fix(rbac): deny a non-member session in an org context (OSS fallback) (#86)

1stvamp · web-flow · commit 0eca444434dc · 2026-08-06T09:41:52.000+01:00
diff --git a/apps/webapp/test/auth-dashboard.e2e.full.test.ts b/apps/webapp/test/auth-dashboard.e2e.full.test.ts
@@ -2,6 +2,8 @@
 // Each test seeds a User + session cookie via seedTestUser / seedTestSession
 // (helpers/seedTestSession.ts) and hits the shared webapp container.
 
+import { randomBytes } from "node:crypto";
+import type { PrismaClient } from "@trigger.dev/database";
 import { describe, expect, it } from "vitest";
 import { getTestServer } from "./helpers/sharedTestServer";
 import { seedTestSession, seedTestUser } from "./helpers/seedTestSession";
@@ -115,4 +117,66 @@ describe("Dashboard", () => {
       expect(new URL(location, "http://localhost").pathname).toBe("/");
     });
   });
+
+  // Cross-tenant tenant floor on org settings routes. settings/roles is the case
+  // the route-level membership scoping (SSO/Team) did NOT cover, so it exercises
+  // the RBAC fallback's org-membership floor specifically: the fallback ability
+  // is permissive (can: () => true), so that floor is the only thing stopping a
+  // non-member from reading the org's role and permission catalogue.
+  //
+  // The request hits the route's own loader directly via Remix's `?_data`, which
+  // is the exact exploit shape: a plain document GET 404s at the org layout
+  // (membership) and never reaches this leaf, so it wouldn't test the leaf floor.
+  // Both users have confirmedBasicDetails set so the `_app` onboarding redirect
+  // can't stand in for the deny.
+  describe("Org settings — cross-tenant tenant floor (settings/roles)", () => {
+    const ROLES_ROUTE_ID = "routes/_app.orgs.$organizationSlug.settings.roles";
+    const rolesData = (slug: string) =>
+      `/orgs/${slug}/settings/roles?_data=${encodeURIComponent(ROLES_ROUTE_ID)}`;
+
+    async function seedConfirmedUser(prisma: PrismaClient) {
+      const user = await seedTestUser(prisma);
+      await prisma.user.update({ where: { id: user.id }, data: { confirmedBasicDetails: true } });
+      return user;
+    }
+
+    async function seedOrgWithOwner() {
+      const server = getTestServer();
+      const owner = await seedConfirmedUser(server.prisma);
+      const org = await server.prisma.organization.create({
+        data: {
+          title: "E2E tenant-floor org",
+          slug: `e2e-tenant-${randomBytes(6).toString("hex")}`,
+          members: { create: { userId: owner.id, role: "ADMIN" } },
+        },
+      });
+      return { server, owner, org };
+    }
+
+    it("denies a non-member: no roles catalogue leaked", async () => {
+      const { server, org } = await seedOrgWithOwner();
+      const outsider = await seedConfirmedUser(server.prisma);
+      const cookie = await seedTestSession({ userId: outsider.id });
+      const res = await server.webapp.fetch(rolesData(org.slug), {
+        redirect: "manual",
+        headers: { Cookie: cookie },
+      });
+      const body = await res.text();
+      // With the tenant floor a non-member is denied (a redirect), so they never
+      // get the loader's 200 payload. Before the fix the permissive ability let
+      // the loader return the org's role/permission catalogue.
+      expect(res.status).not.toBe(200);
+      expect(body).not.toContain("manage:members");
+    });
+
+    it("allows a member: the loader returns the catalogue", async () => {
+      const { server, owner, org } = await seedOrgWithOwner();
+      const cookie = await seedTestSession({ userId: owner.id });
+      const res = await server.webapp.fetch(rolesData(org.slug), {
+        redirect: "manual",
+        headers: { Cookie: cookie },
+      });
+      expect(res.status).toBe(200);
+    });
+  });
 });
diff --git a/apps/webapp/test/rbacFallbackSessionFloor.test.ts b/apps/webapp/test/rbacFallbackSessionFloor.test.ts
@@ -0,0 +1,110 @@
+import { postgresTest } from "@internal/testcontainers";
+import plugin from "@trigger.dev/rbac";
+import { type PrismaClient } from "@trigger.dev/database";
+import { describe, expect, vi } from "vitest";
+import {
+  createTestOrgProjectWithMember,
+  createTestUser,
+} from "./fixtures/environmentVariablesFixtures";
+
+vi.setConfig({ testTimeout: 60_000 });
+
+// The RBAC fallback ability is permissive (`can: () => true` for a non-admin), so
+// `ability.can` is not a tenant floor. `authenticateSession` is the gate every
+// org-scoped dashboard route relies on; a non-member in an org context must be
+// denied here, or a permissive ability lets them act on any org whose slug they
+// know. The route-level e2e (auth-dashboard.e2e.full) covers the HTTP path; this
+// pins the fallback gate directly since that path can't run without a container.
+function fallback(prisma: PrismaClient) {
+  // forceFallback skips the closed-source plugin and uses the in-repo fallback.
+  return plugin.create({ primary: prisma, replica: prisma }, { forceFallback: true });
+}
+
+const request = new Request("https://app.trigger.dev/orgs/x/settings/roles");
+
+describe("RBAC fallback authenticateSession — org membership floor", () => {
+  postgresTest("denies a non-member in an org context", async ({ prisma }) => {
+    const { organization } = await createTestOrgProjectWithMember(prisma);
+    const outsider = await createTestUser(prisma);
+
+    const result = await fallback(prisma).authenticateSession(request, {
+      userId: outsider.id,
+      organizationId: organization.id,
+    });
+
+    expect(result).toMatchObject({ ok: false, reason: "unauthorized" });
+  });
+
+  postgresTest("allows a member in an org context", async ({ prisma }) => {
+    const { user, organization } = await createTestOrgProjectWithMember(prisma);
+
+    const result = await fallback(prisma).authenticateSession(request, {
+      userId: user.id,
+      organizationId: organization.id,
+    });
+
+    expect(result.ok).toBe(true);
+  });
+
+  postgresTest(
+    "stays permissive with no org context, even for a non-member",
+    async ({ prisma }) => {
+      // Identity-only checks (no organizationId) predate any scope, so the floor
+      // does not apply and the permissive baseline is preserved.
+      const outsider = await createTestUser(prisma);
+
+      const result = await fallback(prisma).authenticateSession(request, { userId: outsider.id });
+
+      expect(result.ok).toBe(true);
+    }
+  );
+
+  // A project-only scope is still a tenant claim, so the floor resolves the
+  // project's organization rather than letting the context through unchecked.
+  postgresTest("denies a non-member scoped only to a project", async ({ prisma }) => {
+    const { project } = await createTestOrgProjectWithMember(prisma);
+    const outsider = await createTestUser(prisma);
+
+    const result = await fallback(prisma).authenticateSession(request, {
+      userId: outsider.id,
+      projectId: project.id,
+    });
+
+    expect(result).toMatchObject({ ok: false, reason: "unauthorized" });
+  });
+
+  postgresTest("allows a member scoped only to a project", async ({ prisma }) => {
+    const { user, project } = await createTestOrgProjectWithMember(prisma);
+
+    const result = await fallback(prisma).authenticateSession(request, {
+      userId: user.id,
+      projectId: project.id,
+    });
+
+    expect(result.ok).toBe(true);
+  });
+
+  // The membership probe reads the replica first and the primary on a miss, so a
+  // member whose row has not replicated yet is not bounced. Modelled by giving
+  // the controller a replica that cannot see the row and a primary that can.
+  postgresTest("allows a member the replica has not caught up on", async ({ prisma }) => {
+    const { user, organization } = await createTestOrgProjectWithMember(prisma);
+    const blindReplica = {
+      ...prisma,
+      orgMember: { findFirst: async () => null },
+      user: prisma.user,
+      project: prisma.project,
+    } as unknown as PrismaClient;
+
+    const controller = plugin.create(
+      { primary: prisma, replica: blindReplica },
+      { forceFallback: true }
+    );
+    const result = await controller.authenticateSession(request, {
+      userId: user.id,
+      organizationId: organization.id,
+    });
+
+    expect(result.ok).toBe(true);
+  });
+});
diff --git a/internal-packages/rbac/src/fallback.ts b/internal-packages/rbac/src/fallback.ts
@@ -98,6 +98,21 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
     const user = await this.replica.user.findFirst({ where: { id: context.userId } });
     if (!user) return { ok: false, reason: "unauthenticated" };
 
