fix(security): meter and throttle the deployed-chat TTS relay

POST /api/proxy/tts/stream treated "a live public chat exists" as
authorization to spend the platform ElevenLabs key. A public chat id is
handed to every visitor, so any anonymous caller could synthesize speech
with no length cap, no rate limit and no usage accounting.

Bring the relay in line with its STT sibling (/api/speech/token):

- Resolve the chat's workspace and bill synthesized characters to that
  payer via a new `voice-output` usage source, so spend is attributable
  and counts against the plan's usage limit (402 once exceeded).
- Throttle per IP before any database work, and per chat afterwards, to
  bound both one caller hammering many chats and many callers hammering
  one chat.
- Cap `text` at 2000 characters and allowlist `voiceId`/`modelId`, so the
  caller can no longer choose an unbounded charge, a premium or cloned
  voice, or the billing model.
- Drop `Access-Control-Allow-Origin: *`, which let any third-party page
  read the audio; deployed chat and the Office embed are same-origin.

Author: waleedlatif1

apps/sim/app/(interfaces)/chat/[identifier]/chat.tsx

@@ -3,6 +3,7 @@
 import { type RefObject, useCallback, useEffect, useMemo, useRef, useState } from 'react'
 import { createLogger } from '@sim/logger'
 import { generateId } from '@sim/utils/id'
+import { DEFAULT_TTS_VOICE_ID } from '@/lib/api/contracts/media/tts-stream'
 import { noop } from '@/lib/core/utils/request'
 import {
   AGENT_STREAM_PROTOCOL_HEADER,
@@ -49,7 +50,7 @@ interface ChatRequestPayload {
 }
 
 const DEFAULT_VOICE_SETTINGS = {
-  voiceId: 'cgSgspJ2msm6clMCkdW9', // Default ElevenLabs voice (Jessica) — Flash v2.5-optimized
+  voiceId: DEFAULT_TTS_VOICE_ID,
 }
 
