fix(chat): keep public chat deployments admin-only

A chat deployed with authType 'public' is invocable by anyone holding the
URL with no authentication — the same unauthenticated exposure as a public
workflow API, which is admin-only. Deploying a chat itself stays at write,
so this gates the exposure rather than the deployment: an editor ships a
password/email/SSO chat, an admin is required to make one public.

Only the transition *to* public is gated. Editing an already-public chat,
or moving it off public, stays at write — neither increases exposure.

The chat auth selector disables Public for non-admins with a tooltip, and
the create default (which is 'public') falls back to the first mode they
can actually deploy, so an editor does not hit a wall on a fresh chat.

Existing chat suites mock @/app/api/chat/utils wholesale and deploy with
authType public, so they now default the new gate to admin and keep
testing what they were written to test.

Author: mzxchandra

apps/sim/app/api/chat/manage/[id]/route.test.ts

@@ -23,13 +23,17 @@ import {
 import { NextRequest } from 'next/server'
 import { afterAll, beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCheckChatAccess, mockCheckNeedsRedeployment, mockValidateChatDeployAuth } = vi.hoisted(
-  () => ({
-    mockCheckChatAccess: vi.fn(),
-    mockCheckNeedsRedeployment: vi.fn(),
-    mockValidateChatDeployAuth: vi.fn(),
-  })
-)
+const {
+  mockCheckChatAccess,
+  mockCanSetPublicChatAuth,
+  mockCheckNeedsRedeployment,
+  mockValidateChatDeployAuth,
+} = vi.hoisted(() => ({
+  mockCheckChatAccess: vi.fn(),
+  mockCanSetPublicChatAuth: vi.fn(),
+  mockCheckNeedsRedeployment: vi.fn(),
+  mockValidateChatDeployAuth: vi.fn(),
+}))
 
 const mockCreateSuccessResponse = workflowsApiUtilsMockFns.mockCreateSuccessResponse
 const mockCreateErrorResponse = workflowsApiUtilsMockFns.mockCreateErrorResponse
@@ -46,6 +50,7 @@ vi.mock('@/app/api/workflows/utils', () => workflowsApiUtilsMock)
 vi.mock('@/lib/core/security/encryption', () => encryptionMock)
 vi.mock('@/app/api/chat/utils', () => ({
   checkChatAccess: mockCheckChatAccess,
+  canSetPublicChatAuth: mockCanSetPublicChatAuth,
 }))
 vi.mock('@/ee/access-control/utils/permission-check', () => {
   class ChatDeployAuthNotAllowedError extends Error {
@@ -78,6 +83,9 @@ afterAll(() => {
 describe('Chat Edit API Route', () => {
   beforeEach(() => {
     vi.clearAllMocks()
+    // Existing chat suites deploy with authType public; default to admin so they
+    // keep testing what they were written to test.
+    mockCanSetPublicChatAuth.mockResolvedValue(true)
     resetDbChainMock()
     mockPerformChatUndeploy.mockResolvedValue({ success: true })
 

apps/sim/app/api/chat/manage/[id]/route.ts

@@ -18,7 +18,7 @@ import {
   performChatUndeploy,
   performFullDeploy,
 } from '@/lib/workflows/orchestration'
-import { checkChatAccess } from '@/app/api/chat/utils'
+import { canSetPublicChatAuth, checkChatAccess } from '@/app/api/chat/utils'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
 import {
   ChatDeployAuthNotAllowedError,
@@ -127,6 +127,15 @@ export const PATCH = withRouteHandler(
       // mode actually changes, so a grandfathered mode already saved on this chat
       // can still be re-saved (e.g. a title-only edit) without a 403.
       if (authType && authType !== existingChatRecord.authType && chatWorkspaceId) {
+        // Only the transition *to* public is admin-gated. Leaving an already-public
+        // chat as-is, or moving it off public, does not increase exposure.
+        if (
+          authType === 'public' &&
+          !(await canSetPublicChatAuth(session.user.id, chatWorkspaceId))
+        ) {
+          return createErrorResponse('Only admins can make a chat public', 403)
+        }
+
         try {
           await validateChatDeployAuth(session.user.id, chatWorkspaceId, authType)
         } catch (error) {

apps/sim/app/api/chat/route.test.ts

@@ -16,8 +16,13 @@ import {
 import { NextRequest } from 'next/server'
 import { afterAll, beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockCheckWorkflowAccessForChatCreation, mockValidateChatDeployAuth } = vi.hoisted(() => ({
+const {
+  mockCheckWorkflowAccessForChatCreation,
+  mockCanSetPublicChatAuth,
+  mockValidateChatDeployAuth,
+} = vi.hoisted(() => ({
   mockCheckWorkflowAccessForChatCreation: vi.fn(),
+  mockCanSetPublicChatAuth: vi.fn(),
   mockValidateChatDeployAuth: vi.fn(),
 }))
 
