feat(webapp): consolidate auth path + add comprehensive auth tests

[matt-aitken]

Summary

Consolidates the webapp's authentication and authorization into a small set of route helpers, replacing the ad-hoc requireUser / requireUserId / authenticatedEnvironmentForAuthentication calls scattered across routes. Same security model, but the per-request flow (authenticate → authorize → load) now lives in one place per route family.

Adds a comprehensive end-to-end auth test suite that didn't exist before — 162 tests covering API key, PAT and JWT auth across the public API surface, plus dashboard session auth for admin pages.

Changes

Dashboard auth (started, partial rollout)

Admin and settings pages migrated to a unified loader/action helper that authenticates the session, runs an authorization check, and exposes the result to the route. Other dashboard routes still on the old pattern; remaining migration tracked separately.

Migrated routes:

• admin.* (14 admin / back-office / feature-flags / LLM-models / notifications / orgs / concurrency pages)
• _app.orgs.$organizationSlug.settings.team
• _app.orgs.$organizationSlug.settings.roles

API / realtime / engine auth (complete for the migrated families)

71 routes migrated to a unified apiBuilder that centralizes Bearer / PAT / Public-JWT authentication and applies the per-route authorization check before the handler runs. Includes:

• api.v1.* and api.v2.* and api.v3.* — tasks, runs, batches, queues, prompts, deployments, query, sessions, waitpoints, packets, workers, idempotency keys
• realtime.v1.* — runs, batches, sessions, streams
• engine.v1.* — dev / worker-action protocols

Side effect: action aliases preserved historic JWT scope semantics where the new model is stricter (e.g. a write:tasks JWT now also satisfies trigger / batchTrigger / update actions on the same resource — matched at the auth boundary, not in the route handler).

Auth test suite (new — *.e2e.full.test.ts)

162 e2e tests run against a real spawned webapp + Postgres (no mocks). Coverage matrix:

• API key auth — read / write / trigger / batchTrigger / deploy actions across runs, batches, deployments, prompts, queues, query, sessions, input-streams, waitpoints, tasks, idempotency keys; multi-key resources (a run carries batch / tag / task identifiers — auth must accept any matching scope)
• Personal Access Token auth — comprehensive matrix: scope match, scope mismatch, missing scope, expired token, malformed token
• Public JWT auth — sub-vs-URL environment resolution, expired JWTs, signature verification, scope checking, otu (one-time-use) token semantics, branch-environment signing-key fallback
• Dashboard session auth — admin-only pages reject non-admins; per-action gating
• Cross-cutting edge cases — revoked API key grace window, JWT cross-environment isolation, MissingResource branch behaviour

Test plan

• pnpm run typecheck --filter webapp clean
• pnpm exec vitest run --config apps/webapp/vitest.e2e.full.config.ts — 162/162 pass
• Spot-check an authed API endpoint with a valid + invalid API key against a local stack
• Spot-check the migrated admin pages render and gate non-admins

[changeset-bot]

🦋 Changeset detected

Latest commit: d7055f2

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 31 packages

Name	Type
@trigger.dev/core	Patch
@trigger.dev/plugins	Patch
@trigger.dev/build	Patch
trigger.dev	Patch
@trigger.dev/python	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@trigger.dev/rbac	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch
@internal/zod-worker	Patch
d3-chat	Patch
references-d3-openai-agents	Patch
references-nextjs-realtime	Patch
references-realtime-hooks-test	Patch
references-realtime-streams	Patch
references-telemetry	Patch
@internal/sdk-compat-tests	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/rsc	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Adds a new RBAC system and plugin surface: a @trigger.dev/rbac package, RBAC contracts in packages/plugins, a lazy plugin loader and fallback controller, and a server-side rbac service. Introduces dashboard/api route builder abstractions that centralize authentication/authorization, updates many API/dashboard routes to use typed { type, id } resources (removing prior superScopes), and adds everyResource/authorization aliasing. Webapp changes include role UI (organization Roles page, role picker, token role assignment), invite RBAC handling, schema/migration for OrgMemberInvite.rbacRoleId, project-created environment provisioning refactor, extensive e2e RBAC tests and shared test-server infrastructure, and a CI workflow for full E2E auth runs.

Estimated code review effort

🎯 5 (Critical) | ⏱️ ~120 minutes

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch rbac-packages

[devin-ai-integration]

Devin Review found 3 new potential issues.

