Merge remote-tracking branch 'origin/feat/dashboard-agent-flows' into feat/dashboard-agent-ui

Author: kathiekiwi

apps/webapp/app/routes/api.v1.orgs.ts

@@ -40,20 +40,33 @@ export const loader = createLoaderPATApiRoute(
   }
 );
 
-// No org exists yet, so there is nothing to scope the gate to; any authenticated user can create
-// an org and becomes its ADMIN. The gate is still declared so a narrowly-capped delegated token
-// (which cannot `manage`) is refused rather than inheriting its user's full reach.
+// No org exists yet, so there is nothing to scope a route-level gate to; any authenticated user
+// can create an org and becomes its ADMIN. A narrowly-capped delegated token (which cannot
+// `manage`) is still refused rather than inheriting its user's full reach — but only for
+// user-actor tokens, so an ordinary PAT is unaffected.
 export const action = createActionPATApiRoute(
   {
     method: "POST",
     body: CreateOrgRequestBody,
-    authorization: { action: "manage", resource: () => ({ type: "organization" }) },
   },
-  async ({ body, authentication }) => {
+  async ({ body, authentication, ability }) => {
     if (env.ORG_CREATION_API_ENABLED !== "1") {
       return json({ error: "Not found" }, { status: 404 });
     }
 
+    // After the env gate: an install with the API disabled should 404, not 403.
+    if (authentication.userActor && !ability.can("manage", { type: "organization" })) {
+      return json(
+        {
+          error: "Unauthorized",
+          code: "unauthorized",
+          param: "access_token",
+          type: "authorization",
+        },
+        { status: 403 }
+      );
+    }
+
     // Mirror the dashboard: stash companyUrl/companySize as onboarding data and
     // derive the org avatar from the company domain's favicon.
     const onboardingData: Record<string, string> = {};

apps/webapp/test/contextlessPatRoutes.test.ts

@@ -13,6 +13,10 @@ const mocks = vi.hoisted(() => ({
   authenticatePat: vi.fn(),
   createOrganization: vi.fn(),
   findManyProjects: vi.fn(),
+  env: { SESSION_SECRET: "test-session-secret", ORG_CREATION_API_ENABLED: "1" } as {
+    SESSION_SECRET: string;
+    ORG_CREATION_API_ENABLED?: string;
+  },
 }));
 
 vi.mock("~/services/rbac.server", () => ({
@@ -25,9 +29,7 @@ vi.mock("~/db.server", () => ({
   prisma: { project: { findMany: mocks.findManyProjects } },
   $replica: {},
 }));
-vi.mock("~/env.server", () => ({
-  env: { SESSION_SECRET: "test-session-secret", ORG_CREATION_API_ENABLED: "1" },
-}));
+vi.mock("~/env.server", () => ({ env: mocks.env }));
 vi.mock("~/models/organization.server", () => ({ createOrganization: mocks.createOrganization }));
 vi.mock("~/services/personalAccessToken.server", () => ({
   updateLastAccessedAtIfStale: vi.fn(),
@@ -77,6 +79,30 @@ async function createOrg(cap: string[]): Promise<{ status: number; body: any }>
   return { status: response.status, body: await response.json() };
 }
 
+// An ordinary PAT, paired with an ability that denies everything. Nothing on this route may
+// consult it — the route has no org to scope a gate to, and on cloud the plugin returns a
+// deny-shaped ability when there is no org context.
+async function createOrgWithPat(): Promise<{ status: number; body: any }> {
+  mocks.authenticatePat.mockImplementation(async () => ({
+    ok: true,
+    userId: USER_ID,
+    tokenId: "pat_1",
+    lastAccessedAt: new Date(),
+    ability: { can: () => false, canSuper: () => false },
+  }));
+
+  const response = await action({
+    request: new Request("https://api.trigger.dev/api/v1/orgs", {
+      method: "POST",
+      headers: { Authorization: "Bearer tr_pat_1234", "Content-Type": "application/json" },
+      body: JSON.stringify({ title: "New Org" }),
+    }),
+    params: {},
+    context: {},
+  } as any);
+  return { status: response.status, body: await response.json() };
+}
+
 const AGENT_ENVIRONMENT_ID = "env_dev";
 
 async function listProjects(): Promise<{ status: number; body: any }> {
@@ -146,6 +172,29 @@ describe("creating an organization over the API", () => {
     expect(mocks.createOrganization).not.toHaveBeenCalled();
   });
 
+  it("admits an ordinary PAT without consulting its ability", async () => {
+    const result = await createOrgWithPat();
+
+    expect(result.status).toBe(201);
+    expect(result.body.slug).toBe("new-org");
+  });
+
+  // The env gate runs before the capability gate, so an install with the API disabled tells
+  // every caller the same thing: the route does not exist. A capped token must not learn from a
+  // 403 that it would have been the only thing standing in its way.
+  it("hides the route from a capped token when the API is disabled", async () => {
+    mocks.env.ORG_CREATION_API_ENABLED = undefined;
+
+    try {
+      const result = await createOrg(["read:all"]);
+
+      expect(result.status).toBe(404);
+      expect(mocks.createOrganization).not.toHaveBeenCalled();
+    } finally {
+      mocks.env.ORG_CREATION_API_ENABLED = "1";
+    }
+  });
+
   it("still admits a token that carries the universal grant", async () => {
     const result = await createOrg(["admin"]);