 /**

apps/sim/app/api/proxy/tts/stream/route.test.ts

@@ -0,0 +1,257 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  createMockRequest,
+  queueTableRows,
+  resetDbChainMock,
+  resetEnvMock,
+  schemaMock,
+  setEnv,
+} from '@sim/testing'
+import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockRecordUsage,
+  mockCheckActorUsageLimits,
+  mockResolveSystemBillingAttribution,
+  mockCheckAttributedUsageLimits,
+  mockToBillingContext,
+  mockCheckAndBillPayerOverageThreshold,
+  mockCheckRateLimitDirect,
+} = vi.hoisted(() => ({
+  mockRecordUsage: vi.fn(),
+  mockCheckActorUsageLimits: vi.fn(),
+  mockResolveSystemBillingAttribution: vi.fn(),
+  mockCheckAttributedUsageLimits: vi.fn(),
+  mockToBillingContext: vi.fn(),
+  mockCheckAndBillPayerOverageThreshold: vi.fn(),
+  mockCheckRateLimitDirect: vi.fn(),
+}))
+
+const SYSTEM_BILLING_ATTRIBUTION = {
+  actorUserId: 'payer-1',
+  workspaceId: 'ws-1',
+  organizationId: 'org-1',
+  billedAccountUserId: 'payer-1',
+  billingEntity: { type: 'organization' as const, id: 'org-1' },
+  billingPeriod: {
+    start: '2026-07-01T00:00:00.000Z',
+    end: '2026-08-01T00:00:00.000Z',
+  },
+  payerSubscription: null,
+}
+
+vi.mock('@/lib/billing/core/usage-log', () => ({ recordUsage: mockRecordUsage }))
+
+vi.mock('@/lib/billing/core/billing-attribution', () => ({
+  resolveSystemBillingAttribution: mockResolveSystemBillingAttribution,
+  checkAttributedUsageLimits: mockCheckAttributedUsageLimits,
+  toBillingContext: mockToBillingContext,
+}))
+
+vi.mock('@/lib/billing/calculations/usage-monitor', () => ({
+  checkActorUsageLimits: mockCheckActorUsageLimits,
+}))
+
+vi.mock('@/lib/billing/threshold-billing', () => ({
+  checkAndBillPayerOverageThreshold: mockCheckAndBillPayerOverageThreshold,
+}))
+
+vi.mock('@/lib/core/rate-limiter', () => ({
+  RateLimiter: class {
+    checkRateLimitDirect = mockCheckRateLimitDirect
+  },
+}))
+
+vi.mock('@/lib/core/security/deployment', () => ({ validateAuthToken: vi.fn(() => false) }))
+
+import { DEFAULT_TTS_VOICE_ID, MAX_TTS_TEXT_LENGTH } from '@/lib/api/contracts/media/tts-stream'
+import { POST } from '@/app/api/proxy/tts/stream/route'
+
+const publicChatRow = {
+  id: 'chat-1',
+  userId: 'owner-1',
+  isActive: true,
+  authType: 'public',
+  password: null,
+  workspaceId: 'ws-1',
+}
+
+function validBody(overrides: Record<string, unknown> = {}) {
+  return {
+    text: 'Hello from the deployed chat.',
+    voiceId: DEFAULT_TTS_VOICE_ID,
+    chatId: 'chat-1',
+    ...overrides,
+  }
+}
+
+/** Minimal ElevenLabs stub returning a readable audio body. */
+function mockElevenLabsAudio() {
+  global.fetch = vi.fn().mockResolvedValue({
+    ok: true,
+    status: 200,
+    statusText: 'OK',
+    body: new ReadableStream({
+      start(controller) {
+        controller.enqueue(new Uint8Array([0x49, 0x44, 0x33]))
+        controller.close()
+      },
+    }),
+    // double-cast-allowed: minimal fetch stub for the ElevenLabs stream call
+  }) as unknown as typeof fetch
+}
+
+beforeEach(() => {
+  vi.clearAllMocks()
+  resetDbChainMock()
+  setEnv({ ELEVENLABS_API_KEY: 'test-key' })
+  mockCheckRateLimitDirect.mockResolvedValue({ allowed: true, remaining: 10 })
+  mockRecordUsage.mockResolvedValue(undefined)
+  mockCheckActorUsageLimits.mockResolvedValue({ isExceeded: false })
+  mockCheckAttributedUsageLimits.mockResolvedValue({ isExceeded: false })
+  mockResolveSystemBillingAttribution.mockResolvedValue(SYSTEM_BILLING_ATTRIBUTION)
+  mockToBillingContext.mockImplementation(
+    (attribution: { billingEntity: { type: 'organization' | 'user'; id: string } }) => ({
+      billingEntity: attribution.billingEntity,
+      billingPeriod: {
+        start: new Date('2026-07-01T00:00:00.000Z'),
+        end: new Date('2026-08-01T00:00:00.000Z'),
+      },
+    })
+  )
+  mockElevenLabsAudio()
+})
+
+afterAll(() => {
+  resetDbChainMock()
+  resetEnvMock()
+})
+
+describe('POST /api/proxy/tts/stream — spend controls', () => {
+  it('caps text length so one request cannot bill unbounded characters', async () => {
+    const res = await POST(
+      createMockRequest('POST', validBody({ text: 'a'.repeat(MAX_TTS_TEXT_LENGTH + 1) }))
+    )
+
+    expect(res.status).toBe(400)
+    expect(global.fetch).not.toHaveBeenCalled()
+    expect(mockRecordUsage).not.toHaveBeenCalled()
+  })
+
