fix(webapp): mint the agent's token for the caller's own environment, or not at all

Author: kathiekiwi

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.in.$.ts

@@ -9,6 +9,7 @@ import {
 } from "~/components/dashboard-agent/message-limits";
 import { $replica } from "~/db.server";
 import { findProjectBySlug } from "~/models/project.server";
+import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
 import {
   dashboardAgentApiOrigin,
   dashboardAgentEnvironmentName,
@@ -69,12 +70,11 @@ export async function action({ request, params }: ActionFunctionArgs) {
   const url = new URL(request.url);
   const upstreamUrl = `${apiOrigin.replace(/\/$/, "")}/${upstreamPath}${url.search}`;
 
-  // Resolve the dashboard env slug to the canonical API env name its tools use.
-  const runtimeEnv = await $replica.runtimeEnvironment.findFirst({
-    where: { projectId: project.id, slug: envParam },
-    select: { id: true, type: true },
-  });
-  const environmentName = dashboardAgentEnvironmentName(runtimeEnv?.type);
+  // Membership-scoped: `(projectId, slug)` is not unique because every developer has their own
+  // dev row, and a token must never be minted for someone else's environment — or for none.
+  const runtimeEnv = await findEnvironmentBySlug(project.id, envParam, user.id);
+  if (!runtimeEnv) return json({ error: "Environment not found" }, { status: 404 });
+  const environmentName = dashboardAgentEnvironmentName(runtimeEnv.type);
 
   // Null without a connected GitHub repo, and the agent stays in assistant mode.
   const repoSnapshot = await resolveDashboardAgentRepoSnapshot(project.id);
@@ -106,13 +106,17 @@ export async function action({ request, params }: ActionFunctionArgs) {
       parsed.payload.metadata = {
         ...(parsed.payload.metadata ?? {}),
         userActorToken: await mintDashboardAgentUserActorToken(user.id, {
-          environmentId: runtimeEnv?.id,
+          environmentId: runtimeEnv.id,
         }),
         apiOrigin,
         projectRef: project.externalRef,
+        // Server-owned: the browser sends these too, and the eval opt-out and every tenancy
+        // check key on them, so the client's copy must never win.
+        organizationId: project.organizationId,
+        userId: user.id,
         // `(projectId, slug)` isn't unique (dev is per-member), so anything addressing
         // one environment row uses this id. `environmentName` is for name-addressed tools.
-        environmentId: runtimeEnv?.id,
+        environmentId: runtimeEnv.id,
         environmentName,
         ...(repoSnapshot ? { repoSnapshot } : {}),
       };

apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dashboard-agent.ts

@@ -294,11 +294,11 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
         ...(clientData ? { metadata: { context: clientData } } : {}),
       });
 
-      const runtimeEnv = await $replica.runtimeEnvironment.findFirst({
-        where: { projectId: project.id, slug: envParam },
-        select: { id: true, type: true },
-      });
-      const environmentName = runtimeEnv ? ENV_NAME_BY_TYPE[runtimeEnv.type] : undefined;
+      // Membership-scoped: dev rows are per-developer, so a token must never be minted for
+      // someone else's environment — or, when nothing resolves, for no environment at all.
+      const runtimeEnv = await findEnvironmentBySlug(project.id, envParam, userId);
+      if (!runtimeEnv) return json({ error: "Environment not found" }, { status: 404 });
+      const environmentName = ENV_NAME_BY_TYPE[runtimeEnv.type];
       const repoSnapshot = await resolveDashboardAgentRepoSnapshot(project.id);
 
       const headStarted = Boolean(env.ANTHROPIC_API_KEY);
@@ -313,12 +313,16 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
             // per-turn clientData must accompany the injected auth and context fields.
             ...(clientData ?? {}),
             userActorToken: await mintDashboardAgentUserActorToken(userId, {
-              environmentId: runtimeEnv?.id,
+              environmentId: runtimeEnv.id,
             }),
             apiOrigin: dashboardAgentApiOrigin(),
             projectRef: project.externalRef,
+            // Server-owned, like the `in` proxy: the eval opt-out and every tenancy check
+            // key on these, so a client-sent copy must not win.
+            organizationId: project.organizationId,
+            userId,
             // Same environment identity the `in` proxy injects.
-            environmentId: runtimeEnv?.id,
+            environmentId: runtimeEnv.id,
             environmentName,
             ...(repoSnapshot ? { repoSnapshot } : {}),
           },

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -4,18 +4,30 @@ import { type UserActorClaims } from "@trigger.dev/rbac";
 /** The code returned when a token's environment scope doesn't cover the requested environment. */
 export const FORBIDDEN_ENVIRONMENT_CODE = "forbidden_environment";
 
+/** The agent always mints per-environment, so a claimless token of its own is a bug, not a flow. */
+const DASHBOARD_AGENT_CLIENT = "dashboard-agent";
+
 /**
  * A user-actor token is signed for one environment. Honouring it against another environment
  * would break that signed scope, widening a leaked token to every environment its user can reach.
  *
- * Throws a 403 Response on mismatch. A caller with no `environmentId` claim (a PAT, an org token,
- * or an environment-agnostic UAT flow) is unaffected.
+ * Throws a 403 Response on mismatch. A PAT, an org token or an environment-agnostic UAT flow
+ * (the public PAT exchange, used by MCP and the CLI) carries no claim and is unaffected — but a
+ * dashboard-agent token without one is refused, so a mint that failed to resolve an environment
+ * cannot produce a token that passes every gate.
  */
 export function assertUserActorEnvironment(
   userActor: UserActorClaims | undefined,
   environmentId: string
 ): void {
-  if (!userActor?.environmentId) return;
+  if (!userActor) return;
+  if (!userActor.environmentId) {
+    if (userActor.client !== DASHBOARD_AGENT_CLIENT) return;
+    throw json(
+      { error: "This token isn't scoped to an environment.", code: FORBIDDEN_ENVIRONMENT_CODE },
+      { status: 403 }
+    );
+  }
   if (userActor.environmentId === environmentId) return;
 
   throw json(

apps/webapp/test/uatEnvironmentClaim.test.ts

@@ -116,10 +116,10 @@ const ENV_A = environment("env_aaaa", "prod", "PRODUCTION");
 const ENV_B = environment("env_bbbb", "stg", "STAGING");
 const ENVIRONMENTS = [ENV_A, ENV_B];
 
-function mintToken(opts: { environmentId?: string } = {}) {
+function mintToken(opts: { environmentId?: string; client?: string } = {}) {
   return signUserActorToken(SESSION_SECRET, {
     userId: USER_ID,
-    client: "dashboard-agent",
+    client: opts.client ?? "dashboard-agent",
     ...(opts.environmentId ? { environmentId: opts.environmentId } : {}),
     cap: ["read:apiKeys", "read:runs", "read:deployments"],
   });
@@ -251,11 +251,21 @@ describe("user-actor token environment scope", () => {
       expect(response.status).toBe(200);
     });
 
-    it("allows an environment-agnostic token (no claim)", async () => {
+    it("refuses an agent token that carries no environment claim", async () => {
+      // A mint that couldn't resolve an environment must not produce a token that passes
+      // every gate, so a claimless agent token is a bug rather than a flow.
       const token = await mintToken();
 
       const response = await call(token, "staging");
 
+      expect(response.status).toBe(403);
+    });
+
+    it("allows an environment-agnostic token from another client", async () => {
+      const token = await mintToken({ client: "personal-access-token" });
+
+      const response = await call(token, "staging");
+
       expect(response.status).toBe(200);
     });
   });