e4981d1b11
## Summary
Consolidates the webapp's authentication and authorization into a small
set of route helpers, replacing the ad-hoc `requireUser` /
`requireUserId` / `authenticatedEnvironmentForAuthentication` calls
scattered across routes. Same security model, but the per-request flow
(authenticate → authorize → load) now lives in one place per route
family.
Introduces a plugin seam (`@trigger.dev/plugins`) that lets the cloud
build install a richer RBAC implementation without touching webapp code.
The OSS fallback keeps the pre-RBAC permissive behaviour intact, so
self-hosted deployments work unchanged.
Adds a comprehensive end-to-end auth test suite that didn't exist before
— 193 `it()` blocks (vitest reports ~199 after `it.each` expansion)
covering API key, PAT and JWT auth across the public API surface, plus
dashboard session auth for admin pages.
## Changes
### Plugin contract — `@trigger.dev/plugins`
`RoleBaseAccessController` interface authoritative for both OSS
(fallback) and cloud (enterprise plugin):
- `authenticateBearer(request, { allowJWT? })` — API-key / public-JWT
auth, returns env + ability
- `authenticateSession(request, { userId, organizationId?, projectId?
})` — dashboard auth, caller resolves `userId` from the session cookie
and passes it in (no `helpers.getSessionUserId` callback — decouples the
plugin host from session-cookie code)
- `authenticatePat(request, { organizationId?, projectId? })` — PAT
auth, returns identity + `lastAccessedAt` so the host can throttle the
per-request update
- `authenticateAuthorize*` variants for the auth-and-check-in-one-call
cases
- `isUsingPlugin(): Promise<boolean>` — capability flag for UI /
branching where plugin-present-ness matters; replaces the
sentinel-string coupling that had `personalAccessToken.server` matching
`"RBAC plugin not installed"` literally
### Dashboard auth (started, partial rollout)
Admin and settings pages migrated to a unified `dashboardLoader` /
`dashboardAction` helper that authenticates the session, runs an
authorization check, and exposes the result to the route. Other
dashboard routes still on the old pattern; remaining migration tracked
in TRI-8730.
Migrated routes:
- `admin.*` (14 admin / back-office / feature-flags / LLM-models /
notifications / orgs / concurrency pages)
- `_app.orgs.$organizationSlug.settings.team`
- `_app.orgs.$organizationSlug.settings.roles`
### API / realtime / engine auth (complete for the migrated families)
71 routes migrated to a unified `apiBuilder` that centralizes Bearer /
PAT / Public-JWT authentication and applies the per-route authorization
check before the handler runs. Includes:
- `api.v1.*` and `api.v2.*` and `api.v3.*` — tasks, runs, batches,
queues, prompts, deployments, query, sessions, waitpoints, packets,
workers, idempotency keys
- `realtime.v1.*` — runs, batches, sessions, streams
- `engine.v1.*` — dev / worker-action protocols
29 routes still on the legacy `authenticateApiRequest*` helpers —
tracked as a post-deploy follow-up in TRI-9228.
Multi-resource auth direction is now explicit at the call site via
`anyResource(...)` (OR) and `everyResource(...)` (AND). Bare arrays no
longer typecheck — fixes a class of bug where a JWT scoped to one
resource could implicitly access others under OR semantics.
PAT auth path consolidated: was three DB queries per request (legacy
`authenticateApiRequestWithPersonalAccessToken` findFirst +
`rbac.authenticatePat` join + `lastAccessedAt` update). Now one query in
the steady state — plugin returns `lastAccessedAt`, host smart-skips the
update via JS-side throttle when fresh.
Side effect: action aliases preserved historic JWT scope semantics where
the new model is stricter (e.g. a `write:tasks` JWT now also satisfies
`trigger` / `batchTrigger` / `update` actions on the same resource —
matched at the auth boundary, not in the route handler).
