fix(security): derive Helm proxy trust from ingress.enabled, fail the password ceiling closed

Two gaps in the previous commit.

The chart defaulted TRUST_PROXY_HEADERS to true, but ingress.enabled defaults to
FALSE — so the out-of-the-box install reaches the Service directly (port-forward,
LoadBalancer, NodePort) with nothing appending a peer address, and trusted a
header written entirely by the caller. Derive the default from ingress.enabled
instead: on with the ingress, off without it. An explicit app.env value still
wins, for edges the chart cannot see (Gateway API, a service mesh, an external
LB that appends).

Compare the stringified override, never the raw one — an explicit `false` is
falsy in Go templates, so the obvious `if $explicit` silently discarded the one
override that turns trust off. Caught by rendering all four combinations; the
schema now also accepts a bare YAML boolean, which is what a Helm user writes.

The per-resource password ceiling called checkRateLimitDirect without
failClosed, and that helper allows on storage error. It is the only bound on
distributed guessing at the secret, so failing open removed it during exactly
the outage an attacker could wait for. Matches the contact captcha backstop,
which already opts in for the same reason.

Author: waleedlatif1

apps/sim/app/api/chat/utils.test.ts

@@ -253,11 +253,35 @@ describe('Chat API Utils', () => {
       expect(result.authorized).toBe(false)
       expect(mockCheckRateLimitDirect).toHaveBeenCalledWith(
         'chat-password:resource:chat-id',
-        expect.objectContaining({ maxTokens: 500 })
+        expect.objectContaining({ maxTokens: 500 }),
+        { failClosed: true }
       )
       expect(mockResetRateLimitBucket).not.toHaveBeenCalled()
     })
 
+    it('checks the per-resource ceiling fail-closed so an outage cannot lift it', async () => {
+      // It is the only bound on distributed guessing at the secret; failing open
+      // would silently remove it during exactly the outage an attacker waits for.
+      const deployment = {
+        id: 'chat-id',
+        authType: 'password',
+        password: 'encrypted-password',
+      }
+      const mockRequest = {
+        method: 'POST',
+        cookies: { get: vi.fn().mockReturnValue(null) },
+      } as any
+
+      await validateChatAuth('request-id', deployment, mockRequest, {
+        password: 'correct-password',
+      })
+
+      const resourceCall = mockCheckRateLimitDirect.mock.calls.find((call: unknown[]) =>
+        String(call[0]).includes(':resource:')
+      )
+      expect(resourceCall?.[2]).toEqual({ failClosed: true })
+    })
+
     it('rejects guesses once the per-resource counter is exhausted, without decrypting', async () => {
       const deployment = {
         id: 'chat-id',

apps/sim/lib/core/security/deployment-auth.ts

@@ -148,9 +148,17 @@ export async function validateDeploymentAuth(
       }
 
       const resourceKey = `${cookiePrefix}-password:resource:${resource.id}`
+      /**
+       * `failClosed` because this is the only bound on distributed guessing at
+       * the secret: failing open would silently remove it during exactly the
+       * storage outage an attacker could wait for. The cost is bounded — the
+       * bucket store is Redis or the app database, and if the database is down
+       * the deployment is unreachable anyway.
+       */
       const resourceRateLimit = await rateLimiter.checkRateLimitDirect(
         resourceKey,
-        PASSWORD_RESOURCE_RATE_LIMIT
+        PASSWORD_RESOURCE_RATE_LIMIT,
+        { failClosed: true }
       )
       if (!resourceRateLimit.allowed) {
         logger.warn(

helm/sim/templates/_helpers.tpl

@@ -446,6 +446,31 @@ Ollama URL
 {{- end }}
 {{- end }}
 
+{{/*
+Whether the app may believe x-forwarded-for / x-real-ip.
+
+Derived from ingress.enabled rather than defaulted to "true": every rule about
+which forwarded hop to read presumes a proxy wrote one of them. With the ingress
+off, the Service is reached directly (ClusterIP port-forward, LoadBalancer,
+NodePort) and the header is authored entirely by the caller — trusting it would
+let anyone rotate it for a fresh per-IP rate-limit bucket per request. An
+explicit app.env.TRUST_PROXY_HEADERS always wins, for edges the chart cannot see
+(a Gateway API listener, a service mesh, an external LB that appends).
+*/}}
+{{- define "sim.trustProxyHeaders" -}}
+{{- $explicit := toString ((default (dict) .Values.app.env).TRUST_PROXY_HEADERS) -}}
+{{- /*
+  Compare the STRINGIFIED value, never the raw one: an explicit `false` is falsy
+  in Go templates, so `if $explicit` would silently discard the one override
+  that turns trust off and fall through to the ingress default.
+*/ -}}
+{{- if or (eq $explicit "") (eq $explicit "<nil>") -}}
+{{- ternary "true" "false" .Values.ingress.enabled -}}
+{{- else -}}
+{{- $explicit -}}
+{{- end -}}
+{{- end }}
+
 {{/*
 PII (Presidio) service URL
 */}}

