feat(api): presign deployment artifact download URLs on demand

Adds GET /api/v1/deployments/:id/artifact-url, which returns a
short-lived presigned URL for the deployment's artifact after verifying
the key belongs to the caller's environment and the object still exists.

Mono-RevId: a8cc8df3b0d9e6ea86247562cee63593879cac71

Author: myftija

.changeset/deployment-artifact-url-schema.md

@@ -0,0 +1,5 @@
+---
+"@trigger.dev/core": patch
+---
+
+Adds the `GetDeploymentArtifactUrlResponseBody` schema for the deployment artifact download URL endpoint.

apps/webapp/app/env.server.ts

@@ -867,6 +867,12 @@ const EnvironmentSchema = z
       .number()
       .int()
       .default(100 * 1024 * 1024), // 100MB
+    DEPLOYMENT_ARTIFACT_DOWNLOAD_URL_TTL_SECONDS: z.coerce
+      .number()
+      .int()
+      .positive()
+      .max(60 * 60 * 24 * 7) // SigV4 presign limit
+      .default(60 * 10), // 10 minutes
     DEPLOYMENT_BUILD_ENV_VARS_SIZE_LIMIT_BYTES: z.coerce
       .number()
       .int()

apps/webapp/app/routes/api.v1.deployments.$deploymentId.artifact-url.ts

@@ -0,0 +1,94 @@
+import { type LoaderFunctionArgs, json } from "@remix-run/server-runtime";
+import { type GetDeploymentArtifactUrlResponseBody } from "@trigger.dev/core/v3";
+import { z } from "zod";
+import { authenticateApiKeyWithScope } from "~/services/apiAuth.server";
+import { logger } from "~/services/logger.server";
+import { ArtifactsService } from "~/v3/services/artifacts.server";
+
+const ParamsSchema = z.object({
+  deploymentId: z.string(),
+});
+
+export async function loader({ request, params }: LoaderFunctionArgs) {
+  const parsedParams = ParamsSchema.safeParse(params);
+
+  if (!parsedParams.success) {
+    return json({ error: "Invalid params" }, { status: 400 });
+  }
+
+  try {
+    const authResult = await authenticateApiKeyWithScope(request, {
+      action: "write",
+      resource: { type: "deployments" },
+    });
+
+    if (!authResult.ok) {
+      logger.info("Invalid or missing api key", { url: request.url });
+      return json({ error: authResult.error }, { status: authResult.status });
+    }
+
+    const authenticatedEnv = authResult.authentication.environment;
+    const { deploymentId } = parsedParams.data;
+    const logContext = {
+      deploymentId,
+      environmentId: authenticatedEnv.id,
+      projectId: authenticatedEnv.projectId,
+    };
+
+    return await new ArtifactsService()
+      .createDeploymentDownloadUrl(authenticatedEnv, deploymentId)
+      .match(
+        ({ url, expiresAt }) => {
+          logger.info("Issued deployment artifact download URL", logContext);
+          return json(
+            {
+              url,
+              expiresAt: expiresAt.toISOString(),
+            } satisfies GetDeploymentArtifactUrlResponseBody,
+            { headers: { "Cache-Control": "private, no-store" } }
+          );
+        },
+        (error) => {
+          switch (error.type) {
+            case "development_environment":
+              return json(
+                { error: "Deployments are not supported in development environments" },
+                { status: 400 }
+              );
+            case "deployment_not_found":
+              return json({ error: "deployment_not_found" }, { status: 404 });
+            case "artifact_not_found":
+              return json({ error: "artifact_not_found" }, { status: 404 });
+            case "artifact_key_not_owned":
+              logger.warn("Deployment artifact key does not belong to the environment", {
+                ...logContext,
+                key: error.key,
+              });
+              return json({ error: "artifact_not_found" }, { status: 404 });
+            case "artifacts_bucket_not_configured":
+              logger.error("Artifacts bucket is not configured", logContext);
+              return json({ error: "Internal server error" }, { status: 500 });
+            case "failed_to_check_artifact":
+            case "failed_to_create_download_url":
+              logger.error("Failed to create deployment artifact download URL", {
+                ...logContext,
+                error: error.cause,
+              });
+              return json({ error: "Internal server error" }, { status: 500 });
+            case "other":
+            default:
+              error.type satisfies "other";
+              logger.error("Failed to load deployment for artifact download URL", {
+                ...logContext,
+                error: error.cause,
+              });
+              return json({ error: "Internal server error" }, { status: 500 });
+          }
+        }
+      );
+  } catch (error) {
+    if (error instanceof Response) throw error;
+    logger.error("Failed to create deployment artifact download URL", { error });
+    return json({ error: "Internal Server Error" }, { status: 500 });
+  }
+}

apps/webapp/app/v3/services/artifacts.server.ts

@@ -1,10 +1,14 @@
 import type { AuthenticatedEnvironment } from "~/services/apiAuth.server";
 import { BaseService } from "./baseService.server";
 import { env } from "~/env.server";
+import { logger } from "~/services/logger.server";
 import { createPresignedPost } from "@aws-sdk/s3-presigned-post";
-import { S3Client } from "@aws-sdk/client-s3";
+import { getSignedUrl } from "@aws-sdk/s3-request-presigner";
+import { GetObjectCommand, HeadObjectCommand, S3Client } from "@aws-sdk/client-s3";
+import { BuildServerMetadata } from "@trigger.dev/core/v3";
 import { customAlphabet } from "nanoid";
-import { errAsync, fromPromise } from "neverthrow";
+import { errAsync, fromPromise, okAsync } from "neverthrow";
+import type { PrismaClientOrTransaction } from "@trigger.dev/database";
 
 const nanoid = customAlphabet("1234567890abcdefghijklmnopqrstuvwxyz", 24);
 const objectStoreClient =
@@ -32,8 +36,40 @@ const artifactBytesSizeLimitByType = {
   deployment_bundle: env.DEPLOYMENT_BUNDLE_ARTIFACT_SIZE_LIMIT_BYTES,
 } as const;
 
