revert(webapp): put the JWT exchange back to how main had it

The scope ceiling rewrite landed here and was reverted two PRs up, leaving the
stack asserting both directions. The exchange intersects requested scopes with the
token's cap again, a capless token passes through like a PAT, and the route keeps
only the environment claim check and the acting client.

Author: kathiekiwi

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.jwt.ts

@@ -1,18 +1,17 @@
 import { type ActionFunctionArgs, json } from "@remix-run/node";
 import { generateJWT as internal_generateJWT } from "@trigger.dev/core/v3";
+import { isUserActorToken, verifyUserActorToken, type UserActorClaims } from "@trigger.dev/rbac";
 import { z } from "zod";
 import {
   authenticatedEnvironmentForAuthentication,
+  authenticateRequest,
   branchNameFromRequest,
+  type AuthenticationResult,
 } from "~/services/apiAuth.server";
+import { env as appEnv } from "~/env.server";
+import { assertUserActorEnvironment } from "~/services/userActorEnvironment.server";
 import { logger } from "~/services/logger.server";
 import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
-import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server";
-import { rbac } from "~/services/rbac.server";
-import {
-  assertUserActorEnvironment,
-  clampUserActorScopes,
-} from "~/services/userActorEnvironment.server";
 
 const ParamsSchema = z.object({
   projectRef: z.string(),
@@ -30,17 +29,46 @@ const RequestBodySchema = z.object({
 
 export async function action({ request, params }: ActionFunctionArgs) {
   try {
-    // A user-actor token authenticates as its user, like a PAT. Its scope cap ceilings the
+    const bearer = request.headers
+      .get("Authorization")
+      ?.replace(/^Bearer /, "")
+      .trim();
+    const isUat = !!bearer && isUserActorToken(bearer);
+
+    // A delegated user-actor token authenticates as its user, like a PAT. We
+    // resolve it here (not through authenticateRequest) so the exchange stays
+    // scoped to this route — UATs deliberately aren't accepted on every
+    // PAT route. `uatCap` (the token's optional scope cap) ceilings the
     // minted env JWT below.
-    const authentication = await authenticateUatOrApiRequest(request);
+    let uatCap: string[] | undefined;
+    let userActorId: string | undefined;
+    let userActor: UserActorClaims | undefined;
+    let authenticationResult: AuthenticationResult | undefined;
+    if (isUat) {
+      const claims = await verifyUserActorToken(appEnv.SESSION_SECRET, bearer!);
+      if (!claims) {
+        return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
+      }
+      uatCap = claims.cap;
+      userActorId = claims.userId;
+      userActor = claims;
+      // The env lookup keys purely on the user, identical to a PAT.
+      authenticationResult = {
+        type: "personalAccessToken",
+        result: { userId: claims.userId },
+      };
+    } else {
+      authenticationResult = await authenticateRequest(request, {
+        personalAccessToken: true,
+        organizationAccessToken: true,
+        apiKey: false,
+      });
+    }
 
-    if (!authentication) {
+    if (!authenticationResult) {
       return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
     }
 
-    const { authenticationResult, userActor } = authentication;
-    const userActorId = userActor?.userId;
-
     const parsedParams = ParamsSchema.safeParse(params);
 
     if (!parsedParams.success) {
@@ -57,7 +85,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
       triggerBranch
     );
 
-    // The exchange only ever mints for the environment the token was signed for.
+    // A user-actor token signed for one environment mints only for that one.
     assertUserActorEnvironment(userActor, runtimeEnv.id);
 
     // This mints a JWT signed with the environment's secret key. For a PAT
@@ -83,32 +111,21 @@ export async function action({ request, params }: ActionFunctionArgs) {
       );
     }
 
