fix(chat): bound deployed-chat callers and stop leaking chat gate config

Two authorization/throttling defects on chat deployments.

**Denial of wallet on POST /api/chat/[identifier].** A deployed chat resolves
its execution principal from the workflow's workspace, so the plan rate bucket,
the usage/credit check and the concurrency reservation all belong to the owner
while the request belongs to whoever found the link. Nothing bounded the caller,
and an abort refunds none of it. Both the per-IP and the per-deployment bucket
now run after auth and before `preprocessExecution`, on every execution
regardless of `authType` — an email or SSO visitor is still not the payer.

`GET /api/chat/validate` answered for any anonymous caller, so `available:false`
inventoried live deployments; it now needs a session and a per-user bucket.

**Chat gate config exposed at workflow `read` on GET /api/workflows/[id]/chat/
status.** The route reimplemented the admin-gated detail projection inline,
serving the `allowedEmails` allow-list, `hasPassword` and the customization blob
to any workspace viewer, and asserting no `deploy.chat` capability. It is now an
adapter over `chat_deployments.list` — the same operation `GET /api/v2/chat-
deployments` binds — returning only the deployment's id and identifier, which is
all the editor reads before fetching the detail from `/api/chat/manage/{id}`.

The two buckets are the existing `enforceIpRateLimitWithIndependentBackstop`
plus a new `enforceResourceRateLimit` beside its siblings in `route-helpers`.
The IP bucket is consulted first and returns on refusal, so one flooding IP
cannot drain the deployment's budget and 429 the real audience with it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QWh9WFMYNZ6uTFQFUzF8Bj

Author: waleedlatif1

apps/docs/content/docs/platform/self-hosting/environment-variables.mdx

@@ -159,6 +159,8 @@ Without a remote provider, user code runs in an in-process V8 isolate inside the
 | `API_MAX_JSON_BODY_BYTES` | 50 MB | Max JSON body on contract-validated API routes |
 | `CHAT_MAX_REQUEST_BYTES` | 220 MB | Max body on the public deployed-chat endpoint |
 | `WEBHOOK_MAX_REQUEST_BYTES` | 10 MB | Max body on public webhook receiver endpoints |
+| `DEPLOYMENT_IP_EXECUTIONS_PER_MINUTE` | `60` | Executions one client IP may drive against a single deployed chat |
+| `DEPLOYMENT_EXECUTIONS_PER_MINUTE` | `300` | Executions one deployed chat may serve per minute across all callers |
 | `WORKFLOW_EXECUTION_CONCURRENCY_LIMIT` | `75` | Workflow executions in parallel |
 | `WEBHOOK_EXECUTION_CONCURRENCY_LIMIT` | `75` | Webhook-triggered executions in parallel |
 | `SCHEDULE_EXECUTION_CONCURRENCY_LIMIT` | `30` | Scheduled executions in parallel |

apps/sim/app/api/chat/[identifier]/route.test.ts

@@ -14,6 +14,7 @@ import {
   workflowsApiUtilsMock,
   workflowsApiUtilsMockFns,
 } from '@sim/testing'
+import { NextResponse } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
 /**
@@ -65,10 +66,18 @@ const createMockStream = () => {
   })
 }
 
-const { mockValidateChatAuth, mockSetChatAuthCookie, mockProcessChatFiles } = vi.hoisted(() => ({
+const {
+  mockValidateChatAuth,
+  mockSetChatAuthCookie,
+  mockProcessChatFiles,
+  mockEnforceIpRateLimit,
+  mockEnforceResourceRateLimit,
+} = vi.hoisted(() => ({
   mockValidateChatAuth: vi.fn().mockResolvedValue({ authorized: true }),
   mockSetChatAuthCookie: vi.fn(),
   mockProcessChatFiles: vi.fn(),
+  mockEnforceIpRateLimit: vi.fn(),
+  mockEnforceResourceRateLimit: vi.fn(),
 }))
 
 const mockCreateErrorResponse = workflowsApiUtilsMockFns.mockCreateErrorResponse
@@ -117,6 +126,11 @@ vi.mock('@/lib/core/utils/sse', () => ({
 