+export type ArtifactOwner = Pick<AuthenticatedEnvironment, "id" | "slug" | "type"> & {
+  project: { externalRef: string };
+};
+
+const ArtifactKeyMetadata = BuildServerMetadata.pick({ artifactKey: true });
+
+export function isArtifactKeyOwnedBy(owner: ArtifactOwner, key: string): boolean {
+  const [prefix, projectRef, envSlug, file, ...rest] = key.split("/");
+  return (
+    rest.length === 0 &&
+    Object.values<string>(artifactKeyPrefixByType).includes(prefix) &&
+    projectRef === owner.project.externalRef &&
+    envSlug === owner.slug &&
+    !!file
+  );
+}
+
 export class ArtifactsService extends BaseService {
-  private readonly bucket = env.ARTIFACTS_OBJECT_STORE_BUCKET;
+  private readonly client: S3Client;
+  private readonly bucket: string | undefined;
+  private readonly downloadUrlTtlSeconds: number;
+
+  constructor(options?: {
+    prisma?: PrismaClientOrTransaction;
+    client?: S3Client;
+    bucket?: string;
+    downloadUrlTtlSeconds?: number;
+  }) {
+    super(options?.prisma);
+    this.client = options?.client ?? objectStoreClient;
+    this.bucket = options?.bucket ?? env.ARTIFACTS_OBJECT_STORE_BUCKET;
+    this.downloadUrlTtlSeconds =
+      options?.downloadUrlTtlSeconds ?? env.DEPLOYMENT_ARTIFACT_DOWNLOAD_URL_TTL_SECONDS;
+  }
 
   public createArtifact(
     type: "deployment_context" | "deployment_bundle",
@@ -63,6 +99,74 @@ export class ArtifactsService extends BaseService {
     }));
   }
 
+  public createDeploymentDownloadUrl(
+    authenticatedEnv: ArtifactOwner,
+    deploymentFriendlyId: string
+  ) {
+    if (authenticatedEnv.type === "DEVELOPMENT") {
+      return errAsync({ type: "development_environment" as const });
+    }
+
+    return fromPromise(
+      this._prisma.workerDeployment.findFirst({
+        where: { friendlyId: deploymentFriendlyId, environmentId: authenticatedEnv.id },
+        select: { buildServerMetadata: true },
+      }),
+      (error) => ({ type: "other" as const, cause: error })
+    )
+      .andThen((deployment) =>
+        deployment ? okAsync(deployment) : errAsync({ type: "deployment_not_found" as const })
+      )
+      .andThen((deployment) => {
+        const key = ArtifactKeyMetadata.safeParse(deployment.buildServerMetadata).data?.artifactKey;
+        return key ? okAsync(key) : errAsync({ type: "artifact_not_found" as const });
+      })
+      .andThen((key) => this.createDownloadUrl(authenticatedEnv, key));
+  }
+
+  private createDownloadUrl(owner: ArtifactOwner, key: string) {
+    if (!this.bucket) {
+      return errAsync({
+        type: "artifacts_bucket_not_configured" as const,
+      });
+    }
+
+    if (!isArtifactKeyOwnedBy(owner, key)) {
+      return errAsync({ type: "artifact_key_not_owned" as const, key: key.slice(0, 200) });
+    }
+
+    const bucket = this.bucket;
+    const ttlSeconds = this.downloadUrlTtlSeconds;
+    const signedAt = Date.now();
+
+    return fromPromise(
+      this.client.send(new HeadObjectCommand({ Bucket: bucket, Key: key })),
+      (error) => error
+    )
+      .mapErr((error) => {
+        const status = httpStatusOf(error);
+        // 403 is also what S3 answers for a missing key without s3:ListBucket
+        if (status === 403) {
+          logger.warn("Artifact HEAD returned 403; treating as missing", { key });
+        }
+        return status === 404 || status === 403
+          ? { type: "artifact_not_found" as const }
+          : { type: "failed_to_check_artifact" as const, cause: error };
+      })
+      .andThen(() =>
+        fromPromise(
+          getSignedUrl(this.client, new GetObjectCommand({ Bucket: bucket, Key: key }), {
+            expiresIn: ttlSeconds,
+          }),
+          (error) => ({
+            type: "failed_to_create_download_url" as const,
+            cause: error,
+          })
+        )
+      )
+      .map((url) => ({ url, expiresAt: new Date(signedAt + ttlSeconds * 1000) }));
+  }
+
   private createPresignedPost(key: string, sizeLimit: number, contentLength?: number) {
     if (!this.bucket) {
       return errAsync({
@@ -74,7 +178,7 @@ export class ArtifactsService extends BaseService {
     const expiresAt = new Date(Date.now() + ttlSeconds * 1000);
 
     return fromPromise(
-      createPresignedPost(objectStoreClient, {
+      createPresignedPost(this.client, {
         Bucket: this.bucket,
         Key: key,
         Conditions: [["content-length-range", 0, sizeLimit]],
@@ -93,3 +197,7 @@ export class ArtifactsService extends BaseService {
     }));
   }
 }
+
+function httpStatusOf(error: unknown): number | undefined {
+  return (error as { $metadata?: { httpStatusCode?: number } })?.$metadata?.httpStatusCode;
+}