merge: propagate wave-2 review fixes from feat/dashboard-agent-flows

Author: kathiekiwi

.changeset/uat-ttl-help-text.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+The `mint-token` command's `--ttl` help now shows the correct maximum token lifetime of 7 days.

.server-changes/agent-untrusted-text-fence.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+The dashboard agent now treats captured content it reads — run logs, error messages, and commit messages — as data, so instructions hidden inside them can no longer steer the assistant.

.server-changes/dashboard-agent-chat-retention.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Deleted assistant conversations are now permanently removed after a grace period, and deleting an organization also removes its conversations.

.server-changes/user-actor-token-lifetime-and-revocation.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Revoking a personal access token now also stops any short-lived tokens created from it. Tokens created from a personal access token can now live for at most 7 days.

apps/webapp/app/routes/api.v1.auth.user-actor-token.ts

@@ -9,7 +9,7 @@ import { rbac } from "~/services/rbac.server";
 // with the PAT. The default is short, but the ceiling allows long-lived tokens
 // for callers that need them (e.g. a long-running integration).
 const DEFAULT_UAT_TTL_SECONDS = 60 * 60; // 1 hour
-const MAX_UAT_TTL_SECONDS = 365 * 24 * 60 * 60; // 365 days
+const MAX_UAT_TTL_SECONDS = 7 * 24 * 60 * 60; // 7 days
 
 // Mint a short-lived delegated user-actor token (`tr_uat_`) from a personal
 // access token. A UAT is a strict downgrade of the PAT: same user identity,
@@ -68,6 +68,8 @@ export async function action({ request }: ActionFunctionArgs) {
     const token = await signUserActorToken(env.SESSION_SECRET, {
       userId: patAuth.userId,
       client: body.client ?? "personal-access-token",
+      // Bind the token to its source PAT so revoking the PAT invalidates it.
+      pat: patAuth.tokenId,
       cap: body.cap,
       // Absolute exp (seconds since epoch). jose treats a number as absolute.
       expirationTime: Math.floor(Date.now() / 1000) + ttlSeconds,

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.jwt.ts

@@ -18,6 +18,7 @@ import {
 } from "~/services/apiAuth.server";
 import { env as appEnv } from "~/env.server";
 import { assertUserActorEnvironment } from "~/services/userActorEnvironment.server";
+import { assertSourcePatActive } from "~/services/personalAccessToken.server";
 import { logger } from "~/services/logger.server";
 import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
 
@@ -78,6 +79,10 @@ export async function action({ request, params }: ActionFunctionArgs) {
       if (!claims) {
         return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
       }
+      // A token minted from a PAT dies with it — the PAT must still be live.
+      if (!(await assertSourcePatActive(claims))) {
+        return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
+      }
       uatCap = claims.cap;
       userActorId = claims.userId;
       userActor = claims;

apps/webapp/app/services/apiRateLimit.server.ts

@@ -8,6 +8,73 @@ import type { Duration } from "./rateLimiter.server";
 
 const BATCH_STREAM_ITEMS_PATH = /^\/api\/v3\/batches\/([^/]+)\/items$/;
 
