refactor(webapp): extract shared dashboard authorization foundation

Extract shared dashboard authorization helpers for resolving tenant and
environment scope before feature-specific permission checks. Existing
route behavior remains unchanged until callers adopt them.

Mono-RevId: 981f4694a2ab54f1c39867449704c317efc91b29

Author: d-cs

apps/webapp/app/v3/services/dashboardEnvironmentAccess.server.ts

@@ -0,0 +1,31 @@
+import type { PrismaClientOrTransaction } from "@trigger.dev/database";
+import type { HostRbacController } from "@trigger.dev/rbac";
+import { throwPermissionDenied } from "~/utils/permissionDenied";
+
+/** Resolve tenancy on the writer before asking the optional plugin for an ability. */
+export async function dashboardEnvironmentAccess(
+  database: PrismaClientOrTransaction,
+  controller: Pick<HostRbacController, "authenticateSession">,
+  request: Request,
+  userId: string,
+  environmentId: string
+) {
+  const environment = await database.runtimeEnvironment.findFirst({
+    where: {
+      id: environmentId,
+      archivedAt: null,
+      project: { deletedAt: null },
+      organization: { deletedAt: null, members: { some: { userId } } },
+    },
+    select: { id: true, type: true, projectId: true, organizationId: true },
+  });
+  if (!environment) throw new Response("Environment not found", { status: 404 });
+
+  const auth = await controller.authenticateSession(request, {
+    userId,
+    organizationId: environment.organizationId,
+    projectId: environment.projectId,
+  });
+  if (!auth.ok) throwPermissionDenied();
+  return { environment, ability: auth.ability };
+}

apps/webapp/app/v3/services/dashboardEnvironmentAccess.test.ts

@@ -0,0 +1,105 @@
+import { postgresTest } from "@internal/testcontainers";
+import rbac from "@trigger.dev/rbac";
+import { expect } from "vitest";
+import { dashboardEnvironmentAccess } from "./dashboardEnvironmentAccess.server";
+
+postgresTest(
+  "the writer resolves the actual tenant and tier; self-hosted members retain permissive abilities",
+  async ({ prisma }) => {
+    const member = await prisma.user.create({
+      data: {
+        email: "runtime-member@example.test",
+        authenticationMethod: "MAGIC_LINK",
+        admin: false,
+      },
+    });
+    const outsider = await prisma.user.create({
+      data: { email: "runtime-outsider@example.test", authenticationMethod: "MAGIC_LINK" },
+    });
+    const organization = await prisma.organization.create({
+      data: {
+        slug: "runtime-auth",
+        title: "Runtime auth",
+        members: { create: { userId: member.id, role: "MEMBER" } },
+      },
+    });
+    const project = await prisma.project.create({
+      data: {
+        slug: "runtime-auth",
+        name: "Runtime auth",
+        externalRef: "runtime-auth",
+        organizationId: organization.id,
+      },
+    });
+    const controller = rbac.create(prisma, { forceFallback: true });
+    const request = new Request("https://example.test/orgs/wrong/projects/wrong/env/dev");
+
+    for (const type of ["DEVELOPMENT", "STAGING", "PREVIEW", "PRODUCTION"] as const) {
+      const environment = await prisma.runtimeEnvironment.create({
+        data: {
+          slug: type,
+          type,
+          shortcode: type,
+          apiKey: `key_${type}`,
+          pkApiKey: `pk_${type}`,
+          projectId: project.id,
+          organizationId: organization.id,
+        },
+      });
+      const access = await dashboardEnvironmentAccess(
+        prisma,
+        controller,
+        request,
+        member.id,
+        environment.id
+      );
+      expect(access.environment).toEqual({
+        id: environment.id,
+        type,
+        organizationId: organization.id,
+        projectId: project.id,
+      });
+      expect(access.ability.can("write", { type: "tasks", envType: type })).toBe(true);
+      await expect(
+        dashboardEnvironmentAccess(prisma, controller, request, outsider.id, environment.id)
+      ).rejects.toMatchObject({ status: 404 });
+      await expect(
+        dashboardEnvironmentAccess(prisma, controller, request, "", environment.id)
+      ).rejects.toMatchObject({ status: 404 });
+      // Each inactive ancestor must independently reject an otherwise valid member.
+      for (const inactiveTarget of ["environment", "project", "organization"] as const) {
+        if (inactiveTarget === "environment") {
+          await prisma.runtimeEnvironment.update({
+            where: { id: environment.id },
+            data: { archivedAt: new Date() },
+          });
+        } else if (inactiveTarget === "project") {
+          await prisma.project.update({
+            where: { id: project.id },
+            data: { deletedAt: new Date() },
+          });
+        } else {
+          await prisma.organization.update({
+            where: { id: organization.id },
+            data: { deletedAt: new Date() },
+          });
+        }
+        await expect(
+          dashboardEnvironmentAccess(prisma, controller, request, member.id, environment.id)
+        ).rejects.toMatchObject({ status: 404 });
+        await prisma.runtimeEnvironment.update({
+          where: { id: environment.id },
+          data: { archivedAt: null },
+        });
+        await prisma.project.update({ where: { id: project.id }, data: { deletedAt: null } });
+        await prisma.organization.update({
+          where: { id: organization.id },
+          data: { deletedAt: null },
+        });
+      }
+    }
+    await expect(
+      dashboardEnvironmentAccess(prisma, controller, request, member.id, "missing")
+    ).rejects.toMatchObject({ status: 404 });
+  }
+);

