JWT/realtime token integration: publicJWT subject, jwt metadata, allowJWT option, buildJwtAbility

Author: matt-aitken

internal-packages/rbac/package.json

@@ -5,9 +5,11 @@
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "dependencies": {
+    "@trigger.dev/core": "workspace:*",
     "@trigger.dev/plugins": "workspace:*"
   },
   "devDependencies": {
+    "@trigger.dev/database": "workspace:*",
     "@types/node": "^20.14.14",
     "rimraf": "6.0.1"
   },

internal-packages/rbac/src/ability.test.ts

@@ -1,5 +1,5 @@
 import { describe, it, expect } from "vitest";
-import { permissiveAbility, superAbility, denyAbility, buildFallbackAbility } from "./ability.js";
+import { permissiveAbility, superAbility, denyAbility, buildFallbackAbility, buildJwtAbility } from "./ability.js";
 
 describe("permissiveAbility", () => {
   it("allows any action on any resource type", () => {
@@ -39,6 +39,50 @@ describe("denyAbility", () => {
   });
 });
 
+describe("buildJwtAbility", () => {
+  it("allows action matching a general scope", () => {
+    const ability = buildJwtAbility(["read:runs"]);
+    expect(ability.can("read", { type: "runs" })).toBe(true);
+    expect(ability.can("read", { type: "runs", id: "run_abc" })).toBe(true);
+  });
+
+  it("allows only the specific ID for a scoped permission", () => {
+    const ability = buildJwtAbility(["read:runs:run_abc"]);
+    expect(ability.can("read", { type: "runs", id: "run_abc" })).toBe(true);
+    expect(ability.can("read", { type: "runs", id: "run_xyz" })).toBe(false);
+    expect(ability.can("read", { type: "runs" })).toBe(false);
+  });
+
+  it("allows any read with read:all scope", () => {
+    const ability = buildJwtAbility(["read:all"]);
+    expect(ability.can("read", { type: "runs" })).toBe(true);
+    expect(ability.can("read", { type: "tasks" })).toBe(true);
+    expect(ability.can("write", { type: "runs" })).toBe(false);
+  });
+
+  it("allows everything with admin scope", () => {
+    const ability = buildJwtAbility(["admin"]);
+    expect(ability.can("read", { type: "runs" })).toBe(true);
+    expect(ability.can("write", { type: "deployments" })).toBe(true);
+  });
+
+  it("never grants canSuper", () => {
+    expect(buildJwtAbility(["admin"]).canSuper()).toBe(false);
+    expect(buildJwtAbility(["read:all"]).canSuper()).toBe(false);
+    expect(buildJwtAbility([]).canSuper()).toBe(false);
+  });
+
+  it("denies everything for empty scopes", () => {
+    const ability = buildJwtAbility([]);
+    expect(ability.can("read", { type: "runs" })).toBe(false);
+  });
+
+  it("denies wrong action with general resource scope", () => {
+    const ability = buildJwtAbility(["read:runs"]);
+    expect(ability.can("write", { type: "runs" })).toBe(false);
+  });
+});
+
 describe("buildFallbackAbility", () => {
   it("returns permissiveAbility for non-admin users", () => {
     const ability = buildFallbackAbility(false);

internal-packages/rbac/src/ability.ts

@@ -21,3 +21,23 @@ export const denyAbility: RbacAbility = {
 export function buildFallbackAbility(isAdmin: boolean): RbacAbility {
   return isAdmin ? superAbility : permissiveAbility;
 }
+
+/** Builds an ability from JWT scope strings like "read:runs", "read:runs:run_abc", "read:all", "admin". */
+export function buildJwtAbility(scopes: string[]): RbacAbility {
+  return {
+    can(action: string, resource: { type: string; id?: string }): boolean {
+      return scopes.some((scope) => {
+        const [scopeAction, scopeType, scopeId] = scope.split(":");
+        if (scopeAction === "admin") return true;
+        if (scopeAction !== action && scopeAction !== "*") return false;
+        if (scopeType === "all") return true;
+        if (scopeType !== resource.type) return false;
+        if (!scopeId) return true;
+        return scopeId === resource.id;
+      });
+    },
+    canSuper(): boolean {
+      return false;
+    },
+  };
+}

internal-packages/rbac/src/fallback.ts

@@ -10,7 +10,8 @@ import type {
   RoleBaseAccessController,
 } from "@trigger.dev/plugins";
 import type { PrismaClient } from "@trigger.dev/database";
-import { buildFallbackAbility, permissiveAbility } from "./ability.js";
+import { validateJWT } from "@trigger.dev/core/v3/jwt";
+import { buildFallbackAbility, buildJwtAbility, permissiveAbility } from "./ability.js";
 
 export class RoleBaseAccessFallback {
   constructor(private readonly prisma: PrismaClient) {}
@@ -28,12 +29,55 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
     private readonly helpers: { getSessionUserId: (request: Request) => Promise<string | null> }
   ) {}
 