@@ -29,6 +34,7 @@ vi.mock('@/app/api/workflows/utils', () => workflowsApiUtilsMock)
 
 vi.mock('@/app/api/chat/utils', () => ({
   checkWorkflowAccessForChatCreation: mockCheckWorkflowAccessForChatCreation,
+  canSetPublicChatAuth: mockCanSetPublicChatAuth,
 }))
 
 vi.mock('@/ee/access-control/utils/permission-check', () => {
@@ -53,6 +59,9 @@ describe('Chat API Route', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    // Existing chat suites deploy with authType public; default to admin so they
+    // keep testing what they were written to test.
+    mockCanSetPublicChatAuth.mockResolvedValue(true)
     setEnv({ NODE_ENV: 'development', NEXT_PUBLIC_APP_URL: 'http://localhost:3000' })
 
     mockCreateSuccessResponse.mockImplementation((data) => {
@@ -251,6 +260,65 @@ describe('Chat API Route', () => {
       )
     })
 
+    it('returns 403 when a non-admin deploys a public chat', async () => {
+      authMockFns.mockGetSession.mockResolvedValue({
+        user: { id: 'user-id', email: 'user@example.com' },
+      })
+
+      dbChainMockFns.limit.mockResolvedValueOnce([])
+      mockCheckWorkflowAccessForChatCreation.mockResolvedValue({
+        hasAccess: true,
+        workflow: { userId: 'user-id', workspaceId: 'workspace-1', isDeployed: true },
+      })
+      // Write access is enough to deploy a chat, but not to make one public.
+      mockCanSetPublicChatAuth.mockResolvedValue(false)
+
+      const response = await POST(
+        new NextRequest('http://localhost:3000/api/chat', {
+          method: 'POST',
+          body: JSON.stringify({
+            workflowId: 'workflow-123',
+            identifier: 'test-chat',
+            title: 'Test Chat',
+            authType: 'public',
+            customizations: { primaryColor: '#000000', welcomeMessage: 'Hello' },
+          }),
+        })
+      )
+
+      expect(response.status).toBe(403)
+      expect(mockCanSetPublicChatAuth).toHaveBeenCalledWith('user-id', 'workspace-1')
+    })
+
+    it('lets a non-admin deploy a password-protected chat', async () => {
+      authMockFns.mockGetSession.mockResolvedValue({
+        user: { id: 'user-id', email: 'user@example.com' },
+      })
+
+      dbChainMockFns.limit.mockResolvedValueOnce([])
+      mockCheckWorkflowAccessForChatCreation.mockResolvedValue({
+        hasAccess: true,
+        workflow: { userId: 'user-id', workspaceId: 'workspace-1', isDeployed: true },
+      })
+      mockCanSetPublicChatAuth.mockResolvedValue(false)
+
+      const response = await POST(
+        new NextRequest('http://localhost:3000/api/chat', {
+          method: 'POST',
+          body: JSON.stringify({
+            workflowId: 'workflow-123',
+            identifier: 'test-chat',
+            title: 'Test Chat',
+            authType: 'password',
+            password: 'test-password',
+            customizations: { primaryColor: '#000000', welcomeMessage: 'Hello' },
+          }),
+        })
+      )
+
+      expect(response.status).not.toBe(403)
+    })
+
     it('returns 403 when the chat auth type is blocked by the permission group', async () => {
       authMockFns.mockGetSession.mockResolvedValue({
         user: { id: 'user-id', email: 'user@example.com' },

apps/sim/app/api/chat/route.ts

@@ -9,7 +9,7 @@ import { getValidationErrorMessage, parseRequest } from '@/lib/api/server'
 import { getSession } from '@/lib/auth'
 import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
 import { performChatDeploy } from '@/lib/workflows/orchestration'
-import { checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
+import { canSetPublicChatAuth, checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
 import { createErrorResponse, createSuccessResponse } from '@/app/api/workflows/utils'
 import {
   ChatDeployAuthNotAllowedError,
@@ -113,6 +113,13 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     }
 
     if (workflowRecord.workspaceId) {
+      if (
+        authType === 'public' &&
+        !(await canSetPublicChatAuth(session.user.id, workflowRecord.workspaceId))
+      ) {
+        return createErrorResponse('Only admins can deploy a public chat', 403)
+      }
+
       try {
         await validateChatDeployAuth(session.user.id, workflowRecord.workspaceId, authType)
       } catch (error) {

apps/sim/app/api/chat/utils.permissions.test.ts

@@ -3,8 +3,17 @@
  */
 
 import { workflowAuthzMockFns } from '@sim/testing'
+
+const { mockGetUserEntityPermissions } = vi.hoisted(() => ({
+  mockGetUserEntityPermissions: vi.fn(),
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
 import { beforeEach, describe, expect, it, vi } from 'vitest'
-import { checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
+import { canSetPublicChatAuth, checkWorkflowAccessForChatCreation } from '@/app/api/chat/utils'
 
