fix(security): meter and throttle the deployed-chat TTS relay

[waleedlatif1]

Summary

• POST /api/proxy/tts/stream treated "a live public chat exists" as authorization to spend the platform ElevenLabs key. A public chat id is handed to every visitor, so any anonymous caller could synthesize speech with no length cap, no rate limit and no usage accounting.
• Resolve the chat's workspace and bill synthesized characters to that payer via a new voice-output usage source, so spend is attributable and counts against the plan's usage limit (402 once exceeded).
• Throttle per IP before any database work, and per chat afterwards — bounding both one caller hammering many chats and many callers hammering one chat.
• Cap text at 2000 characters, cap the request body at 16 KB, and allowlist voiceId/modelId so the caller can no longer pick an unbounded charge, a premium/cloned voice, or the billing model.
• Drop Access-Control-Allow-Origin: *, which let any third-party page read the audio. Deployed chat and the Office embed are same-origin.
• Extract the chat auth + payer lookup that TTS and STT had both grown into resolveDeployedChatCaller, and filter chat.archivedAt there — an archived chat could previously still authorize spend against its former owner's workspace, on both routes.

Notes for review

• Pricing: TTS_COST_PER_1K_CHARS = 0.05 is ElevenLabs' published Flash/Turbo API rate. Please confirm against our actual contract — if we're on a negotiated rate this constant needs updating. It's the vendor cost; getCostMultiplier() applies markup, matching the STT precedent.
• The per-IP bucket only filters naive floods — getClientIp trusts the leftmost X-Forwarded-For, which the caller controls. The per-chat bucket is the load-bearing control.
• Metering writes one usage_log row per synthesized sentence, so a long answer produces ~10-30 rows. Accurate, but noisier than STT's one-row-per-session.
• The residual risk after this change is that an attacker burns a specific customer's usage budget rather than the platform's. A per-chat period character budget would bound that; not included here.
• The chat.archivedAt filter is not covered by a test — the db chain mock does not evaluate WHERE clauses, so an assertion there could not fail.

Type of Change

• Bug fix

Testing

13 route tests covering the length cap, voice/model allowlists, body cap, both rate-limit buckets, workspace attribution, the usage-limit 402, and unique sourceReference per call. Each guard was verified to fail when its fix is reverted. Full sweep: 811 tests across billing/contracts/chat/rate-limiter, typecheck clean on apps/sim and packages/db, check:migrations clean, no drizzle schema drift. Not live-tested against ElevenLabs.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview	Aug 3, 2026 6:38pm

[cursor]

PR Summary

High Risk
Changes anonymous-access billing, vendor spend controls, and usage enforcement on a security-sensitive proxy; incorrect metering or limits could allow free ElevenLabs usage or drain customer budgets.

Overview
Closes an unmetered spend path on the deployed-chat TTS proxy: a live public chat id was treated as enough to use the platform ElevenLabs key with no length limits, throttling, or usage accounting.

The POST /api/proxy/tts/stream route now applies per-IP limits before DB work, per-chat limits after auth, a 2000-character text cap and 16 KB body cap, and allowlisted voiceId/modelId. Synthesized characters are billed to the chat workspace payer via a new voice-output usage source (402 when limits are exceeded). recordUsage runs after ElevenLabs accepts the request; ledger failure returns 500 and cancels the vendor stream instead of serving free audio. Access-Control-Allow-Origin: * is removed.

resolveDeployedChatCaller centralizes deployed-chat auth and payer resolution for TTS and STT (including archivedAt filtering). The client splitForSynthesis helper chunks oversized text (e.g. CJK or unpunctuated blocks) so long answers still play audio under the relay cap.

^{Reviewed by Cursor Bugbot for commit 2ad92d7. Configure here.}

[greptile-apps]

Greptile Summary

The PR secures deployed-chat TTS by attributing and recording vendor usage, enforcing payer limits and request throttles, restricting accepted synthesis inputs, and centralizing deployed-chat caller resolution.

• Adds per-IP and per-chat throttling, body and text caps, and voice/model allowlists.
• Bills synthesized characters to the resolved workspace or chat owner and fails closed when the ledger write fails.
• Cancels the open ElevenLabs response body when metering fails.
• Adds the voice-output usage source and its database migration.
• Shares deployed-chat authorization and payer resolution between TTS and speech-token routes.
• Splits oversized client-side synthesis text into relay-compatible chunks.

Confidence Score: 4/5

The PR should not be considered fully safe to merge until the outstanding concurrent usage-limit overshoot is either prevented or explicitly accepted as bounded follow-up risk.

The route still checks usage before the ElevenLabs request and records the charge afterward without a reservation, so concurrent requests can pass against the same stale balance and exceed the payer's configured limit; the new per-chat bucket bounds but does not eliminate that failure.

Files Needing Attention: apps/sim/app/api/proxy/tts/stream/route.ts

Important Files Changed

Filename	Overview
apps/sim/app/api/proxy/tts/stream/route.ts	Adds throttling, payer-limit checks, vendor-cost metering, and fail-closed stream cancellation; the previously reported non-atomic usage-limit race remains.
apps/sim/lib/chat/deployed-chat-caller.ts	Centralizes deployed-chat authorization and payer lookup while rejecting inactive and archived chats.
apps/sim/lib/api/contracts/media/tts-stream.ts	Caps synthesis text and restricts anonymous callers to approved voice and model identifiers.
apps/sim/app/(interfaces)/chat/hooks/use-audio-streaming.ts	Splits long synthesis input into relay-compatible chunks and uses the shared default model.
apps/sim/lib/billing/core/usage-log.ts	Extends the usage-source type with metered voice output.
packages/db/migrations/0281_fixed_madame_web.sql	Adds voice-output to the persisted usage-log source enum.

Sequence Diagram

sequenceDiagram
  participant Client
  participant TTS as TTS Relay
  participant Chat as Chat Resolver
  participant Billing
  participant ElevenLabs
  Client->>TTS: POST text, voice, model, chatId
  TTS->>TTS: Enforce IP limit and validate body
  TTS->>Chat: Resolve authorization and payer
  Chat-->>TTS: Owner/workspace attribution
  TTS->>TTS: Enforce per-chat limit
  TTS->>Billing: Check payer usage limit
  Billing-->>TTS: Allowed
  TTS->>ElevenLabs: Request synthesis
  ElevenLabs-->>TTS: Audio response stream
  TTS->>Billing: Record voice-output charge
  alt Usage recorded
    TTS-->>Client: Stream audio
  else Ledger failure
    TTS->>ElevenLabs: Cancel response body
    TTS-->>Client: 500 without audio
  end

Loading

_{Reviews (4): Last reviewed commit: "fix(security): release the vendor stream..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 03f9bd8. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 2ad92d7. Configure here.}