RBAC/plugin updates

Author: matt-aitken

internal-packages/rbac/src/fallback.ts

@@ -1,7 +1,44 @@
-import type { RBACPlugin } from "@trigger.dev/plugins";
+import type {
+  Permission,
+  Role,
+  RoleBaseAccessController,
+  RoleBasedAccessControlPlugin,
+} from "@trigger.dev/plugins";
 
-export function create(): RBACPlugin {
-  return {
-    type: "rbac",
-  };
+export class RoleBaseAccessFallback implements RoleBasedAccessControlPlugin {
+  async create() {
+    return new RoleBaseAccessFallbackController();
+  }
+}
+
+const accountWildcard: Permission = {
+  name: "*:account",
+  description: "Full abilities for an account",
+};
+
+const superWildcard: Permission = {
+  name: "*:super",
+  description: "Full abilities for a super user",
+};
+
+const owner: Role = {
+  name: "owner",
+  description: "Full access to all features",
+  permissions: [accountWildcard, superWildcard],
+};
+
+const superAdmin: Role = {
+  name: "super_admin",
+  description: "Full access to all features and the ability to manage the Trigger.dev platform",
+  permissions: [accountWildcard, superWildcard],
+};
+
+class RoleBaseAccessFallbackController implements RoleBaseAccessController {
+  async allPermissions(): Promise<Permission[]> {
+    return [owner, superAdmin];
+  }
+
+  async allRoles(): Promise<Role[]> {
+    return [owner, superAdmin];
+  }
 }

internal-packages/rbac/src/index.ts

@@ -1,20 +1,25 @@
-import type { RBACPlugin } from "@trigger.dev/plugins";
+import type {
+  RoleBaseAccessController,
+  RoleBasedAccessControlPlugin,
+  PrismaClient,
+} from "@trigger.dev/plugins";
+import { RoleBaseAccessFallback } from "./fallback";
+export type { RoleBaseAccessController, RoleBasedAccessControlPlugin };
 
-export type { RBACPlugin };
-
-type PluginModule = {
-  create(): RBACPlugin | Promise<RBACPlugin>;
-};
-
-export async function createRBACPlugin(): Promise<RBACPlugin> {
-  try {
-    // Installed in cloud deployments; absent in OSS
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { create } = require("@triggerdotdev/plugin-rbac") as PluginModule;
-    return create();
-  } catch {
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { create } = require("./fallback") as PluginModule;
-    return create();
+class RoleBaseAccess implements RoleBasedAccessControlPlugin {
+  async create(prisma: PrismaClient) {
+    try {
+      const moduleName = "@triggerdotdev/plugin-rbac";
+      const module = await import(moduleName);
+      const { create } = await module();
+      return create(prisma);
+    } catch {
+      const fallback = new RoleBaseAccessFallback();
+      return fallback.create();
+    }
   }
 }
+
+const plugin = new RoleBaseAccess();
+
+export default plugin;

packages/plugins/api-extractor.json

@@ -0,0 +1,27 @@
+{
+  "$schema": "https://developer.microsoft.com/json-schemas/api-extractor/v7/api-extractor.schema.json",
+  "mainEntryPointFilePath": "<projectFolder>/dist/types/index.d.ts",
+  "bundledPackages": ["@trigger.dev/database"],
+  "compiler": {
+    "tsconfigFilePath": "<projectFolder>/tsconfig.dts.json"
+  },
+  "dtsRollup": {
+    "enabled": true,
+    "untrimmedFilePath": "<projectFolder>/dist/index.d.ts",
+    "alphaTrimmedFilePath": "",
+    "betaTrimmedFilePath": "",
+    "publicTrimmedFilePath": ""
+  },
+  "apiReport": { "enabled": false },
+  "docModel": { "enabled": false },
+  "tsdocMetadata": { "enabled": false },
+  "messages": {
+    "extractorMessageReporting": {
+      "ae-forgotten-export": { "logLevel": "none" },
+      "ae-missing-release-tag": { "logLevel": "none" }
+    },
+    "tsdocMessageReporting": {
+      "default": { "logLevel": "none" }
+    }
+  }
+}

packages/plugins/package.json

@@ -17,11 +17,13 @@
   ],
   "scripts": {
     "clean": "rimraf dist .turbo",
-    "build": "tsup",
-    "dev": "tsup --watch --onSuccess 'npm unpublish @trigger.dev/plugins --registry http://localhost:4873 --force 2>/dev/null; pnpm publish --registry http://localhost:4873 --no-git-checks 2>/dev/null || true'",
+    "build": "tsup && tsc -p tsconfig.dts.json && api-extractor run --local",
+    "dev": "tsup --watch --onSuccess 'tsc -p tsconfig.dts.json && api-extractor run --local --quiet'",
     "typecheck": "tsc --noEmit"
   },
   "devDependencies": {
+    "@microsoft/api-extractor": "^7.58.2",
+    "@trigger.dev/database": "workspace:*",
     "@types/node": "^20.14.14",
     "rimraf": "6.0.1",
     "tsup": "^8.4.0",

packages/plugins/src/index.ts

@@ -1 +1,7 @@
-export type { RBACPlugin } from "./rbac.js";
+export type {
+  RoleBasedAccessControlPlugin,
+  RoleBaseAccessController,
+  PrismaClient,
+  Permission,
+  Role,
+} from "./rbac.js";

packages/plugins/src/rbac.ts

@@ -1,3 +1,23 @@
-export interface RBACPlugin {
-  readonly type: "rbac";
+import type { PrismaClient } from "@trigger.dev/database";
+
+export type { PrismaClient };
+
+export type Permission = {
+  name: string;
+  description: string;
+};
+
+export type Role = {
+  name: string;
+  description: string;
+  permissions: Permission[];
+};
+
+export interface RoleBaseAccessController {
+  allPermissions(): Promise<Permission[]>;
+  allRoles(): Promise<Role[]>;
+}
+
+export interface RoleBasedAccessControlPlugin {
+  create(prisma: PrismaClient): RoleBaseAccessController | Promise<RoleBaseAccessController>;
 }

packages/plugins/tsconfig.dts.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../.configs/tsconfig.base.json",
+  "compilerOptions": {
+    "declaration": true,
+    "emitDeclarationOnly": true,
+    "outDir": "dist/types",
+    "rootDir": "src"
+  },
+  "include": ["./src/**/*.ts"]
+}

packages/plugins/tsup.config.ts

@@ -3,7 +3,7 @@ import { defineConfig } from "tsup";
 export default defineConfig({
   entry: ["src/index.ts"],
   format: ["cjs", "esm"],
-  dts: true,
+  dts: false,
   splitting: false,
   sourcemap: true,
   clean: true,