fix(webapp,sdk): enforce scoped token resource boundaries

Mono-RevId: 941c01f76cc443b5b6c74f3444029abf052163c1

Author: carderne

.changeset/strict-public-token-scope-ids.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/sdk": patch
+---
+
+Validate resource IDs when creating scoped public tokens. Explicitly empty IDs are now rejected instead of being interpreted as type-wide permissions.

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts

@@ -5,7 +5,6 @@ import { regenerateApiKey, RootApiKeyNotVisibleError } from "~/models/api-key.se
 import {
   authenticatedEnvironmentForAuthentication,
   authenticateRequest,
-  branchNameFromRequest,
 } from "~/services/apiAuth.server";
 import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
 import { logger } from "~/services/logger.server";
@@ -39,11 +38,15 @@ export async function action({ request, params }: ActionFunctionArgs) {
       return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
     }
 
+    if (request.headers.has("x-trigger-branch")) {
+      return json({ error: "Branch-scoped key rotation is not supported" }, { status: 400 });
+    }
+
     const environment = await authenticatedEnvironmentForAuthentication(
       authenticationResult,
       projectRef,
       env,
-      branchNameFromRequest(request)
+      undefined
     );
 
     // Rotating the key requires env-tier write:apiKeys — same gate the

apps/webapp/app/routes/api.v1.runs.$runId.spans.$spanId.ts

@@ -9,6 +9,7 @@ import { getTaskEventStoreTableForRun } from "~/v3/taskEventStore.server";
 import { findRunByIdWithMollifierFallback } from "~/v3/mollifier/readFallback.server";
 import { buildSyntheticSpanDetailBody } from "~/v3/mollifier/syntheticApiResponses.server";
 import { runStore } from "~/v3/runStore.server";
+import { canReadRunWithAliases } from "~/utils/runReadAuthorization";
 
 const ParamsSchema = z.object({
   runId: z.string(),
@@ -79,7 +80,7 @@ export const loader = createLoaderApiRoute(
       },
     },
   },
-  async ({ params, resource: resolved, authentication }) => {
+  async ({ params, resource: resolved, authentication, ability }) => {
     if (resolved.source === "buffer") {
       // Buffered runs have exactly one valid spanId — the queued span the
       // mollifier gate recorded at trigger time, which becomes the run's
@@ -126,6 +127,8 @@ export const loader = createLoaderApiRoute(
         select: {
           friendlyId: true,
           taskIdentifier: true,
+          runTags: true,
+          batchId: true,
           status: true,
           createdAt: true,
         },
@@ -137,6 +140,10 @@ export const loader = createLoaderApiRoute(
       $replica
     );
 
+    const authorizedTriggeredRuns = triggeredRuns.filter((run) =>
+      canReadRunWithAliases(ability, run)
+    );
+
     const properties =
       span.properties &&
       typeof span.properties === "object" &&
@@ -182,8 +189,8 @@ export const loader = createLoaderApiRoute(
             }
           : undefined,
         triggeredRuns:
-          triggeredRuns.length > 0
-            ? triggeredRuns.map((r) => ({
+          authorizedTriggeredRuns.length > 0
+            ? authorizedTriggeredRuns.map((r) => ({
                 runId: r.friendlyId,
                 taskIdentifier: r.taskIdentifier,
                 status: r.status,

apps/webapp/app/utils/runReadAuthorization.test.ts

@@ -0,0 +1,55 @@
+import { buildJwtAbility } from "@trigger.dev/rbac";
+import { describe, expect, it } from "vitest";
+import { canReadRunWithAliases } from "./runReadAuthorization";
+
+const run = {
+  friendlyId: "run_child",
+  taskIdentifier: "child-task",
+  runTags: ["user:alice", "paid"],
+  batchId: "abcdefghijklmnopqrstuvwx",
+};
+
+describe("canReadRunWithAliases", () => {
+  it.each([
+    "read:runs:run_child",
+    "read:tasks:child-task",
+    "read:tags:user:alice",
+    "read:batch:batch_abcdefghijklmnopqrstuvwx",
+    "read:runs",
+  ])("allows child metadata through the %s alias", (scope) => {
+    expect(canReadRunWithAliases(buildJwtAbility([scope]), run)).toBe(true);
+  });
+
+  it.each([
+    "read:runs:run_parent",
+    "read:tasks:parent-task",
+    "read:tags:user:bob",
+    "read:batch:batch_other",
+  ])("denies child metadata when only %s is authorized", (scope) => {
+    expect(canReadRunWithAliases(buildJwtAbility([scope]), run)).toBe(false);
+  });
+
+  it("checks all 13 bounded aliases in one ability call", () => {
+    const runWithMaxTags = {
+      ...run,
+      runTags: Array.from({ length: 10 }, (_, index) => `tag:${index}`),
+    };
+    let checks = 0;
+
+    expect(
+      canReadRunWithAliases(
+        {
+          can(action, resources) {
+            checks++;
+            expect(action).toBe("read");
+            expect(resources).toHaveLength(13);
+            return false;
+          },
+          canSuper: () => false,
+        },
+        runWithMaxTags
+      )
+    ).toBe(false);
+    expect(checks).toBe(1);
+  });
+});