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 
+vi.mock('@/lib/core/rate-limiter', () => ({
+  enforceIpRateLimitWithIndependentBackstop: mockEnforceIpRateLimit,
+  enforceResourceRateLimit: mockEnforceResourceRateLimit,
+}))
+
 import { preprocessExecution } from '@/lib/execution/preprocessing'
 import { executeWorkflow } from '@/lib/workflows/executor/execute-workflow'
 import { createStreamingResponse } from '@/lib/workflows/streaming/streaming'
@@ -182,6 +196,8 @@ describe('Chat Identifier API Route', () => {
     })
 
     mockValidateChatAuth.mockResolvedValue({ authorized: true })
+    mockEnforceIpRateLimit.mockResolvedValue(null)
+    mockEnforceResourceRateLimit.mockResolvedValue(null)
     mockProcessChatFiles.mockResolvedValue([])
     mockCreateErrorResponse.mockImplementation((message: string, status: number, code?: string) => {
       return new Response(
@@ -335,6 +351,72 @@ describe('Chat Identifier API Route', () => {
       expect(mockSetChatAuthCookie).toHaveBeenCalledWith(expect.anything(), passwordDeployment)
     })
 
+    describe('execution rate limit', () => {
+      it.each([
+        ['per-IP', mockEnforceIpRateLimit],
+        ['per-deployment', mockEnforceResourceRateLimit],
+      ])("refuses on the %s bucket before the owner's budget is reserved", async (_, bucket) => {
+        bucket.mockResolvedValue(
+          NextResponse.json({ error: 'Rate limit exceeded' }, { status: 429 })
+        )
+        const req = createMockNextRequest('POST', { input: 'drain the wallet' })
+
+        const response = await POST(req, { params: Promise.resolve({ identifier: 'test-chat' }) })
+
+        expect(response.status).toBe(429)
+        expect(preprocessExecution).not.toHaveBeenCalled()
+        expect(createStreamingResponse).not.toHaveBeenCalled()
+        expect(mockProcessChatFiles).not.toHaveBeenCalled()
+      })
+
+      it('debits buckets keyed on the deployment, not the workflow', async () => {
+        const req = createMockNextRequest('POST', { input: 'hello' })
+
+        await POST(req, { params: Promise.resolve({ identifier: 'test-chat' }) })
+
+        expect(mockEnforceIpRateLimit).toHaveBeenCalledWith(
+          'chat-execute:chat-id',
+          req,
+          expect.objectContaining({ refillIntervalMs: 60_000 })
+        )
+        expect(mockEnforceResourceRateLimit).toHaveBeenCalledWith(
+          'chat-execute',
+          'chat-id',
+          expect.objectContaining({ refillIntervalMs: 60_000 })
+        )
+      })
+
+      it('leaves the deployment bucket untouched when the IP bucket refuses', async () => {
+        mockEnforceIpRateLimit.mockResolvedValue(NextResponse.json({}, { status: 429 }))
+        const req = createMockNextRequest('POST', { input: 'flood' })
+
+        await POST(req, { params: Promise.resolve({ identifier: 'test-chat' }) })
+
+        expect(mockEnforceResourceRateLimit).not.toHaveBeenCalled()
+      })
+
+      it('leaves the gate-configuration fetch unmetered', async () => {
+        const passwordDeployment = {
+          ...mockChatResult[0],
+          authType: 'password',
+          password: 'encrypted-password',
+        }
+        dbChainMockFns.select.mockImplementation(() => ({
+          from: vi.fn().mockReturnValue({
+            where: vi.fn().mockReturnValue({
+              limit: vi.fn().mockReturnValue([passwordDeployment]),
+            }),
+          }),
+        }))
+        const req = createMockNextRequest('POST', { password: 'test-password' })
+
+        await POST(req, { params: Promise.resolve({ identifier: 'password-protected-chat' }) })
+
+        expect(mockEnforceIpRateLimit).not.toHaveBeenCalled()
+        expect(mockEnforceResourceRateLimit).not.toHaveBeenCalled()
+      })
+    })
+
     it('should return 400 for requests without input', async () => {
       const req = createMockNextRequest('POST', {})
       const params = Promise.resolve({ identifier: 'test-chat' })

