Merge branch 'feat/dashboard-agent-flows' into feat/dashboard-agent-ui

Author: kathiekiwi

apps/webapp/app/routes/api.v1.orgs.ts

@@ -11,38 +11,43 @@ import {
 import { extractDomain, faviconUrl } from "~/utils/favicon";
 
 // Identity-only: lists the caller's own orgs, so no authorization gate.
-export const loader = createLoaderPATApiRoute({}, async ({ authentication }) => {
-  const orgs = await prisma.organization.findMany({
-    where: {
-      deletedAt: null,
-      members: {
-        some: {
-          userId: authentication.userId,
+export const loader = createLoaderPATApiRoute(
+  { identityOnly: true },
+  async ({ authentication }) => {
+    const orgs = await prisma.organization.findMany({
+      where: {
+        deletedAt: null,
+        members: {
+          some: {
+            userId: authentication.userId,
+          },
         },
       },
-    },
-  });
+    });
 
-  if (!orgs) {
-    return json({ error: "Orgs not found" }, { status: 404 });
-  }
+    if (!orgs) {
+      return json({ error: "Orgs not found" }, { status: 404 });
+    }
 
-  const result: GetOrgsResponseBody = orgs.map((org) => ({
-    id: org.id,
-    title: org.title,
-    slug: org.slug,
-    createdAt: org.createdAt,
-  }));
+    const result: GetOrgsResponseBody = orgs.map((org) => ({
+      id: org.id,
+      title: org.title,
+      slug: org.slug,
+      createdAt: org.createdAt,
+    }));
 
-  return json(result);
-});
+    return json(result);
+  }
+);
 
-// No org exists yet, so no authorization gate; any authenticated user can
-// create an org and becomes its ADMIN.
+// No org exists yet, so there is nothing to scope the gate to; any authenticated user can create
+// an org and becomes its ADMIN. The gate is still declared so a narrowly-capped delegated token
+// (which cannot `manage`) is refused rather than inheriting its user's full reach.
 export const action = createActionPATApiRoute(
   {
     method: "POST",
     body: CreateOrgRequestBody,
+    authorization: { action: "manage", resource: () => ({ type: "organization" }) },
   },
   async ({ body, authentication }) => {
     if (env.ORG_CREATION_API_ENABLED !== "1") {

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.runs.$runId.commit.ts

@@ -6,6 +6,7 @@ import {
   type AuthenticatedEnvironment,
 } from "~/services/apiAuth.server";
 import { resolveRunCommit } from "~/services/dashboardAgent.server";
+import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
 import { logger } from "~/services/logger.server";
 import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server";
 
@@ -51,6 +52,18 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
       triggerBranch
     );
 
+    // The answer is a deployment's git metadata, so it's gated like the deployments list.
+    const denied = await authorizePatEnvironmentAccess({
+      request,
+      authType: authentication.authenticationResult.type,
+      organizationId: runtimeEnv.organizationId,
+      projectId: runtimeEnv.project.id,
+      envType: runtimeEnv.type,
+      resource: "deployments",
+      action: "read",
+    });
+    if (denied) return denied;
+
     const commit = await resolveRunCommit(runtimeEnv.id, runId);
     if (!commit) {
       return json(

apps/webapp/app/routes/api.v1.projects.ts

@@ -4,44 +4,47 @@ import { prisma } from "~/db.server";
 import { createLoaderPATApiRoute } from "~/services/routeBuilders/apiBuilder.server";
 
 // Identity-only: lists projects across the caller's orgs, so no authorization gate.
-export const loader = createLoaderPATApiRoute({}, async ({ authentication }) => {
-  const projects = await prisma.project.findMany({
-    where: {
-      organization: {
-        deletedAt: null,
-        members: {
-          some: {
-            userId: authentication.userId,
+export const loader = createLoaderPATApiRoute(
+  { identityOnly: true },
+  async ({ authentication }) => {
+    const projects = await prisma.project.findMany({
+      where: {
+        organization: {
+          deletedAt: null,
+          members: {
+            some: {
+              userId: authentication.userId,
+            },
           },
         },
+        version: "V3",
+        deletedAt: null,
+      },
+      include: {
+        organization: true,
+        defaultWorkerGroup: { select: { name: true } },
       },
-      version: "V3",
-      deletedAt: null,
-    },
-    include: {
-      organization: true,
-      defaultWorkerGroup: { select: { name: true } },
-    },
-  });
+    });
 
-  if (!projects) {
-    return json({ error: "Projects not found" }, { status: 404 });
-  }
+    if (!projects) {
+      return json({ error: "Projects not found" }, { status: 404 });
+    }
 
