e4981d1b11
## Summary
Consolidates the webapp's authentication and authorization into a small
set of route helpers, replacing the ad-hoc `requireUser` /
`requireUserId` / `authenticatedEnvironmentForAuthentication` calls
scattered across routes. Same security model, but the per-request flow
(authenticate → authorize → load) now lives in one place per route
family.
Introduces a plugin seam (`@trigger.dev/plugins`) that lets the cloud
build install a richer RBAC implementation without touching webapp code.
The OSS fallback keeps the pre-RBAC permissive behaviour intact, so
self-hosted deployments work unchanged.
Adds a comprehensive end-to-end auth test suite that didn't exist before
— 193 `it()` blocks (vitest reports ~199 after `it.each` expansion)
covering API key, PAT and JWT auth across the public API surface, plus
dashboard session auth for admin pages.
## Changes
### Plugin contract — `@trigger.dev/plugins`
`RoleBaseAccessController` interface authoritative for both OSS
(fallback) and cloud (enterprise plugin):
- `authenticateBearer(request, { allowJWT? })` — API-key / public-JWT
auth, returns env + ability
- `authenticateSession(request, { userId, organizationId?, projectId?
})` — dashboard auth, caller resolves `userId` from the session cookie
and passes it in (no `helpers.getSessionUserId` callback — decouples the
plugin host from session-cookie code)
- `authenticatePat(request, { organizationId?, projectId? })` — PAT
auth, returns identity + `lastAccessedAt` so the host can throttle the
per-request update
- `authenticateAuthorize*` variants for the auth-and-check-in-one-call
cases
- `isUsingPlugin(): Promise<boolean>` — capability flag for UI /
branching where plugin-present-ness matters; replaces the
sentinel-string coupling that had `personalAccessToken.server` matching
`"RBAC plugin not installed"` literally
### Dashboard auth (started, partial rollout)
Admin and settings pages migrated to a unified `dashboardLoader` /
`dashboardAction` helper that authenticates the session, runs an
authorization check, and exposes the result to the route. Other
dashboard routes still on the old pattern; remaining migration tracked
in TRI-8730.
Migrated routes:
- `admin.*` (14 admin / back-office / feature-flags / LLM-models /
notifications / orgs / concurrency pages)
- `_app.orgs.$organizationSlug.settings.team`
- `_app.orgs.$organizationSlug.settings.roles`
### API / realtime / engine auth (complete for the migrated families)
71 routes migrated to a unified `apiBuilder` that centralizes Bearer /
PAT / Public-JWT authentication and applies the per-route authorization
check before the handler runs. Includes:
- `api.v1.*` and `api.v2.*` and `api.v3.*` — tasks, runs, batches,
queues, prompts, deployments, query, sessions, waitpoints, packets,
workers, idempotency keys
- `realtime.v1.*` — runs, batches, sessions, streams
- `engine.v1.*` — dev / worker-action protocols
29 routes still on the legacy `authenticateApiRequest*` helpers —
tracked as a post-deploy follow-up in TRI-9228.
Multi-resource auth direction is now explicit at the call site via
`anyResource(...)` (OR) and `everyResource(...)` (AND). Bare arrays no
longer typecheck — fixes a class of bug where a JWT scoped to one
resource could implicitly access others under OR semantics.
PAT auth path consolidated: was three DB queries per request (legacy
`authenticateApiRequestWithPersonalAccessToken` findFirst +
`rbac.authenticatePat` join + `lastAccessedAt` update). Now one query in
the steady state — plugin returns `lastAccessedAt`, host smart-skips the
update via JS-side throttle when fresh.
Side effect: action aliases preserved historic JWT scope semantics where
the new model is stricter (e.g. a `write:tasks` JWT now also satisfies
`trigger` / `batchTrigger` / `update` actions on the same resource —
matched at the auth boundary, not in the route handler).
### Backwards-compat fixes
The strict-match model regressed several real-world JWT shapes. Each
preserved via explicit `anyResource(...)` entries in the route's authz
block:
- **Batch retrieve routes** (`api.v1.batches.$batchId`, `api.v2.*`,
`realtime.v1.batches.*`) accept `read:runs` JWTs again (pre-RBAC
literal-match superScope behaviour)
- **Runs list routes** (`api.v1.runs`, `realtime.v1.runs`) accept
type-level `read:tasks` / `read:tags` on unfiltered queries (matched the
legacy `Object.keys` iteration semantic)
- **PAT/OAT auth shape** normalized through `toAuthenticated` so all
auth methods return the same slim `AuthenticatedEnvironment` (was:
API-key returned the slim shape but PAT/OAT returned raw Prisma
`Decimal` / no `orgMember`)
- **Scope `:` preservation** in resource ids — `read:tags:env:staging`
now correctly identifies the tag id as `env:staging`, not `env`
### Slim `AuthenticatedEnvironment`
Extracted to `@trigger.dev/core/v3/auth/environment` — a structural
shape independent of `@trigger.dev/database`. The plugin contract
returns this; webapp consumers import from there; the cloud plugin
(Drizzle) returns the same shape without Prisma's `Decimal` class
leaking into the public surface. Lets internal-packages (run-engine,
etc.) refer to `AuthenticatedEnvironment` without pulling Prisma in.
### Auth test suite (new — `*.e2e.full.test.ts`)
193 e2e tests run against a real spawned webapp + Postgres (no mocks).
