fix(security): backstop public OTP requests

Author: TheodoreSpeaks

apps/sim/app/api/chat/[identifier]/otp/route.test.ts

@@ -283,6 +283,48 @@ describe('Chat OTP API Route', () => {
     })
 
     it('returns 429 with Retry-After when email rate limit is exceeded', async () => {
+      mockCheckRateLimitDirect
+        .mockResolvedValueOnce({
+          allowed: true,
+          remaining: 9,
+          resetAt: new Date(Date.now() + 60_000),
+        })
+        .mockResolvedValueOnce({
+          allowed: true,
+          remaining: 99,
+          resetAt: new Date(Date.now() + 60_000),
+        })
+        .mockResolvedValueOnce({
+          allowed: false,
+          remaining: 0,
+          resetAt: new Date(Date.now() + 900_000),
+          retryAfterMs: 900_000,
+        })
+
+      const headerSet = vi.fn()
+      mockCreateErrorResponse.mockImplementationOnce((message: string, status: number) => ({
+        json: () => Promise.resolve({ error: message }),
+        status,
+        headers: { set: headerSet },
+      }))
+
+      queueDeployment(emailDeployment)
+
+      const request = new NextRequest('http://localhost:3000/api/chat/test/otp', {
+        method: 'POST',
+        body: JSON.stringify({ email: mockEmail }),
+      })
+
+      const response = await POST(request, {
+        params: Promise.resolve({ identifier: mockIdentifier }),
+      })
+
+      expect(response.status).toBe(429)
+      expect(headerSet).toHaveBeenCalledWith('Retry-After', '900')
+      expect(mockSendEmail).not.toHaveBeenCalled()
+    })
+
+    it('returns 429 with Retry-After when the chat resource rate limit is exceeded', async () => {
       mockCheckRateLimitDirect
         .mockResolvedValueOnce({
           allowed: true,
@@ -343,7 +385,7 @@ describe('Chat OTP API Route', () => {
       expect(headerSet).toHaveBeenCalledWith('Retry-After', '900')
     })
 
-    it('skips the IP bucket when the client IP cannot be resolved', async () => {
+    it('retains resource and email backstops when the client IP cannot be resolved', async () => {
       requestUtilsMockFns.mockGetClientIp.mockReturnValueOnce(null)
       queueDeployment(emailDeployment)
 
@@ -354,8 +396,15 @@ describe('Chat OTP API Route', () => {
 
       await POST(request, { params: Promise.resolve({ identifier: mockIdentifier }) })
 
-      expect(mockCheckRateLimitDirect).toHaveBeenCalledTimes(1)
-      expect(mockCheckRateLimitDirect).toHaveBeenCalledWith(
+      expect(mockCheckRateLimitDirect).toHaveBeenCalledTimes(2)
+      expect(mockCheckRateLimitDirect).toHaveBeenNthCalledWith(
+        1,
+        'chat-otp:resource:chat-123',
+        expect.any(Object),
+        { failClosed: true }
+      )
+      expect(mockCheckRateLimitDirect).toHaveBeenNthCalledWith(
+        2,
         expect.stringContaining('chat-otp:email:'),
         expect.any(Object),
         { failClosed: true }

apps/sim/app/api/chat/[identifier]/otp/route.ts

@@ -17,6 +17,7 @@ import {
   MAX_OTP_ATTEMPTS,
   OTP_EMAIL_RATE_LIMIT,
   OTP_IP_RATE_LIMIT,
+  OTP_RESOURCE_RATE_LIMIT,
   storeOTP,
 } from '@/lib/core/security/otp'
 import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
@@ -88,6 +89,24 @@ export const POST = withRouteHandler(
         ? deployment.allowedEmails
         : []
 
+      const resourceRateLimit = await rateLimiter.checkRateLimitDirect(
+        `chat-otp:resource:${deployment.id}`,
+        OTP_RESOURCE_RATE_LIMIT,
+        { failClosed: true }
+      )
+      if (!resourceRateLimit.allowed) {
+        logger.warn(`[${requestId}] OTP resource rate limit exceeded for chat ${deployment.id}`)
+        const retryAfter = Math.ceil(
+          (resourceRateLimit.retryAfterMs ?? OTP_RESOURCE_RATE_LIMIT.refillIntervalMs) / 1000
+        )
+        const response = createErrorResponse(
+          'Too many verification code requests. Please try again later.',
+          429
+        )
+        response.headers.set('Retry-After', String(retryAfter))
+        return response
+      }
+
       if (!isEmailAllowed(email, allowedEmails)) {
         return createErrorResponse('Email not authorized for this chat', 403)
       }

