fix(chat): show deployment passwords to admins

Author: j15z

apps/sim/app/api/chat/manage/[id]/password/route.test.ts

@@ -0,0 +1,139 @@
+/**
+ * @vitest-environment node
+ */
+import {
+  auditMock,
+  auditMockFns,
+  authMockFns,
+  encryptionMock,
+  encryptionMockFns,
+  workflowsApiUtilsMock,
+  workflowsApiUtilsMockFns,
+} from '@sim/testing'
+import { NextRequest } from 'next/server'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const { mockCheckChatAccess } = vi.hoisted(() => ({
+  mockCheckChatAccess: vi.fn(),
+}))
+
+const mockCreateErrorResponse = workflowsApiUtilsMockFns.mockCreateErrorResponse
+const mockDecryptSecret = encryptionMockFns.mockDecryptSecret
+const mockRecordAudit = auditMockFns.mockRecordAudit
+
+vi.mock('@sim/audit', () => auditMock)
+vi.mock('@/app/api/workflows/utils', () => workflowsApiUtilsMock)
+vi.mock('@/lib/core/security/encryption', () => encryptionMock)
+vi.mock('@/app/api/chat/utils', () => ({
+  checkChatAccess: mockCheckChatAccess,
+}))
+
+import { GET } from '@/app/api/chat/manage/[id]/password/route'
+
+const passwordChat = {
+  id: 'chat-123',
+  workflowId: 'workflow-123',
+  identifier: 'test-chat',
+  title: 'Test Chat',
+  authType: 'password',
+  password: 'encrypted-password',
+}
+
+function makeRequest() {
+  return new NextRequest('http://localhost:3000/api/chat/manage/chat-123/password')
+}
+
+function callGet() {
+  return GET(makeRequest(), { params: Promise.resolve({ id: 'chat-123' }) })
+}
+
+describe('Chat Password Reveal API Route', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+
+    authMockFns.mockGetSession.mockResolvedValue({
+      user: { id: 'user-id', name: 'Test User', email: 'user@example.com' },
+    })
+
+    mockCreateErrorResponse.mockImplementation((message, status = 500) => {
+      return new Response(JSON.stringify({ error: message }), {
+        status,
+        headers: { 'Content-Type': 'application/json' },
+      })
+    })
+
+    mockDecryptSecret.mockResolvedValue({ decrypted: 'super-secret' })
+    mockCheckChatAccess.mockResolvedValue({
+      hasAccess: true,
+      chat: passwordChat,
+      workspaceId: 'workspace-123',
+    })
+  })
+
+  it('should return 401 when user is not authenticated', async () => {
+    authMockFns.mockGetSession.mockResolvedValue(null)
+
+    const response = await callGet()
+
+    expect(response.status).toBe(401)
+    const data = await response.json()
+    expect(data.error).toBe('Unauthorized')
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+  })
+
+  it('should return 404 when chat not found or access denied', async () => {
+    mockCheckChatAccess.mockResolvedValue({ hasAccess: false })
+
+    const response = await callGet()
+
+    expect(response.status).toBe(404)
+    const data = await response.json()
+    expect(data.error).toBe('Chat not found or access denied')
+    expect(mockCheckChatAccess).toHaveBeenCalledWith('chat-123', 'user-id')
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+  })
+
+  it('should return 404 when the chat has no password set', async () => {
+    mockCheckChatAccess.mockResolvedValue({
+      hasAccess: true,
+      chat: { ...passwordChat, authType: 'public', password: null },
+      workspaceId: 'workspace-123',
+    })
+
+    const response = await callGet()
+
+    expect(response.status).toBe(404)
+    const data = await response.json()
+    expect(data.error).toBe('This chat does not have a password set')
+    expect(mockDecryptSecret).not.toHaveBeenCalled()
+  })
+
+  it('should return the decrypted password and record an audit event', async () => {
+    const response = await callGet()
+
+    expect(response.status).toBe(200)
+    const data = await response.json()
+    expect(data.password).toBe('super-secret')
+    expect(mockDecryptSecret).toHaveBeenCalledWith('encrypted-password')
+    expect(mockRecordAudit).toHaveBeenCalledWith(
+      expect.objectContaining({
+        workspaceId: 'workspace-123',
+        actorId: 'user-id',
+        action: 'chat.password_viewed',
+        resourceId: 'chat-123',
+      })
+    )
+    expect(response.headers.get('Cache-Control')).toBe('private, no-store')
+  })
+
+  it('should return 500 when decryption fails', async () => {
+    mockDecryptSecret.mockRejectedValue(new Error('Decryption failed'))
+
+    const response = await callGet()
+
+    expect(response.status).toBe(500)
+    const data = await response.json()
+    expect(data.error).toBe('Decryption failed')
+    expect(mockRecordAudit).not.toHaveBeenCalled()
+  })
+})

