Update RBAC plugin interface: authenticateBearer/Session, drop PrismaClient from public interface

- Replace buildBearerAbility/buildSessionAbility with authenticateBearer/authenticateSession
- Add RbacEnvironment, RbacUser, BearerAuthResult, SessionAuthResult types
- Remove PrismaClient from @trigger.dev/plugins interface (no Prisma crossing repo boundary)
- Remove @trigger.dev/database dependency and api-extractor from plugins package
- Switch plugins build to tsup --dts, delete api-extractor.json and tsconfig.dts.json
- OSS fallback imports PrismaClient from @trigger.dev/database directly
- OSS loader passes helpers-only to enterprise plugin, (prisma, helpers) to fallback
- Add rbac.server.ts singleton to webapp
- PoC: migrate admin.concurrency route to rbac.authenticateSession + canSuper()

Author: matt-aitken

apps/webapp/app/routes/admin.concurrency.tsx

@@ -4,14 +4,13 @@ import { redirect, typedjson, useTypedLoaderData } from "remix-typedjson";
 import { Header1 } from "~/components/primitives/Headers";
 import { InfoPanel } from "~/components/primitives/InfoPanel";
 import { Paragraph } from "~/components/primitives/Paragraph";
-import { requireUser } from "~/services/session.server";
+import { rbac } from "~/services/rbac.server";
 import { concurrencyTracker } from "~/v3/services/taskRunConcurrencyTracker.server";
 
-export const loader = async ({ request, params }: LoaderFunctionArgs) => {
-  const user = await requireUser(request);
-  if (!user.admin) {
-    return redirect("/");
-  }
+export const loader = async ({ request }: LoaderFunctionArgs) => {
+  const auth = await rbac.authenticateSession(request, {});
+  if (!auth.ok) return redirect("/login");
+  if (!auth.ability.canSuper()) return redirect("/");
 
   const deployedConcurrency = await concurrencyTracker.globalConcurrentRunCount(true);
   const devConcurrency = await concurrencyTracker.globalConcurrentRunCount(false);

apps/webapp/app/services/rbac.server.ts

@@ -0,0 +1,10 @@
+import { prisma } from "~/db.server";
+import plugin from "@trigger.dev/rbac";
+import { getUserId } from "./session.server";
+
+async function getSessionUserId(request: Request): Promise<string | null> {
+  const id = await getUserId(request);
+  return id ?? null;
+}
+
+export const rbac = await plugin.create(prisma, { getSessionUserId });

apps/webapp/package.json

@@ -124,6 +124,7 @@
     "@trigger.dev/companyicons": "^1.5.35",
     "@trigger.dev/core": "workspace:*",
     "@trigger.dev/database": "workspace:*",
+    "@trigger.dev/rbac": "workspace:*",
     "@trigger.dev/otlp-importer": "workspace:*",
     "@trigger.dev/platform": "1.0.27",
     "@trigger.dev/redis-worker": "workspace:*",

internal-packages/rbac/package.json

@@ -2,8 +2,8 @@
   "name": "@trigger.dev/rbac",
   "private": true,
   "version": "0.0.1",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "main": "./dist/src/index.js",
+  "types": "./dist/src/index.d.ts",
   "dependencies": {
     "@trigger.dev/plugins": "workspace:*"
   },
@@ -15,6 +15,8 @@
     "clean": "rimraf dist",
     "typecheck": "tsc --noEmit",
     "build": "pnpm run clean && tsc --noEmit false --outDir dist --declaration",
-    "dev": "tsc --noEmit false --outDir dist --declaration --watch"
+    "dev": "tsc --noEmit false --outDir dist --declaration --watch",
+    "test": "vitest run",
+    "test:watch": "vitest"
   }
 }

