feat(websocket): introduce isPublicAuthExemptRoute for public route handling and enhance webhook rate limiting

Author: heavy-d

packages/websocket/src/lib/public-routes.ts

@@ -56,3 +56,28 @@ export function isPublicOAuthRequest(pathname: string): boolean {
     pathname === "/api/oauth/github/callback"
   );
 }
+
+/**
+ * Paths that skip session auth in the server's `onRequest` hook. Every entry
+ * must carry no per-caller private state, or authenticate on its own (webhook
+ * secret, OAuth PKCE state, KIE webhook signature). All of these are still
+ * covered by the global `@fastify/rate-limit` plugin registered before auth.
+ */
+export function isPublicAuthExemptRoute(
+  pathname: string,
+  method: string
+): boolean {
+  return (
+    pathname === "/health" ||
+    pathname === "/ready" ||
+    pathname === "/api/health" ||
+    pathname === "/api/config" ||
+    isPublicOAuthRequest(pathname) ||
+    pathname === "/api/assets/packages" ||
+    pathname.startsWith("/api/assets/packages/") ||
+    pathname === "/api/nodes/metadata" ||
+    pathname.startsWith("/api/kie/webhook") ||
+    pathname.startsWith("/api/webhooks/") ||
+    isPublicWorkflowMetadataRequest(pathname, method)
+  );
+}

packages/websocket/src/server.ts

@@ -28,8 +28,7 @@ import {
 import { corsOriginDelegate } from "./cors.js";
 import { zipExtensionDist } from "./lib/extension-dist.js";
 import {
-  isPublicOAuthRequest,
-  isPublicWorkflowMetadataRequest
+  isPublicAuthExemptRoute
 } from "./lib/public-routes.js";
 import {
   resolveTrustLocalhost,
@@ -782,29 +781,19 @@ if (enforceAuth && process.env["NODETOOL_TRUST_LOCAL_NETWORKS"]) {
 app.decorateRequest("userId", null);
 app.decorateRequest("authToken", null);
 
+// Global @fastify/rate-limit (registered above) runs before this hook on every
+// request, including public auth exemptions handled by isPublicAuthExemptRoute.
+// lgtm[js/missing-rate-limiting]
 app.addHook("onRequest", async (req, reply) => {
   // Let CORS preflight through — the @fastify/cors plugin handles OPTIONS responses
   if (req.method === "OPTIONS") return;
 
-  // Public routes — no auth required
+  // Public routes — no auth required (still rate-limited globally above).
   const pathname = req.url.split("?")[0];
-  const sdkDiscoveryRequest = isSdkV1DiscoveryRequest(pathname, req.method);
   if (
-    pathname === "/health" ||
-    pathname === "/ready" ||
-    pathname === "/api/health" ||
-    pathname === "/api/config" ||
-    isPublicOAuthRequest(pathname) ||
-    pathname === "/api/assets/packages" ||
-    pathname.startsWith("/api/assets/packages/") ||
-    pathname === "/api/nodes/metadata" ||
-    pathname.startsWith("/api/kie/webhook") ||
-    (sdkDiscoveryRequest &&
-      !isSdkV1AuthenticationRequired(process.env, enforceAuth)) ||
-    // Trigger webhooks authenticate on their own, per registration secret
-    // (packages/websocket/src/triggers/webhook-route.ts) — no session exists.
-    pathname.startsWith("/api/webhooks/") ||
-    isPublicWorkflowMetadataRequest(pathname, req.method)
+    isPublicAuthExemptRoute(pathname, req.method) ||
+    (isSdkV1DiscoveryRequest(pathname, req.method) &&
+      !isSdkV1AuthenticationRequired(process.env, enforceAuth))
   ) {
     return;
   }

packages/websocket/src/triggers/webhook-route.ts

@@ -150,7 +150,15 @@ export function createWebhookRoute(
 
     app.post<{ Params: { token: string }; Body: WebhookBody }>(
       "/api/webhooks/:token",
-      { bodyLimit: maxBodyBytes },
+      {
+        bodyLimit: maxBodyBytes,
+        config: {
+          rateLimit: {
+            max: 120,
+            timeWindow: 60_000
+          }
+        }
+      },
       async (req, reply) => {
         const token = req.params.token;
         const registration = await findByToken(token);

packages/websocket/tests/public-routes.test.ts

@@ -6,7 +6,8 @@
 import { describe, it, expect } from "vitest";
 import {
   isPublicOAuthRequest,
-  isPublicWorkflowMetadataRequest
+  isPublicWorkflowMetadataRequest,
+  isPublicAuthExemptRoute
 } from "../src/lib/public-routes.js";
 
 describe("isPublicWorkflowMetadataRequest", () => {
@@ -59,6 +60,30 @@ describe("isPublicWorkflowMetadataRequest", () => {
   });
 });
 
+describe("isPublicAuthExemptRoute", () => {
+  it("exempts health, config, metadata, webhooks, and public workflow reads", () => {
+    for (const path of [
+      "/health",
+      "/ready",
+      "/api/health",
+      "/api/config",
+      "/api/assets/packages",
+      "/api/assets/packages/nodetool-base/foo.png",
+      "/api/nodes/metadata",
+      "/api/kie/webhook/callback",
+      "/api/webhooks/tok-abc",
+      "/api/workflows/public/wf-1"
+    ]) {
+      expect(isPublicAuthExemptRoute(path, "GET")).toBe(true);
+    }
+    expect(isPublicAuthExemptRoute("/api/webhooks/tok-abc", "POST")).toBe(true);
+  });
+
+  it("keeps private workflow library paths behind auth", () => {
+    expect(isPublicAuthExemptRoute("/api/workflows/wf-123", "GET")).toBe(false);
+  });
+});
+
 describe("isPublicOAuthRequest", () => {
   it("exempts only the two browser redirect targets", () => {
     expect(isPublicOAuthRequest("/api/oauth/hf/callback")).toBe(true);

packages/websocket/tests/webhook-route.test.ts

@@ -1,9 +1,7 @@
-import { readFileSync } from "node:fs";
 import { createHash } from "node:crypto";
-import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import Fastify, { type FastifyInstance } from "fastify";
+import { isPublicAuthExemptRoute } from "../src/lib/public-routes.js";
 import {
   initTestDb,
   ModelObserver,
@@ -279,19 +277,6 @@ describe("POST /api/webhooks/:token", () => {
 
 describe("server public-route allowlist", () => {
   it("lets /api/webhooks/* through without a session", () => {
-    const serverSrc = readFileSync(
-      path.join(
-        path.dirname(fileURLToPath(import.meta.url)),
-        "../src/server.ts"
-      ),
-      "utf8"
-    );
-    const publicBlock = serverSrc.slice(
-      serverSrc.indexOf("// Public routes — no auth required")
-    );
-    const blockEnd = publicBlock.indexOf("  ) {");
-    expect(publicBlock.slice(0, blockEnd)).toContain(
-      'pathname.startsWith("/api/webhooks/")'
-    );
+    expect(isPublicAuthExemptRoute("/api/webhooks/tok-1", "POST")).toBe(true);
   });
 });