fix(webapp): use branch permissions for branch management

Mono-RevId: 6620c9d8e5ba543eeb8ef18cc82e944e3b3fb365

Author: carderne

.server-changes/branch-management-permission.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Creating and archiving Development and Preview branches now requires the branch management permission, which the Developer role has by default.

apps/webapp/app/components/BlankStatePanels.tsx

@@ -478,11 +478,13 @@ export function BranchesNoBranches({
   limits,
   canUpgrade,
   showSelfServe,
+  canCreateBranches,
 }: {
   env: BranchableEnvironmentToken;
   limits: { used: number; limit: number };
   canUpgrade: boolean;
   showSelfServe: boolean;
+  canCreateBranches: boolean;
 }) {
   const organization = useOrganization();
 
@@ -534,6 +536,10 @@ export function BranchesNoBranches({
               variant="primary/small"
               LeadingIcon={PlusIcon}
               leadingIconClassName="text-white"
+              disabled={!canCreateBranches}
+              tooltip={
+                canCreateBranches ? undefined : "You don't have permission to create branches."
+              }
             >
               New branch
             </Button>

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.branches/route.tsx

@@ -122,7 +122,9 @@ export const loader = dashboardLoader(
 
       return typedjson({
         ...result,
-        canArchiveBranches: ability.can("write", { type: "deployments", envType: "PREVIEW" }),
+        canManageBranches:
+          ability.can("write", { type: "branches", envType: "PREVIEW" }) ||
+          ability.can("write", { type: "deployments", envType: "PREVIEW" }),
       });
     } catch (error) {
       logger.error("Error loading preview branches page", { error });
@@ -217,7 +219,7 @@ export default function Page() {
     totalPages,
     hasBranches,
     canPurchaseBranches,
-    canArchiveBranches,
+    canManageBranches,
     extraBranches,
     branchPricing,
     maxBranchQuota,
@@ -301,6 +303,10 @@ export default function Page() {
                   leadingIconClassName="text-white"
                   fullWidth
                   textAlignLeft
+                  disabled={!canManageBranches}
+                  tooltip={
+                    canManageBranches ? undefined : "You don't have permission to create branches."
+                  }
                 >
                   New branch…
                 </Button>
@@ -319,6 +325,7 @@ export default function Page() {
                 limits={limits}
                 canUpgrade={canUpgrade ?? false}
                 showSelfServe={showSelfServe}
+                canCreateBranches={canManageBranches}
               />
             </MainCenteredContainer>
           ) : (
@@ -415,7 +422,7 @@ export default function Page() {
                                     {!branch.archivedAt ? (
                                       <ArchiveButton
                                         environment={branch}
-                                        canArchive={canArchiveBranches}
+                                        canArchive={canManageBranches}
                                       />
                                     ) : null}
                                   </>

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.dev-branches/route.tsx

@@ -76,7 +76,9 @@ export const loader = dashboardLoader(
 
       return typedjson({
         ...result,
-        canArchiveBranches: ability.can("write", { type: "deployments", envType: "DEVELOPMENT" }),
+        canManageBranches:
+          ability.can("write", { type: "branches", envType: "DEVELOPMENT" }) ||
+          ability.can("write", { type: "deployments", envType: "DEVELOPMENT" }),
       });
     } catch (error) {
       logger.error("Error loading dev branches page", { error });
@@ -93,7 +95,7 @@ export const handle: Handle = {
 };
 
 export default function Page() {
-  const { branches, limits, currentPage, totalPages, canArchiveBranches } =
+  const { branches, limits, currentPage, totalPages, canManageBranches } =
     useTypedLoaderData<typeof loader>();
   useAutoRevalidate({ interval: 5000 });
 
@@ -144,6 +146,10 @@ export default function Page() {
                   leadingIconClassName="text-white"
                   fullWidth
                   textAlignLeft
+                  disabled={!canManageBranches}
+                  tooltip={
+                    canManageBranches ? undefined : "You don't have permission to create branches."
+                  }
                 >
                   New branch…
                 </Button>
@@ -249,7 +255,7 @@ export default function Page() {
                                 {!branch.archivedAt ? (
                                   <ArchiveButton
                                     environment={branch}
-                                    canArchive={canArchiveBranches}
+                                    canArchive={canManageBranches}
                                     // The root dev env (no parent) is the default
                                     // branch and can't be archived — matches the
                                     // guard in ArchiveBranchService.