apps/sim/app/api/chat/manage/[id]/password/route.ts

@@ -0,0 +1,77 @@
+import { AuditAction, AuditResourceType, recordAudit } from '@sim/audit'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import type { NextRequest } from 'next/server'
+import { NextResponse } from 'next/server'
+import { getChatPasswordContract } from '@/lib/api/contracts/chats'
+import { parseRequest } from '@/lib/api/server'
+import { getSession } from '@/lib/auth'
+import { decryptSecret } from '@/lib/core/security/encryption'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { checkChatAccess } from '@/app/api/chat/utils'
+import { createErrorResponse } from '@/app/api/workflows/utils'
+
+export const dynamic = 'force-dynamic'
+
+const logger = createLogger('ChatPasswordAPI')
+const PRIVATE_NO_STORE = { 'Cache-Control': 'private, no-store' } as const
+
+/**
+ * GET endpoint that reveals a chat deployment's current password.
+ * Restricted to workspace admins (checkChatAccess requires admin permission
+ * on the workflow's workspace); each reveal is recorded in the audit log.
+ */
+export const GET = withRouteHandler(
+  async (request: NextRequest, context: { params: Promise<{ id: string }> }) => {
+    try {
+      const session = await getSession()
+
+      if (!session) {
+        return createErrorResponse('Unauthorized', 401)
+      }
+
+      const parsed = await parseRequest(getChatPasswordContract, request, context)
+      if (!parsed.success) return parsed.response
+
+      const { id: chatId } = parsed.data.params
+
+      const {
+        hasAccess,
+        chat: chatRecord,
+        workspaceId: chatWorkspaceId,
+      } = await checkChatAccess(chatId, session.user.id)
+
+      if (!hasAccess || !chatRecord) {
+        return createErrorResponse('Chat not found or access denied', 404)
+      }
+
+      if (chatRecord.authType !== 'password' || !chatRecord.password) {
+        return createErrorResponse('This chat does not have a password set', 404)
+      }
+
+      const { decrypted } = await decryptSecret(chatRecord.password)
+
+      recordAudit({
+        workspaceId: chatWorkspaceId || null,
+        actorId: session.user.id,
+        actorName: session.user.name,
+        actorEmail: session.user.email,
+        action: AuditAction.CHAT_PASSWORD_VIEWED,
+        resourceType: AuditResourceType.CHAT,
+        resourceId: chatId,
+        resourceName: chatRecord.title,
+        description: `Viewed the password for chat deployment "${chatRecord.title}"`,
+        metadata: {
+          identifier: chatRecord.identifier,
+          workflowId: chatRecord.workflowId,
+        },
+        request,
+      })
+
+      return NextResponse.json({ password: decrypted }, { headers: PRIVATE_NO_STORE })
+    } catch (error) {
+      logger.error('Error revealing chat password:', error)
+      return createErrorResponse(getErrorMessage(error, 'Failed to reveal chat password'), 500)
+    }
+  }
+)

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/deploy/components/deploy-modal/components/chat/chat.tsx

@@ -31,6 +31,7 @@ import {
   type ChatFormData,
   useCreateChat,
   useDeleteChat,
+  useRevealChatPassword,
   useUpdateChat,
 } from '@/hooks/queries/chats'
 import type { ChatDetail } from '@/hooks/queries/deployments'
@@ -41,6 +42,7 @@ import {
   getPasswordPlaceholder,
   hasExistingPassword,
   isPasswordRequired,
+  shouldConfirmPasswordChange,
 } from './utils'
 
 const logger = createLogger('ChatDeploy')
@@ -57,6 +59,7 @@ interface ChatDeployProps {
   onRefetchChat: () => Promise<void>
   chatSubmitting: boolean
   setChatSubmitting: (submitting: boolean) => void
+  canRevealPassword: boolean
   onValidationChange?: (isValid: boolean) => void
   showDeleteConfirmation?: boolean
   setShowDeleteConfirmation?: (show: boolean) => void
@@ -97,6 +100,7 @@ export function ChatDeploy({
   onRefetchChat,
   chatSubmitting,
   setChatSubmitting,
+  canRevealPassword,
   onValidationChange,
   showDeleteConfirmation: externalShowDeleteConfirmation,
   setShowDeleteConfirmation: externalSetShowDeleteConfirmation,
@@ -106,6 +110,7 @@ export function ChatDeploy({
 }: ChatDeployProps) {
   const [imageUrl, setImageUrl] = useState<string | null>(null)
   const [internalShowDeleteConfirmation, setInternalShowDeleteConfirmation] = useState(false)
+  const [showPasswordChangeConfirmation, setShowPasswordChangeConfirmation] = useState(false)
 
   const showDeleteConfirmation =
     externalShowDeleteConfirmation !== undefined
@@ -213,9 +218,7 @@ export function ChatDeploy({
     }
   }, [existingChat, isLoadingChat])
 