apps/webapp/app/utils/runReadAuthorization.ts

@@ -0,0 +1,23 @@
+import type { RbacAbility, RbacResource } from "@trigger.dev/rbac";
+import { BatchId } from "@trigger.dev/core/v3/isomorphic";
+
+type RunReadAliases = {
+  friendlyId: string;
+  taskIdentifier: string;
+  runTags: string[];
+  batchId: string | null;
+};
+
+export function canReadRunWithAliases(ability: RbacAbility, run: RunReadAliases): boolean {
+  const resources: RbacResource[] = [
+    { type: "runs", id: run.friendlyId },
+    { type: "tasks", id: run.taskIdentifier },
+    ...run.runTags.map((tag) => ({ type: "tags", id: tag })),
+  ];
+
+  if (run.batchId) {
+    resources.push({ type: "batch", id: BatchId.toFriendlyId(run.batchId) });
+  }
+
+  return ability.can("read", resources);
+}

apps/webapp/test/regenerateApiKeyBranch.e2e.full.test.ts

@@ -0,0 +1,56 @@
+import { describe, expect, it } from "vitest";
+import { getTestServer } from "./helpers/sharedTestServer";
+import { seedTestUserProject } from "./helpers/seedTestUserProject";
+
+describe("regenerate API key branch handling", () => {
+  it.each(["feature", "", "default"])(
+    "rejects a present branch header without rotating the root key (%s)",
+    async (branch) => {
+      const server = getTestServer();
+      const { environment, pat, project } = await seedTestUserProject(server.prisma);
+
+      const response = await server.webapp.fetch(
+        `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${pat.token}`,
+            "x-trigger-branch": branch,
+          },
+        }
+      );
+
+      expect(response.status).toBe(400);
+      expect(await response.json()).toEqual({
+        error: "Branch-scoped key rotation is not supported",
+      });
+      const persisted = await server.prisma.runtimeEnvironment.findUniqueOrThrow({
+        where: { id: environment.id },
+        select: { apiKey: true },
+      });
+      expect(persisted.apiKey).toBe(environment.apiKey);
+    }
+  );
+
+  it("preserves root key rotation and grace behavior without a branch header", async () => {
+    const server = getTestServer();
+    const { environment, pat, project } = await seedTestUserProject(server.prisma);
+
+    const response = await server.webapp.fetch(
+      `/api/v1/projects/${project.externalRef}/dev/regenerate-api-key`,
+      {
+        method: "POST",
+        headers: { Authorization: `Bearer ${pat.token}` },
+      }
+    );
+
+    expect(response.status).toBe(200);
+    const body = (await response.json()) as { apiKey: string };
+    expect(body.apiKey).not.toBe(environment.apiKey);
+
+    const revoked = await server.prisma.revokedApiKey.findFirst({
+      where: { apiKey: environment.apiKey, runtimeEnvironmentId: environment.id },
+    });
+    expect(revoked?.expiresAt.getTime()).toBeGreaterThan(Date.now());
+  });
+});

internal-packages/rbac/src/ability.test.ts

@@ -1,3 +1,4 @@
+import { buildScope } from "@trigger.dev/plugins";
 import { describe, it, expect } from "vitest";
 import {
   permissiveAbility,
@@ -60,17 +61,42 @@ describe("buildJwtAbility", () => {
     expect(ability.can("read", { type: "runs" })).toBe(false);
   });
 
