refactor(webapp): share scoped API key authentication

Author: carderne

apps/webapp/app/routes/api.v1.projects.$projectRef.branches.ts

@@ -3,11 +3,7 @@ import { tryCatch, UpsertBranchRequestBody } from "@trigger.dev/core/v3";
 import { DEFAULT_DEV_BRANCH, isDefaultDevBranch } from "@trigger.dev/core/v3/utils/gitBranch";
 import { z } from "zod";
 import { prisma } from "~/db.server";
-import {
-  authenticateApiKeyWithScope,
-  authenticateRequest,
-  type AuthenticationResult,
-} from "~/services/apiAuth.server";
+import { authenticateRequestWithScopedApiKey } from "~/services/apiAuth.server";
 import { logger } from "~/services/logger.server";
 import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
 import { UpsertBranchService } from "~/services/upsertBranch.server";
@@ -25,29 +21,19 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   logger.info("project upsert branch", { url: request.url });
 
-  const userOrOrganizationAuthentication = await authenticateRequest(request, {
+  const authentication = await authenticateRequestWithScopedApiKey(request, {
     personalAccessToken: true,
     organizationAccessToken: true,
-    apiKey: false,
-  });
-
-  let authenticationResult: AuthenticationResult;
-  if (userOrOrganizationAuthentication) {
-    authenticationResult = userOrOrganizationAuthentication;
-  } else {
-    const apiKeyAuthentication = await authenticateApiKeyWithScope(request, {
+    apiKey: {
       action: "write",
       resource: { type: "branches" },
       allowPreviewParent: true,
-    });
-    if (!apiKeyAuthentication.ok) {
-      return json({ error: apiKeyAuthentication.error }, { status: apiKeyAuthentication.status });
-    }
-    authenticationResult = {
-      type: "apiKey",
-      result: apiKeyAuthentication.authentication,
-    };
+    },
+  });
+  if (!authentication.ok) {
+    return json({ error: authentication.error }, { status: authentication.status });
   }
+  const authenticationResult = authentication.authentication;
 
   const apiKeyEnvironment =
     authenticationResult.type === "apiKey" && authenticationResult.result.ok

apps/webapp/app/services/apiAuth.server.ts

@@ -341,19 +341,16 @@ export async function authenticateApiKeyRequest(
  * Only apiKey credentials are accepted (no PAT / org token / public key). Use
  * this for routes previously guarded by a bare `authenticateApiRequest` call.
  */
+export type ApiKeyScopeAuthorization = {
+  action: string;
+  resource: RbacResource;
+  allowJWT?: boolean;
+  allowPreviewParent?: boolean;
+};
+
 export async function authenticateApiKeyWithScope(
   request: Request,
-  {
-    action,
-    resource,
-    allowJWT = false,
-    allowPreviewParent = false,
-  }: {
-    action: string;
-    resource: RbacResource;
-    allowJWT?: boolean;
-    allowPreviewParent?: boolean;
-  },
+  { action, resource, allowJWT = false, allowPreviewParent = false }: ApiKeyScopeAuthorization,
   authorizeBearer: typeof authenticateAuthorizeBearerWithTelemetry = authenticateAuthorizeBearerWithTelemetry
 ): Promise<
   | { ok: true; authentication: ApiAuthenticationResultSuccess }
@@ -385,6 +382,50 @@ export async function authenticateApiKeyWithScope(
   };
 }
 
+export type ScopedApiKeyAuthenticationDependencies = {
+  authenticateRequest: typeof authenticateRequest;
+  authenticateApiKeyWithScope: typeof authenticateApiKeyWithScope;
+};
+
+export async function authenticateRequestWithScopedApiKey(
+  request: Request,
+  {
+    personalAccessToken,
+    organizationAccessToken,
+    apiKey,
+  }: {
+    personalAccessToken: true;
+    organizationAccessToken: true;
+    apiKey: ApiKeyScopeAuthorization;
+  },
+  dependencies: ScopedApiKeyAuthenticationDependencies = {
+    authenticateRequest,
+    authenticateApiKeyWithScope,
+  }
+): Promise<
+  | { ok: true; authentication: AuthenticationResult }
+  | { ok: false; status: 401 | 403; error: string }
+> {
+  const userOrOrganizationAuthentication = await dependencies.authenticateRequest(request, {
+    personalAccessToken,
+    organizationAccessToken,
+    apiKey: false,
+  });
+  if (userOrOrganizationAuthentication) {
+    return { ok: true, authentication: userOrOrganizationAuthentication };
+  }
+
+  const apiKeyAuthentication = await dependencies.authenticateApiKeyWithScope(request, apiKey);
+  if (!apiKeyAuthentication.ok) {
+    return apiKeyAuthentication;
+  }
+
+  return {
+    ok: true,
+    authentication: { type: "apiKey", result: apiKeyAuthentication.authentication },
+  };
+}
+
 export async function authenticateAuthorizationHeader(
   authorization: string,
   {

apps/webapp/app/services/environmentVariableApiAccess.server.ts

@@ -4,9 +4,10 @@ import { isUserActorToken } from "@trigger.dev/rbac";
 import type { RbacAbility } from "@trigger.dev/rbac";
 import {
   authenticateApiKeyRequest,
-  authenticateApiKeyWithScope,
   authenticateRequest,
+  authenticateRequestWithScopedApiKey,
   type AuthenticationResult,
+  type ScopedApiKeyAuthenticationDependencies,
 } from "~/services/apiAuth.server";
 import { rbac } from "~/services/rbac.server";
 
