refactor(chat): share the deployed-chat auth gate across voice routes

Review of the previous commits surfaced duplication and one more gap:

- The TTS and STT routes had grown near-identical copies of the chat
  auth + payer lookup. Extracted to resolveDeployedChatCaller, so the
  gate and the payer resolve together and cannot drift per route — that
  duplication is how the unmetered TTS path shipped in the first place.
- Neither copy filtered chat.archivedAt, so an archived chat could still
  authorize spend against its former owner's workspace. The shared
  lookup now filters it, fixing both routes at once. Note: not covered
  by a test — the db chain mock does not evaluate WHERE clauses, so an
  assertion here could not fail.
- Replaced the route's hand-rolled 429 builder with the existing
  enforceIpRateLimit helper, and added enforceChatRateLimit alongside
  the per-user/IP/workspace helpers. Gains the standard Retry-After and
  X-RateLimit-Reset headers plus throttle logging.
- Dropped a test that asserted a module the route no longer imports was
  never called: it could not fail.
- Narrowed the contract: unexported the single-use allowlists and
  dropped .passthrough() now that the body is a closed shape.

Author: waleedlatif1

apps/sim/app/(interfaces)/chat/hooks/use-audio-streaming.ts

@@ -2,6 +2,7 @@
 
 import { type RefObject, useCallback, useRef, useState } from 'react'
 import { createLogger } from '@sim/logger'
+import { DEFAULT_TTS_MODEL_ID } from '@/lib/api/contracts/media/tts-stream'
 
 const logger = createLogger('UseAudioStreaming')
 
@@ -79,7 +80,7 @@ export function useAudioStreaming(sharedAudioContextRef?: RefObject<AudioContext
     const { text, options } = item
     const {
       voiceId,
-      modelId = 'eleven_flash_v2_5',
+      modelId = DEFAULT_TTS_MODEL_ID,
       chatId,
       onAudioStart,
       onAudioEnd,

apps/sim/app/api/proxy/tts/stream/route.test.ts

@@ -17,16 +17,16 @@ const {
   mockResolveSystemBillingAttribution,
   mockCheckAttributedUsageLimits,
   mockToBillingContext,
-  mockCheckAndBillPayerOverageThreshold,
-  mockCheckRateLimitDirect,
+  mockEnforceIpRateLimit,
+  mockEnforceChatRateLimit,
 } = vi.hoisted(() => ({
   mockRecordUsage: vi.fn(),
   mockCheckActorUsageLimits: vi.fn(),
   mockResolveSystemBillingAttribution: vi.fn(),
   mockCheckAttributedUsageLimits: vi.fn(),
   mockToBillingContext: vi.fn(),
-  mockCheckAndBillPayerOverageThreshold: vi.fn(),
-  mockCheckRateLimitDirect: vi.fn(),
+  mockEnforceIpRateLimit: vi.fn(),
+  mockEnforceChatRateLimit: vi.fn(),
 }))
 
 const SYSTEM_BILLING_ATTRIBUTION = {
@@ -54,14 +54,9 @@ vi.mock('@/lib/billing/calculations/usage-monitor', () => ({
   checkActorUsageLimits: mockCheckActorUsageLimits,
 }))
 
-vi.mock('@/lib/billing/threshold-billing', () => ({
-  checkAndBillPayerOverageThreshold: mockCheckAndBillPayerOverageThreshold,
-}))
-
-vi.mock('@/lib/core/rate-limiter', () => ({
-  RateLimiter: class {
-    checkRateLimitDirect = mockCheckRateLimitDirect
-  },
+vi.mock('@/lib/core/rate-limiter/route-helpers', () => ({
+  enforceIpRateLimit: mockEnforceIpRateLimit,
+  enforceChatRateLimit: mockEnforceChatRateLimit,
 }))
 
 vi.mock('@/lib/core/security/deployment', () => ({ validateAuthToken: vi.fn(() => false) }))
@@ -107,7 +102,8 @@ beforeEach(() => {
   vi.clearAllMocks()
   resetDbChainMock()
   setEnv({ ELEVENLABS_API_KEY: 'test-key' })
-  mockCheckRateLimitDirect.mockResolvedValue({ allowed: true, remaining: 10 })
+  mockEnforceIpRateLimit.mockResolvedValue(null)
+  mockEnforceChatRateLimit.mockResolvedValue(null)
   mockRecordUsage.mockResolvedValue(undefined)
   mockCheckActorUsageLimits.mockResolvedValue({ isExceeded: false })
   mockCheckAttributedUsageLimits.mockResolvedValue({ isExceeded: false })
@@ -167,26 +163,32 @@ describe('POST /api/proxy/tts/stream — spend controls', () => {
   })
 