+  it.each(["read:runs:", "read:runs:   "])(
+    "rejects an explicitly empty resource ID in %s",
+    (scope) => {
+      const ability = buildJwtAbility([scope]);
+      expect(ability.can("read", { type: "runs", id: "run_abc" })).toBe(false);
+      expect(ability.can("read", { type: "runs" })).toBe(false);
+    }
+  );
+
   it("preserves colons in the resource id (everything after the 2nd colon)", () => {
-    // Resource ids can contain colons (e.g. user-provided tags like
-    // `env:staging`). The naive `[a, b, c] = scope.split(":")` form
-    // truncated `read:tags:env:staging` → scopeId="env" and silently
-    // mis-matched. Regression coverage for the multi-colon id path.
     const ability = buildJwtAbility(["read:tags:env:staging"]);
     expect(ability.can("read", { type: "tags", id: "env:staging" })).toBe(true);
     expect(ability.can("read", { type: "tags", id: "env" })).toBe(false);
     expect(ability.can("read", { type: "tags", id: "env:prod" })).toBe(false);
   });
 
+  it("preserves meaningful whitespace around resource ids", () => {
+    const ability = buildJwtAbility(["read:tags: env:staging "]);
+    expect(ability.can("read", { type: "tags", id: " env:staging " })).toBe(true);
+    expect(ability.can("read", { type: "tags", id: "env:staging" })).toBe(false);
+  });
+
+  it("preserves wildcard actions and ignores resource condition fields", () => {
+    const ability = buildJwtAbility(["*:runs:run_abc"]);
+    const resource = {
+      type: "runs",
+      id: "run_abc",
+      projectId: "proj_123",
+      environmentId: "env_123",
+    };
+
+    expect(ability.can("read", resource)).toBe(true);
+    expect(ability.can("write", resource)).toBe(true);
+    expect(ability.can("read", { ...resource, id: "run_other" })).toBe(false);
+  });
+
   it("allows any read with read:all scope", () => {
     const ability = buildJwtAbility(["read:all"]);
     expect(ability.can("read", { type: "runs" })).toBe(true);
@@ -122,6 +148,32 @@ describe("buildJwtAbility", () => {
     const ability = buildJwtAbility(["read:runs"]);
     expect(ability.can("write", { type: "runs" })).toBe(false);
   });
+
+  it("does not revisit the supplied scope set during repeated checks", () => {
+    const rawScopes = Array.from({ length: 300 }, (_, index) => `read:runs:allowed_${index}`);
+    let scopeReads = 0;
+    const scopes = new Proxy(rawScopes, {
+      get(target, property, receiver) {
+        if (typeof property === "string" && /^\d+$/.test(property)) {
+          scopeReads++;
+        }
+        return Reflect.get(target, property, receiver);
+      },
+    });
+    const ability = buildJwtAbility(scopes);
+    const readsAfterConstruction = scopeReads;
+    const childAliases = Array.from({ length: 13 }, (_, index) => ({
+      type: "runs",
+      id: `denied_${index}`,
+    }));
+
+    for (let child = 0; child < 50; child++) {
+      expect(ability.can("read", childAliases)).toBe(false);
+    }
+
+    expect(readsAfterConstruction).toBeGreaterThan(0);
+    expect(scopeReads).toBe(readsAfterConstruction);
+  });
 });
 
 describe("scopesWithinAbility", () => {
@@ -189,13 +241,27 @@ describe("scopesWithinAbility", () => {
   });
 
   it("rejects malformed scopes for restricted abilities", () => {
-    expect(scopesWithinAbility(["read"], buildJwtAbility(["read:all"]))).toEqual({
+    expect(
+      scopesWithinAbility(["read", "read:runs:", "read:tags:   "], buildJwtAbility(["read:all"]))
+    ).toEqual({
       ok: false,
-      deniedScopes: ["read"],
+      deniedScopes: ["read", "read:runs:", "read:tags:   "],
     });
   });
 });
 
+describe("buildScope", () => {
+  it("distinguishes an absent ID from an explicitly empty ID", () => {
+    expect(buildScope("read", "runs")).toBe("read:runs");
+    expect(() => buildScope("read", "runs", "")).toThrow("Scope resource IDs must not be empty");
+    expect(() => buildScope("read", "runs", "   ")).toThrow("Scope resource IDs must not be empty");
+  });
+
+  it("preserves nonempty IDs exactly", () => {
+    expect(buildScope("read", "tags", " env:staging ")).toBe("read:tags: env:staging ");
+  });
+});
+
 describe("buildJwtAbility — array resources", () => {
   it("authorizes when any resource in the array passes a scope check", () => {
     const ability = buildJwtAbility(["read:batch:batch_abc"]);