Eric Allam
06969b254a
## Summary Adds a short-lived, delegated token (`tr_uat_...`) that authenticates against the API as a user without handing out a long-lived personal access token. You mint one from a PAT, optionally narrow it to a set of scopes, and give it a lifetime; the API then treats requests as that user, subject to their role. `trigger.dev mint-token` is the entry point (it uses your stored PAT): ```bash UAT=$(trigger.dev mint-token --ttl 3600 --cap read:runs) ``` The token works anywhere a PAT does for user-level endpoints, and can be exchanged for an environment JWT at `POST /api/v1/projects/:ref/:env/jwt` to reach environment-scoped data (the same exchange a PAT supports). ## How it works A user-actor token is a short-lived JWT verified by a new first-class `authenticateUserActor` method on the RBAC plugin. Self-hosters get a built-in fallback; role-aware enforcement comes from the plugin. Effective permissions are the intersection of the user's role and the token's optional scope cap, so a token is only ever narrower than the user, never broader. Minting is restricted to personal access tokens (a token can't mint another one, and an environment key can't mint one). Tokens default to a 1 hour lifetime (max 365 days). When exchanged for an environment JWT, the user is stamped on it for attribution and the scope cap is carried through.
32 lines
1.6 KiB
TypeScript
32 lines
1.6 KiB
TypeScript
import { $replica, prisma } from "~/db.server";
|
|
import type { PrismaClient } from "@trigger.dev/database";
|
|
import plugin from "@trigger.dev/rbac";
|
|
import { env } from "~/env.server";
|
|
|
|
// plugin.create() is synchronous — returns a lazy controller that resolves
|
|
// any installed RBAC plugin on first call. Top-level await is not used
|
|
// because CJS output format does not support it.
|
|
//
|
|
// Auth-path reads run on every request — pass the replica explicitly so
|
|
// they don't pile up on the primary. Writes (role mutations) still go
|
|
// through the primary. Same separation findEnvironmentByApiKey used
|
|
// before this PR moved bearer auth into the RBAC plugin.
|
|
//
|
|
// Session-cookie userId resolution lives at the call site (see
|
|
// dashboardBuilder.server.ts), not here. Statically importing
|
|
// `~/services/session.server` from this module dragged the entire
|
|
// remix-auth pipeline (auth.server → emailAuth/gitHubAuth/googleAuth,
|
|
// each validating their secret at module load) into anything that
|
|
// transitively imported `rbac` — including PAT auth callers that have
|
|
// no session-cookie path at all. Passing userId through the
|
|
// `authenticateSession` context decouples the plugin host from the
|
|
// host's session implementation.
|
|
export const rbac = plugin.create(
|
|
// $replica is structurally a PrismaClient minus `$transaction` — the
|
|
// RBAC fallback only uses `findFirst` on it, so the cast is safe.
|
|
{ primary: prisma, replica: $replica as PrismaClient },
|
|
// SESSION_SECRET signs delegated user-actor tokens; the plugin verifies
|
|
// them with it in authenticateUserActor.
|
|
{ forceFallback: env.RBAC_FORCE_FALLBACK, userActorSecret: env.SESSION_SECRET }
|
|
);
|