fix(chat-otp): re-check authType before minting deployment auth cookie

[waleedlatif1]

Summary

• The chat OTP verify endpoint (PUT /api/chat/[identifier]/otp) minted the deployment auth cookie using the chat's current authType without re-checking it was still email, unlike the sibling POST handler and the public-file OTP route
• Added the same authType !== 'email' guard used elsewhere, right before OTP verification/cookie minting

Type of Change

• Bug fix (security)

Testing

• Added a regression test asserting the guard rejects verification when the chat is no longer email-auth, and confirmed it fails without the fix
• bunx vitest run app/api/chat/[identifier]/otp/route.test.ts — 17/17 passing
• bun run check:api-validation passes
• Typecheck and lint clean on changed files

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Jul 11, 2026 6:27pm

[cursor]

PR Summary

High Risk
Touches deployment authentication cookie minting; the change reduces risk by blocking verify when email auth is no longer enabled.

Overview
Chat OTP verify (PUT) now rejects requests when the deployment’s authType is no longer email, matching the existing POST send-OTP guard and the public-file OTP verify flow.

The handler returns 400 (This chat does not use email authentication) before reading stored OTPs or calling setChatAuthCookie, closing a gap where a code issued under email auth could still mint a cookie after the chat switched to password (or another mode).

A regression test asserts that path: no Redis OTP lookup and no auth cookie when authType is password.

^{Reviewed by Cursor Bugbot for commit 51b040a. Configure here.}

[greptile-apps]

Greptile Summary

This PR adds a safer check to the chat OTP verification flow.

• Re-checks that the chat still uses email auth before verifying an OTP.
• Stops OTP lookup and auth-cookie minting when the chat has switched to another auth type.
• Adds a regression test for the switched-auth case.

Confidence Score: 5/5

This looks safe to merge.

• No blocking issues found in the changed code.
• The new check runs before OTP storage access and cookie creation.
• The guard matches the existing email-auth checks used by sibling OTP paths.

Important Files Changed

Filename	Overview
apps/sim/app/api/chat/[identifier]/otp/route.ts	Adds an email-auth guard before OTP verification and chat auth cookie creation.
apps/sim/app/api/chat/[identifier]/otp/route.test.ts	Adds coverage for rejecting OTP verification after the chat switches away from email auth.

_{Reviews (1): Last reviewed commit: "fix(chat-otp): re-check authType before ..." | Re-trigger Greptile}