+  it('rejects a voice outside the allowlist so the caller cannot pick a premium voice', async () => {
+    const res = await POST(
+      createMockRequest('POST', validBody({ voiceId: '21m00Tcm4TlvDq8ikWAM' }))
+    )
+
+    expect(res.status).toBe(400)
+    expect(global.fetch).not.toHaveBeenCalled()
+  })
+
+  it('rejects a model outside the allowlist so the caller cannot pick the billing model', async () => {
+    const res = await POST(
+      createMockRequest('POST', validBody({ modelId: 'eleven_multilingual_v2' }))
+    )
+
+    expect(res.status).toBe(400)
+    expect(global.fetch).not.toHaveBeenCalled()
+  })
+
+  it('throttles per IP before any chat lookup so a flood cannot be amplified into queries', async () => {
+    mockCheckRateLimitDirect.mockResolvedValueOnce({ allowed: false, retryAfterMs: 30_000 })
+
+    const res = await POST(createMockRequest('POST', validBody()))
+
+    expect(res.status).toBe(429)
+    expect(res.headers.get('Retry-After')).toBe('30')
+    expect(mockCheckRateLimitDirect.mock.calls[0][0]).toContain('tts-stream:ip:')
+    expect(global.fetch).not.toHaveBeenCalled()
+  })
+
+  it('throttles per chat so many callers cannot drain one public chat', async () => {
+    queueTableRows(schemaMock.chat, [publicChatRow])
+    mockCheckRateLimitDirect
+      .mockResolvedValueOnce({ allowed: true, remaining: 10 })
+      .mockResolvedValueOnce({ allowed: false, retryAfterMs: 60_000 })
+
+    const res = await POST(createMockRequest('POST', validBody()))
+
+    expect(res.status).toBe(429)
+    expect(mockCheckRateLimitDirect.mock.calls[1][0]).toBe('tts-stream:chat:chat-1')
+    expect(global.fetch).not.toHaveBeenCalled()
+    expect(mockRecordUsage).not.toHaveBeenCalled()
+  })
+})
+
+describe('POST /api/proxy/tts/stream — attribution', () => {
+  it('meters synthesized characters against the chat workspace payer', async () => {
+    queueTableRows(schemaMock.chat, [publicChatRow])
+    const text = 'a'.repeat(1000)
+
+    const res = await POST(createMockRequest('POST', validBody({ text })))
+
+    expect(res.status).toBe(200)
+    expect(mockResolveSystemBillingAttribution).toHaveBeenCalledWith('ws-1')
+    expect(mockCheckAttributedUsageLimits).toHaveBeenCalledWith(SYSTEM_BILLING_ATTRIBUTION)
+    expect(mockRecordUsage).toHaveBeenCalledTimes(1)
+    expect(mockRecordUsage.mock.calls[0][0]).toMatchObject({
+      userId: 'payer-1',
+      workspaceId: 'ws-1',
+      billingEntity: { type: 'organization', id: 'org-1' },
+    })
+    expect(mockRecordUsage.mock.calls[0][0].entries[0]).toMatchObject({
+      category: 'fixed',
+      source: 'voice-output',
+      cost: 0.1,
+    })
+    expect(mockCheckAndBillPayerOverageThreshold).toHaveBeenCalledWith({
+      type: 'organization',
+      id: 'org-1',
+    })
+  })
+
+  it('falls back to the chat owner when the workflow has no workspace', async () => {
+    queueTableRows(schemaMock.chat, [{ ...publicChatRow, workspaceId: null }])
+
+    const res = await POST(createMockRequest('POST', validBody()))
+
+    expect(res.status).toBe(200)
+    expect(mockResolveSystemBillingAttribution).not.toHaveBeenCalled()
+    expect(mockCheckActorUsageLimits).toHaveBeenCalledWith('owner-1')
+    expect(mockRecordUsage.mock.calls[0][0]).toMatchObject({ userId: 'owner-1' })
+  })
+
+  it('refuses to spend when the payer is over its usage limit', async () => {
+    queueTableRows(schemaMock.chat, [publicChatRow])
+    mockCheckAttributedUsageLimits.mockResolvedValue({
+      isExceeded: true,
+      message: 'Usage limit exceeded.',
+    })
+
+    const res = await POST(createMockRequest('POST', validBody()))
+
+    expect(res.status).toBe(402)
+    expect(global.fetch).not.toHaveBeenCalled()
+    expect(mockRecordUsage).not.toHaveBeenCalled()
+  })
+
+  it('rejects an unknown chat without touching the platform key', async () => {
+    queueTableRows(schemaMock.chat, [])
+
+    const res = await POST(createMockRequest('POST', validBody()))
+
+    expect(res.status).toBe(401)
+    expect(global.fetch).not.toHaveBeenCalled()
+    expect(mockRecordUsage).not.toHaveBeenCalled()
+  })
+
+  it('does not expose the audio stream to arbitrary origins', async () => {
+    queueTableRows(schemaMock.chat, [publicChatRow])
+
+    const res = await POST(createMockRequest('POST', validBody()))
+
+    expect(res.status).toBe(200)
+    expect(res.headers.get('Access-Control-Allow-Origin')).toBeNull()
+  })
+})