fix(chat): reject whitespace-only passwords

Author: j15z

apps/sim/app/api/chat/manage/[id]/route.test.ts

@@ -429,6 +429,24 @@ describe('Chat Edit API Route', () => {
       expect(data.error).toBe('Password is required when using password protection')
     })
 
+    it('rejects a whitespace-only replacement password', async () => {
+      authMockFns.mockGetSession.mockResolvedValue({
+        user: { id: 'user-id' },
+      })
+
+      const req = new NextRequest('http://localhost:3000/api/chat/manage/chat-123', {
+        method: 'PATCH',
+        body: JSON.stringify({ authType: 'password', password: '   ' }),
+      })
+      const response = await PATCH(req, { params: Promise.resolve({ id: 'chat-123' }) })
+
+      expect(response.status).toBe(400)
+      const data = await response.json()
+      expect(data.error).toBe('Password cannot contain only whitespace')
+      expect(mockCheckChatAccess).not.toHaveBeenCalled()
+      expect(mockEncryptSecret).not.toHaveBeenCalled()
+    })
+
     it('should keep the existing password when updating a password-protected chat', async () => {
       authMockFns.mockGetSession.mockResolvedValue({
         user: { id: 'user-id' },

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

@@ -42,6 +42,7 @@ import {
   getPasswordPlaceholder,
   hasExistingPassword,
   isPasswordRequired,
+  isWhitespaceOnlyPassword,
   shouldConfirmPasswordChange,
 } from './utils'
 
@@ -158,6 +159,8 @@ export function ChatDeploy({
 
     if (isPasswordRequired(formData.authType, formData.password, existingPassword)) {
       newErrors.password = 'Password is required when using password protection'
+    } else if (formData.authType === 'password' && isWhitespaceOnlyPassword(formData.password)) {
+      newErrors.password = 'Password cannot contain only whitespace'
     }
 
     if (
@@ -180,6 +183,7 @@ export function ChatDeploy({
     Boolean(formData.title.trim()) &&
     formData.selectedOutputBlocks.length > 0 &&
     !isPasswordRequired(formData.authType, formData.password, existingPassword) &&
+    (formData.authType !== 'password' || !isWhitespaceOnlyPassword(formData.password)) &&
     ((formData.authType !== 'email' && formData.authType !== 'sso') || formData.emails.length > 0)
 
   useEffect(() => {

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/utils.test.ts

@@ -4,6 +4,7 @@ import {
   getPasswordPlaceholder,
   hasExistingPassword,
   isPasswordRequired,
+  isWhitespaceOnlyPassword,
   shouldConfirmPasswordChange,
 } from './utils'
 
@@ -24,6 +25,12 @@ describe.concurrent('chat password state', () => {
     expect(isPasswordRequired('password', '', true)).toBe(false)
   })
 
+  it('identifies whitespace-only password values', () => {
+    expect(isWhitespaceOnlyPassword('   ')).toBe(true)
+    expect(isWhitespaceOnlyPassword('')).toBe(false)
+    expect(isWhitespaceOnlyPassword(' password ')).toBe(false)
+  })
+
   it('returns copy that matches the stored-password state', () => {
     expect(getPasswordPlaceholder(true)).toBe('Enter new password to change')
     expect(getPasswordHelperText(true)).toBe('Leave empty to keep the current password')
@@ -34,6 +41,7 @@ describe.concurrent('chat password state', () => {
   it('confirms a password change only for an existing password deployment with a new value', () => {
     expect(shouldConfirmPasswordChange(true, 'password', 'new-password')).toBe(true)
     expect(shouldConfirmPasswordChange(true, 'password', '')).toBe(false)
+    expect(shouldConfirmPasswordChange(true, 'password', '   ')).toBe(false)
     expect(shouldConfirmPasswordChange(true, 'public', 'new-password')).toBe(false)
     expect(shouldConfirmPasswordChange(false, 'password', 'new-password')).toBe(false)
   })

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/utils.ts

@@ -19,12 +19,16 @@ export function isPasswordRequired(
   return authType === 'password' && !existingPassword && !password.trim()
 }
 
+export function isWhitespaceOnlyPassword(password: string): boolean {
+  return password.length > 0 && password.trim().length === 0
+}
+
 export function shouldConfirmPasswordChange(
   hasExistingChat: boolean,
   authType: AuthType,
   password: string
 ): boolean {
-  return hasExistingChat && authType === 'password' && password.length > 0
+  return hasExistingChat && authType === 'password' && password.trim().length > 0
 }
 
 export function getPasswordPlaceholder(existingPassword: boolean): string {

apps/sim/lib/api/contracts/chats.ts

@@ -4,6 +4,13 @@ import { defineRouteContract } from '@/lib/api/contracts/types'
 export const chatAuthTypeSchema = z.enum(['public', 'password', 'email', 'sso'])
 export type ChatAuthType = z.output<typeof chatAuthTypeSchema>
 
+export const chatDeploymentPasswordSchema = z
+  .string()
+  .refine(
+    (password) => password.length === 0 || password.trim().length > 0,
+    'Password cannot contain only whitespace'
+  )
+
 export const chatIdParamsSchema = z.object({
   id: z.string().min(1),
 })
@@ -38,7 +45,7 @@ export const createChatBodySchema = z.object({
   description: z.string().optional(),
   customizations: chatCustomizationsSchema,
   authType: chatAuthTypeSchema.default('public'),
-  password: z.string().optional(),
+  password: chatDeploymentPasswordSchema.optional(),
   allowedEmails: z.array(z.string()).optional().default([]),
   outputConfigs: z.array(chatOutputConfigSchema).optional().default([]),
   /** When true, clients may receive thinking SSE if they also send the protocol header. Default off. */
@@ -59,7 +66,7 @@ export const updateChatBodySchema = z.object({
   description: z.string().optional(),
   customizations: chatCustomizationsSchema.optional(),
   authType: chatAuthTypeSchema.optional(),
-  password: z.string().optional(),
+  password: chatDeploymentPasswordSchema.optional(),
   allowedEmails: z.array(z.string()).optional(),
   outputConfigs: z.array(chatOutputConfigSchema).optional(),
   includeThinking: z.boolean().optional(),