+    // A non-member in a scoped context is denied, not handed a permissive
+    // ability. buildFallbackAbility is permissive for a non-admin
+    // (can: () => true), so ability.can is not a tenant floor; returning it here
+    // let a non-member act on any org whose slug they knew. An unscoped context
+    // stays permissive (identity-only checks predate any scope), and a platform
+    // admin keeps their ability.
+    if (!user.admin) {
+      const denied = await this.deniedByMembership(
+        context.organizationId,
+        context.projectId,
+        user.id
+      );
+      if (denied) return { ok: false, reason: "unauthorized" };
+    }
+
     const subject: RbacSubject = {
       type: "user",
       userId: user.id,
@@ -113,6 +128,46 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
     };
   }
 
+  /**
+   * Whether a non-admin user is outside the tenant a scoped context names. A project-only scope
+   * resolves through the project's organization, so the floor holds whichever scope a route
+   * resolves; an unscoped context is not a tenant claim and is never denied here.
+   *
+   * Both lookups read the replica first and fall back to the primary before denying: org creation,
+   * invite acceptance and SSO provisioning all write to the primary, so a member who just joined
+   * must not be bounced while the row replicates.
+   */
+  private async deniedByMembership(
+    organizationId: string | undefined,
+    projectId: string | undefined,
+    userId: string
+  ): Promise<boolean> {
+    let orgId = organizationId;
+
+    if (!orgId && projectId) {
+      const project =
+        (await this.replica.project.findFirst({
+          where: { id: projectId },
+          select: { organizationId: true },
+        })) ??
+        (await this.prisma.project.findFirst({
+          where: { id: projectId },
+          select: { organizationId: true },
+        }));
+      // An unresolvable project names no tenant, so there is nothing to deny against.
+      if (!project) return false;
+      orgId = project.organizationId;
+    }
+
+    if (!orgId) return false;
+
+    const where = { organizationId: orgId, userId };
+    const member =
+      (await this.replica.orgMember.findFirst({ where, select: { id: true } })) ??
+      (await this.prisma.orgMember.findFirst({ where, select: { id: true } }));
+    return !member;
+  }
+
   async authenticateAuthorizeBearer(
     request: Request,
     check: { action: string; resource: RbacResource | RbacResource[] },
