From 271740cc193a984e28cd7e946dd4be421f2986a4 Mon Sep 17 00:00:00 2001
From: Dotta <bippadotta@protonmail.com>
Date: Mon, 26 Oct 2026 13:22:33 -0500
Subject: [PATCH] Deduplicate account checks in effective profile projections

Co-Authored-By: Paperclip <noreply@paperclip.ing>
---
 .../connection-management.integration.test.ts | 28 +++++++++++++++++++
 server/src/routes/tool-access.ts              |  6 ++--
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/server/src/__tests__/connection-management.integration.test.ts b/server/src/__tests__/connection-management.integration.test.ts
index 8f35f853904..7e6056e62a0 100644
--- a/server/src/__tests__/connection-management.integration.test.ts
+++ b/server/src/__tests__/connection-management.integration.test.ts
@@ -96,6 +96,34 @@ describe("connection management with production default agents", () => {
     expect(profile, JSON.stringify(profile)).toMatchObject({ status: 201 });
   });
 
+  it("checks effective-profile connection access once for hundreds of tools on the same account", async () => {
+    const f = await fixture();
+    const connection = await f.request("POST", `/companies/${f.companyId}/tools/connections`, { name: "Large catalog", transport: "mcp_remote", authKind: "none", config: { url: "https://1.1.1.1/mcp" } });
+    expect(connection).toMatchObject({ status: 201 });
+    await server.db.insert(toolCatalogEntries).values(Array.from({ length: 200 }, (_, index) => ({ companyId: f.companyId, applicationId: connection.body.applicationId, connectionId: connection.body.id, name: `tool_${index}`, toolName: `tool_${index}`, versionHash: `fixture_${index}` })));
+    const profile = await f.request("POST", `/companies/${f.companyId}/tools/profiles`, { profileKey: "large-catalog", name: "Large catalog", entries: [{ selectorType: "connection", connectionId: connection.body.id }] });
+    expect(profile).toMatchObject({ status: 201 });
+    expect(await f.request("POST", `/companies/${f.companyId}/tools/profiles/${profile.body.id}/bind`, { targetType: "agent", targetId: f.agentId })).toMatchObject({ status: 201 });
+    expect(await f.request("PUT", `/tool-connections/${connection.body.id}/installs`, { installs: [{ targetType: "agent", targetId: f.agentId }] })).toMatchObject({ status: 200 });
+    const module = await import("../services/connection-management.js");
+    const original = connectionManagementService;
+    let connectionChecks = 0;
+    const factory = vi.spyOn(module, "connectionManagementService").mockImplementation((...args) => {
+      const service = original(...args);
+      return { ...service, capability: async (...input: Parameters<typeof service.capability>) => {
+        if (input[2].connectionId === connection.body.id) connectionChecks++;
+        return service.capability(...input);
+      } };
+    });
+    try {
+      const effective = await f.request("GET", `/companies/${f.companyId}/tools/profiles/effective/agents/${f.agentId}`);
+      expect(effective, JSON.stringify(effective)).toMatchObject({ status: 200 });
+      expect(effective.body.allowedTools).toHaveLength(200);
+      expect(effective.body.installedConnections).toHaveLength(1);
+      expect(connectionChecks).toBe(1);
+    } finally { factory.mockRestore(); }
+  });
+
   it("checks every saved profile selector and effective projection against personal account visibility", async () => {
     const f = await fixture();
     const first = await f.request("POST", `/companies/${f.companyId}/tools/connections`, { name: "Owned profile account", transport: "mcp_remote", authKind: "none", config: { url: "https://1.1.1.1/mcp" } });
diff --git a/server/src/routes/tool-access.ts b/server/src/routes/tool-access.ts
index bd1a7063195..d9ca0608e06 100644
--- a/server/src/routes/tool-access.ts
+++ b/server/src/routes/tool-access.ts
@@ -2358,9 +2358,9 @@ function connectorEnrollmentPrincipal(req: Request): string {
     assertCompanyAccess(req, companyId);
     const effective = await svc.getEffectiveProfilesForAgent(companyId, req.params.agentId as string);
     const profiles = await filterConnectionManagementRows(db, req, "connections:profiles", effective.profiles, profile => ({ profileId: profile.id }));
-    const tools = await filterConnectionManagementRows(db, req, "connections:profiles", effective.allowedTools, tool => ({ connectionId: tool.connectionId }));
-    const installed = await filterConnectionManagementRows(db, req, "connections:profiles", effective.installedConnections, connection => ({ connectionId: connection.id }));
-    if (profiles.length !== effective.profiles.length || tools.length !== effective.allowedTools.length || installed.length !== effective.installedConnections.length) throw forbidden("Effective profile resources are unavailable to this delegated principal");
+    const connectionIds = [...new Set([...effective.allowedTools.map(tool => tool.connectionId), ...effective.installedConnections.map(connection => connection.id)])];
+    const connections = await filterConnectionManagementRows(db, req, "connections:profiles", connectionIds, connectionId => ({ connectionId }));
+    if (profiles.length !== effective.profiles.length || connections.length !== connectionIds.length) throw forbidden("Effective profile resources are unavailable to this delegated principal");
     res.json(effective);
   });