View 11 additional findings in Devin Review.

[devin-ai-integration]

Devin Review found 4 new potential issues.

View 16 additional findings in Devin Review.

[devin-ai-integration]

🟡 toAuthenticated() claims to coerce Prisma Decimal but passes it through unchanged

The comment on toAuthenticated() says it "converts concurrencyLimitBurstFactor from Prisma's Decimal to a plain number" but the implementation just passes the value through unchanged (concurrencyLimitBurstFactor: env.concurrencyLimitBurstFactor). The AuthenticatedEnvironment type now accepts number | DecimalLike, so it compiles, but at runtime the value is still a Prisma Decimal object — not a plain number. Any new downstream consumer that trusts the comment and performs arithmetic (e.g. env.concurrencyLimitBurstFactor * 2) will get NaN because Prisma's Decimal doesn't support JS arithmetic operators. The EnvironmentQueuePresenter was updated in this PR to handle both types (line 50-53), which proves the issue is real. The fix would be to add .toNumber() coercion here (or, if the pass-through is intentional, fix the misleading comment).

Suggested change

	concurrencyLimitBurstFactor: env.concurrencyLimitBurstFactor,
	concurrencyLimitBurstFactor: typeof env.concurrencyLimitBurstFactor === "number" ? env.concurrencyLimitBurstFactor : env.concurrencyLimitBurstFactor.toNumber(),

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🟡 Fallback toAuthenticatedEnvironment is identity function — Prisma Decimal not coerced

The fallback's toAuthenticatedEnvironment in fallback.ts:370 is documented as coercing Prisma's Decimal to number but is just an identity pass-through. This is the same issue as in runtimeEnvironment.server.ts but on the RBAC fallback auth path. Every API request authenticated via the fallback (i.e. all OSS deployments) returns an AuthenticatedEnvironment with a Prisma Decimal for concurrencyLimitBurstFactor. Since the AuthenticatedEnvironment type now says number | DecimalLike, new code written to this contract might assume it's a number and fail with NaN on arithmetic.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🔴 RBAC fallback reads from primary DB instead of read replica for every API auth call

The old findEnvironmentByApiKey (used by authenticateApiRequestWithFailure) used $replica for its Prisma reads, spreading auth-path load across replicas. The new RoleBaseAccessFallbackController.authenticateBearer at fallback.ts:115 uses this.prisma which is the primary write client (injected from rbac.server.ts:14 via import { prisma } from "~/db.server"). Since bearer auth runs on every API request, this shifts all auth read traffic from the replica to the primary. For high-traffic deployments this is a meaningful load increase on the primary database.

Relevant code in rbac.server.ts

import { prisma } from "~/db.server";
export const rbac = plugin.create(prisma, ...);

The prisma import is the primary client. The fallback should use $replica for reads.

Prompt for agents

The RBAC fallback controller receives a single PrismaClient and uses it for all reads (environment lookups, user lookups, PAT lookups). The old auth path used $replica (the read replica client) for these high-frequency reads. The fix should either:

1. Pass both prisma and $replica to the fallback (e.g. via a { primary, replica } object) and use replica for reads in authenticateBearer/authenticateSession/authenticatePat, OR
2. Import $replica in rbac.server.ts and pass it as the client (but this won't work for writes like setUserRole)

The cleanest approach is option 1: extend the fallback constructor to accept { primary: PrismaClient, replica: PrismaClient } and use replica in the read-only authenticate* methods. The RoleBaseAccessFallback class in internal-packages/rbac/src/fallback.ts and the rbac.server.ts initialization in apps/webapp/app/services/rbac.server.ts both need updating.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🚩 Fallback uses primary DB instead of $replica for auth queries

The RoleBaseAccessFallbackController in internal-packages/rbac/src/fallback.ts uses this.prisma (the primary Prisma client passed from apps/webapp/app/services/rbac.server.ts:14) for all authentication queries. The old code path (findEnvironmentByApiKey in apps/webapp/app/models/runtimeEnvironment.server.ts:28) used $replica. This means every API request's auth query now hits the primary database instead of the read replica. For high-traffic deployments this shifts significant read load from the replica to the primary. Not a correctness bug, but a performance regression worth noting.

---

Was this helpful? React with 👍 or 👎 to provide feedback.