fix(webapp): instrument scoped API key authentication

Author: carderne

apps/webapp/app/services/apiAuth.server.ts

@@ -30,8 +30,10 @@ import {
 } from "./organizationAccessToken.server";
 import { isPublicJWT, validatePublicJwtKey } from "./realtime/jwtAuth.server";
 import { isDefaultDevBranch, sanitizeBranchName } from "@trigger.dev/core/v3/utils/gitBranch";
-import { rbac } from "./rbac.server";
-import { observeLegacyBearerAuthentication } from "~/services/authTelemetry.server";
+import {
+  authenticateAuthorizeBearerWithTelemetry,
+  observeLegacyBearerAuthentication,
+} from "~/services/authTelemetry.server";
 
 const ClaimsSchema = z.object({
   scopes: z.array(z.string()).optional(),
@@ -307,7 +309,7 @@ export async function authenticateApiKeyWithScope(
     return { ok: false, status: 401, error: "Invalid or Missing API key" };
   }
 
-  const result = await rbac.authenticateAuthorizeBearer(
+  const result = await authenticateAuthorizeBearerWithTelemetry(
     request,
     { action, resource },
     { allowJWT }

apps/webapp/app/services/authTelemetry.server.ts

@@ -5,6 +5,7 @@ import type {
   BearerCredentialKind,
   BearerLookupPath,
   HostBearerAuthResult,
+  RbacResource,
 } from "@trigger.dev/rbac";
 import { authFeatureControls } from "~/services/authFeatureControls.server";
 import { rbac } from "~/services/rbac.server";
@@ -75,6 +76,25 @@ export async function authenticateBearerWithTelemetry(
   }
 }
 
+export async function authenticateAuthorizeBearerWithTelemetry(
+  request: Request,
+  check: { action: string; resource: RbacResource },
+  options: { allowJWT: boolean }
+) {
+  // Keep authentication telemetry consistent with apiBuilder: a valid
+  // credential records a successful authentication even when the subsequent
+  // resource authorization fails. Authorization correctness is covered by the
+  // route tests rather than folded into the authentication-health metric.
+  const result = await authenticateBearerWithTelemetry(request, options);
+  if (!result.ok) return result;
+
+  if (!result.ability.can(check.action, check.resource)) {
+    return { ok: false as const, status: 403 as const, error: "Unauthorized" };
+  }
+
+  return result;
+}
+
 export async function observeLegacyBearerAuthentication<T extends { ok: boolean } | undefined>(
   request: Request,
   operation: () => Promise<T>

apps/webapp/test/apiAuthScope.test.ts

@@ -1,9 +1,21 @@
 import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const rbacMocks = vi.hoisted(() => ({
-  authenticateAuthorizeBearer: vi.fn<(...args: any[]) => Promise<any>>(),
+  authenticateBearer: vi.fn<(...args: any[]) => Promise<any>>(),
 }));
 
+const telemetryMocks = vi.hoisted(() => ({
+  attemptsAdd: vi.fn(),
+  durationRecord: vi.fn(),
+}));
+
+vi.mock("@internal/tracing", () => ({
+  getMeter: () => ({
+    createCounter: () => ({ add: telemetryMocks.attemptsAdd }),
+    createHistogram: () => ({ record: telemetryMocks.durationRecord }),
+    createObservableGauge: () => ({ addCallback: vi.fn() }),
+  }),
+}));
 vi.mock("~/services/rbac.server", () => ({ rbac: rbacMocks }));
 vi.mock("~/db.server", () => ({ prisma: {}, $replica: {} }));
 vi.mock("~/env.server", () => ({ env: { SESSION_SECRET: "test-session-secret" } }));
@@ -35,7 +47,9 @@ import { authenticateApiKeyWithScope } from "~/services/apiAuth.server";
 
 describe("authenticateApiKeyWithScope", () => {
   beforeEach(() => {
-    rbacMocks.authenticateAuthorizeBearer.mockReset();
+    rbacMocks.authenticateBearer.mockReset();
+    telemetryMocks.attemptsAdd.mockReset();
+    telemetryMocks.durationRecord.mockReset();
   });
 
   it("returns 401 without a bearer credential", async () => {
@@ -49,14 +63,14 @@ describe("authenticateApiKeyWithScope", () => {
       status: 401,
       error: "Invalid or Missing API key",
     });
-    expect(rbacMocks.authenticateAuthorizeBearer).not.toHaveBeenCalled();
+    expect(rbacMocks.authenticateBearer).not.toHaveBeenCalled();
   });
 
