fix(elevenlabs): added internal auth helper for proxy routes

[waleedlatif1]

• fix(elevenlabs): added internal auth helper for proxy routes
• remove concurrent tests

Summary

• added internal auth helper for proxy routes

Type of Change

• Bug fix

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Preview	Comments	Updated (UTC)
docs	Skipped			Oct 26, 2025 0:48am

[greptile-apps]

Greptile Overview

Greptile Summary

This PR adds authentication to proxy routes using the checkHybridAuth helper, which supports three authentication methods: internal JWT tokens, session cookies, and request headers. The authentication check was added to all proxy endpoints (/api/proxy, /api/proxy/image, /api/proxy/tts, /api/proxy/tts/stream) to prevent unauthorized access.

Key Changes:

• Added checkHybridAuth call at the start of each proxy route handler with requireWorkflowId: false option
• Improved error response consistency in TTS routes by using NextResponse.json format throughout
• Added error handling in elevenlabs/tts.ts to properly handle error responses from the proxy
• Removed .concurrent flag from all tests to run them sequentially (addressing test flakiness)
• Cleaned up unnecessary comments in proxy route file

Confidence Score: 5/5

• This PR is safe to merge with minimal risk
• The changes are straightforward security improvements that add authentication to previously unprotected proxy routes. The checkHybridAuth helper is well-tested and already used elsewhere in the codebase. The implementation is consistent across all proxy endpoints, and the test changes address concurrency issues. No breaking changes or risky logic modifications.
• No files require special attention

Important Files Changed

File Analysis

Filename	Score	Overview
apps/sim/app/api/proxy/route.ts	5/5	Added checkHybridAuth call at the start of POST handler to authenticate requests; removed some comments
apps/sim/app/api/proxy/image/route.ts	5/5	Added checkHybridAuth call at the start of GET handler to authenticate image proxy requests
apps/sim/app/api/proxy/tts/route.ts	5/5	Added checkHybridAuth authentication; improved error responses by consistently using NextResponse.json format
apps/sim/app/api/proxy/tts/stream/route.ts	5/5	Added checkHybridAuth call at the start of POST handler to authenticate streaming TTS requests
apps/sim/tools/elevenlabs/tts.ts	5/5	Added error handling in transformResponse to check for errors in the response data and return appropriate error structure
apps/sim/tools/index.test.ts	5/5	Removed .concurrent flag from all test cases to run tests sequentially instead of concurrently

Sequence Diagram

sequenceDiagram
    participant Client
    participant ProxyRoute as Proxy Route
    participant HybridAuth as checkHybridAuth
    participant AuthLayer as Authentication Layer
    participant ToolExecution as Tool Execution

    Client->>ProxyRoute: POST /api/proxy
    ProxyRoute->>HybridAuth: Verify request
    
    HybridAuth->>AuthLayer: Check internal token
    alt Internal token present and validated
        AuthLayer-->>HybridAuth: Returns user context from workflow
        HybridAuth-->>ProxyRoute: Access granted
    else Internal token not present or invalid
        AuthLayer->>AuthLayer: Check session cookie
        alt Session cookie found and verified
            AuthLayer-->>HybridAuth: Returns user from session
            HybridAuth-->>ProxyRoute: Access granted
        else No session cookie
            AuthLayer->>AuthLayer: Check request headers
            alt Request headers verified
                AuthLayer-->>HybridAuth: Returns user from headers
                HybridAuth-->>ProxyRoute: Access granted
            else No access method found
                AuthLayer-->>HybridAuth: No authentication present
                HybridAuth-->>ProxyRoute: Access denied
            end
        end
    end
    
    alt Access Denied
        ProxyRoute-->>Client: 401 Unauthorized
    else Access Granted
        ProxyRoute->>ToolExecution: Execute tool with params
        ToolExecution-->>ProxyRoute: Tool result
        ProxyRoute-->>Client: 200 OK with result
    end

Loading

_{8 files reviewed, no comments}

_{Edit Code Review Agent Settings | Greptile}