Merge commit '8b719d2c430d7634e00abb694951dcd4950f777e' into wip/platform-org-wiring

Author: waleedlatif1

apps/sim/platform/app/(shell)/integrations/_components/integration-details/integration-details.tsx

@@ -40,6 +40,10 @@ export function IntegrationDetails({ integration, onChange }: IntegrationDetails
   const canConnect = !account && integration.availability === 'ready' && connectableMethod !== null
   const canAuthorize = Boolean(integration.fixtureAuthorization)
   const canAttach = canAuthorize && canConnect && connectionCandidate?.method === connectableMethod
+  const accessMessage =
+    integration.availability === 'managed'
+      ? `Managed by your organization. ${integration.accessDescription}`
+      : integration.accessDescription
 
   function connect() {
     if (!canAttach || !connectionCandidate) return
@@ -102,26 +106,21 @@ export function IntegrationDetails({ integration, onChange }: IntegrationDetails
           title='This credential is no longer connected'
           action={<Chip href={providerHref}>View integration</Chip>}
         />
-      ) : canConnect ? (
+      ) : !account ? (
         <ConnectionPrompt
-          title={`Connect your ${integration.name} account`}
+          title={canConnect ? `Connect your ${integration.name} account` : accessMessage}
           setupGuideUrl={integration.setupGuideUrl}
-          options={[
-            {
-              label: integration.name,
-              icon: { providerId },
-              onConnect: canAttach ? connect : undefined,
-            },
-          ]}
-        />
-      ) : !account ? (
-        <EmptyState
-          title={
-            integration.availability === 'managed'
-              ? 'Organization managed'
-              : 'No connected credential'
+          options={
+            canConnect
+              ? [
+                  {
+                    label: integration.name,
+                    icon: { providerId },
+                    onConnect: canAttach ? connect : undefined,
+                  },
+                ]
+              : []
           }
-          description={integration.accessDescription}
         />
       ) : null}
       {!staleCredential && account?.permissions && (

apps/sim/platform/app/(shell)/integrations/_components/member-secrets/member-secrets.tsx

@@ -1,4 +1,5 @@
 import { EmptyState } from '@/platform/design-system/components'
+import { ConnectionPrompt } from '@/platform/design-system/components/connection-prompt/connection-prompt'
 import {
   SettingsRow,
   SettingsSection,
@@ -12,12 +13,11 @@ interface MemberSecretsProps {
 export function MemberSecrets({ source }: MemberSecretsProps) {
   if (source.mode === 'organization') {
     return (
-      <SettingsSection title='Access'>
-        <SettingsRow
-          label='Organization managed'
-          description='Your organization’s administrators manage these credentials.'
-        />
-      </SettingsSection>
+      <ConnectionPrompt
+        title='Your organization’s administrators manage these credentials.'
+        setupGuideUrl={source.setupGuideUrl}
+        options={[]}
+      />
     )
   }
   if (source.names.length === 0) return <EmptyState title='No personal secrets' />

apps/sim/platform/checks/integrations.spec.ts

@@ -102,10 +102,17 @@ test('managed, unconfigured and retained connections expose only the actions the
   await expect(reads).toContainText('Read available meeting summaries')
   await expect(main.getByRole('radio')).toHaveCount(0)
   await main.getByRole('link', { name: 'Integrations', exact: true }).click()
-  await main.getByRole('link', { name: /^GitLab / }).click()
-  await expect(main.getByRole('heading', { name: 'Organization managed' })).toBeVisible()
-  await expect(main.getByRole('button', { name: 'Connect account' })).toHaveCount(0)
-  await main.getByRole('link', { name: 'Integrations', exact: true }).click()
+  const managed = main.getByRole('region', { name: 'Managed by your organization' })
+  for (const provider of ['GitLab', 'Slack', 'Granola', 'Zoom']) {
+    await managed.getByRole('link', { name: new RegExp(`^${provider} `) }).click()
+    const docs = main.getByRole('link', { name: /Docs/ })
+    await expect(docs).toHaveAttribute(
+      'href',
+      `https://docs.sim.ai/search/${provider.toLowerCase()}`
+    )
+    await expect(main.getByRole('button', { name: provider, exact: true })).toHaveCount(0)
+    await main.getByRole('link', { name: 'Integrations', exact: true }).click()
+  }
   await main.getByRole('link', { name: /^Confluence / }).click()
   await main.getByRole('button', { name: 'Manage engineering@sim.ai' }).click()
   await expect(page.getByRole('menuitem', { name: 'Disconnect account' })).toBeVisible()

apps/sim/platform/checks/member-secrets.spec.ts

@@ -20,9 +20,12 @@ test('the member secrets destination delivers only the credential names the view
   expect(await managed?.text()).not.toContain('REPORTING_TOKEN')
   await link.click()
   await expect(page).toHaveURL(/\/integrations\/secrets\?.*secrets=organization/)
-  await expect(
-    page.getByRole('main').getByText('Organization managed', { exact: true })
-  ).toBeVisible()
+  const main = page.getByRole('main')
+  await expect(main.getByRole('link', { name: /Docs/ })).toHaveAttribute(
+    'href',
+    'https://docs.sim.ai/search/generic-secrets'
+  )
+  await expect(main.getByRole('button')).toHaveCount(0)
   const detail = await page.reload()
   expect(await detail?.text()).not.toContain('REPORTING_TOKEN')
 })

apps/sim/platform/docs/organization-integrations.md

@@ -13,6 +13,6 @@ The existing [organization route](../../app/o/%5BorganizationId%5D/integrations/
 
