feat(cli,webapp): bootstrap new accounts from the CLI

Mono-RevId: bd637f60d90b7f86a549f9c7d038d4b948f6c057

Author: carderne

.changeset/fresh-accounts-bootstrap.md

@@ -0,0 +1,5 @@
+---
+"trigger.dev": patch
+---
+
+Set up a new Trigger.dev account from the CLI. Login can prefill an email address, save the user's full name after authorization, and resume authorization later, while `init` can create the first organization, activate its Free plan, and create the first project before scaffolding the app.

apps/webapp/app/routes/api.v1.orgs.$orgParam.activate-free-plan.ts

@@ -0,0 +1,55 @@
+import { json } from "@remix-run/server-runtime";
+import { z } from "zod";
+import { prisma } from "~/db.server";
+import { env } from "~/env.server";
+import { resolveOrganizationForApiUser } from "~/services/organizationApiAccess.server";
+import { activateFreePlan } from "~/services/platform.v3.server";
+import { createActionPATApiRoute } from "~/services/routeBuilders/apiBuilder.server";
+import { engine } from "~/v3/runEngine.server";
+
+const ParamsSchema = z.object({
+  orgParam: z.string(),
+});
+
+export const action = createActionPATApiRoute(
+  {
+    method: "POST",
+    params: ParamsSchema,
+    context: async ({ orgParam }) => {
+      const organization = await prisma.organization.findFirst({
+        where: { OR: [{ id: orgParam }, { slug: orgParam }], deletedAt: null },
+        select: { id: true },
+      });
+      return organization ? { organizationId: organization.id } : {};
+    },
+    authorization: { action: "manage", resource: () => ({ type: "billing" }) },
+  },
+  async ({ params, authentication }) => {
+    if (env.ORG_CREATION_API_ENABLED !== "1") {
+      return json({ error: "Not found" }, { status: 404 });
+    }
+
+    const organization = await resolveOrganizationForApiUser({
+      orgParam: params.orgParam,
+      userId: authentication.userId,
+    });
+
+    if (!organization) {
+      return json({ error: "Organization not found" }, { status: 404 });
+    }
+
+    if (organization.isActivated) {
+      return json({ error: "Organization is already activated" }, { status: 409 });
+    }
+
+    const result = await activateFreePlan(organization.id, authentication.userId, {
+      invalidateBillingCache: engine.invalidateBillingCache.bind(engine),
+    });
+
+    if (!result.success) {
+      return json({ error: "Failed to activate Free plan" }, { status: 502 });
+    }
+
+    return json({ plan: "free" as const });
+  }
+);

apps/webapp/app/routes/api.v1.orgs.ts

@@ -10,6 +10,8 @@ import {
 } from "~/services/routeBuilders/apiBuilder.server";
 import { extractDomain, faviconUrl } from "~/utils/favicon";
 
+const API_ORGANIZATION_LIMIT = 25;
+
 // Identity-only: lists the caller's own orgs, so no authorization gate.
 export const loader = createLoaderPATApiRoute(
   { identityOnly: true },
@@ -67,6 +69,24 @@ export const action = createActionPATApiRoute(
       );
     }
 
+    const organizationMemberships = await prisma.orgMember.findMany({
+      where: {
+        userId: authentication.userId,
+        organization: { deletedAt: null },
+      },
+      select: { id: true },
+      take: API_ORGANIZATION_LIMIT,
+    });
+
+    if (organizationMemberships.length >= API_ORGANIZATION_LIMIT) {
+      return json(
+        {
+          error: `Organization creation through the API is limited to ${API_ORGANIZATION_LIMIT} organizations. Create additional organizations in the dashboard.`,
+        },
+        { status: 403 }
+      );
+    }
+
     // Mirror the dashboard: stash companyUrl/companySize as onboarding data and
     // derive the org avatar from the company domain's favicon.
     const onboardingData: Record<string, string> = {};

