fix(auth): revoke stale email share access

[waleedlatif1]

Summary

• bind email-gated chat and file-share sessions to the verified identity and current allow-list
• re-check live authorization when an OTP is redeemed, closing the issuance-to-redemption revocation gap
• centralize chat and file cookie validation with versioned, resource-bound signed tokens

Type of Change

• Bug fix

Testing

• bun run lint
• bun run check:audits (40/40)
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run --cwd apps/sim type-check
• focused Vitest suite (9 files, 93 tests)

Notes

• Existing password and email deployment cookies require one-time reauthentication because legacy tokens are intentionally rejected.
• No database migration is required.

Checklist

• I have performed a self-review of my code
• I have added tests that prove the fix is effective
• New and existing unit tests pass locally
• The change is rebased onto the current staging branch
• Generated artifacts and repository audits are clean

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 31, 2026 11:10pm

[greptile-apps]

Greptile Summary

This PR strengthens email-gated chat and public-file authorization by binding signed cookies to the verified identity, resource, current policy, and token lifetime.

• Rechecks the current email allow-list when an OTP is redeemed and whenever an email session cookie is validated.
• Replaces legacy deployment cookies with versioned, resource-bound HMAC tokens.
• Centralizes chat and file-share cookie creation and validation.
• Normalizes email identities and rejects malformed allow-list entries without weakening authorization.

Confidence Score: 5/5

The PR appears safe to merge, with no concrete changed-code regression identified in the reviewed authentication flows.

The chat and file-share paths load the policy fields required by the new validator, email cookies are issued only after live authorization checks, and centralized validation preserves valid password and email sessions while revoking stale grants.

Important Files Changed

Filename	Overview
apps/sim/lib/core/security/deployment.ts	Introduces structured versioned deployment-auth tokens, strict payload validation, identity-derived email slots, and live allow-list enforcement.
apps/sim/lib/core/security/deployment-auth.ts	Centralizes password and email cookie validation while preserving public and SSO authentication behavior.
apps/sim/app/api/chat/[identifier]/otp/route.ts	Normalizes OTP identities, reloads the current allow-list at redemption, and mints an identity-bound chat cookie.
apps/sim/app/api/chat/[identifier]/route.ts	Removes duplicate legacy-cookie validation and delegates authorization to the centralized deployment validator.
apps/sim/app/api/files/public/[token]/otp/route.ts	Rechecks the live file-share allow-list before consuming an OTP and issuing the signed cookie.
apps/sim/app/f/[token]/page.tsx	Validates file-share cookies against the complete current share policy.

Sequence Diagram

sequenceDiagram
  participant U as User
  participant O as OTP route
  participant D as Deployment/share record
  participant C as Signed auth cookie
  participant R as Protected resource
  U->>O: Redeem OTP with email
  O->>D: Load current auth policy
  O->>O: Normalize email and check current allow-list
  O->>C: Mint identity- and resource-bound token
  U->>R: Request with auth cookie
  R->>D: Load current auth policy
  R->>C: Verify signature, resource, mode, lifetime, and current grant
  C-->>R: Authorized only while grant remains active

Loading

_{Reviews (1): Last reviewed commit: "fix(auth): revoke stale email share acce..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 14 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.

Re-trigger cubic</sub>