   it('throttles per IP before any chat lookup so a flood cannot be amplified into queries', async () => {
-    mockCheckRateLimitDirect.mockResolvedValueOnce({ allowed: false, retryAfterMs: 30_000 })
+    mockEnforceIpRateLimit.mockResolvedValue(new Response('Rate limit exceeded', { status: 429 }))
 
     const res = await POST(createMockRequest('POST', validBody()))
 
     expect(res.status).toBe(429)
-    expect(res.headers.get('Retry-After')).toBe('30')
-    expect(mockCheckRateLimitDirect.mock.calls[0][0]).toContain('tts-stream:ip:')
+    expect(mockEnforceIpRateLimit).toHaveBeenCalledWith('tts-stream', expect.anything(), {
+      maxTokens: 60,
+      refillRate: 30,
+      refillIntervalMs: 60_000,
+    })
+    expect(mockEnforceChatRateLimit).not.toHaveBeenCalled()
     expect(global.fetch).not.toHaveBeenCalled()
   })
 
   it('throttles per chat so many callers cannot drain one public chat', async () => {
     queueTableRows(schemaMock.chat, [publicChatRow])
-    mockCheckRateLimitDirect
-      .mockResolvedValueOnce({ allowed: true, remaining: 10 })
-      .mockResolvedValueOnce({ allowed: false, retryAfterMs: 60_000 })
+    mockEnforceChatRateLimit.mockResolvedValue(new Response('Rate limit exceeded', { status: 429 }))
 
     const res = await POST(createMockRequest('POST', validBody()))
 
     expect(res.status).toBe(429)
-    expect(mockCheckRateLimitDirect.mock.calls[1][0]).toBe('tts-stream:chat:chat-1')
+    expect(mockEnforceChatRateLimit).toHaveBeenCalledWith('tts-stream', 'chat-1', {
+      maxTokens: 120,
+      refillRate: 60,
+      refillIntervalMs: 60_000,
+    })
     expect(global.fetch).not.toHaveBeenCalled()
     expect(mockRecordUsage).not.toHaveBeenCalled()
   })
@@ -230,14 +232,6 @@ describe('POST /api/proxy/tts/stream — attribution', () => {
     expect(first).not.toBe(second)
   })
 
-  it('does not run per-request threshold settlement on the realtime path', async () => {
-    queueTableRows(schemaMock.chat, [publicChatRow])
-
-    await POST(createMockRequest('POST', validBody()))
-
-    expect(mockCheckAndBillPayerOverageThreshold).not.toHaveBeenCalled()
-  })
-
   it('falls back to the chat owner when the workflow has no workspace', async () => {
     queueTableRows(schemaMock.chat, [{ ...publicChatRow, workspaceId: null }])
 

apps/sim/app/api/proxy/tts/stream/route.ts

@@ -1,39 +1,27 @@
 import { randomUUID } from 'node:crypto'
-import { db } from '@sim/db'
-import { chat, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
-import { eq } from 'drizzle-orm'
 import { type NextRequest, NextResponse } from 'next/server'
 import { ttsStreamContract } from '@/lib/api/contracts/media/tts-stream'
 import { parseRequest } from '@/lib/api/server'
 import { checkActorUsageLimits } from '@/lib/billing/calculations/usage-monitor'
 import {
-  type BillingAttributionSnapshot,
   checkAttributedUsageLimits,
   resolveSystemBillingAttribution,
   toBillingContext,
 } from '@/lib/billing/core/billing-attribution'
 import { recordUsage } from '@/lib/billing/core/usage-log'
+import { resolveDeployedChatCaller } from '@/lib/chat/deployed-chat-caller'
 import { env } from '@/lib/core/config/env'
 import { getCostMultiplier } from '@/lib/core/config/env-flags'
-import { RateLimiter } from '@/lib/core/rate-limiter'
-import { validateAuthToken } from '@/lib/core/security/deployment'
-import { getClientIp } from '@/lib/core/utils/request'
+import { enforceChatRateLimit, enforceIpRateLimit } from '@/lib/core/rate-limiter/route-helpers'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 
 const logger = createLogger('ProxyTTSStreamAPI')
 