 With `SIM_PLATFORM_FIXTURES=1`, open [the populated inventory](http://localhost:3100/integrations?state=full), [the empty state](http://localhost:3100/integrations?state=empty), or [the stress scenario](http://localhost:3100/integrations?state=stress). The flagged loader supplies sample credential handoffs and tool catalogs. Changes live in the current product session. The default-off route has no example providers or credentials. Real authorization, credential exchange, policy persistence and secret handling belong to Phase 3.
 
-The detail header places the provider mark beside its name and description. **Connected credential** is a separate section below the header. Its title uses the Home section heading typography and aligns with the left edge of the permissions sections. The member’s account label sits on the next line. Its trailing menu acts on that credential. A status appears when the account needs reconnection or its organization has restricted access. In the inline connection prompt, the book icon and **Docs** link sit to the left of the connect action and open the provider’s Sim Search setup guide in a new tab. Providers without a dedicated guide use the member account connection guide.
+The detail header places the provider mark beside its name and description. **Connected credential** is a separate section below the header. Its title uses the Home section heading typography and aligns with the left edge of the permissions sections. The member’s account label sits on the next line. Its trailing menu acts on that credential. A status appears when the account needs reconnection or its organization has restricted access. In the inline connection prompt, the book icon and **Docs** link sit to the left of the connect action and open the provider’s Sim Search setup guide in a new tab. For entries under **Managed by your organization**, the same panel explains the access state and shows only **Docs**. Organization-managed Generic Secrets links to its own guide; personal secret names stay private to the member view. Providers without a dedicated guide use the member account connection guide.
 
 Provider names and descriptions come from Sim’s workspace integration catalog, which is generated from block definitions. Lucid uses its managed connector definition. **Tool permissions** groups eligible actions by read and write. Each tool retains its own description and approval control. **Requested permissions** lists human-readable OAuth scopes in always-visible groups. These are authorization requests. **Search access** describes the content a member can search. For managed providers such as Fireflies it lists the read-only Search operations the existing adapter supports. Use hanging bullets for static scopes and Search capabilities so wrapped lines stay with their item. Editable tool rows keep the name, description and permission control together without bullets. Actual account grants and eligible assistant tools come from their own operations. Refresh canonical metadata with `bun scripts/sync-platform-integration-metadata.ts` when its sources change.

apps/sim/platform/lib/integrations/member-secret-source.ts

@@ -1,4 +1,4 @@
-export type MemberSecretSource = { name: string; description: string } & (
+export type MemberSecretSource = { name: string; description: string; setupGuideUrl: string } & (
   | { mode: 'organization' }
   | { mode: 'member'; names: readonly string[] }
 )

apps/sim/platform/lib/integrations/metadata.generated.ts

@@ -444,4 +444,5 @@ export const gmailToolMetadata = [
 export const memberSecretMetadata = {
   name: 'Generic Secrets',
   description: 'Store shared or personal secrets for organization Home conversations',
+  setupGuideUrl: 'https://docs.sim.ai/search/generic-secrets',
 } as const

scripts/sync-platform-integration-metadata.ts

@@ -168,8 +168,9 @@ const gmailTools = (GmailV2Block.tools?.access ?? []).flatMap((id) => {
     ? [{ id, label: tool.name, description: tool.description, kind: tool.assistant.effect }]
     : []
 })
+const secretGuide = 'generic-secrets'
 const { title, description } = matter.read(
-  resolve(root, 'apps/docs/content/docs/search/generic-secrets.mdx')
+  resolve(root, `apps/docs/content/docs/search/${secretGuide}.mdx`)
 ).data
 if (typeof title !== 'string' || typeof description !== 'string')
   throw new Error('Generic Secrets needs a name and description in its Search guide')
@@ -178,7 +179,7 @@ const generated = formatGeneratedSource(
   `/** Generated by scripts/sync-platform-integration-metadata.ts. */
 export const providerMetadata = ${JSON.stringify(providers)} as const
 export const gmailToolMetadata = ${JSON.stringify(gmailTools)} as const
-export const memberSecretMetadata = ${JSON.stringify({ name: title, description })} as const
+export const memberSecretMetadata = ${JSON.stringify({ name: title, description, setupGuideUrl: `${SIM_DOCS_URL}/search/${secretGuide}` })} as const
 `,
   output,
   root