apps/webapp/app/routes/api.v1.projects.$projectRef.branches.archive.ts

@@ -157,7 +157,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
       organizationId: environment.organizationId,
       projectId: environment.projectId,
       envType: environment.type,
-      resource: "deployments",
+      resource: ["branches", "deployments"],
       action: "write",
     });
     if (denied) return denied;

apps/webapp/app/routes/api.v1.projects.$projectRef.branches.ts

@@ -4,9 +4,11 @@ import { DEFAULT_DEV_BRANCH, isDefaultDevBranch } from "@trigger.dev/core/v3/uti
 import { z } from "zod";
 import { prisma } from "~/db.server";
 import { authenticateRequestWithScopedApiKey } from "~/services/apiAuth.server";
+import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
 import { logger } from "~/services/logger.server";
 import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
 import { UpsertBranchService } from "~/services/upsertBranch.server";
+import { toBranchableEnvironmentType } from "~/utils/branchableEnvironment";
 
 const ParamsSchema = z.object({
   projectRef: z.string(),
@@ -48,16 +50,17 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   const { projectRef } = parsedParams.data;
 
-  let project: { id: string } | null | undefined;
+  let project: { id: string; organizationId: string } | null | undefined;
   if (authenticationResult.type === "apiKey") {
     project =
       apiKeyEnvironment?.project.externalRef === projectRef
-        ? { id: apiKeyEnvironment.project.id }
+        ? { id: apiKeyEnvironment.project.id, organizationId: apiKeyEnvironment.organizationId }
         : undefined;
   } else {
     project = await prisma.project.findFirst({
       select: {
         id: true,
+        organizationId: true,
       },
       where: {
         externalRef: projectRef,
@@ -121,6 +124,19 @@ export async function action({ request, params }: ActionFunctionArgs) {
     );
   }
 
+  if (authenticationResult.type !== "apiKey") {
+    const denied = await authorizePatEnvironmentAccess({
+      request,
+      authType: authenticationResult.type,
+      organizationId: project.organizationId,
+      projectId: project.id,
+      envType: toBranchableEnvironmentType(env),
+      resource: ["branches", "deployments"],
+      action: "write",
+    });
+    if (denied) return denied;
+  }
+
   let orgFilter:
     | { type: "userMembership"; userId: string }
     | { type: "orgId"; organizationId: string };

apps/webapp/app/routes/resources.branches.archive.tsx

@@ -55,7 +55,11 @@ export async function action({ request }: ActionFunctionArgs) {
     organizationId: environment.organizationId,
     projectId: environment.projectId,
   });
-  if (!auth.ok || !auth.ability.can("write", { type: "deployments", envType: environment.type })) {
+  const canArchive =
+    auth.ok &&
+    (auth.ability.can("write", { type: "branches", envType: environment.type }) ||
+      auth.ability.can("write", { type: "deployments", envType: environment.type }));
+  if (!canArchive) {
     return redirectWithErrorMessage(
       redirectPath,
       request,

apps/webapp/app/routes/resources.branches.create.tsx

@@ -5,6 +5,7 @@ import { useFetcher, useLocation, useSearchParams } from "@remix-run/react";
 import { type ActionFunctionArgs, json } from "@remix-run/server-runtime";
 import { useEffect, useState } from "react";
 import { InlineCode } from "~/components/code/InlineCode";
+import { $replica } from "~/db.server";
 import { Button } from "~/components/primitives/Buttons";
 import { Dialog, DialogContent, DialogHeader, DialogTrigger } from "~/components/primitives/Dialog";
 import { Fieldset } from "~/components/primitives/Fieldset";
@@ -16,9 +17,13 @@ import { InputGroup } from "~/components/primitives/InputGroup";
 import { Label } from "~/components/primitives/Label";
 import { useProject } from "~/hooks/useProject";
 import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/message.server";
+import { rbac } from "~/services/rbac.server";
 import { requireUserId } from "~/services/session.server";
 import { UpsertBranchService } from "~/services/upsertBranch.server";
-import { type BranchableEnvironmentToken } from "~/utils/branchableEnvironment";
+import {
+  type BranchableEnvironmentToken,
+  toBranchableEnvironmentType,
+} from "~/utils/branchableEnvironment";
 import { CreateBranchFormSchema } from "~/utils/branches";
 import { branchesDevPath, branchesPath } from "~/utils/pathBuilder";
 