-  const result: GetProjectsResponseBody = projects.map((project) => ({
-    id: project.id,
-    externalRef: project.externalRef,
-    name: project.name,
-    slug: project.slug,
-    createdAt: project.createdAt,
-    defaultRegion: project.defaultWorkerGroup?.name ?? null,
-    organization: {
-      id: project.organization.id,
-      title: project.organization.title,
-      slug: project.organization.slug,
-      createdAt: project.organization.createdAt,
-    },
-  }));
+    const result: GetProjectsResponseBody = projects.map((project) => ({
+      id: project.id,
+      externalRef: project.externalRef,
+      name: project.name,
+      slug: project.slug,
+      createdAt: project.createdAt,
+      defaultRegion: project.defaultWorkerGroup?.name ?? null,
+      organization: {
+        id: project.organization.id,
+        title: project.organization.title,
+        slug: project.organization.slug,
+        createdAt: project.organization.createdAt,
+      },
+    }));
 
-  return json(result);
-});
+    return json(result);
+  }
+);

apps/webapp/app/services/environmentVariableApiAccess.server.ts

@@ -9,7 +9,7 @@ import {
 } from "~/services/apiAuth.server";
 import { rbac } from "~/services/rbac.server";
 
-type EnvironmentScopedResource = "envvars" | "apiKeys";
+type EnvironmentScopedResource = "envvars" | "apiKeys" | "deployments";
 
 type EnvironmentScopedAuthentication =
   | { ok: true; authentication: AuthenticationResult }
@@ -78,6 +78,7 @@ export function authenticateEnvVarApiRequest(
 const RESOURCE_LABELS: Record<EnvironmentScopedResource, string> = {
   envvars: "environment variables",
   apiKeys: "API keys",
+  deployments: "deployments",
 };
 
 /**

apps/webapp/app/services/routeBuilders/apiBuilder.server.ts

@@ -500,6 +500,10 @@ type PATRouteBuilderOptions<
       : undefined,
     request: Request
   ) => PATRouteContext | Promise<PATRouteContext>;
+  // Opts a contextless route into being reachable by an environment-scoped user-actor token.
+  // Only for routes whose answer is the caller's own identity (their orgs, their projects) and
+  // which mutate nothing — otherwise such a token is refused for want of anything to check.
+  identityOnly?: true;
   authorization?: {
     action: string;
     resource: (
@@ -555,6 +559,7 @@ export function createLoaderPATApiRoute<
       headers: headersSchema,
       corsStrategy = "none",
       context: contextFn,
+      identityOnly,
       authorization,
     } = options;
 
@@ -658,7 +663,7 @@ export function createLoaderPATApiRoute<
             corsStrategy !== "none"
           );
         }
-        await assertUserActorScope(claims, ctx);
+        await assertUserActorScope(claims, ctx, { identityOnly });
         authenticationResult = { userId: uatAuth.userId, userActor: claims };
         ability = uatAuth.ability;
       } else {
@@ -798,6 +803,7 @@ export function createActionPATApiRoute<
       body: bodySchema,
       corsStrategy = "none",
       context: contextFn,
+      identityOnly,
       authorization,
       method,
     } = options;
@@ -930,7 +936,7 @@ export function createActionPATApiRoute<
             corsStrategy !== "none"
           );
         }
-        await assertUserActorScope(claims, ctx);
+        await assertUserActorScope(claims, ctx, { identityOnly });
         authenticationResult = { userId: uatAuth.userId, userActor: claims };
         ability = uatAuth.ability;
       } else {

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -3,9 +3,10 @@
  * MCP and the CLI may use their existing ones. Both normalize into the same authorized
  * capability context, so every route calls in here rather than deriving the rule itself.
  *
- * The rule: a token signed for one environment may only act inside it. Anything with no claim
- * is environment-agnostic and unaffected — except a dashboard-agent token, which always carries
- * one, so its absence is a failed mint rather than a flow. Mismatches throw a 403 Response.
+ * The rule: a token signed for one environment may only act inside it. A route that names nothing
+ * to check the claim against is refused too, unless it declares itself identity-only. Anything
+ * with no claim is environment-agnostic and unaffected — except a dashboard-agent token, which
+ * always carries one, so its absence is a failed mint rather than a flow. Mismatches throw 403.
  */
 
 import { json } from "@remix-run/server-runtime";
@@ -33,7 +34,8 @@ export function assertUserActorEnvironment(
 /** The same check for a route that names an org/project rather than one environment. */
 export async function assertUserActorScope(
   userActor: UserActorClaims | undefined,
-  scope: { organizationId?: string; projectId?: string; environmentId?: string }
+  scope: { organizationId?: string; projectId?: string; environmentId?: string },
+  route?: { identityOnly?: boolean }
 ): Promise<void> {
   if (!userActor) return;
 
@@ -47,7 +49,12 @@ export async function assertUserActorScope(
     return;
   }
 
-  if (!scope.organizationId && !scope.projectId) return;
+  // A route that names nothing offers no way to honour the claim, so it isn't reachable unless it
+  // has declared itself identity-only.
+  if (!scope.organizationId && !scope.projectId) {
+    if (route?.identityOnly) return;
+    throw forbiddenEnvironment("This token is scoped to an environment this route doesn't name.");
+  }
 
   const environment = await $replica.runtimeEnvironment.findFirst({
     where: { id: userActor.environmentId },