apps/webapp/app/v3/services/dashboardResourceAccess.server.ts

@@ -0,0 +1,73 @@
+import { type PrismaClientOrTransaction, RuntimeEnvironmentType } from "@trigger.dev/database";
+import type { HostRbacController } from "@trigger.dev/rbac";
+import { throwPermissionDenied } from "~/utils/permissionDenied";
+
+export async function dashboardResourceAccess(
+  database: PrismaClientOrTransaction,
+  controller: Pick<HostRbacController, "authenticateSession">,
+  request: Request,
+  userId: string,
+  scope: { organizationId: string; projectId?: string; environmentId?: string }
+) {
+  const organization = await database.organization.findFirst({
+    where: { id: scope.organizationId, deletedAt: null, members: { some: { userId } } },
+    select: { id: true },
+  });
+  if (!organization) throw new Response("Organization not found", { status: 404 });
+  // Both lookups depend only on the validated organization and supplied scope.
+  const [project, environment] = await Promise.all([
+    scope.projectId
+      ? database.project.findFirst({
+          where: { id: scope.projectId, organizationId: organization.id, deletedAt: null },
+          select: { id: true },
+        })
+      : undefined,
+    scope.environmentId
+      ? database.runtimeEnvironment.findFirst({
+          where: {
+            id: scope.environmentId,
+            organizationId: organization.id,
+            projectId: scope.projectId,
+            archivedAt: null,
+            project: { deletedAt: null },
+          },
+          select: { id: true, type: true, projectId: true },
+        })
+      : undefined,
+  ]);
+  if (scope.projectId && !project) throw new Response("Project not found", { status: 404 });
+  if (scope.environmentId && !environment)
+    throw new Response("Environment not found", { status: 404 });
+  const auth = await controller.authenticateSession(request, {
+    userId,
+    organizationId: organization.id,
+    projectId: environment?.projectId ?? scope.projectId,
+  });
+  if (!auth.ok) throwPermissionDenied();
+  const can = (action: string, type: string) =>
+    auth.ability.can(action, { type, ...(environment ? { envType: environment.type } : {}) });
+  const canAcrossEnvironments = (
+    action: string,
+    type: string,
+    environmentTypes: readonly RuntimeEnvironmentType[]
+  ) =>
+    (environmentTypes.length ? environmentTypes : Object.values(RuntimeEnvironmentType)).every(
+      (envType) => auth.ability.can(action, { type, envType })
+    );
+  return {
+    can,
+    canAcrossEnvironments,
+    requireAcrossEnvironments(
+      action: string,
+      type: string,
+      environmentTypes: readonly RuntimeEnvironmentType[]
+    ) {
+      if (!canAcrossEnvironments(action, type, environmentTypes))
+        throwPermissionDenied("You don't have permission in every affected environment.");
+    },
+    require(action: string, type: string) {
+      if (!can(action, type))
+        throwPermissionDenied("You don't have permission to perform this action.");
+    },
+  };
+}