-  async authenticateBearer(request: Request): Promise<BearerAuthResult> {
-    const apiKey = request.headers.get("Authorization")?.replace(/^Bearer /, "").trim();
-    if (!apiKey) return { ok: false, status: 401, error: "Invalid or Missing API key" };
+  async authenticateBearer(
+    request: Request,
+    options?: { allowJWT?: boolean }
+  ): Promise<BearerAuthResult> {
+    const rawToken = request.headers.get("Authorization")?.replace(/^Bearer /, "").trim();
+    if (!rawToken) return { ok: false, status: 401, error: "Invalid or Missing API key" };
+
+    if (options?.allowJWT && isPublicJWT(rawToken)) {
+      const envId = extractJWTSub(rawToken);
+      if (!envId) return { ok: false, status: 401, error: "Invalid Public Access Token" };
+
+      const env = await this.prisma.runtimeEnvironment.findFirst({
+        where: { id: envId },
+        include: {
+          project: true,
+          organization: true,
+          parentEnvironment: { select: { apiKey: true } },
+        },
+      });
+      if (!env || env.project.deletedAt !== null) {
+        return { ok: false, status: 401, error: "Invalid Public Access Token" };
+      }
+
+      const signingKey = env.parentEnvironment?.apiKey ?? env.apiKey;
+      const result = await validateJWT(rawToken, signingKey);
+      if (!result.ok) return { ok: false, status: 401, error: "Public Access Token is invalid" };
+
+      const scopes = Array.isArray(result.payload.scopes)
+        ? (result.payload.scopes as string[])
+        : [];
+      const realtime = result.payload.realtime as { skipColumns?: string[] } | undefined;
+      const oneTimeUse = result.payload.otu === true;
+
+      return {
+        ok: true,
+        environment: toRbacEnvironment(env),
+        subject: {
+          type: "publicJWT",
+          environmentId: env.id,
+          organizationId: env.organizationId,
+          projectId: env.projectId,
+        },
+        ability: buildJwtAbility(scopes),
+        jwt: { realtime, oneTimeUse },
+      };
+    }
 
     const env = await this.prisma.runtimeEnvironment.findFirst({
-      where: { apiKey },
+      where: { apiKey: rawToken },
       include: {
         project: true,
         organization: true,
@@ -87,9 +131,10 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
 
   async authenticateAuthorizeBearer(
     request: Request,
-    check: { action: string; resource: RbacResource }
+    check: { action: string; resource: RbacResource },
+    options?: { allowJWT?: boolean }
   ): Promise<BearerAuthResult> {
-    const auth = await this.authenticateBearer(request);
+    const auth = await this.authenticateBearer(request, options);
     if (!auth.ok) return auth;
     if (!auth.ability.can(check.action, check.resource)) {
       return { ok: false, status: 403, error: "Unauthorized" };
@@ -143,6 +188,30 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
   async removeTokenRole(): Promise<void> {}
 }
 
+function isPublicJWT(token: string): boolean {
+  const parts = token.split(".");
+  if (parts.length !== 3) return false;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+    return payload !== null && typeof payload === "object" && payload.pub === true;
+  } catch {
+    return false;
+  }
+}
+
+function extractJWTSub(token: string): string | undefined {
+  const parts = token.split(".");
+  if (parts.length !== 3) return undefined;
+  try {
+    const payload = JSON.parse(Buffer.from(parts[1].replace(/-/g, "+").replace(/_/g, "/"), "base64").toString("utf8"));
+    return payload !== null && typeof payload === "object" && typeof payload.sub === "string"
+      ? payload.sub
+      : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
 function toRbacEnvironment(
   env: {
     id: string;

internal-packages/rbac/tsconfig.json

@@ -1,13 +1,17 @@
 {
   "compilerOptions": {
+    "target": "ES2019",
+    "lib": ["ES2019", "DOM"],
+    "module": "ESNext",
+    "moduleResolution": "Bundler",
     "esModuleInterop": true,
     "forceConsistentCasingInFileNames": true,
     "isolatedModules": true,
-    "moduleResolution": "node",
     "preserveWatchOutput": true,
     "skipLibCheck": true,
     "noEmit": true,
-    "strict": true
+    "strict": true,
+    "customConditions": ["@triggerdotdev/source"]
   },
   "exclude": ["node_modules"]
 }

packages/plugins/src/rbac.ts

@@ -13,7 +13,8 @@ export type Role = {
 
 export type RbacSubject =
   | { type: "user"; userId: string; organizationId: string; projectId?: string }
-  | { type: "personalAccessToken"; tokenId: string; organizationId: string; projectId?: string };
+  | { type: "personalAccessToken"; tokenId: string; organizationId: string; projectId?: string }
+  | { type: "publicJWT"; environmentId: string; organizationId: string; projectId?: string };
 
 export type RbacResource = {
   type: string;
@@ -51,15 +52,22 @@ export interface RbacAbility {
 
 export type BearerAuthResult =
   | { ok: false; status: 401 | 403; error: string }
-  | { ok: true; environment: RbacEnvironment; subject: RbacSubject; ability: RbacAbility };
+  | {
+      ok: true;
+      environment: RbacEnvironment;
+      subject: RbacSubject;
+      ability: RbacAbility;
+      jwt?: { realtime?: { skipColumns?: string[] }; oneTimeUse?: boolean };
+    };
 
 export type SessionAuthResult =
   | { ok: false; reason: "unauthenticated" | "unauthorized" }
   | { ok: true; user: RbacUser; subject: RbacSubject; ability: RbacAbility };
 
 export interface RoleBaseAccessController {
   // API routes (Bearer token): one DB query → identity + pre-built ability
-  authenticateBearer(request: Request): Promise<BearerAuthResult>;
+  // options.allowJWT: when true, accepts PUBLIC_JWT tokens in addition to environment API keys
+  authenticateBearer(request: Request, options?: { allowJWT?: boolean }): Promise<BearerAuthResult>;
 
   // Dashboard loaders/actions (session cookie): one DB query → user + pre-built ability
   authenticateSession(
@@ -70,7 +78,8 @@ export interface RoleBaseAccessController {
   // Convenience: authenticate + ability.can() check in one call; returns ok:false if check fails
   authenticateAuthorizeBearer(
     request: Request,
-    check: { action: string; resource: RbacResource }
+    check: { action: string; resource: RbacResource },
+    options?: { allowJWT?: boolean }
   ): Promise<BearerAuthResult>;
 
   authenticateAuthorizeSession(