### Backwards-compat fixes
The strict-match model regressed several real-world JWT shapes. Each
preserved via explicit `anyResource(...)` entries in the route's authz
block:
- **Batch retrieve routes** (`api.v1.batches.$batchId`, `api.v2.*`,
`realtime.v1.batches.*`) accept `read:runs` JWTs again (pre-RBAC
literal-match superScope behaviour)
- **Runs list routes** (`api.v1.runs`, `realtime.v1.runs`) accept
type-level `read:tasks` / `read:tags` on unfiltered queries (matched the
legacy `Object.keys` iteration semantic)
- **PAT/OAT auth shape** normalized through `toAuthenticated` so all
auth methods return the same slim `AuthenticatedEnvironment` (was:
API-key returned the slim shape but PAT/OAT returned raw Prisma
`Decimal` / no `orgMember`)
- **Scope `:` preservation** in resource ids — `read:tags:env:staging`
now correctly identifies the tag id as `env:staging`, not `env`
### Slim `AuthenticatedEnvironment`
Extracted to `@trigger.dev/core/v3/auth/environment` — a structural
shape independent of `@trigger.dev/database`. The plugin contract
returns this; webapp consumers import from there; the cloud plugin
(Drizzle) returns the same shape without Prisma's `Decimal` class
leaking into the public surface. Lets internal-packages (run-engine,
etc.) refer to `AuthenticatedEnvironment` without pulling Prisma in.
### Auth test suite (new — `*.e2e.full.test.ts`)
193 e2e tests run against a real spawned webapp + Postgres (no mocks).
Coverage matrix:
- **API key auth** — read / write / trigger / batchTrigger / deploy
actions across runs, batches, deployments, prompts, queues, query,
sessions, input-streams, waitpoints, tasks, idempotency keys; multi-key
resources (a run carries batch / tag / task identifiers — auth must
accept any matching scope)
- **Personal Access Token auth** — comprehensive matrix: scope match,
scope mismatch, missing scope, expired token, malformed token
- **Public JWT auth** — sub-vs-URL environment resolution, expired JWTs,
signature verification, scope checking, otu (one-time-use) token
semantics, branch-environment signing-key fallback
- **Dashboard session auth** — admin-only pages reject non-admins;
per-action gating
- **Cross-cutting edge cases** — revoked API key grace window, JWT
cross-environment isolation, MissingResource branch behaviour
### Hygiene cleanups
- Deleted dead `app/services/authorization.server.ts` (legacy
`checkAuthorization` + types — no live consumers post-migration) and its
orphaned test
- Dropped the never-populated `scopes` field from
`ApiAuthenticationResultSuccess`
- `scheduleEmail` moved out of `email.server.ts` into its own module —
breaks a `commonWorker → marqs/V1` import chain that was poisoning the
auth test graph
- OSS Roles page shows a deployment-aware empty state ("Roles aren't
available in this self-hosted deployment" vs the plan-upsell copy) via
`rbac.isUsingPlugin()`
- Team action handler: explicit per-intent ability gates
(`manage:billing` for purchase-seats, `manage:members` for set-role +
remove-member with self-leave carve-out)
### Cross-repo coordination
All public-package contract changes paired in `triggerdotdev/cloud#763`
(rbac-packages branch) — the enterprise plugin implements the same
`RoleBaseAccessController` interface against Drizzle.
## Test plan
- [x] `pnpm run typecheck --filter webapp` clean
- [x] `pnpm --filter webapp exec vitest run --config
vitest.e2e.full.config.ts` — 193/193 pass (requires Docker for
testcontainers)
- [x] Spot-check an authed API endpoint with a valid + invalid API key
against a local stack
- [x] Spot-check the migrated admin pages render and gate non-admins
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
124 lines
3.9 KiB
TypeScript
124 lines
3.9 KiB
TypeScript
import { Organization } from "@trigger.dev/database";
|
|
import { z } from "zod";
|
|
import { env } from "~/env.server";
|
|
import {
|
|
RateLimiterConfig,
|
|
createLimiterFromConfig,
|
|
} from "~/services/authorizationRateLimitMiddleware.server";
|
|
import { createRedisRateLimitClient, Duration, RateLimiter } from "~/services/rateLimiter.server";
|
|
import { singleton } from "~/utils/singleton";
|
|
|
|
const BatchLimitsConfig = z.object({
|
|
processingConcurrency: z.number().int().default(env.BATCH_CONCURRENCY_LIMIT_DEFAULT),
|
|
});
|
|
|
|
/**
|
|
* Batch limits configuration for a plan type
|
|
*/
|
|
export type BatchLimitsConfig = z.infer<typeof BatchLimitsConfig>;
|
|
|
|
const batchLimitsRedisClient = singleton("batchLimitsRedisClient", createBatchLimitsRedisClient);
|
|
|
|
function createBatchLimitsRedisClient() {
|
|
const redisClient = createRedisRateLimitClient({
|
|
port: env.RATE_LIMIT_REDIS_PORT,
|
|
host: env.RATE_LIMIT_REDIS_HOST,
|
|
username: env.RATE_LIMIT_REDIS_USERNAME,
|
|
password: env.RATE_LIMIT_REDIS_PASSWORD,
|
|
tlsDisabled: env.RATE_LIMIT_REDIS_TLS_DISABLED === "true",
|
|
clusterMode: env.RATE_LIMIT_REDIS_CLUSTER_MODE_ENABLED === "1",
|
|
});
|
|
|
|
return redisClient;
|
|
}
|
|
|
|
// Just the org fields this module reads. Compatible with both the full
|
|
// Prisma `Organization` payload and the slim `AuthenticatedEnvironment`
|
|
// `["organization"]` shape (when passed `batchRateLimitConfig` /
|
|
// `batchQueueConcurrencyConfig` as `unknown`).
