fix(security): correct TTS metering, pricing and body cap

Follow-up review of the previous commit found five defects in it:

- Usage rows collided. `usage_log.event_key` is unique and inserts are
  conflict-do-nothing, and the key is derived from the entry's stable
  fields. With no explicit sourceReference, two synthesis calls of equal
  character count in the same workspace produced the same key, so every
  repeat length went unbilled — defeating the metering this change is
  for. Each call now carries a unique sourceReference.
- Priced at $0.10 per 1k characters, twice the published ElevenLabs
  Flash/Turbo rate of $0.05, which would have overcharged customers 2x.
- No body cap, so an anonymous caller could make the route buffer up to
  the shared 50 MB default before validation. Now 16 KB, as the STT
  sibling does.
- Threshold settlement ran per sentence: several queries and a possible
  Stripe call on a realtime path. The workflow execution that produced
  the text already settles the payer.
- The per-IP bucket was described as preventing database amplification.
  getClientIp trusts the leftmost X-Forwarded-For, so an attacker rotates
  past it; the comment now says the per-chat bucket is load-bearing.

Author: waleedlatif1

apps/sim/app/api/proxy/tts/stream/route.test.ts

@@ -140,6 +140,14 @@ describe('POST /api/proxy/tts/stream — spend controls', () => {
     expect(mockRecordUsage).not.toHaveBeenCalled()
   })
 
+  it('rejects an oversized body before buffering it', async () => {
+    const res = await POST(createMockRequest('POST', validBody({ padding: 'x'.repeat(32 * 1024) })))
+
+    expect(res.status).toBe(413)
+    expect(global.fetch).not.toHaveBeenCalled()
+    expect(mockRecordUsage).not.toHaveBeenCalled()
+  })
+
   it('rejects a voice outside the allowlist so the caller cannot pick a premium voice', async () => {
     const res = await POST(
       createMockRequest('POST', validBody({ voiceId: '21m00Tcm4TlvDq8ikWAM' }))
@@ -203,14 +211,33 @@ describe('POST /api/proxy/tts/stream — attribution', () => {
     expect(mockRecordUsage.mock.calls[0][0].entries[0]).toMatchObject({
       category: 'fixed',
       source: 'voice-output',
-      cost: 0.1,
-    })
-    expect(mockCheckAndBillPayerOverageThreshold).toHaveBeenCalledWith({
-      type: 'organization',
-      id: 'org-1',
+      cost: 0.05,
     })
   })
 
+  it('gives each call a unique source reference so equal-length calls are not deduplicated', async () => {
+    const text = 'Same length text.'
+
+    queueTableRows(schemaMock.chat, [publicChatRow])
+    await POST(createMockRequest('POST', validBody({ text })))
+    queueTableRows(schemaMock.chat, [publicChatRow])
+    await POST(createMockRequest('POST', validBody({ text })))
+
+    expect(mockRecordUsage).toHaveBeenCalledTimes(2)
+    const first = mockRecordUsage.mock.calls[0][0].entries[0].sourceReference
+    const second = mockRecordUsage.mock.calls[1][0].entries[0].sourceReference
+    expect(first).toBeDefined()
+    expect(first).not.toBe(second)
+  })
+
+  it('does not run per-request threshold settlement on the realtime path', async () => {
+    queueTableRows(schemaMock.chat, [publicChatRow])
+
+    await POST(createMockRequest('POST', validBody()))
+
+    expect(mockCheckAndBillPayerOverageThreshold).not.toHaveBeenCalled()
+  })
+
   it('falls back to the chat owner when the workflow has no workspace', async () => {
     queueTableRows(schemaMock.chat, [{ ...publicChatRow, workspaceId: null }])
 

apps/sim/app/api/proxy/tts/stream/route.ts

@@ -1,3 +1,4 @@
+import { randomUUID } from 'node:crypto'
 import { db } from '@sim/db'
 import { chat, workflow } from '@sim/db/schema'
 import { createLogger } from '@sim/logger'
@@ -13,7 +14,6 @@ import {
   toBillingContext,
 } from '@/lib/billing/core/billing-attribution'
 import { recordUsage } from '@/lib/billing/core/usage-log'
-import { checkAndBillPayerOverageThreshold } from '@/lib/billing/threshold-billing'
 import { env } from '@/lib/core/config/env'
 import { getCostMultiplier } from '@/lib/core/config/env-flags'
 import { RateLimiter } from '@/lib/core/rate-limiter'
@@ -27,8 +27,14 @@ const rateLimiter = new RateLimiter()
 