internal-packages/rbac/src/ability.test.ts

@@ -0,0 +1,54 @@
+import { describe, it, expect } from "vitest";
+import { permissiveAbility, superAbility, denyAbility, buildFallbackAbility } from "./ability.js";
+
+describe("permissiveAbility", () => {
+  it("allows any action on any resource type", () => {
+    expect(permissiveAbility.can("read", { type: "run" })).toBe(true);
+    expect(permissiveAbility.can("write", { type: "deployment" })).toBe(true);
+    expect(permissiveAbility.can("delete", { type: "task" })).toBe(true);
+  });
+
+  it("allows actions on specific resource instances", () => {
+    expect(permissiveAbility.can("read", { type: "run", id: "run_abc123" })).toBe(true);
+  });
+
+  it("does not grant super-user access", () => {
+    expect(permissiveAbility.canSuper()).toBe(false);
+  });
+});
+
+describe("superAbility", () => {
+  it("allows any action on any resource", () => {
+    expect(superAbility.can("read", { type: "run" })).toBe(true);
+    expect(superAbility.can("write", { type: "deployment" })).toBe(true);
+  });
+
+  it("grants super-user access", () => {
+    expect(superAbility.canSuper()).toBe(true);
+  });
+});
+
+describe("denyAbility", () => {
+  it("denies all actions", () => {
+    expect(denyAbility.can("read", { type: "run" })).toBe(false);
+    expect(denyAbility.can("write", { type: "deployment" })).toBe(false);
+  });
+
+  it("does not grant super-user access", () => {
+    expect(denyAbility.canSuper()).toBe(false);
+  });
+});
+
+describe("buildFallbackAbility", () => {
+  it("returns permissiveAbility for non-admin users", () => {
+    const ability = buildFallbackAbility(false);
+    expect(ability.can("read", { type: "run" })).toBe(true);
+    expect(ability.canSuper()).toBe(false);
+  });
+
+  it("returns superAbility for admin users", () => {
+    const ability = buildFallbackAbility(true);
+    expect(ability.can("read", { type: "run" })).toBe(true);
+    expect(ability.canSuper()).toBe(true);
+  });
+});

internal-packages/rbac/src/ability.ts

@@ -0,0 +1,23 @@
+import type { RbacAbility } from "@trigger.dev/plugins";
+
+/** Every authenticated non-admin subject: can do anything, cannot do super-user actions. */
+export const permissiveAbility: RbacAbility = {
+  can: () => true,
+  canSuper: () => false,
+};
+
+/** Platform admin (user.admin = true): can do everything including super-user actions. */
+export const superAbility: RbacAbility = {
+  can: () => true,
+  canSuper: () => true,
+};
+
+/** Deprecated PUBLIC tokens and unauthenticated subjects: denied everything. */
+export const denyAbility: RbacAbility = {
+  can: () => false,
+  canSuper: () => false,
+};
+
+export function buildFallbackAbility(isAdmin: boolean): RbacAbility {
+  return isAdmin ? superAbility : permissiveAbility;
+}

internal-packages/rbac/src/fallback.ts

@@ -1,44 +1,200 @@
 import type {
   Permission,
   Role,
+  RbacEnvironment,
+  RbacUser,
+  RbacSubject,
+  RbacResource,
+  BearerAuthResult,
+  SessionAuthResult,
   RoleBaseAccessController,
-  RoleBasedAccessControlPlugin,
 } from "@trigger.dev/plugins";
+import type { PrismaClient } from "@trigger.dev/database";
+import { buildFallbackAbility, permissiveAbility } from "./ability.js";
 
-export class RoleBaseAccessFallback implements RoleBasedAccessControlPlugin {
-  async create() {
-    return new RoleBaseAccessFallbackController();
+export class RoleBaseAccessFallback {
+  constructor(private readonly prisma: PrismaClient) {}
+
+  create(
+    helpers: { getSessionUserId: (request: Request) => Promise<string | null> }
+  ): RoleBaseAccessFallbackController {
+    return new RoleBaseAccessFallbackController(this.prisma, helpers);
   }
 }
 
-const accountWildcard: Permission = {
-  name: "*:account",
-  description: "Full abilities for an account",
-};
+class RoleBaseAccessFallbackController implements RoleBaseAccessController {
+  constructor(
+    private readonly prisma: PrismaClient,
+    private readonly helpers: { getSessionUserId: (request: Request) => Promise<string | null> }
+  ) {}
+
+  async authenticateBearer(request: Request): Promise<BearerAuthResult> {
+    const apiKey = request.headers.get("Authorization")?.replace(/^Bearer /, "").trim();
+    if (!apiKey) return { ok: false, status: 401, error: "Invalid or Missing API key" };
 
-const superWildcard: Permission = {
-  name: "*:super",
-  description: "Full abilities for a super user",
-};
+    const env = await this.prisma.runtimeEnvironment.findFirst({
+      where: { apiKey },
+      include: {
+        project: true,
+        organization: true,
+        orgMember: { select: { userId: true } },
+      },
+    });
 
-const owner: Role = {
-  name: "owner",
-  description: "Full access to all features",
-  permissions: [accountWildcard, superWildcard],
-};
+    if (!env || env.project.deletedAt !== null) {
+      return { ok: false, status: 401, error: "Invalid API key" };
+    }
 