-    // The env JWT carries scopes only — downstream auth builds its ability from them with no role
-    // context. So for a user-actor token the ceiling is the actor's own ability (role floor ∩ the
-    // token's cap), never the request: a delegated token can't mint a credential more capable than
-    // itself, and a capless token is read-only rather than unbounded. A PAT passes through, gated
-    // by the env-tier check above.
+    // The env JWT carries scopes only — downstream auth builds its ability
+    // from them with no role context. So for a user-actor token we ceiling
+    // the scopes by the token's own cap here (a read-only agent token can't
+    // widen its grant through the exchange) and stamp the user via `act` so
+    // the minted env JWT stays attributable. The cap is a ceiling, not a
+    // replacement: intersect what the caller asked for with the cap (or use
+    // the full cap if they asked for nothing). No cap → the request passes
+    // through, same as a PAT.
     const requestedScopes = parsedBody.data.claims?.scopes;
-    let scopes = requestedScopes;
-
-    if (userActor) {
-      const actorAuth = await rbac.authenticateUserActor(request, {
-        organizationId: runtimeEnv.organizationId,
-        projectId: runtimeEnv.project.id,
-      });
-      if (!actorAuth.ok) {
-        return json({ error: actorAuth.error }, { status: actorAuth.status });
-      }
-
-      const clamped = clampUserActorScopes(requestedScopes, userActor, actorAuth.ability);
-      if (clamped.scopes.length === 0) {
-        return json(
-          { error: "This token isn't allowed the requested scopes", scopes: clamped.deniedScopes },
-          { status: 403 }
-        );
-      }
-      scopes = clamped.scopes;
-    }
+    const scopes =
+      isUat && uatCap
+        ? requestedScopes && requestedScopes.length > 0
+          ? requestedScopes.filter((scope) => uatCap.includes(scope))
+          : uatCap
+        : requestedScopes;
 
     // Attribution: stamp the acting user on the minted env JWT. A UAT carries
     // its user as `userActorId`; a PAT exchange resolves the user from the
@@ -120,13 +137,14 @@ export async function action({ request, params }: ActionFunctionArgs) {
       (authenticationResult.type === "personalAccessToken"
         ? authenticationResult.result.userId
         : undefined);
-    const actorClient = userActor?.client ?? "personal-access-token";
 
     const claims = {
       sub: runtimeEnv.id,
       pub: true,
       ...(scopes ? { scopes } : {}),
-      ...(actorUserId ? { act: { sub: actorUserId, client: actorClient } } : {}),
+      ...(actorUserId
+        ? { act: { sub: actorUserId, client: userActor?.client ?? "personal-access-token" } }
+        : {}),
     };
 
     const jwt = await internal_generateJWT({

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -9,12 +9,7 @@
  */
 
 import { json } from "@remix-run/server-runtime";
-import {
-  buildJwtAbility,
-  type RbacAbility,
-  scopesWithinAbility,
-  type UserActorClaims,
-} from "@trigger.dev/rbac";
+import { type UserActorClaims } from "@trigger.dev/rbac";
 import { $replica } from "~/db.server";
 
 export const FORBIDDEN_ENVIRONMENT_CODE = "forbidden_environment";
@@ -114,33 +109,6 @@ export async function resolveUserActorEnvironmentScope(
   };
 }
 
-/** Mirrors the RBAC fallback's own default. */
-const CAPLESS_USER_ACTOR_SCOPES = ["read:all"];
-
-/**
- * A delegated token must never mint something more capable than itself. Two ceilings apply:
- * the actor's own ability (their role) and the token's `cap`. The role alone is not enough —
- * a read-only agent token belongs to a user who may well be allowed to write.
- */
-export function clampUserActorScopes(
-  requestedScopes: string[] | undefined,
-  userActor: UserActorClaims,
-  ability: RbacAbility
-): { scopes: string[]; deniedScopes: string[] } {
-  const cap = userActor.cap ?? CAPLESS_USER_ACTOR_SCOPES;
-  const requested = requestedScopes && requestedScopes.length > 0 ? requestedScopes : cap;
-
-  const denied = new Set([
-    ...scopesWithinAbility(requested, ability).deniedScopes,
-    ...scopesWithinAbility(requested, buildJwtAbility(cap)).deniedScopes,
-  ]);
-
-  return {
-    scopes: requested.filter((scope) => !denied.has(scope)),
-    deniedScopes: [...denied],
-  };
-}
-
 function assertClaimIsOptional(userActor: UserActorClaims): void {
   if (userActor.client !== DASHBOARD_AGENT_CLIENT) return;
   throw forbiddenEnvironment("This token isn't scoped to an environment.");

apps/webapp/test/dashboardAgentDelegatedScopeCeiling.test.ts

@@ -292,6 +292,59 @@ describe("user-actor token environment scope", () => {
   });
 });
 