+// Rate-limit key for a delegated (agent/PAT-minted) JWT. Its token value rotates every
+// turn, so keying on the token would hand each turn a fresh bucket. Key on env+acting-user
+// so the agent's traffic shares one bucket across turns. The `jwt-actor:` prefix keeps it
+// off PRIVATE-key buckets, which key on the bare environment id.
+export function jwtActorRateLimitIdentifier(environmentId: string, actorSub: string): string {
+  return `jwt-actor:${environmentId}:${actorSub}`;
+}
+
+// The per-request bucket decision for the API limiter. Exported so the branch below
+// (a delegated JWT keys on env+acting-user, everything else keeps its prior key) is
+// testable without standing up the middleware and its Redis.
+export async function resolveApiRateLimitOverride(
+  authorizationValue: string
+): Promise<{ config?: unknown; identifier?: string } | undefined> {
+  const rawApiKey = authorizationValue.replace(/^Bearer /, "");
+
+  if (rawApiKey.startsWith("tr_")) {
+    const scope = await resolvePrivateApiKeyRateLimitScope(rawApiKey);
+
+    if (!scope) {
+      return;
+    }
+
+    return {
+      config: scope.apiRateLimiterConfig,
+      identifier: scope.environmentId,
+    };
+  }
+
+  const authenticatedEnv = await authenticateAuthorizationHeader(authorizationValue, {
+    allowPublicKey: true,
+    allowJWT: true,
+  });
+
+  if (!authenticatedEnv || !authenticatedEnv.ok) {
+    return;
+  }
+
+  if (authenticatedEnv.type === "PUBLIC_JWT") {
+    const config = {
+      type: "fixedWindow",
+      window: env.API_RATE_LIMIT_JWT_WINDOW,
+      tokens: env.API_RATE_LIMIT_JWT_TOKENS,
+    } as const;
+
+    // A delegated JWT (agent/PAT-minted) shares one bucket per env+acting-user across turns.
+    // A browser realtime JWT carries no `act`, so it keeps the hashed-token fallback.
+    if (authenticatedEnv.actor?.sub) {
+      return {
+        config,
+        identifier: jwtActorRateLimitIdentifier(
+          authenticatedEnv.environment.id,
+          authenticatedEnv.actor.sub
+        ),
+      };
+    }
+
+    return { config };
+  }
+
+  return {
+    config: authenticatedEnv.environment.organization.apiRateLimiterConfig,
+    // Public keys are browser-distributed, so keep them on per-key buckets.
+    identifier: authenticatedEnv.type === "PRIVATE" ? authenticatedEnv.environment.id : undefined,
+  };
+}
+
 export const apiRateLimiter = authorizationRateLimitMiddleware({
   redis: {
     port: env.RATE_LIMIT_REDIS_PORT,
@@ -29,47 +96,7 @@ export const apiRateLimiter = authorizationRateLimitMiddleware({
     stale: 60_000 * 20, // Date is stale after 20 minutes
     maxItems: 1000,
   },
-  limiterConfigOverride: async (authorizationValue) => {
-    const rawApiKey = authorizationValue.replace(/^Bearer /, "");
-
-    if (rawApiKey.startsWith("tr_")) {
-      const scope = await resolvePrivateApiKeyRateLimitScope(rawApiKey);
-
-      if (!scope) {
-        return;
-      }
-
-      return {
-        config: scope.apiRateLimiterConfig,
-        identifier: scope.environmentId,
-      };
-    }
-
-    const authenticatedEnv = await authenticateAuthorizationHeader(authorizationValue, {
-      allowPublicKey: true,
-      allowJWT: true,
-    });
-
-    if (!authenticatedEnv || !authenticatedEnv.ok) {
-      return;
-    }
-
-    if (authenticatedEnv.type === "PUBLIC_JWT") {
-      return {
-        config: {
-          type: "fixedWindow",
-          window: env.API_RATE_LIMIT_JWT_WINDOW,
-          tokens: env.API_RATE_LIMIT_JWT_TOKENS,
-        },
-      };
-    }
-
-    return {
-      config: authenticatedEnv.environment.organization.apiRateLimiterConfig,
-      // Public keys are browser-distributed, so keep them on per-key buckets.
-      identifier: authenticatedEnv.type === "PRIVATE" ? authenticatedEnv.environment.id : undefined,
-    };
-  },
+  limiterConfigOverride: resolveApiRateLimitOverride,
   pathMatchers: [/^\/api/],
   // Allow /api/v1/tasks/:id/callback/:secret
   pathWhiteList: [

apps/webapp/app/services/dashboardAgentChatRetention.server.ts

@@ -0,0 +1,74 @@
+/**
+ * Retention for soft-deleted chats. A deleted chat is kept for a grace window and then
+ * hard-deleted with all its child rows; one bounded statement per run, oldest first.
+ * Also the eventual purge behind organization deletion, which soft-deletes the org's
+ * chats so this same sweep removes them.
+ */
+
+import {
+  hardDeleteChatsSoftDeletedBefore,
+  softDeleteChatsForOrganization,
+} from "@internal/dashboard-agent-db";
+import { dashboardAgentDb } from "~/services/dashboardAgentDb.server";
+import { logger } from "~/services/logger.server";
+
+/**
+ * How long a soft-deleted chat is kept before it and its children are hard-deleted.
+ * Long enough that an accidental delete can still be investigated; org deletion soft-
+ * deletes the org's chats, so those are removed the same way once the window passes.
+ */
+export const CHAT_SOFT_DELETE_RETENTION_MS = 30 * 24 * 60 * 60 * 1000;
+
+/** Per-run cap. Retention is one bounded statement, not a row-at-a-time loop. */
+const RETENTION_BATCH_LIMIT = 500;
+
+export type ChatRetentionResult = {
+  /** Soft-deleted chats past the retention window dropped this run. */
+  purged: number;
+  failed: number;
+};
+
+export type ChatRetentionDeps = {
+  now?: () => Date;
+  limit?: number;
+  /** Hard-delete chats soft-deleted before `before`. Returns how many went. */
+  purge?: (params: { before: Date; limit: number }) => Promise<number>;
+};
+
+export async function sweepDashboardAgentSoftDeletedChats(
+  deps: ChatRetentionDeps = {}
+): Promise<ChatRetentionResult> {
+  const now = deps.now?.() ?? new Date();
+  const limit = deps.limit ?? RETENTION_BATCH_LIMIT;
+  const purge =
+    deps.purge ?? ((params) => hardDeleteChatsSoftDeletedBefore(dashboardAgentDb, params));
+
+  const result: ChatRetentionResult = { purged: 0, failed: 0 };
+
+  try {
+    result.purged = await purge({
+      before: new Date(now.getTime() - CHAT_SOFT_DELETE_RETENTION_MS),
+      limit,
+    });
+  } catch (error) {
+    result.failed++;
+    logger.error("Dashboard agent chat retention failed", { error });
+  }
+
+  if (result.failed > 0) {
+    throw new Error("The dashboard agent chat retention pass failed");
+  }
+
+  return result;
+}
+
+/**
+ * Soft-delete every chat belonging to a deleted organization. The retention sweep above
+ * hard-deletes them once the window passes, so the org-deletion request never runs a
+ * cross-database hard delete.
+ */
+export async function purgeDashboardAgentChatsForOrganization(params: {
+  organizationId: string;
+}): Promise<number> {
+  return softDeleteChatsForOrganization(dashboardAgentDb, params);
+}

