Katia Bulatova
cb0bcc92b9
assertUserActorScope returned early whenever the passed scope carried no
org, project or environment, and the route builder passes {} for any route
that declares no context — so the guard was a no-op there. api.v1.orgs's
action is such a route and has no authorization block either, letting a
read-only agent token create an organization.
Fail closed instead, with an explicit identityOnly opt-in for the two
contextless loaders that answer with the caller's own identity, and give
org creation the gate its siblings have.
Trigger webapp - powered by Remix
To start, run with pnpm run dev --filter webapp
Build the docker image locally:
pnpm run docker:build:webapp
docker run -it triggerdotdev-webapp sh