|
|
type OrganizationForBatchLimits = {
|
|
batchRateLimitConfig?: unknown;
|
|
batchQueueConcurrencyConfig?: unknown;
|
|
};
|
|
|
|
function createOrganizationRateLimiter(organization: OrganizationForBatchLimits): RateLimiter {
|
|
const limiterConfig = resolveBatchRateLimitConfig(organization.batchRateLimitConfig);
|
|
|
|
const limiter = createLimiterFromConfig(limiterConfig);
|
|
|
|
return new RateLimiter({
|
|
redisClient: batchLimitsRedisClient,
|
|
keyPrefix: "ratelimit:batch",
|
|
limiter,
|
|
logSuccess: false,
|
|
logFailure: true,
|
|
});
|
|
}
|
|
|
|
function resolveBatchRateLimitConfig(batchRateLimitConfig?: unknown): RateLimiterConfig {
|
|
const defaultRateLimiterConfig: RateLimiterConfig = {
|
|
type: "tokenBucket",
|
|
refillRate: env.BATCH_RATE_LIMIT_REFILL_RATE,
|
|
interval: env.BATCH_RATE_LIMIT_REFILL_INTERVAL as Duration,
|
|
maxTokens: env.BATCH_RATE_LIMIT_MAX,
|
|
};
|
|
|
|
if (!batchRateLimitConfig) {
|
|
return defaultRateLimiterConfig;
|
|
}
|
|
|
|
const parsedBatchRateLimitConfig = RateLimiterConfig.safeParse(batchRateLimitConfig);
|
|
|
|
if (!parsedBatchRateLimitConfig.success) {
|
|
return defaultRateLimiterConfig;
|
|
}
|
|
|
|
return parsedBatchRateLimitConfig.data;
|
|
}
|
|
|
|
/**
|
|
* Get the rate limiter and limits for an organization.
|
|
* Internally looks up the plan type, but doesn't expose it to callers.
|
|
*/
|
|
export async function getBatchLimits(
|
|
organization: OrganizationForBatchLimits
|
|
): Promise<{ rateLimiter: RateLimiter; config: BatchLimitsConfig }> {
|
|
const rateLimiter = createOrganizationRateLimiter(organization);
|
|
const config = resolveBatchLimitsConfig(organization.batchQueueConcurrencyConfig);
|
|
return { rateLimiter, config };
|
|
}
|
|
|
|
function resolveBatchLimitsConfig(batchLimitsConfig?: unknown): BatchLimitsConfig {
|
|
const defaultLimitsConfig: BatchLimitsConfig = {
|
|
processingConcurrency: env.BATCH_CONCURRENCY_LIMIT_DEFAULT,
|
|
};
|
|
|
|
if (!batchLimitsConfig) {
|
|
return defaultLimitsConfig;
|
|
}
|
|
|
|
const parsedBatchLimitsConfig = BatchLimitsConfig.safeParse(batchLimitsConfig);
|
|
|
|
if (!parsedBatchLimitsConfig.success) {
|
|
return defaultLimitsConfig;
|
|
}
|
|
|
|
return parsedBatchLimitsConfig.data;
|
|
}
|
|
|
|
/**
|
|
* Error thrown when batch rate limit is exceeded.
|
|
* Contains information for constructing a proper 429 response.
|
|
*/
|
|
export class BatchRateLimitExceededError extends Error {
|
|
constructor(
|
|
public readonly limit: number,
|
|
public readonly remaining: number,
|
|
public readonly resetAt: Date,
|
|
public readonly itemCount: number
|
|
) {
|
|
super(`Batch rate limit exceeded. Limit resets at ${resetAt.toISOString()}`);
|
|
this.name = "BatchRateLimitExceededError";
|
|
}
|
|
}
|