fix(interfaces): bound descriptions in the service and rate-limit OTP verify

Two gaps recovered from the copilot-tool and duplicate-implementation audits.

- `MAX_INTERFACE_DESCRIPTION_LENGTH` was enforced only in the HTTP contract, but
  the contract is not the only writer: the copilot's `user_interface` tool calls
  `createInterface`/`updateInterfaceDescription` directly, so the cap did not
  apply to it. An unbounded description is then re-serialized into every
  subsequent get/list response and into the copilot's VFS metadata each turn —
  recurring context cost, not just row bloat. Now asserted beside the name check
  that was already there for the same reason.

- The public file OTP route rate-limited the send path but not verify, while the
  interfaces route limits both. Added the matching per-IP bucket, kept separate
  from the send bucket so failed verifies cannot throttle a legitimate resend.

Author: waleedlatif1

apps/sim/app/api/files/public/[token]/otp/route.ts

@@ -131,6 +131,18 @@ export const PUT = withRouteHandler(
     const requestId = generateRequestId()
 
     try {
+      // Its own IP bucket, separate from the send path above, so failed verifies
+      // never throttle a legitimate resend.
+      const ip = getClientIp(request)
+      const ipRateLimit = await rateLimiter.checkRateLimitDirect(
+        `file-otp:verify:ip:${ip}`,
+        OTP_IP_RATE_LIMIT
+      )
+      if (!ipRateLimit.allowed) {
+        logger.warn(`[${requestId}] OTP verify IP rate limit exceeded from ${ip}`)
+        return rateLimited(ipRateLimit.retryAfterMs, OTP_IP_RATE_LIMIT.refillIntervalMs)
+      }
+
       const parsed = await parseRequest(verifyPublicFileOtpContract, request, context)
       if (!parsed.success) return parsed.response
       const { token } = parsed.data.params

apps/sim/lib/interfaces/service.ts

@@ -28,6 +28,7 @@ import { generateRestoreName, restoreWithUniqueName } from '@/lib/core/utils/res
 import {
   createEmptyLayout,
   createInterfaceModule,
+  MAX_INTERFACE_DESCRIPTION_LENGTH,
   MAX_INTERFACE_NAME_LENGTH,
 } from '@/lib/interfaces/constants'
 import { moveModuleToCell, overlappingModules } from '@/lib/interfaces/geometry'
@@ -153,6 +154,25 @@ function assertValidName(name: string): void {
   }
 }
 
+/**
+ * Bounds a description here rather than only at the HTTP contract.
+ *
+ * The contract is not the only writer: the copilot's `user_interface` tool calls
+ * this service directly, so a cap that lives solely in the boundary schema is a
+ * cap the tool does not have. An unbounded description is persisted, then
+ * re-serialized into every subsequent `get`/`list` response and into the
+ * copilot's VFS metadata on every turn — so it is recurring context cost, not
+ * just row bloat. Mirrors {@link assertValidName}, which was already here for
+ * exactly this reason.
+ */
+function assertValidDescription(description: string | null): void {
+  if (description !== null && description.length > MAX_INTERFACE_DESCRIPTION_LENGTH) {
+    throw new Error(
+      `Interface description exceeds maximum length (${MAX_INTERFACE_DESCRIPTION_LENGTH} characters)`
+    )
+  }
+}
+
 /**
  * Lists interfaces in a workspace, ordered by creation time.
  */
@@ -210,6 +230,7 @@ export async function getInterfaceById(
  */
 export async function createInterface(data: CreateInterfaceData): Promise<InterfaceDefinition> {
   assertValidName(data.name)
+  assertValidDescription(data.description ?? null)
 
   const now = new Date()
   try {
@@ -276,6 +297,8 @@ export async function updateInterfaceDescription(
   id: string,
   description: string | null
 ): Promise<InterfaceDefinition> {
+  assertValidDescription(description)
+
   const [row] = await db
     .update(workspaceInterface)
     .set({ description, updatedAt: new Date() })