apps/sim/app/api/chat/[identifier]/route.ts

@@ -8,7 +8,12 @@ import { deployedChatPostContract } from '@/lib/api/contracts/chats'
 import { parseRequest } from '@/lib/api/server'
 import { releaseExecutionSlot } from '@/lib/billing/calculations/usage-reservation'
 import { admissionRejectedResponse, tryAdmit } from '@/lib/core/admission/gate'
-import { env } from '@/lib/core/config/env'
+import { env, envNumber } from '@/lib/core/config/env'
+import {
+  enforceIpRateLimitWithIndependentBackstop,
+  enforceResourceRateLimit,
+  type TokenBucketConfig,
+} from '@/lib/core/rate-limiter'
 import { generateRequestId } from '@/lib/core/utils/request'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { preprocessExecution } from '@/lib/execution/preprocessing'
@@ -49,6 +54,29 @@ export const runtime = 'nodejs'
 
 const CHAT_MAX_REQUEST_BYTES = Number.parseInt(env.CHAT_MAX_REQUEST_BYTES, 10) || 220 * 1024 * 1024
 
+/** A per-minute ceiling, as a bucket that refills its whole allowance each minute. */
+function executionsPerMinute(value: string | undefined, fallback: number): TokenBucketConfig {
+  const perMinute = envNumber(value, fallback, { min: 1, integer: true })
+  return { maxTokens: perMinute, refillRate: perMinute, refillIntervalMs: 60_000 }
+}
+
+/**
+ * Executions one client IP may drive against a single deployed chat.
+ *
+ * A deployed chat runs the owner's workflow on the owner's plan bucket, credit
+ * balance and concurrency reservation for whoever holds the link, so every
+ * ceiling on that path belongs to the payer and none of them bound the caller.
+ * Sized well above a human conversation and above shared-NAT aggregation, so it
+ * costs a flooder a botnet rather than costing a real audience its session.
+ */
+const CHAT_EXECUTION_IP_LIMIT = executionsPerMinute(env.DEPLOYMENT_IP_EXECUTIONS_PER_MINUTE, 60)
+
+/**
+ * What bounds the owner's exposure when attempts are spread across addresses,
+ * and the only bound left when the proxy chain resolves to no client IP.
+ */
+const CHAT_EXECUTION_LIMIT = executionsPerMinute(env.DEPLOYMENT_EXECUTIONS_PER_MINUTE, 300)
+
 export const POST = withRouteHandler(
   async (request: NextRequest, context: { params: Promise<{ identifier: string }> }) => {
     const { identifier } = await context.params
@@ -169,6 +197,22 @@ export const POST = withRouteHandler(
         return createErrorResponse('No input provided', 400)
       }
 
+      // Both buckets apply regardless of the chat's auth type: an email or SSO
+      // visitor is still not the payer.
+      const ipLimited = await enforceIpRateLimitWithIndependentBackstop(
+        `chat-execute:${deployment.id}`,
+        request,
+        CHAT_EXECUTION_IP_LIMIT
+      )
+      if (ipLimited) return ipLimited
+
+      const deploymentLimited = await enforceResourceRateLimit(
+        'chat-execute',
+        deployment.id,
+        CHAT_EXECUTION_LIMIT
+      )
+      if (deploymentLimited) return deploymentLimited
+
       const executionId = generateId()
 