apps/sim/app/api/files/public/[token]/otp/route.test.ts

@@ -1,6 +1,7 @@
 /**
  * @vitest-environment node
  */
+import { requestUtilsMockFns } from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -49,6 +50,7 @@ vi.mock('@/lib/core/security/otp', () => ({
   MAX_OTP_ATTEMPTS: 5,
   OTP_IP_RATE_LIMIT: { maxTokens: 10, refillRate: 10, refillIntervalMs: 1000 },
   OTP_EMAIL_RATE_LIMIT: { maxTokens: 3, refillRate: 3, refillIntervalMs: 1000 },
+  OTP_RESOURCE_RATE_LIMIT: { maxTokens: 100, refillRate: 100, refillIntervalMs: 1000 },
 }))
 vi.mock('@/components/emails', () => ({
   getOtpSubject: (label: string) => `Verification code for ${label}`,
@@ -128,6 +130,40 @@ describe('POST /api/files/public/[token]/otp', () => {
     expect(res.status).toBe(429)
     expect(res.headers.get('Retry-After')).toBe('1')
   })
+
+  it('returns 429 when the share resource rate limit is exceeded', async () => {
+    mockCheckRateLimitDirect
+      .mockResolvedValueOnce({ allowed: true })
+      .mockResolvedValueOnce({ allowed: false, retryAfterMs: 1000 })
+
+    const res = await POST(post('user@acme.com'), params())
+
+    expect(res.status).toBe(429)
+    expect(res.headers.get('Retry-After')).toBe('1')
+    expect(mockStoreOTP).not.toHaveBeenCalled()
+    expect(mockSendEmail).not.toHaveBeenCalled()
+  })
+
+  it('retains resource and email backstops when the client IP cannot be resolved', async () => {
+    requestUtilsMockFns.mockGetClientIp.mockReturnValueOnce(null)
+
+    const res = await POST(post('user@acme.com'), params())
+
+    expect(res.status).toBe(200)
+    expect(mockCheckRateLimitDirect).toHaveBeenCalledTimes(2)
+    expect(mockCheckRateLimitDirect).toHaveBeenNthCalledWith(
+      1,
+      'file-otp:resource:sh_1',
+      expect.any(Object),
+      { failClosed: true }
+    )
+    expect(mockCheckRateLimitDirect).toHaveBeenNthCalledWith(
+      2,
+      'file-otp:email:sh_1:user@acme.com',
+      expect.any(Object),
+      { failClosed: true }
+    )
+  })
 })
 
 describe('PUT /api/files/public/[token]/otp', () => {

apps/sim/app/api/files/public/[token]/otp/route.ts

@@ -19,6 +19,7 @@ import {
   MAX_OTP_ATTEMPTS,
   OTP_EMAIL_RATE_LIMIT,
   OTP_IP_RATE_LIMIT,
+  OTP_RESOURCE_RATE_LIMIT,
   storeOTP,
 } from '@/lib/core/security/otp'
 import { generateRequestId, getClientIp } from '@/lib/core/utils/request'
@@ -88,6 +89,18 @@ export const POST = withRouteHandler(
         )
       }
 
+      const resourceRateLimit = await rateLimiter.checkRateLimitDirect(
+        `file-otp:resource:${resolved.share.id}`,
+        OTP_RESOURCE_RATE_LIMIT,
+        { failClosed: true }
+      )
+      if (!resourceRateLimit.allowed) {
+        logger.warn(
+          `[${requestId}] OTP resource rate limit exceeded for share ${resolved.share.id}`
+        )
+        return rateLimited(resourceRateLimit.retryAfterMs, OTP_RESOURCE_RATE_LIMIT.refillIntervalMs)
+      }
+
       if (!isEmailAllowed(email, shareAllowedEmails(resolved.share.allowedEmails))) {
         return NextResponse.json({ error: 'Email not authorized for this file' }, { status: 403 })
       }

apps/sim/lib/core/config/env.ts

@@ -612,7 +612,8 @@ export const env = createEnv({
     REACT_SCAN_ENABLED:                    z.boolean().optional(),                 // Enable React Scan for performance debugging (dev only)
 
     // Network / proxy trust
-    AUTH_TRUSTED_PROXIES:                  z.string().optional(),                  // Comma-separated reverse-proxy IPs or CIDR ranges. Sim and Better Auth walk the forwarded-IP chain right to left, skip these trusted hops, and use the first untrusted address. Invalid and catch-all entries fail at startup.
+    /** Comma-separated proxy IPs/CIDRs skipped while resolving the forwarded client chain. */
+    AUTH_TRUSTED_PROXIES:                  z.string().optional(),
 
     // SSO Configuration (for script-based registration)
     SSO_ENABLED:                           z.boolean().optional(),                 // Enable SSO functionality

apps/sim/lib/core/security/otp.ts

@@ -28,6 +28,13 @@ export const OTP_EMAIL_RATE_LIMIT: TokenBucketConfig = {
   refillIntervalMs: 15 * 60_000,
 }
 
+/** Caps OTP requests against one deployment independently of client identity. */
+export const OTP_RESOURCE_RATE_LIMIT: TokenBucketConfig = {
+  maxTokens: 100,
+  refillRate: 100,
+  refillIntervalMs: 15 * 60_000,
+}
+
 /**
  * Key formats are kept per-kind to preserve any in-flight OTPs already issued
  * against existing chat deployments. The chat Redis key uses the legacy `otp:`