 /**
  * Chat deployment dropped from `admin` to `write` alongside the rest of the
@@ -67,3 +76,30 @@ describe('chat deployment permission level', () => {
     expect(result.hasAccess).toBe(false)
   })
 })
+
+/**
+ * A chat deployed with `authType: 'public'` is invocable by anyone with the URL
+ * and no authentication — the same exposure as a public workflow API, which is
+ * admin-only. Deploying an authenticated chat stays at `write`.
+ */
+describe('public chat auth is admin-only', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('allows an admin', async () => {
+    mockGetUserEntityPermissions.mockResolvedValue('admin')
+    await expect(canSetPublicChatAuth('user-1', 'ws-1')).resolves.toBe(true)
+    expect(mockGetUserEntityPermissions).toHaveBeenCalledWith('user-1', 'workspace', 'ws-1')
+  })
+
+  it.each(['write', 'read'] as const)('refuses a %s member', async (permission) => {
+    mockGetUserEntityPermissions.mockResolvedValue(permission)
+    await expect(canSetPublicChatAuth('user-1', 'ws-1')).resolves.toBe(false)
+  })
+
+  it('refuses a member with no permission on the workspace', async () => {
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+    await expect(canSetPublicChatAuth('user-1', 'ws-1')).resolves.toBe(false)
+  })
+})

apps/sim/app/api/chat/utils.ts

@@ -8,6 +8,22 @@ import {
   type DeploymentAuthResult,
   validateDeploymentAuth,
 } from '@/lib/core/security/deployment-auth'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+
+/**
+ * A chat deployed with `authType: 'public'` is invocable by anyone holding the
+ * URL, with no authentication — the same unauthenticated exposure as a public
+ * workflow API, which is admin-only. Deploying a chat itself only needs
+ * `write`, so this gates the exposure rather than the deployment: an editor can
+ * ship a password/email/SSO chat, but only an admin can make one public.
+ *
+ * Only the *transition to* public is gated. Editing an already-public chat, or
+ * moving it off public, stays at `write` — neither increases exposure.
+ */
+export async function canSetPublicChatAuth(userId: string, workspaceId: string): Promise<boolean> {
+  const permission = await getUserEntityPermissions(userId, 'workspace', workspaceId)
+  return permission === 'admin'
+}
 
 export function setChatAuthCookie(
   response: NextResponse,

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

@@ -23,6 +23,7 @@ import { GeneratedPasswordInput } from '@/components/ui'
 import { isSsoEnabled } from '@/lib/core/config/env-flags'
 import { getBaseUrl, getEmailDomain } from '@/lib/core/utils/urls'
 import { validateAllowlistEntry } from '@/lib/messaging/email/validation'
+import { useUserPermissionsContext } from '@/app/workspace/[workspaceId]/providers/workspace-permissions-provider'
 import { OutputSelect } from '@/app/workspace/[workspaceId]/w/[workflowId]/components/chat/components/output-select/output-select'
 import {
   type AuthType,
@@ -706,6 +707,14 @@ function AuthSelector({
 
   const { config: permissionConfig } = usePermissionConfig()
   const allowedAuthTypes = permissionConfig.allowedChatDeployAuthTypes
+  /**
+   * A public chat is invocable by anyone holding the URL with no auth, so it is
+   * admin-only — the same boundary the workflow's public API sits behind.
+   * Deploying an authenticated chat stays at `write`. An already-public chat
+   * keeps the option selectable so an editor can still edit its other fields.
+   */
+  const { canAdmin } = useUserPermissionsContext()
+  const canSetPublic = canAdmin || savedAuthType === 'public'
 
   const ssoAvailable =
     isSsoEnabled || savedAuthType === 'sso' || (allowedAuthTypes?.includes('sso') ?? false)
@@ -720,8 +729,15 @@ function AuthSelector({
   useEffect(() => {
     if (authOptions.length > 0 && !authOptions.includes(authType)) {
       onAuthTypeChange(authOptions[0])
+      return
     }
-  }, [authOptions, authType, onAuthTypeChange])
+    // A non-admin defaults to 'public' on a fresh chat, which they cannot use —
+    // move them to the first mode they can actually deploy.
+    if (authType === 'public' && !canSetPublic) {
+      const fallback = authOptions.find((type) => type !== 'public')
+      if (fallback) onAuthTypeChange(fallback)
+    }
+  }, [authOptions, authType, onAuthTypeChange, canSetPublic])
 
   return (
     <div className='space-y-4'>
@@ -734,11 +750,24 @@ function AuthSelector({
           onValueChange={(val) => onAuthTypeChange(val as AuthType)}
           disabled={disabled}
         >
-          {authOptions.map((type) => (
-            <ButtonGroupItem key={type} value={type}>
-              {AUTH_LABELS[type]}
-            </ButtonGroupItem>
-          ))}
+          {authOptions.map((type) =>
+            type === 'public' && !canSetPublic ? (
+              <Tooltip.Root key={type}>
+                <Tooltip.Trigger asChild>
+                  <span className='inline-flex'>
+                    <ButtonGroupItem value={type} disabled>
+                      {AUTH_LABELS[type]}
+                    </ButtonGroupItem>
+                  </span>
+                </Tooltip.Trigger>
+                <Tooltip.Content>Only admins can deploy a public chat</Tooltip.Content>
+              </Tooltip.Root>
+            ) : (
+              <ButtonGroupItem key={type} value={type}>
+                {AUTH_LABELS[type]}
+              </ButtonGroupItem>
+            )
+          )}
         </ButtonGroup>
       </div>