@@ -32,6 +37,34 @@ export async function action({ request }: ActionFunctionArgs) {
     return redirectWithErrorMessage("/", request, "Invalid form data");
   }
 
+  const project = await $replica.project.findFirst({
+    where: {
+      id: submission.value.projectId,
+      organization: { members: { some: { userId } } },
+    },
+    select: { id: true, organizationId: true },
+  });
+  if (!project) {
+    return json(submission.reply({ formErrors: ["Project not found"] }), { status: 404 });
+  }
+
+  const environmentType = toBranchableEnvironmentType(submission.value.env);
+  const auth = await rbac.authenticateSession(request, {
+    userId,
+    organizationId: project.organizationId,
+    projectId: project.id,
+  });
+  const canCreate =
+    auth.ok &&
+    (auth.ability.can("write", { type: "branches", envType: environmentType }) ||
+      auth.ability.can("write", { type: "deployments", envType: environmentType }));
+  if (!canCreate) {
+    return json(
+      submission.reply({ formErrors: ["You don't have permission to create branches."] }),
+      { status: 403 }
+    );
+  }
+
   const upsertBranchService = new UpsertBranchService();
   const result = await upsertBranchService.call(
     { type: "userMembership", userId },

apps/webapp/app/services/environmentVariableApiAccess.server.ts

@@ -11,7 +11,7 @@ import {
 } from "~/services/apiAuth.server";
 import { rbac } from "~/services/rbac.server";
 
-type EnvironmentScopedResource = "envvars" | "apiKeys" | "deployments";
+type EnvironmentScopedResource = "envvars" | "apiKeys" | "deployments" | "branches";
 
 type EnvironmentScopedAuthentication =
   | { ok: true; authentication: AuthenticationResult }
@@ -112,11 +112,11 @@ const RESOURCE_LABELS: Record<EnvironmentScopedResource, string> = {
   envvars: "environment variables",
   apiKeys: "API keys",
   deployments: "deployments",
+  branches: "branches",
 };
 
 /**
- * Env-tier RBAC for environment-scoped API routes (env vars, and the endpoints
- * that hand out an environment's secret credentials).
+ * Env-tier RBAC for environment-scoped API routes.
  *
  * Machine credentials (an environment's API key) are authorized by the
  * ability returned by the RBAC bearer controller. A personal
@@ -145,11 +145,13 @@ export async function authorizePatEnvironmentAccess({
   organizationId: string;
   projectId: string;
   envType: RuntimeEnvironmentType;
-  resource: EnvironmentScopedResource;
+  resource: EnvironmentScopedResource | EnvironmentScopedResource[];
   action: "read" | "write";
   // Controller ability for API-key credentials. Absent for PAT/OAT callers.
   ability?: RbacAbility;
 }): Promise<Response | undefined> {
+  const resources = Array.isArray(resource) ? resource : [resource];
+  const resourceLabel = RESOURCE_LABELS[resources[0] ?? "branches"];
   const bearer = request.headers
     .get("Authorization")
     ?.replace(/^Bearer /, "")
@@ -159,12 +161,12 @@ export async function authorizePatEnvironmentAccess({
   // Machine API keys are authorized by their controller ability. Root keys and
   // ungranted additional keys are permissive; granted keys are restricted.
   if (authType === "apiKey") {
-    if (ability?.can(action, { type: resource })) {
+    if (resources.some((candidate) => ability?.can(action, { type: candidate }))) {
       return undefined;
     }
     return json(
       {
-        error: `You don't have permission to access this environment's ${RESOURCE_LABELS[resource]}.`,
+        error: `You don't have permission to access this environment's ${resourceLabel}.`,
       },
       { status: 403 }
     );
@@ -183,10 +185,10 @@ export async function authorizePatEnvironmentAccess({
     return json({ error: userAuth.error }, { status: userAuth.status });
   }
 
-  if (!userAuth.ability.can(action, { type: resource, envType })) {
+  if (!resources.some((candidate) => userAuth.ability.can(action, { type: candidate, envType }))) {
     return json(
       {
-        error: `You don't have permission to access this environment's ${RESOURCE_LABELS[resource]}.`,
+        error: `You don't have permission to access this environment's ${resourceLabel}.`,
       },
       { status: 403 }
     );