fix(security): apply the proxy-trust gate in the docs app too

The docs Ask-AI limiter honored the trusted-proxy list but not
TRUST_PROXY_HEADERS, so on a direct exposure it still keyed on a caller-authored
header — leaving paid inference unmetered on the one endpoint where that costs
real money. Same gate as the app and audit package now.

Consolidate the predicate into parseTrustForwardedHeaders rather than keep a
third copy of the spelling check. Three hand-rolled copies of a security
predicate drifting apart is the exact failure this PR started as.

Author: waleedlatif1

apps/docs/app/api/chat/route.ts

@@ -1,5 +1,10 @@
 import { openai } from '@ai-sdk/openai'
-import { parseTrustedProxies, resolveClientIp } from '@sim/security/client-ip'
+import {
+  parseTrustedProxies,
+  parseTrustForwardedHeaders,
+  resolveClientIp,
+  UNKNOWN_CLIENT_IP,
+} from '@sim/security/client-ip'
 import {
   convertToModelMessages,
   jsonSchema,
@@ -80,6 +85,15 @@ const rateLimitHits = new Map<string, { count: number; resetAt: number }>()
  */
 const trustedProxies = parseTrustedProxies(process.env.AUTH_TRUSTED_PROXIES)
 
+/**
+ * Mirrors the main app's `TRUST_PROXY_HEADERS`. Every rule about which hop to
+ * read presumes a proxy wrote one of them; with nothing in front, the header is
+ * caller-authored and this limiter guards paid inference, so decline to guess
+ * and let all callers share one bucket. Defaults to true — the docs site is
+ * served behind an edge that sets the header.
+ */
+const trustForwardedHeaders = parseTrustForwardedHeaders(process.env.TRUST_PROXY_HEADERS)
+
 /**
  * Resolve the client IP from forwarding headers, falling back to a shared
  * bucket. Walks the chain right to left: the leftmost `X-Forwarded-For` entry is
@@ -88,6 +102,7 @@ const trustedProxies = parseTrustedProxies(process.env.AUTH_TRUSTED_PROXIES)
  * spend plus unbounded growth of `rateLimitHits`. See {@link resolveClientIp}.
  */
 function getClientIp(req: Request): string {
+  if (!trustForwardedHeaders) return UNKNOWN_CLIENT_IP
   return resolveClientIp(req, trustedProxies)
 }
 

apps/sim/lib/core/utils/client-ip.test.ts

@@ -16,11 +16,7 @@ const { mockEnv } = vi.hoisted(() => ({
   },
 }))
 
-vi.mock('@/lib/core/config/env', () => ({
-  env: mockEnv,
-  isFalsy: (value: string | boolean | number | undefined) =>
-    value === false || value === 'false' || value === 0 || value === '0',
-}))
+vi.mock('@/lib/core/config/env', () => ({ env: mockEnv }))
 vi.unmock('@/lib/core/utils/client-ip')
 
 /**

apps/sim/lib/core/utils/client-ip.ts

@@ -1,10 +1,11 @@
 import {
   type ClientIpHeaderSource,
   parseTrustedProxies,
+  parseTrustForwardedHeaders,
   resolveClientIp,
   UNKNOWN_CLIENT_IP,
 } from '@sim/security/client-ip'
-import { env, isFalsy } from '@/lib/core/config/env'
+import { env } from '@/lib/core/config/env'
 
 /**
  * Reverse-proxy hops trusted for forwarded-IP resolution, read from the same
@@ -27,7 +28,7 @@ const trustedProxies = parseTrustedProxies(env.AUTH_TRUSTED_PROXIES)
  * real address from it. Operators of such a deployment set
  * `TRUST_PROXY_HEADERS=false`, which makes {@link getClientIp} decline to guess.
  */
-const trustForwardedHeaders = !isFalsy(env.TRUST_PROXY_HEADERS)
+const trustForwardedHeaders = parseTrustForwardedHeaders(env.TRUST_PROXY_HEADERS)
 
