fix: the post /reset endpoint in the real-time servi... in git_routes.ts

app/client/packages/rts/src/middlewares/AuthMiddleware.ts

@@ -0,0 +1,14 @@
+import type { Request, Response, NextFunction } from "express";
+
+export function requireInternalAuth(req: Request, res: Response, next: NextFunction) {
+  const secret = process.env.APPSMITH_RTS_SECRET;
+  if (!secret) {
+    console.warn("[AuthMiddleware] APPSMITH_RTS_SECRET is not set; rejecting request to protected endpoint");
+    return res.status(401).json({ success: false, message: "Unauthorized" });
+  }
+  const header = req.headers["x-rts-secret"];
+  if (!header || header !== secret) {
+    return res.status(401).json({ success: false, message: "Unauthorized" });
+  }
+  next();
+}

app/client/packages/rts/src/routes/git_routes.ts

@@ -1,11 +1,19 @@
 import express from "express";
+import { body } from "express-validator";
 import GitController from "@controllers/git";
 import { Validator } from "@middlewares/Validator";
+import { requireInternalAuth } from "@middlewares/AuthMiddleware";
 
 const router = express.Router();
 const gitController = new GitController();
 const validator = new Validator();
 
-router.post("/reset", validator.validateRequest, gitController.reset);
+router.post(
+  "/reset",
+  body("repoPath").isString().notEmpty().withMessage("repoPath is required and must be a string"),
+  requireInternalAuth,
+  validator.validateRequest,
+  gitController.reset,
+);
 
 export default router;

tests/invariant_git_routes.test.ts

@@ -0,0 +1,44 @@
+import request from 'supertest';
+import express from 'express';
+import gitRoutes from '../../../src/routes/git_routes';
+
+describe('Protected endpoints reject unauthenticated requests', () => {
+  let app: express.Application;
+  let originalSecret: string | undefined;
+
+  beforeAll(() => {
+    originalSecret = process.env.APPSMITH_RTS_SECRET;
+    process.env.APPSMITH_RTS_SECRET = 'test-secret';
+    app = express();
+    app.use(express.json());
+    app.use('/git', gitRoutes);
+  });
+
+  afterAll(() => {
+    if (originalSecret === undefined) {
+      delete process.env.APPSMITH_RTS_SECRET;
+    } else {
+      process.env.APPSMITH_RTS_SECRET = originalSecret;
+    }
+  });
+
+  const payloads = [
+    { name: 'missing_auth_header', headers: {}, expectedStatus: 401 },
+    { name: 'invalid_token', headers: { 'x-rts-secret': 'invalid_token_xyz' }, expectedStatus: 401 },
+    { name: 'expired_token', headers: { 'x-rts-secret': 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJleHAiOjE2MDAwMDAwMDB9.invalid' }, expectedStatus: 401 },
+    { name: 'malformed_auth', headers: { 'x-rts-secret': 'InvalidScheme token123' }, expectedStatus: 401 },
+    { name: 'empty_token', headers: { 'x-rts-secret': '' }, expectedStatus: 401 },
+  ];
+
+  test.each(payloads)(
+    'POST /reset rejects unauthenticated request: $name',
+    async ({ headers, expectedStatus }) => {
+      const response = await request(app)
+        .post('/git/reset')
+        .set(headers)
+        .send({ repoPath: 'test-repo' });
+
+      expect(response.status).toBe(expectedStatus);
+    }
+  );
+});