github/sim
1
1
Fork 0
mirror of https://github.com/simstudioai/sim.git synced 2026-04-28 03:00:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): require internal API key for copilot training endpoints (#4311)

Browse Source
This commit is contained in:
Waleed
2026-04-27 14:30:47 -07:00
committed by GitHub
parent 74946fb162
commit 896a00ae31
2 changed files with 6 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
apps/sim/app/api/copilot/training/examples/route.ts
View File

@@ -1,10 +1,7 @@
import { createLogger } from '@sim/logger'
import { type NextRequest, NextResponse } from 'next/server'
import { z } from 'zod'
import {
authenticateCopilotRequestSessionOnly,
createUnauthorizedResponse,
} from '@/lib/copilot/request/http'
import { checkInternalApiKey, createUnauthorizedResponse } from '@/lib/copilot/request/http'
import { env } from '@/lib/core/config/env'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -21,8 +18,8 @@ const TrainingExampleSchema = z.object({
})
export const POST = withRouteHandler(async (request: NextRequest) => {
const { userId, isAuthenticated } = await authenticateCopilotRequestSessionOnly()
if (!isAuthenticated || !userId) {
const auth = checkInternalApiKey(request)
if (!auth.success) {
return createUnauthorizedResponse()
}

9
apps/sim/app/api/copilot/training/route.ts
View File

@@ -1,10 +1,7 @@
import { createLogger } from '@sim/logger'
import { type NextRequest, NextResponse } from 'next/server'
import { z } from 'zod'
import {
authenticateCopilotRequestSessionOnly,
createUnauthorizedResponse,
} from '@/lib/copilot/request/http'
import { checkInternalApiKey, createUnauthorizedResponse } from '@/lib/copilot/request/http'
import { env } from '@/lib/core/config/env'
import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
@@ -27,8 +24,8 @@ const TrainingDataSchema = z.object({
})
export const POST = withRouteHandler(async (request: NextRequest) => {
const { userId, isAuthenticated } = await authenticateCopilotRequestSessionOnly()
if (!isAuthenticated || !userId) {
const auth = checkInternalApiKey(request)
if (!auth.success) {
return createUnauthorizedResponse()
}