   it.each([
     { status: 401 as const, error: "Invalid API key" },
     { status: 403 as const, error: "Unauthorized" },
   ])("preserves controller $status failures", async (failure) => {
-    rbacMocks.authenticateAuthorizeBearer.mockResolvedValue({ ok: false, ...failure });
+    rbacMocks.authenticateBearer.mockResolvedValue({ ok: false, ...failure });
     const request = new Request("https://example.com", {
       headers: { Authorization: "Bearer tr_test_key" },
     });
@@ -72,11 +86,12 @@ describe("authenticateApiKeyWithScope", () => {
   it("bridges controller success into the legacy private authentication shape", async () => {
     const environment = { id: "env_123" };
     const ability = { can: vi.fn(() => true), canSuper: vi.fn(() => true) };
-    rbacMocks.authenticateAuthorizeBearer.mockResolvedValue({
+    rbacMocks.authenticateBearer.mockResolvedValue({
       ok: true,
       environment,
       ability,
       subject: { type: "apiKey", apiKeyId: "key_123" },
+      resolution: { credentialKind: "root_api_key", lookupPath: "root_current" },
     });
     const request = new Request("https://example.com", {
       headers: { Authorization: "Bearer tr_test_key", "x-trigger-branch": "feature/test" },
@@ -88,10 +103,22 @@ describe("authenticateApiKeyWithScope", () => {
       allowJWT: true,
     });
 
-    expect(rbacMocks.authenticateAuthorizeBearer).toHaveBeenCalledWith(
-      request,
-      { action: "read", resource: { type: "envvars" } },
-      { allowJWT: true }
+    expect(rbacMocks.authenticateBearer).toHaveBeenCalledWith(request, { allowJWT: true });
+    expect(ability.can).toHaveBeenCalledWith("read", { type: "envvars" });
+    expect(telemetryMocks.attemptsAdd).toHaveBeenCalledWith(1, {
+      resolver: "rbac",
+      credential_kind: "root_api_key",
+      result: "success",
+      lookup_path: "root_current",
+    });
+    expect(telemetryMocks.durationRecord).toHaveBeenCalledWith(
+      expect.any(Number),
+      expect.objectContaining({
+        resolver: "rbac",
+        credential_kind: "root_api_key",
+        result: "success",
+        lookup_path: "root_current",
+      })
     );
     expect(result).toEqual({
       ok: true,
@@ -104,4 +131,33 @@ describe("authenticateApiKeyWithScope", () => {
       },
     });
   });
+
+  it("records successful authentication before returning an authorization failure", async () => {
+    const ability = { can: vi.fn(() => false), canSuper: vi.fn(() => false) };
+    rbacMocks.authenticateBearer.mockResolvedValue({
+      ok: true,
+      environment: { id: "env_123" },
+      ability,
+      subject: { type: "apiKey", apiKeyId: "key_123" },
+      resolution: { credentialKind: "additional_api_key", lookupPath: "additional" },
+    });
+    const request = new Request("https://example.com", {
+      headers: { Authorization: "Bearer tr_prod_sk_0123456789abcdefghijklmn" },
+    });
+
+    await expect(
+      authenticateApiKeyWithScope(request, {
+        action: "write",
+        resource: { type: "deployments" },
+      })
+    ).resolves.toEqual({ ok: false, status: 403, error: "Unauthorized" });
+
+    expect(ability.can).toHaveBeenCalledWith("write", { type: "deployments" });
+    expect(telemetryMocks.attemptsAdd).toHaveBeenCalledWith(1, {
+      resolver: "rbac",
+      credential_kind: "additional_api_key",
+      result: "success",
+      lookup_path: "additional",
+    });
+  });
 });

apps/webapp/test/projectEnvironmentCredentialRoute.test.ts

@@ -85,6 +85,29 @@ describe("project environment credential response", () => {
     });
   });
 
+  it("does not exchange a grace-window root key for the current root key", async () => {
+    mocks.authenticateEnvironmentScopedApiRequest.mockResolvedValue({
+      ok: true,
+      authentication: {
+        type: "apiKey",
+        result: {
+          ok: true,
+          apiKey: "tr_prod_rotated_grace_key",
+          type: "PRIVATE",
+          environment,
+        },
+      },
+    });
+
+    const response = await load();
+
+    expect(response.status).toBe(200);
+    await expect(responseJson(response)).resolves.toMatchObject({
+      apiKey: "tr_prod_rotated_grace_key",
+      projectId: "proj_123",
+    });
+  });
+
   it("returns the root key to an authorized user token", async () => {
     mocks.authenticateEnvironmentScopedApiRequest.mockResolvedValue({
       ok: true,