fix(webapp): scope the org-creation RBAC check to user-actor tokens

Author: kathiekiwi

apps/webapp/app/routes/api.v1.orgs.ts

@@ -40,20 +40,33 @@ export const loader = createLoaderPATApiRoute(
   }
 );
 
-// No org exists yet, so there is nothing to scope the gate to; any authenticated user can create
-// an org and becomes its ADMIN. The gate is still declared so a narrowly-capped delegated token
-// (which cannot `manage`) is refused rather than inheriting its user's full reach.
+// No org exists yet, so there is nothing to scope a route-level gate to; any authenticated user
+// can create an org and becomes its ADMIN. A narrowly-capped delegated token (which cannot
+// `manage`) is still refused rather than inheriting its user's full reach — but only for
+// user-actor tokens, so an ordinary PAT is unaffected.
 export const action = createActionPATApiRoute(
   {
     method: "POST",
     body: CreateOrgRequestBody,
-    authorization: { action: "manage", resource: () => ({ type: "organization" }) },
   },
-  async ({ body, authentication }) => {
+  async ({ body, authentication, ability }) => {
     if (env.ORG_CREATION_API_ENABLED !== "1") {
       return json({ error: "Not found" }, { status: 404 });
     }
 
+    // After the env gate: an install with the API disabled should 404, not 403.
+    if (authentication.userActor && !ability.can("manage", { type: "organization" })) {
+      return json(
+        {
+          error: "Unauthorized",
+          code: "unauthorized",
+          param: "access_token",
+          type: "authorization",
+        },
+        { status: 403 }
+      );
+    }
+
     // Mirror the dashboard: stash companyUrl/companySize as onboarding data and
     // derive the org avatar from the company domain's favicon.
     const onboardingData: Record<string, string> = {};

apps/webapp/test/contextlessPatRoutes.test.ts

@@ -77,6 +77,30 @@ async function createOrg(cap: string[]): Promise<{ status: number; body: any }>
   return { status: response.status, body: await response.json() };
 }
 
+// An ordinary PAT, paired with an ability that denies everything. Nothing on this route may
+// consult it — the route has no org to scope a gate to, and on cloud the plugin returns a
+// deny-shaped ability when there is no org context.
+async function createOrgWithPat(): Promise<{ status: number; body: any }> {
+  mocks.authenticatePat.mockImplementation(async () => ({
+    ok: true,
+    userId: USER_ID,
+    tokenId: "pat_1",
+    lastAccessedAt: new Date(),
+    ability: { can: () => false, canSuper: () => false },
+  }));
+
+  const response = await action({
+    request: new Request("https://api.trigger.dev/api/v1/orgs", {
+      method: "POST",
+      headers: { Authorization: "Bearer tr_pat_1234", "Content-Type": "application/json" },
+      body: JSON.stringify({ title: "New Org" }),
+    }),
+    params: {},
+    context: {},
+  } as any);
+  return { status: response.status, body: await response.json() };
+}
+
 const AGENT_ENVIRONMENT_ID = "env_dev";
 
 async function listProjects(): Promise<{ status: number; body: any }> {
@@ -146,6 +170,13 @@ describe("creating an organization over the API", () => {
     expect(mocks.createOrganization).not.toHaveBeenCalled();
   });
 
+  it("admits an ordinary PAT without consulting its ability", async () => {
+    const result = await createOrgWithPat();
+
+    expect(result.status).toBe(201);
+    expect(result.body.slug).toBe("new-org");
+  });
+
   it("still admits a token that carries the universal grant", async () => {
     const result = await createOrg(["admin"]);