helm/sim/templates/deployment-app.yaml

@@ -91,6 +91,8 @@ spec:
               value: {{ include "sim.ollamaUrl" . | quote }}
             - name: PII_URL
               value: {{ include "sim.piiUrl" . | quote }}
+            - name: TRUST_PROXY_HEADERS
+              value: {{ include "sim.trustProxyHeaders" . | quote }}
             {{- /*
               Skip envDefaults keys that the user has explicitly overridden in app.env
               with a non-empty value. K8s `env` takes precedence over `envFrom`, so an

helm/sim/values.schema.json

@@ -160,8 +160,8 @@
               "description": "Comma-separated reverse-proxy IPs or CIDR ranges in front of the app (e.g. the ingress pods, '10.42.0.0/24'). When set, Better Auth and Sim's per-IP rate limits both walk x-forwarded-for right to left, skip these hops, and use the first untrusted address as the client IP. Leave empty and the two differ: Better Auth trusts only a single-value header, while Sim's throttles key on the rightmost, proxy-written entry. Do not use a range broad enough to also cover client traffic — a caller inside a trusted range makes the whole chain trusted."
             },
             "TRUST_PROXY_HEADERS": {
-              "type": "string",
-              "description": "Whether x-forwarded-for / x-real-ip may be believed at all. Empty (the default) means yes, which is correct behind the chart's ingress. Set to 'false' only when the app is exposed with no proxy appending the peer address, where those headers are entirely caller-written; per-IP rate limits then collapse to one shared bucket rather than being bypassable per request."
+              "type": ["string", "boolean"],
+              "description": "Whether x-forwarded-for / x-real-ip may be believed at all. Leave empty to derive it from ingress.enabled: on with the ingress (which appends the peer address), off without it, since a directly-reached Service sees a header written entirely by the caller and trusting it makes per-IP rate limits bypassable per request. Set explicitly ('true'/'false', quoted or bare) only for an edge the chart cannot see, e.g. a Gateway API listener, a service mesh, or an external load balancer that appends."
             },
             "SSO_TRUSTED_PROVIDER_IDS": {
               "type": "string",

helm/sim/values.yaml

@@ -91,12 +91,14 @@ app:
     # to also cover client traffic: a caller whose own address falls inside a trusted range makes
     # the whole chain trusted and can then forge the value Sim keys on.
     AUTH_TRUSTED_PROXIES: ""
-    # TRUST_PROXY_HEADERS: whether x-forwarded-for / x-real-ip may be believed at all. Left empty
-    # (= true), which is correct here because the chart runs behind an ingress that appends the peer
-    # address. Set to "false" only if you expose the Service directly with no proxy in front: with
-    # nothing appending, those headers are written entirely by the caller and believing them lets
-    # anyone rotate a header for a fresh per-IP rate-limit bucket per request. While false, per-IP
-    # limits collapse into one shared bucket — blunt, but it fails closed.
+    # TRUST_PROXY_HEADERS: whether x-forwarded-for / x-real-ip may be believed at all.
+    # Left empty it is DERIVED from ingress.enabled — on with the ingress (which appends the peer
+    # address), off without it. That matters because ingress.enabled defaults to false: a Service
+    # reached directly (port-forward, LoadBalancer, NodePort) sees a header written entirely by the
+    # caller, and believing it lets anyone rotate a header for a fresh per-IP rate-limit bucket on
+    # every request. While off, per-IP limits collapse into one shared bucket — blunt, but it fails
+    # closed. Set it explicitly ("true"/"false") only for an edge the chart cannot see: a Gateway
+    # API listener, a service mesh, or an external load balancer that appends the peer address.
     TRUST_PROXY_HEADERS: ""
     # SOCKET_SERVER_URL: Auto-detected when realtime.enabled=true (uses internal service)
     # NEXT_PUBLIC_SOCKET_URL: public WebSocket URL for browsers. Leave empty to default to the