@@ -40,10 +41,7 @@ export function apiKeyForProjectEnvironmentBootstrap(
  * Keep PAT/OAT authentication on the legacy path while routing machine API
  * keys through the RBAC controller, where plugin grants are applied.
  */
-type AuthenticationDependencies = {
-  authenticateRequest: typeof authenticateRequest;
-  authenticateApiKeyWithScope: typeof authenticateApiKeyWithScope;
-};
+type AuthenticationDependencies = ScopedApiKeyAuthenticationDependencies;
 
 type BootstrapAuthenticationDependencies = {
   authenticateRequest: typeof authenticateRequest;
@@ -54,29 +52,17 @@ export async function authenticateEnvironmentScopedApiRequest(
   request: Request,
   action: "read" | "write",
   resource: EnvironmentScopedResource,
-  dependencies: AuthenticationDependencies = { authenticateRequest, authenticateApiKeyWithScope }
+  dependencies?: AuthenticationDependencies
 ): Promise<EnvironmentScopedAuthentication> {
-  const userOrOrganizationAuthentication = await dependencies.authenticateRequest(request, {
-    personalAccessToken: true,
-    organizationAccessToken: true,
-    apiKey: false,
-  });
-  if (userOrOrganizationAuthentication) {
-    return { ok: true, authentication: userOrOrganizationAuthentication };
-  }
-
-  const apiKeyAuthentication = await dependencies.authenticateApiKeyWithScope(request, {
-    action,
-    resource: { type: resource },
-  });
-  if (!apiKeyAuthentication.ok) {
-    return apiKeyAuthentication;
-  }
-
-  return {
-    ok: true,
-    authentication: { type: "apiKey", result: apiKeyAuthentication.authentication },
-  };
+  return authenticateRequestWithScopedApiKey(
+    request,
+    {
+      personalAccessToken: true,
+      organizationAccessToken: true,
+      apiKey: { action, resource: { type: resource } },
+    },
+    dependencies
+  );
 }
 
 /**

apps/webapp/test/apiAuthScope.test.ts

@@ -1,5 +1,9 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { authenticateApiKeyRequest, authenticateApiKeyWithScope } from "~/services/apiAuth.server";
+import {
+  authenticateApiKeyRequest,
+  authenticateApiKeyWithScope,
+  authenticateRequestWithScopedApiKey,
+} from "~/services/apiAuth.server";
 
 const authorizeBearer = vi.fn();
 
@@ -151,3 +155,61 @@ describe("authenticateApiKeyWithScope", () => {
     expect(ability.can).not.toHaveBeenCalled();
   });
 });
+
+describe("authenticateRequestWithScopedApiKey", () => {
+  const options = {
+    personalAccessToken: true as const,
+    organizationAccessToken: true as const,
+    apiKey: {
+      action: "write",
+      resource: { type: "branches" },
+      allowPreviewParent: true,
+    },
+  };
+
+  it("keeps user and organization tokens on the legacy path", async () => {
+    const authentication = {
+      type: "personalAccessToken",
+      result: { userId: "user_123" },
+    } as const;
+    const authenticateRequest = vi.fn().mockResolvedValueOnce(authentication);
+    const authenticateApiKeyWithScope = vi.fn();
+
+    await expect(
+      authenticateRequestWithScopedApiKey(new Request("https://example.com"), options, {
+        authenticateRequest,
+        authenticateApiKeyWithScope,
+      })
+    ).resolves.toEqual({ ok: true, authentication });
+    expect(authenticateRequest).toHaveBeenCalledWith(expect.any(Request), {
+      personalAccessToken: true,
+      organizationAccessToken: true,
+      apiKey: false,
+    });
+    expect(authenticateApiKeyWithScope).not.toHaveBeenCalled();
+  });
+
+  it("uses scoped RBAC authentication for API keys", async () => {
+    const apiKeyAuthentication = {
+      ok: true,
+      apiKey: "tr_preview_sk_test",
+      type: "PRIVATE",
+      environment: {},
+    } as const;
+    const authenticateRequest = vi.fn().mockResolvedValueOnce(undefined);
+    const authenticateApiKeyWithScope = vi
+      .fn()
+      .mockResolvedValueOnce({ ok: true, authentication: apiKeyAuthentication });
+
+    await expect(
+      authenticateRequestWithScopedApiKey(new Request("https://example.com"), options, {
+        authenticateRequest,
+        authenticateApiKeyWithScope,
+      })
+    ).resolves.toEqual({
+      ok: true,
+      authentication: { type: "apiKey", result: apiKeyAuthentication },
+    });
+    expect(authenticateApiKeyWithScope).toHaveBeenCalledWith(expect.any(Request), options.apiKey);
+  });
+});