-const superAdmin: Role = {
-  name: "super_admin",
-  description: "Full access to all features and the ability to manage the Trigger.dev platform",
-  permissions: [accountWildcard, superWildcard],
-};
+    const subject: RbacSubject = {
+      type: "user",
+      userId: env.orgMember?.userId ?? "",
+      organizationId: env.organizationId,
+      projectId: env.projectId,
+    };
+
+    return {
+      ok: true,
+      environment: toRbacEnvironment(env),
+      subject,
+      ability: permissiveAbility,
+    };
+  }
+
+  async authenticateSession(
+    request: Request,
+    context: { organizationId?: string; projectId?: string }
+  ): Promise<SessionAuthResult> {
+    const userId = await this.helpers.getSessionUserId(request);
+    if (!userId) return { ok: false, reason: "unauthenticated" };
+
+    const user = await this.prisma.user.findFirst({ where: { id: userId } });
+    if (!user) return { ok: false, reason: "unauthenticated" };
+
+    const subject: RbacSubject = {
+      type: "user",
+      userId: user.id,
+      organizationId: context.organizationId ?? "",
+      projectId: context.projectId,
+    };
+
+    return {
+      ok: true,
+      user: toRbacUser(user),
+      subject,
+      ability: buildFallbackAbility(user.admin),
+    };
+  }
+
+  async authenticateAuthorizeBearer(
+    request: Request,
+    check: { action: string; resource: RbacResource }
+  ): Promise<BearerAuthResult> {
+    const auth = await this.authenticateBearer(request);
+    if (!auth.ok) return auth;
+    if (!auth.ability.can(check.action, check.resource)) {
+      return { ok: false, status: 403, error: "Unauthorized" };
+    }
+    return auth;
+  }
+
+  async authenticateAuthorizeSession(
+    request: Request,
+    context: { organizationId?: string; projectId?: string },
+    check: { action: string; resource: RbacResource }
+  ): Promise<SessionAuthResult> {
+    const auth = await this.authenticateSession(request, context);
+    if (!auth.ok) return auth;
+    if (!auth.ability.can(check.action, check.resource)) {
+      return { ok: false, reason: "unauthorized" };
+    }
+    return auth;
+  }
 
-class RoleBaseAccessFallbackController implements RoleBaseAccessController {
   async allPermissions(): Promise<Permission[]> {
-    return [owner, superAdmin];
+    return [];
   }
 
   async allRoles(): Promise<Role[]> {
-    return [owner, superAdmin];
+    return [];
   }
+
+  async createRole(): Promise<Role> {
+    throw new Error("RBAC plugin not installed");
+  }
+
+  async updateRole(): Promise<Role> {
+    throw new Error("RBAC plugin not installed");
+  }
+
+  async deleteRole(): Promise<void> {}
+
+  async getUserRole(): Promise<Role | null> {
+    return null;
+  }
+
+  async setUserRole(): Promise<void> {}
+  async removeUserRole(): Promise<void> {}
+
+  async getTokenRole(): Promise<Role | null> {
+    return null;
+  }
+
+  async setTokenRole(): Promise<void> {}
+  async removeTokenRole(): Promise<void> {}
+}
+
+function toRbacEnvironment(
+  env: {
+    id: string;
+    slug: string;
+    type: string;
+    apiKey: string;
+    pkApiKey: string;
+    organizationId: string;
+    projectId: string;
+    organization: { id: string; slug: string; title: string };
+    project: { id: string; slug: string; name: string; externalRef: string };
+  }
+): RbacEnvironment {
+  return {
+    id: env.id,
+    slug: env.slug,
+    type: env.type,
+    apiKey: env.apiKey,
+    pkApiKey: env.pkApiKey,
+    organizationId: env.organizationId,
+    projectId: env.projectId,
+    organization: {
+      id: env.organization.id,
+      slug: env.organization.slug,
+      title: env.organization.title,
+    },
+    project: {
+      id: env.project.id,
+      slug: env.project.slug,
+      name: env.project.name,
+      externalRef: env.project.externalRef,
+    },
+  };
+}
+
+function toRbacUser(user: {
+  id: string;
+  email: string;
+  name: string | null;
+  displayName: string | null;
+  avatarUrl: string | null;
+  admin: boolean;
+  confirmedBasicDetails: boolean;
+}): RbacUser {
+  return {
+    id: user.id,
+    email: user.email,
+    name: user.name,
+    displayName: user.displayName,
+    avatarUrl: user.avatarUrl,
+    admin: user.admin,
+    confirmedBasicDetails: user.confirmedBasicDetails,
+    isImpersonating: false,
+  };
 }