apps/webapp/app/v3/services/dashboardResourceAccess.test.ts

@@ -0,0 +1,83 @@
+import { postgresTest } from "@internal/testcontainers";
+import rbac from "@trigger.dev/rbac";
+import { expect } from "vitest";
+import { dashboardResourceAccess } from "./dashboardResourceAccess.server";
+
+postgresTest(
+  "resource access resolves writer tenancy before permissive fallback",
+  async ({ prisma }) => {
+    const user = await prisma.user.create({
+      data: { email: "resource@example.test", authenticationMethod: "MAGIC_LINK" },
+    });
+    const org = await prisma.organization.create({
+      data: {
+        slug: "resource",
+        title: "Resource",
+        members: { create: { userId: user.id, role: "MEMBER" } },
+      },
+    });
+    const project = await prisma.project.create({
+      data: { slug: "resource", name: "Resource", externalRef: "resource", organizationId: org.id },
+    });
+    const environment = await prisma.runtimeEnvironment.create({
+      data: {
+        slug: "prod",
+        shortcode: "prod",
+        type: "PRODUCTION",
+        apiKey: "key",
+        pkApiKey: "pk",
+        projectId: project.id,
+        organizationId: org.id,
+      },
+    });
+    const controller = rbac.create(prisma, { forceFallback: true });
+    const request = new Request("https://example.test/env/dev");
+    const scope = { organizationId: org.id, projectId: project.id, environmentId: environment.id };
+    const access = await dashboardResourceAccess(prisma, controller, request, user.id, scope);
+    for (const subject of [
+      "webhooks",
+      "alerts",
+      "dashboards",
+      "errors",
+      "query",
+      "sessions",
+      "slack",
+      "privateConnections",
+      "dashboardAgent",
+    ]) {
+      expect(access.can("write", subject)).toBe(true);
+      expect(() => access.require("write", subject)).not.toThrow();
+    }
+    for (const invalid of [
+      { ...scope, organizationId: "foreign" },
+      { ...scope, projectId: "foreign" },
+      { ...scope, environmentId: "foreign" },
+    ]) {
+      await expect(
+        dashboardResourceAccess(prisma, controller, request, user.id, invalid)
+      ).rejects.toMatchObject({ status: 404 });
+    }
+    await expect(
+      dashboardResourceAccess(prisma, controller, request, "outsider", scope)
+    ).rejects.toMatchObject({ status: 404 });
+    // Environment-only scopes must enforce the owning project's lifecycle too.
+    const environmentScope = { organizationId: org.id, environmentId: environment.id };
+    await expect(
+      dashboardResourceAccess(prisma, controller, request, user.id, environmentScope)
+    ).resolves.toBeDefined();
+    await prisma.project.update({ where: { id: project.id }, data: { deletedAt: new Date() } });
+    for (const deletedProjectScope of [scope, environmentScope]) {
+      await expect(
+        dashboardResourceAccess(prisma, controller, request, user.id, deletedProjectScope)
+      ).rejects.toMatchObject({ status: 404 });
+    }
+    await prisma.project.update({ where: { id: project.id }, data: { deletedAt: null } });
+    await prisma.runtimeEnvironment.update({
+      where: { id: environment.id },
+      data: { archivedAt: new Date() },
+    });
+    await expect(
+      dashboardResourceAccess(prisma, controller, request, user.id, scope)
+    ).rejects.toMatchObject({ status: 404 });
+  }
+);