 /**
  * Public chats hand their id to every visitor, so the id alone cannot gate
- * spend on the platform ElevenLabs key. Two buckets bound the two abuse shapes:
- * one caller hammering many chats, and many callers hammering one chat.
+ * spend on the platform ElevenLabs key.
+ *
+ * The per-IP bucket only filters naive floods: `getClientIp` trusts the
+ * leftmost `X-Forwarded-For` value, which the caller controls, so a deliberate
+ * attacker rotates past it. The per-chat bucket is the load-bearing control —
+ * it is keyed on server-held state and bounds total spend per chat regardless
+ * of how many source addresses the traffic claims to come from.
+ *
  * Deployed chat synthesizes sentence by sentence, so a real conversation issues
  * several requests per answer — hence the generous burst.
  */
@@ -45,11 +51,19 @@ const TTS_CHAT_RATE_LIMIT = {
 } as const
 
 /**
- * Platform ElevenLabs rate for the Flash v2.5 model, in USD per 1,000
- * characters. Synthesis is billed to the chat's workspace payer so the spend is
- * attributable and counts against that plan's usage limit.
+ * Published ElevenLabs API rate for Flash/Turbo text-to-speech, in USD per
+ * 1,000 characters. This is the vendor cost; `getCostMultiplier()` applies the
+ * platform markup, matching how other metered sources are priced.
  */
-const TTS_COST_PER_1K_CHARS = 0.1
+const TTS_COST_PER_1K_CHARS = 0.05
+
+/**
+ * The body carries at most `MAX_TTS_TEXT_LENGTH` characters of text plus two
+ * short ids, so a tight cap keeps an anonymous caller from making the route
+ * buffer a large payload before validation runs. Without it the shared default
+ * is 50 MB.
+ */
+const MAX_TTS_BODY_BYTES = 16 * 1024
 
 interface ChatAuthResult {
   valid: boolean
@@ -132,6 +146,7 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
       request,
       {},
       {
+        maxBodyBytes: MAX_TTS_BODY_BYTES,
         invalidJsonResponse: () => new NextResponse('Invalid request body', { status: 400 }),
         validationErrorResponse: (error) => {
           if (error.issues.some((issue) => issue.path[0] === 'chatId')) {
@@ -224,6 +239,17 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
     /**
      * Meter once ElevenLabs has accepted the request — the characters are billed
      * to us at that point regardless of whether the client drains the stream.
+     *
+     * `sourceReference` must be unique per call. `usage_log.event_key` is
+     * unique and inserts conflict-do-nothing, and the key is derived from the
+     * entry's stable fields — without this, two synthesis calls of equal length
+     * in the same workspace would collide and the second would silently go
+     * unbilled. Each call is a separate charge from ElevenLabs, so each needs
+     * its own row rather than being deduplicated.
+     *
+     * No threshold settlement here: it runs per metered event elsewhere and is
+     * far too heavy for a per-sentence realtime path. The workflow execution
+     * that produced this text already settles the payer.
      */
     if (actorUserId) {
       try {
@@ -237,12 +263,10 @@ export const POST = withRouteHandler(async (request: NextRequest) => {
               source: 'voice-output',
               description: `Voice output (${text.length} characters)`,
               cost: (text.length / 1000) * TTS_COST_PER_1K_CHARS * getCostMultiplier(),
+              sourceReference: `voice-output:${chatId}:${randomUUID()}`,
             },
           ],
         })
-        if (billingAttribution) {
-          await checkAndBillPayerOverageThreshold(billingAttribution.billingEntity)
-        }
       } catch (err) {
         logger.warn('Failed to record voice output usage, continuing:', err)
       }