apps/webapp/app/routes/api.v1.profile.complete.ts

@@ -0,0 +1,37 @@
+import { json } from "@remix-run/server-runtime";
+import { CompleteProfileRequestBody } from "@trigger.dev/core/v3";
+import { prisma } from "~/db.server";
+import { createActionPATApiRoute } from "~/services/routeBuilders/apiBuilder.server";
+
+export const action = createActionPATApiRoute(
+  {
+    method: "POST",
+    body: CompleteProfileRequestBody,
+  },
+  async ({ body, authentication }) => {
+    if (authentication.userActor) {
+      return json(
+        {
+          error: "Unauthorized",
+          code: "unauthorized",
+          param: "access_token",
+          type: "authorization",
+        },
+        { status: 403 }
+      );
+    }
+
+    const result = await prisma.user.updateMany({
+      where: {
+        id: authentication.userId,
+        confirmedBasicDetails: false,
+      },
+      data: {
+        name: body.name,
+        confirmedBasicDetails: true,
+      },
+    });
+
+    return json({ updated: result.count > 0 });
+  }
+);

apps/webapp/app/routes/login._index/route.tsx

@@ -95,6 +95,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
 
   const url = requestUrl(request);
   const redirectTo = url.searchParams.get("redirectTo");
+  const prefilledEmail = getAuthorizationEmail(redirectTo);
   const lastAuthMethod = await getLastAuthMethod(request);
 
   const notice =
@@ -152,6 +153,7 @@ export async function loader({ request }: LoaderFunctionArgs) {
         lastAuthMethod,
         authError,
         notice,
+        prefilledEmail,
         isVercelMarketplace: redirectTo.startsWith("/vercel/callback"),
       },
       { headers }
@@ -166,13 +168,29 @@ export async function loader({ request }: LoaderFunctionArgs) {
         lastAuthMethod,
         authError,
         notice,
+        prefilledEmail,
         isVercelMarketplace: false,
       },
       { headers }
     );
   }
 }
 
+export function getAuthorizationEmail(redirectTo: string | null) {
+  if (!redirectTo) return null;
+
+  try {
+    const redirectUrl = new URL(redirectTo, "https://trigger.dev");
+    if (!redirectUrl.pathname.startsWith("/account/authorization-code/")) return null;
+
+    const email = redirectUrl.searchParams.get("email");
+    const parsed = z.string().email().safeParse(email);
+    return parsed.success ? parsed.data : null;
+  } catch {
+    return null;
+  }
+}
+
 export default function LoginPage() {
   const data = useTypedLoaderData<typeof loader>();
   const navigation = useNavigation();
@@ -185,6 +203,9 @@ export default function LoginPage() {
 
   const [emailForm, emailFields] = useForm({
     id: "login-email",
+    defaultValue: {
+      email: data.prefilledEmail ?? "",
+    },
     onValidate({ formData }) {
       return parseWithZod(formData, { schema: emailSchema });
     },

apps/webapp/app/services/organizationApiAccess.server.ts

@@ -12,13 +12,13 @@ export async function resolveOrganizationForApiUser({
 }: {
   orgParam: string;
   userId: string;
-}): Promise<{ id: string; slug: string } | null> {
+}): Promise<{ id: string; slug: string; isActivated: boolean } | null> {
   return prisma.organization.findFirst({
     where: {
       OR: [{ id: orgParam }, { slug: orgParam }],
       deletedAt: null,
       members: { some: { userId } },
     },
-    select: { id: true, slug: true },
+    select: { id: true, slug: true, isActivated: true },
   });
 }