+/**
+ * The exchange's own ceiling: a delegated token names the scopes it wants, and its `cap` is
+ * what it may have. Without the intersection a read-only agent token mints a write JWT
+ * whenever its user's role allows writes — the token travels in a task payload, so that is
+ * a real widening rather than a theoretical one.
+ */
+describe("env JWT exchange — the cap is a ceiling", () => {
+  beforeEach(() => {
+    mocks.can.mockReset();
+    mocks.can.mockReturnValue(true);
+  });
+
+  async function exchange(token: string, scopes?: string[]) {
+    const response = await respond(
+      () =>
+        jwtAction({
+          request: requestFor(token, `/api/v1/projects/${PROJECT.externalRef}/prod/jwt`, {
+            method: "POST",
+            body: JSON.stringify(scopes ? { claims: { scopes } } : {}),
+          }),
+          params: { projectRef: PROJECT.externalRef, env: "prod" },
+          context: {} as any,
+        }) as Promise<Response>
+    );
+    return response;
+  }
+
+  it("drops a scope the cap doesn't carry", async () => {
+    const token = await mintToken({ environmentId: ENV_A.id });
+
+    const response = await exchange(token, ["read:runs", "write:runs"]);
+
+    expect(response.status).toBe(200);
+    const { token: jwt } = (await response.json()) as { token: string };
+    const payload = JSON.parse(Buffer.from(jwt.split(".")[1]!, "base64url").toString()) as {
+      scopes?: string[];
+    };
+    expect(payload.scopes).toEqual(["read:runs"]);
+  });
+
+  it("falls back to the whole cap when the caller asks for nothing", async () => {
+    const token = await mintToken({ environmentId: ENV_A.id });
+
+    const response = await exchange(token);
+
+    const { token: jwt } = (await response.json()) as { token: string };
+    const payload = JSON.parse(Buffer.from(jwt.split(".")[1]!, "base64url").toString()) as {
+      scopes?: string[];
+    };
+    expect(payload.scopes).toEqual(["read:apiKeys", "read:runs", "read:deployments"]);
+  });
+});
+
 describe("repo snapshot authorization", () => {
   beforeEach(() => {
     mocks.can.mockReset();

apps/webapp/test/uatEnvironmentClaim.test.ts

@@ -1,8 +1,8 @@
 /**
  * Two seams a delegated user-actor token passes through outside the route builder:
  * the direct PAT authentication (which used to hand back identity only, dropping the
- * environment scope), and the environment JWT exchange (which used to mint whatever
- * scopes the caller asked for when the token declared no cap).
+ * environment scope), and the environment JWT exchange (which ceilings the minted
+ * scopes by the token's cap and only mints for the environment it was signed for).
  */
 
 import { postgresTest } from "@internal/testcontainers";
@@ -183,43 +183,6 @@ function payloadOf(jwt: string): any {
   return JSON.parse(Buffer.from(jwt.split(".")[1], "base64url").toString("utf8"));
 }
 
-postgresTest(
-  "the exchange never mints scopes a capless delegated token doesn't have",
-  async ({ prisma }) => {
-    ctx.prisma = prisma;
-    const seeded = await seedProject(prisma);
-
-    const denied = await exchange({
-      projectRef: seeded.project.externalRef,
-      env: "prod",
-      token: await token({ userId: seeded.user.id, environmentId: seeded.prod.id }),
-      scopes: ["write:runs"],
-    });
-
-    expect(denied.status).toBe(403);
-    expect(denied.body.token).toBeUndefined();
-  },
-  60_000
-);
-
-postgresTest(
-  "a capless delegated token exchanges for a read-only JWT",
-  async ({ prisma }) => {
-    ctx.prisma = prisma;
-    const seeded = await seedProject(prisma);
-
-    const minted = await exchange({
-      projectRef: seeded.project.externalRef,
-      env: "prod",
-      token: await token({ userId: seeded.user.id, environmentId: seeded.prod.id }),
-    });
-
-    expect(minted.status).toBe(200);
-    expect(payloadOf(minted.body.token).scopes).toEqual(["read:all"]);
-  },
-  60_000
-);
-
 postgresTest(
   "the exchange clamps requested scopes to the token's cap",
   async ({ prisma }) => {