-const rateLimiter = new RateLimiter()
-
 /**
- * Public chats hand their id to every visitor, so the id alone cannot gate
- * spend on the platform ElevenLabs key.
- *
- * The per-IP bucket only filters naive floods: `getClientIp` trusts the
- * leftmost `X-Forwarded-For` value, which the caller controls, so a deliberate
- * attacker rotates past it. The per-chat bucket is the load-bearing control —
- * it is keyed on server-held state and bounds total spend per chat regardless
- * of how many source addresses the traffic claims to come from.
+ * Filters naive floods only: `getClientIp` trusts the leftmost
+ * `X-Forwarded-For` value, which the caller controls, so a deliberate attacker
+ * rotates past this bucket. See {@link TTS_CHAT_RATE_LIMIT}.
  *
  * Deployed chat synthesizes sentence by sentence, so a real conversation issues
  * several requests per answer — hence the generous burst.
@@ -44,6 +32,12 @@ const TTS_IP_RATE_LIMIT = {
   refillIntervalMs: 60 * 1000,
 } as const
 
+/**
+ * The load-bearing spend control. Public chats hand their id to every visitor,
+ * so the id alone cannot gate use of the platform ElevenLabs key. This bucket
+ * is keyed on server-held state, bounding total spend per chat regardless of
+ * how many source addresses the traffic claims to come from.
+ */
 const TTS_CHAT_RATE_LIMIT = {
   maxTokens: 120,
   refillRate: 60,
@@ -65,81 +59,11 @@ const TTS_COST_PER_1K_CHARS = 0.05
  */
 const MAX_TTS_BODY_BYTES = 16 * 1024
 
-interface ChatAuthResult {
-  valid: boolean
-  ownerId?: string
-  workspaceId?: string | null
-}
-
-/**
- * Validates chat-based authentication for deployed chat voice mode, resolving
- * the owning workspace so the synthesis can be attributed to a payer.
- */
-async function validateChatAuth(request: NextRequest, chatId: string): Promise<ChatAuthResult> {
-  try {
-    const chatResult = await db
-      .select({
-        id: chat.id,
-        userId: chat.userId,
-        isActive: chat.isActive,
-        authType: chat.authType,
-        password: chat.password,
-        workspaceId: workflow.workspaceId,
-      })
-      .from(chat)
-      .leftJoin(workflow, eq(workflow.id, chat.workflowId))
-      .where(eq(chat.id, chatId))
-      .limit(1)
-
-    if (chatResult.length === 0 || !chatResult[0].isActive) {
-      logger.warn('Chat not found or inactive for TTS auth:', chatId)
-      return { valid: false }
-    }
-
-    const chatData = chatResult[0]
-
-    if (chatData.authType === 'public') {
-      return { valid: true, ownerId: chatData.userId, workspaceId: chatData.workspaceId }
-    }
-
-    const cookieName = `chat_auth_${chatId}`
-    const authCookie = request.cookies.get(cookieName)
-
-    if (
-      authCookie &&
-      validateAuthToken(authCookie.value, chatId, chatData.authType, chatData.password)
-    ) {
-      return { valid: true, ownerId: chatData.userId, workspaceId: chatData.workspaceId }
-    }
-
-    return { valid: false }
-  } catch (error) {
-    logger.error('Error validating chat auth for TTS:', error)
-    return { valid: false }
-  }
-}
-
-function rateLimitResponse(retryAfterMs: number | undefined): Response {
-  return new NextResponse('Rate limit exceeded', {
-    status: 429,
-    headers: { 'Retry-After': String(Math.ceil((retryAfterMs ?? 60_000) / 1000)) },
-  })
-}
-
 export const POST = withRouteHandler(async (request: NextRequest) => {
   try {
-    /**
-     * Throttle per IP before any database work so an anonymous flood cannot be
-     * amplified into chat lookups.
-     */
-    const clientIp = getClientIp(request)
-    const ipRateCheck = await rateLimiter.checkRateLimitDirect(
-      `tts-stream:ip:${clientIp}`,
-      TTS_IP_RATE_LIMIT
-    )
-    if (!ipRateCheck.allowed) {
-      return rateLimitResponse(ipRateCheck.retryAfterMs)
-    }
+    // Throttle per IP before any database work so a flood cannot be amplified into chat lookups.
+    const ipLimited = await enforceIpRateLimit('tts-stream', request, TTS_IP_RATE_LIMIT)
+    if (ipLimited) return ipLimited
 
     const parsed = await parseRequest(
       ttsStreamContract,
@@ -160,39 +84,27 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
 
     const { text, voiceId, modelId, chatId } = parsed.data.body
 
-    const chatAuth = await validateChatAuth(request, chatId)
-    if (!chatAuth.valid) {
+    const caller = await resolveDeployedChatCaller(request, chatId)
+    if (!caller.authorized) {
       logger.warn('Chat authentication failed for TTS, chatId:', chatId)
       return new Response('Unauthorized', { status: 401 })
     }
 