apps/webapp/app/services/deleteOrganization.server.ts

@@ -5,6 +5,7 @@ import { featuresForRequest } from "~/features.server";
 import { DeleteProjectService } from "./deleteProject.server";
 import { getCurrentPlan } from "./platform.v3.server";
 import { controlPlaneResolver } from "~/v3/runOpsMigration/controlPlaneResolver.server";
+import { commonWorker } from "~/v3/commonWorker.server";
 
 export class DeleteOrganizationService {
   #prismaClient: PrismaClient;
@@ -86,5 +87,13 @@ export class DeleteOrganizationService {
 
     // runsEnabled + the org's projects (project.deletedAt) changed; drop all cached env rows.
     controlPlaneResolver.invalidateOrganization(organization.id);
+
+    // Soft-delete the org's dashboard agent chats; retention purges them later. Enqueued,
+    // not inline: the agent store is a separate database in cloud.
+    await commonWorker.enqueue({
+      id: `dashboardAgent.purgeOrganization:${organization.id}`,
+      job: "dashboardAgent.purgeOrganization",
+      payload: { organizationId: organization.id },
+    });
   }
 }

apps/webapp/app/services/personalAccessToken.server.ts

@@ -6,7 +6,7 @@ import { logger } from "./logger.server";
 import { rbac } from "./rbac.server";
 import { decryptToken, encryptToken, hashToken } from "~/utils/tokens.server";
 import { env } from "~/env.server";
-import { isUserActorToken, type UserActorClaims } from "@trigger.dev/rbac";
+import { isUserActorToken, verifyUserActorToken, type UserActorClaims } from "@trigger.dev/rbac";
 
 const tokenValueLength = 40;
 //lowercase only, removed 0 and l to avoid confusion
@@ -290,6 +290,41 @@ export function isPersonalAccessToken(token: string) {
   return token.startsWith(tokenPrefix);
 }
 
+/**
+ * A user-actor token minted from a PAT carries the source PAT's id (`claims.pat`).
+ * The token is stateless, so revoking the PAT can't invalidate it by itself — hosts
+ * recheck the source PAT is still live here. A token with no `pat` (e.g. the dashboard
+ * agent's) has no source to check and is left alone.
+ */
+export async function assertSourcePatActive(claims: UserActorClaims): Promise<boolean> {
+  if (!claims.pat) return true;
+
+  const found = await prisma.personalAccessToken.findFirst({
+    where: { id: claims.pat, revokedAt: null },
+    select: { id: true },
+  });
+  return Boolean(found);
+}
+
+/**
+ * Resolve + source-PAT-recheck a user-actor token for a verify site where `claims` may be
+ * supplied by the RBAC plugin (the apiBuilder path). We re-verify the bearer locally so the
+ * recheck reads the token's OWN `pat`, not the plugin's: a plugin image predating the `pat`
+ * claim would deliver pat-less claims and silently no-op revocation here. Returns the claims
+ * to act on, or undefined to deny. The direct verify sites (jwt exchange, the UAT preamble)
+ * don't go through a plugin and call `assertSourcePatActive` on their own verified claims.
+ */
+export async function resolveAndRecheckUserActorClaims(
+  claims: UserActorClaims | undefined,
+  bearer: string
+): Promise<UserActorClaims | undefined> {
+  const verified = await verifyUserActorToken(env.SESSION_SECRET, bearer);
+  const resolved = claims ?? verified;
+  if (!resolved) return undefined;
+  // Recheck against the locally-verified claims when available, so `pat` is authoritative.
+  return (await assertSourcePatActive(verified ?? resolved)) ? resolved : undefined;
+}
+
 /**
  * Read-only check that an authorization code is still mintable: it exists, is
  * unconsumed (`personalAccessTokenId: null`), and within the TTL. Lets the