 /**
  * Extract the client IP from a request for logging, audit trails, and — most

packages/audit/src/log.ts

@@ -3,6 +3,7 @@ import { createLogger } from '@sim/logger'
 import {
   type ClientIpHeaderSource,
   parseTrustedProxies,
+  parseTrustForwardedHeaders,
   resolveClientIp,
   UNKNOWN_CLIENT_IP,
 } from '@sim/security/client-ip'
@@ -45,9 +46,7 @@ const trustedProxies = parseTrustedProxies(process.env.AUTH_TRUSTED_PROXIES)
  * as forensic evidence is worse than recording none, so a deployment that
  * declares it has no proxy in front gets `unknown` rather than a fabrication.
  */
-const trustForwardedHeaders = !/^(false|0|no|off)$/i.test(
-  (process.env.TRUST_PROXY_HEADERS ?? '').trim()
-)
+const trustForwardedHeaders = parseTrustForwardedHeaders(process.env.TRUST_PROXY_HEADERS)
 
 /**
  * An audit row's `ipAddress` is forensic evidence, so it must not be whatever

packages/security/src/client-ip.test.ts

@@ -3,6 +3,7 @@ import {
   canonicalizeIp,
   getAssertedOriginIp,
   parseTrustedProxies,
+  parseTrustForwardedHeaders,
   resolveClientIp,
   UNKNOWN_CLIENT_IP,
 } from './client-ip'
@@ -269,3 +270,31 @@ describe('parseTrustedProxies', () => {
     expect(trusted.cidrs).toHaveLength(2)
   })
 })
+
+describe('parseTrustForwardedHeaders', () => {
+  it('defaults to trusting the headers when unset', () => {
+    // Unset must never silently disable IP resolution — that would turn every
+    // per-IP limit into one global bucket on an ordinary proxied deployment.
+    expect(parseTrustForwardedHeaders(undefined)).toBe(true)
+    expect(parseTrustForwardedHeaders(null)).toBe(true)
+    expect(parseTrustForwardedHeaders('')).toBe(true)
+    expect(parseTrustForwardedHeaders('   ')).toBe(true)
+  })
+
+  it('accepts the usual falsey spellings, case- and space-insensitively', () => {
+    for (const value of ['false', 'FALSE', ' False ', '0', 'no', 'off', 'OFF']) {
+      expect(parseTrustForwardedHeaders(value)).toBe(false)
+    }
+  })
+
+  it('accepts a real boolean, since one caller reads a parsed env', () => {
+    expect(parseTrustForwardedHeaders(false)).toBe(false)
+    expect(parseTrustForwardedHeaders(true)).toBe(true)
+  })
+
+  it('treats anything else as trusting', () => {
+    for (const value of ['true', 'yes', 'on', '1', 'anything']) {
+      expect(parseTrustForwardedHeaders(value)).toBe(true)
+    }
+  })
+})

packages/security/src/client-ip.ts

@@ -148,6 +148,25 @@ export function parseTrustedProxies(raw: string | null | undefined): TrustedProx
   return { cidrs }
 }
 
+/**
+ * Reads the `TRUST_PROXY_HEADERS` setting: may `X-Forwarded-For` / `X-Real-IP`
+ * be believed at all?
+ *
+ * Every rule about *which* hop to read presumes a proxy wrote one of them. An
+ * app reachable directly sees a header authored entirely by the caller, and no
+ * parsing strategy recovers a real address from that — so this is a deployment
+ * fact the operator has to state, not something the code can detect.
+ *
+ * Defaults to `true` (a proxy is assumed) so an unset value never silently
+ * disables IP resolution. Accepts a boolean or the usual string spellings,
+ * because the value arrives parsed from the app's env module in one caller and
+ * raw from `process.env` in others.
+ */
+export function parseTrustForwardedHeaders(raw: string | boolean | null | undefined): boolean {
+  if (typeof raw === 'boolean') return raw
+  return !/^(false|0|no|off)$/i.test((raw ?? '').trim())
+}
+
 /**
  * Resolves the client IP behind a reverse proxy, safely enough to key a rate
  * limit on.