       const loggingSession = new LoggingSession(

apps/sim/app/api/chat/validate/route.test.ts

@@ -0,0 +1,75 @@
+/**
+ * Tests for the chat identifier availability endpoint.
+ *
+ * @vitest-environment node
+ */
+import { authMockFns, queueTableRows, resetDbChainMock, schemaMock } from '@sim/testing'
+import { NextRequest, NextResponse } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockEnforceUserRateLimit } = vi.hoisted(() => ({
+  mockEnforceUserRateLimit: vi.fn(),
+}))
+
+vi.mock('@/lib/core/rate-limiter', () => ({
+  enforceUserRateLimit: mockEnforceUserRateLimit,
+}))
+
+import { GET } from '@/app/api/chat/validate/route'
+
+function request(identifier: string) {
+  return new NextRequest(`http://localhost:3000/api/chat/validate?identifier=${identifier}`)
+}
+
+describe('chat identifier validation route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    resetDbChainMock()
+    authMockFns.mockGetSession.mockResolvedValue({
+      user: { id: 'user-1' },
+      session: { id: 'session-1' },
+    })
+    mockEnforceUserRateLimit.mockResolvedValue(null)
+  })
+
+  it('refuses an anonymous caller before answering', async () => {
+    authMockFns.mockGetSession.mockResolvedValue(null)
+
+    const response = await GET(request('assistant'))
+
+    expect(response.status).toBe(401)
+    expect(mockEnforceUserRateLimit).not.toHaveBeenCalled()
+  })
+
+  it('reports a taken identifier to a signed-in caller', async () => {
+    queueTableRows(schemaMock.chat, [{ id: 'chat-1' }])
+
+    const response = await GET(request('assistant'))
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({
+      available: false,
+      error: 'This identifier is already in use',
+    })
+  })
+
+  it('reports a free identifier to a signed-in caller', async () => {
+    const response = await GET(request('bot'))
+
+    expect(response.status).toBe(200)
+    expect(await response.json()).toEqual({ available: true, error: null })
+  })
+
+  it('caps how far one caller can walk a dictionary', async () => {
+    mockEnforceUserRateLimit.mockResolvedValue(NextResponse.json({}, { status: 429 }))
+
+    const response = await GET(request('support'))
+
+    expect(response.status).toBe(429)
+    expect(mockEnforceUserRateLimit).toHaveBeenCalledWith(
+      'chat-identifier-check',
+      'user-1',
+      expect.objectContaining({ maxTokens: 60, refillIntervalMs: 60_000 })
+    )
+  })
+})

apps/sim/app/api/chat/validate/route.ts

@@ -5,16 +5,39 @@ import { and, eq, isNull } from 'drizzle-orm'
 import type { NextRequest } from 'next/server'
 import { identifierValidationQuerySchema } from '@/lib/api/contracts/chats'
 import { getValidationErrorMessage } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { enforceUserRateLimit, type TokenBucketConfig } from '@/lib/core/rate-limiter'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
 
 const logger = createLogger('ChatValidateAPI')
 
 /**
- * GET endpoint to validate chat identifier availability
+ * Caps how far one caller can walk a dictionary of identifiers. Sized for a
+ * debounced availability field, which sends one request per pause in typing.
+ */
+const IDENTIFIER_CHECK_RATE_LIMIT: TokenBucketConfig = {
+  maxTokens: 60,
+  refillRate: 60,
+  refillIntervalMs: 60_000,
+}
+
+/**
+ * GET endpoint to validate chat identifier availability.
+ *
+ * Chat identifiers are globally unique, so availability cannot be scoped to a
+ * workspace and there is no resource here to authorize. What the endpoint must
+ * not be is anonymous: `available: false` names a live deployment, and the chat
+ * behind it executes its owner's workflow on their budget for anyone holding
+ * the identifier, so an unmetered answer is a deployment inventory.
  */
 export const GET = withRouteHandler(async (request: NextRequest) => {
   try {
+    const session = await getSession()
+    if (!session?.user?.id) {
+      return createErrorResponse('Unauthorized', 401)
+    }
+
     const { searchParams } = new URL(request.url)
     const identifier = searchParams.get('identifier')
 
@@ -34,6 +57,13 @@ export const GET = withRouteHandler(async (request: NextRequest) => {
       return createErrorResponse(errorMessage, 400)
     }
 
+    const rateLimited = await enforceUserRateLimit(
+      'chat-identifier-check',
+      session.user.id,
+      IDENTIFIER_CHECK_RATE_LIMIT
+    )
+    if (rateLimited) return rateLimited
+
     const { identifier: validatedIdentifier } = validation.data
 
     const existingChat = await db