-  const handleSubmit = async (e?: React.FormEvent) => {
-    if (e) e.preventDefault()
-
+  const submitChat = async (passwordChangeConfirmed = false) => {
     if (chatSubmitting) return
 
     setChatSubmitting(true)
@@ -227,14 +230,20 @@ export function ChatDeploy({
     try {
       if (!validateForm()) {
         newTab?.close()
-        setChatSubmitting(false)
         return
       }
 
       if (!isIdentifierValid && formData.identifier !== existingChat?.identifier) {
         newTab?.close()
         setError('identifier', 'Please wait for identifier validation to complete')
-        setChatSubmitting(false)
+        return
+      }
+
+      if (
+        !passwordChangeConfirmed &&
+        shouldConfirmPasswordChange(Boolean(existingChat?.id), formData.authType, formData.password)
+      ) {
+        setShowPasswordChangeConfirmation(true)
         return
       }
 
@@ -283,6 +292,11 @@ export function ChatDeploy({
     }
   }
 
+  const handleSubmit = async (event: React.FormEvent) => {
+    event.preventDefault()
+    await submitChat()
+  }
+
   const handleDelete = async () => {
     if (!existingChat || !existingChat.id) return
 
@@ -306,6 +320,11 @@ export function ChatDeploy({
     }
   }
 
+  const handleConfirmPasswordChange = async () => {
+    setShowPasswordChangeConfirmation(false)
+    await submitChat(true)
+  }
+
   if (isLoadingChat) {
     return <LoadingSkeleton />
   }
@@ -404,6 +423,8 @@ export function ChatDeploy({
 
           <AuthSelector
             key={`${existingChat?.id ?? 'new'}-${formInitCounter}`}
+            chatId={existingChat?.id ?? null}
+            canRevealPassword={canRevealPassword}
             authType={formData.authType}
             savedAuthType={existingChat?.authType as AuthType | undefined}
             password={formData.password}
@@ -445,6 +466,21 @@ export function ChatDeploy({
         </div>
       </form>
 
+      <ChipConfirmModal
+        open={showPasswordChangeConfirmation}
+        onOpenChange={setShowPasswordChangeConfirmation}
+        srTitle='Change deployment password'
+        title='Change deployment password?'
+        text='Are you sure you want to change the password for this deployment?'
+        confirm={{
+          label: 'Change Password and Redeploy',
+          onClick: handleConfirmPasswordChange,
+          variant: 'primary',
+          pending: chatSubmitting,
+          pendingLabel: 'Updating...',
+        }}
+      />
+
       <ChipConfirmModal
         open={showDeleteConfirmation}
         onOpenChange={setShowDeleteConfirmation}
@@ -617,6 +653,8 @@ function IdentifierInput({
 }
 
 interface AuthSelectorProps {
+  chatId: string | null
+  canRevealPassword: boolean
   authType: AuthType
   /** The persisted mode of an existing chat, kept selectable even if newly disallowed. */
   savedAuthType?: AuthType
@@ -638,6 +676,8 @@ const AUTH_LABELS: Record<AuthType, string> = {
 }
 
 function AuthSelector({
+  chatId,
+  canRevealPassword,
   authType,
   savedAuthType,
   password,
@@ -651,6 +691,7 @@ function AuthSelector({
 }: AuthSelectorProps) {
   const [emailError, setEmailError] = useState('')
   const [invalidEmailItems, setInvalidEmailItems] = useState<TagItem[]>([])
+  const revealPasswordMutation = useRevealChatPassword()
 
   const emailsRef = useRef(emails)
   const invalidEmailItemsRef = useRef(invalidEmailItems)
@@ -756,9 +797,19 @@ function AuthSelector({
             value={password}
             onChange={onPasswordChange}
             disabled={disabled}
-            placeholder={getPasswordPlaceholder(hasExistingPassword)}
+            placeholder={hasExistingPassword ? '' : getPasswordPlaceholder(false)}
             required={!hasExistingPassword}
+            fetchCurrentPassword={
+              canRevealPassword && chatId && hasExistingPassword
+                ? () => revealPasswordMutation.mutateAsync({ chatId })
+                : undefined
+            }
           />
+          {canRevealPassword && revealPasswordMutation.isError && (
+            <p className='mt-[6.5px] text-[var(--text-error)] text-caption'>
+              Failed to load the current password
+            </p>
+          )}
           <p className='mt-[6.5px] text-[var(--text-secondary)] text-xs'>
             {getPasswordHelperText(hasExistingPassword)}
           </p>