Coverage matrix:
- **API key auth** — read / write / trigger / batchTrigger / deploy
actions across runs, batches, deployments, prompts, queues, query,
sessions, input-streams, waitpoints, tasks, idempotency keys; multi-key
resources (a run carries batch / tag / task identifiers — auth must
accept any matching scope)
- **Personal Access Token auth** — comprehensive matrix: scope match,
scope mismatch, missing scope, expired token, malformed token
- **Public JWT auth** — sub-vs-URL environment resolution, expired JWTs,
signature verification, scope checking, otu (one-time-use) token
semantics, branch-environment signing-key fallback
- **Dashboard session auth** — admin-only pages reject non-admins;
per-action gating
- **Cross-cutting edge cases** — revoked API key grace window, JWT
cross-environment isolation, MissingResource branch behaviour
### Hygiene cleanups
- Deleted dead `app/services/authorization.server.ts` (legacy
`checkAuthorization` + types — no live consumers post-migration) and its
orphaned test
- Dropped the never-populated `scopes` field from
`ApiAuthenticationResultSuccess`
- `scheduleEmail` moved out of `email.server.ts` into its own module —
breaks a `commonWorker → marqs/V1` import chain that was poisoning the
auth test graph
- OSS Roles page shows a deployment-aware empty state ("Roles aren't
available in this self-hosted deployment" vs the plan-upsell copy) via
`rbac.isUsingPlugin()`
- Team action handler: explicit per-intent ability gates
(`manage:billing` for purchase-seats, `manage:members` for set-role +
remove-member with self-leave carve-out)
### Cross-repo coordination
All public-package contract changes paired in `triggerdotdev/cloud#763`
(rbac-packages branch) — the enterprise plugin implements the same
`RoleBaseAccessController` interface against Drizzle.
## Test plan
- [x] `pnpm run typecheck --filter webapp` clean
- [x] `pnpm --filter webapp exec vitest run --config
vitest.e2e.full.config.ts` — 193/193 pass (requires Docker for
testcontainers)
- [x] Spot-check an authed API endpoint with a valid + invalid API key
against a local stack
- [x] Spot-check the migrated admin pages render and gate non-admins
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
88 lines
3.1 KiB
TypeScript
88 lines
3.1 KiB
TypeScript
import { context, propagation, trace } from "@opentelemetry/api";
|
|
import { NodeTracerProvider } from "@opentelemetry/sdk-trace-node";
|
|
import { InMemorySpanExporter, SimpleSpanProcessor } from "@opentelemetry/sdk-trace-base";
|
|
import {
|
|
MeterProvider,
|
|
InMemoryMetricExporter,
|
|
PeriodicExportingMetricReader,
|
|
AggregationTemporality,
|
|
} from "@opentelemetry/sdk-metrics";
|
|
|
|
export function createInMemoryTracing() {
|
|
// Webapp's vitest config uses `pool: "forks"` with `--no-file-parallelism`,
|
|
// so all test files in a shard share one process. globalThis persists
|
|
// across files even though vitest clears the module cache between them.
|
|
//
|
|
// OTel's `provider.register()` calls trace/context/propagation
|
|
// `setGlobal*` — and `setGlobal` no-ops (logs an error, returns false)
|
|
// when a global is already set. Two patterns hit that path:
|
|
// 1. `~/v3/tracer.server.ts` runs `provider.register()` via its
|
|
// `singleton("opentelemetry", setupTelemetry)` — first test in the
|
|
// shard to import that path sets the globals to webapp's tracer.
|
|
// 2. A subsequent test calls `createInMemoryTracing()` to swap in its
|
|
// own in-memory provider. Without disabling first, register() is
|
|
// a no-op — the test's provider receives spans via its
|
|
// SimpleSpanProcessor (provider-scoped), but `trace.getActiveSpan()`
|
|
// (used by code under test, e.g. sentryTraceContext.server.ts)
|
|
// reads from the stale global context manager from step 1.
|
|
//
|
|
// Disable first, then register, so the test's provider always wins
|
|
// for both span recording and the global API. After the test, the
|
|
// next caller's createInMemoryTracing rotates again — no leakage.
|
|
trace.disable();
|
|
context.disable();
|
|
propagation.disable();
|
|
|
|
const exporter = new InMemorySpanExporter();
|
|
const provider = new NodeTracerProvider({
|
|
spanProcessors: [new SimpleSpanProcessor(exporter)],
|
|
});
|
|
provider.register();
|
|
|
|
const tracer = provider.getTracer("test-tracer");
|
|
|
|
return {
|
|
exporter,
|
|
tracer,
|
|
};
|
|
}
|
|
|
|
export function createInMemoryMetrics() {
|
|
// Initialize the metric exporter with cumulative temporality for easier testing
|
|
const metricExporter = new InMemoryMetricExporter(AggregationTemporality.CUMULATIVE);
|
|
|
|
// Create a metric reader that exports frequently for testing
|
|
const metricReader = new PeriodicExportingMetricReader({
|
|
exporter: metricExporter,
|
|
exportIntervalMillis: 100, // Export frequently for tests
|
|
});
|
|
|
|
// Initialize the meter provider
|
|
const meterProvider = new MeterProvider({
|
|
readers: [metricReader],
|
|
});
|
|
|
|
// Retrieve a meter
|
|
const meter = meterProvider.getMeter("test-meter");
|
|
|
|
return {
|
|
metricExporter,
|
|
metricReader,
|
|
meterProvider,
|
|
meter,
|
|
// Helper to force collection and get metrics
|
|
async getMetrics() {
|
|
await metricReader.forceFlush();
|
|
return metricExporter.getMetrics();
|
|
},
|
|
// Helper to reset metrics between tests
|
|
reset() {
|
|
metricExporter.reset();
|
|
},
|
|
// Helper to shutdown the meter provider
|
|
async shutdown() {
|
|
await meterProvider.shutdown();
|
|
},
|
|
};
|
|
}
|