reference that may resolve empty',
+      'the key references an empty variable',
       { input: { url: 'https://a.co', apiKey: '{{FIRECRAWL_KEY}}' } },
     ],
   ])('refuses a hosted-key call over the usage limit when %s', async (_case, input) => {
     mocks.checkUsageLimits.mockResolvedValue({ isExceeded: true, message: 'Usage limit exceeded' })
+    environmentUtilsMockFns.mockGetEffectiveDecryptedEnv.mockResolvedValue({ FIRECRAWL_KEY: ' ' })
 
     await expect(run(input)).rejects.toBeInstanceOf(ToolUsageLimitExceededError)
   })
 
   it.each([
     ['the caller brings their own key', { input: { url: 'https://a.co', apiKey: 'sk-own' } }],
+    [
+      'the caller references a variable holding their own key',
+      { input: { url: 'https://a.co', apiKey: '{{FIRECRAWL_KEY}}' } },
+    ],
     [
       'the tool has no hosted key',
       { toolId: 'zendesk_get_ticket', input: { ticketId: '4', subdomain: 'a', apiToken: 't' } },
     ],
   ])('does not gate on usage when %s', async (_case, input) => {
     mocks.checkUsageLimits.mockResolvedValue({ isExceeded: true, message: 'Usage limit exceeded' })
+    environmentUtilsMockFns.mockGetEffectiveDecryptedEnv.mockResolvedValue({
+      FIRECRAWL_KEY: 'fc-own',
+    })
 
     await expect(run(input)).resolves.toMatchObject({ status: 'succeeded' })
   })

apps/sim/lib/tool-execution/application/execute-tool.ts

@@ -17,9 +17,10 @@ import { defineAuthorizedWorkspaceUseCase } from '@/lib/core/application'
 import { ForbiddenOperationError } from '@/lib/core/application/forbidden'
 import { isHosted } from '@/lib/core/config/env-flags'
 import { OrchestrationError } from '@/lib/core/orchestration/types'
+import { getEffectiveDecryptedEnv } from '@/lib/environment/utils'
 import { principalUserId } from '@/lib/integrations/principal-scope.server'
 import { toolExecutionOperations } from '@/lib/tool-execution/application/operations'
-import { isEnvVarReference } from '@/executor/constants'
+import { extractEnvVarName, isEnvVarReference } from '@/executor/constants'
 import { executeTool as executeRegistryTool } from '@/tools'
 import type { ExecutableToolConfig } from '@/tools/types'
 import { getTool } from '@/tools/utils'
@@ -78,6 +79,23 @@ function hostedKeyParamFor(
   return tool.hosting.apiKeyParam
 }
 
+/**
+ * Whether a `{{VAR}}` key resolves to a key of the caller's own.
+ *
+ * The registry resolves the reference from this same environment before it
+ * decides on Sim's key, and a variable that is missing or empty leaves the
+ * parameter for Sim's key to fill.
+ */
+async function referencesOwnKey(
+  value: unknown,
+  userId: string,
+  workspaceId: string
+): Promise<boolean> {
+  if (typeof value !== 'string' || !isEnvVarReference(value)) return false
+  const env = await getEffectiveDecryptedEnv(userId, workspaceId)
+  return Boolean(env[extractEnvVarName(value)]?.trim())
+}
+
 /**
  * The three spellings the executor accepts for "which credential".
  *
@@ -320,7 +338,10 @@ export const executeToolForCaller = defineAuthorizedWorkspaceUseCase({
      * has charged it. A BYOK workspace is gated too, since only the registry can
      * see that key — the same standing every workflow run is held to.
      */
-    if (hostedKeyParam) {
+    if (
+      hostedKeyParam &&
+      !(await referencesOwnKey(callerParams[hostedKeyParam], userId, context.workspaceId))
+    ) {
       const usage = await checkExecutionUsageLimits(billingAttribution)
       if (usage.isExceeded) {
         throw new ToolUsageLimitExceededError(