-    const chatRateCheck = await rateLimiter.checkRateLimitDirect(
-      `tts-stream:chat:${chatId}`,
-      TTS_CHAT_RATE_LIMIT
-    )
-    if (!chatRateCheck.allowed) {
-      return rateLimitResponse(chatRateCheck.retryAfterMs)
-    }
-
-    /**
-     * Anonymous deployed chats have no human request actor, so resolve the
-     * system actor and immutable workspace payer together.
-     */
-    const workspaceId = chatAuth.workspaceId ?? undefined
-    let billingAttribution: BillingAttributionSnapshot | undefined
-    let actorUserId = chatAuth.ownerId
-    if (workspaceId) {
-      billingAttribution = await resolveSystemBillingAttribution(workspaceId)
-      actorUserId = billingAttribution.actorUserId
-    }
-
-    if (actorUserId) {
-      const usageCheck = billingAttribution
-        ? await checkAttributedUsageLimits(billingAttribution)
-        : await checkActorUsageLimits(actorUserId)
-      if (usageCheck.isExceeded) {
-        return new Response(usageCheck.message || 'Usage limit exceeded.', { status: 402 })
-      }
+    const chatLimited = await enforceChatRateLimit('tts-stream', chatId, TTS_CHAT_RATE_LIMIT)
+    if (chatLimited) return chatLimited
+
+    // Anonymous deployed chats have no human request actor, so the workspace payer is charged.
+    const workspaceId = caller.workspaceId ?? undefined
+    const billingAttribution = workspaceId
+      ? await resolveSystemBillingAttribution(workspaceId)
+      : undefined
+    const actorUserId = billingAttribution?.actorUserId ?? caller.ownerId
+
+    const usageCheck = billingAttribution
+      ? await checkAttributedUsageLimits(billingAttribution)
+      : await checkActorUsageLimits(actorUserId)
+    if (usageCheck.isExceeded) {
+      return new Response(usageCheck.message || 'Usage limit exceeded.', { status: 402 })
     }
 
     const apiKey = env.ELEVENLABS_API_KEY
@@ -245,31 +157,30 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
      * entry's stable fields — without this, two synthesis calls of equal length
      * in the same workspace would collide and the second would silently go
      * unbilled. Each call is a separate charge from ElevenLabs, so each needs
-     * its own row rather than being deduplicated.
+     * its own row rather than being deduplicated. `randomUUID` rather than
+     * `generateRequestId`, whose fallback truncates to 8 characters.
      *
      * No threshold settlement here: it runs per metered event elsewhere and is
      * far too heavy for a per-sentence realtime path. The workflow execution
      * that produced this text already settles the payer.
      */
-    if (actorUserId) {
-      try {
-        await recordUsage({
-          userId: actorUserId,
-          workspaceId,
-          ...(billingAttribution ? toBillingContext(billingAttribution) : {}),
-          entries: [
-            {
-              category: 'fixed',
-              source: 'voice-output',
-              description: `Voice output (${text.length} characters)`,
-              cost: (text.length / 1000) * TTS_COST_PER_1K_CHARS * getCostMultiplier(),
-              sourceReference: `voice-output:${chatId}:${randomUUID()}`,
-            },
-          ],
-        })
-      } catch (err) {
-        logger.warn('Failed to record voice output usage, continuing:', err)
-      }
+    try {
+      await recordUsage({
+        userId: actorUserId,
+        workspaceId,
+        ...(billingAttribution ? toBillingContext(billingAttribution) : {}),
+        entries: [
+          {
+            category: 'fixed',
+            source: 'voice-output',
+            description: `Voice output (${text.length} characters)`,
+            cost: (text.length / 1000) * TTS_COST_PER_1K_CHARS * getCostMultiplier(),
+            sourceReference: `voice-output:${chatId}:${randomUUID()}`,
+          },
+        ],
+      })
+    } catch (err) {
+      logger.warn('Failed to record voice output usage, continuing:', err)
     }
 
     const { readable, writable } = new TransformStream({