apps/webapp/app/services/platform.v3.server.ts

@@ -548,6 +548,36 @@ export async function getPlans() {
   }
 }
 
+export async function activateFreePlan(
+  organizationId: string,
+  userId: string,
+  opts?: { invalidateBillingCache?: (orgId: string) => void }
+): Promise<{ success: true } | { success: false; error: string }> {
+  if (!client) {
+    return { success: false, error: "Billing is not configured" };
+  }
+
+  const [error, result] = await tryCatch(client.setPlan(organizationId, { type: "free", userId }));
+
+  if (error) {
+    recordPlatformFailure("activateFreePlan", "caught");
+    return { success: false, error: error.message };
+  }
+
+  if (!result.success) {
+    recordPlatformFailure("activateFreePlan", "no_success");
+    return { success: false, error: result.error };
+  }
+
+  if (result.action !== "free_connect_required" && result.action !== "free_connected") {
+    return { success: false, error: "Unable to activate the Free plan" };
+  }
+
+  opts?.invalidateBillingCache?.(organizationId);
+  invalidatePlanDerivedCaches(organizationId);
+  return { success: true };
+}
+
 export async function setPlan(
   organization: { id: string; slug: string },
   request: Request,

apps/webapp/scripts/fk-cascade-index-baseline.json

@@ -126,11 +126,6 @@
       "onDelete": "Cascade",
       "fkColumns": ["organizationIntegrationId"]
     },
-    {
-      "key": "control-plane:OrgMember.user",
-      "onDelete": "Cascade",
-      "fkColumns": ["userId"]
-    },
     {
       "key": "control-plane:OrgMemberInvite.inviter",
       "onDelete": "Cascade",

apps/webapp/test/contextlessPatRoutes.test.ts

@@ -12,6 +12,7 @@ const mocks = vi.hoisted(() => ({
   authenticateUserActor: vi.fn(),
   authenticatePat: vi.fn(),
   createOrganization: vi.fn(),
+  findManyOrgMembers: vi.fn(),
   findManyProjects: vi.fn(),
   env: { SESSION_SECRET: "test-session-secret", ORG_CREATION_API_ENABLED: "1" } as {
     SESSION_SECRET: string;
@@ -26,7 +27,10 @@ vi.mock("~/services/rbac.server", () => ({
   },
 }));
 vi.mock("~/db.server", () => ({
-  prisma: { project: { findMany: mocks.findManyProjects } },
+  prisma: {
+    orgMember: { findMany: mocks.findManyOrgMembers },
+    project: { findMany: mocks.findManyProjects },
+  },
   $replica: {},
 }));
 vi.mock("~/env.server", () => ({ env: mocks.env }));
@@ -188,6 +192,8 @@ describe("creating an organization over the API", () => {
   // Creation always succeeds if it is reached, so a refusal is the gate and nothing else.
   beforeEach(() => {
     mocks.createOrganization.mockReset();
+    mocks.findManyOrgMembers.mockReset();
+    mocks.findManyOrgMembers.mockResolvedValue([]);
     mocks.createOrganization.mockResolvedValue({
       id: "org_new",
       title: "New Org",
@@ -210,6 +216,38 @@ describe("creating an organization over the API", () => {
     expect(result.status).toBe(201);
     expect(result.body.slug).toBe("new-org");
     expect(result.canCalls).toBe(0);
+    expect(mocks.findManyOrgMembers).toHaveBeenCalledWith({
+      where: {
+        userId: USER_ID,
+        organization: { deletedAt: null },
+      },
+      select: { id: true },
+      take: 25,
+    });
+  });
+
+  it("admits users with fewer than 25 organizations", async () => {
+    mocks.findManyOrgMembers.mockResolvedValue(
+      Array.from({ length: 24 }, (_, index) => ({ id: `member_${index}` }))
+    );
+
+    const result = await createOrgWithPat();
+
+    expect(result.status).toBe(201);
+    expect(mocks.createOrganization).toHaveBeenCalled();
+  });
+
+  it("directs users with 25 organizations to the dashboard", async () => {
+    mocks.findManyOrgMembers.mockResolvedValue(
+      Array.from({ length: 25 }, (_, index) => ({ id: `member_${index}` }))
+    );
+
+    const result = await createOrgWithPat();
+
+    expect(result.status).toBe(403);
+    expect(result.body.error).toContain("limited to 25 organizations");
+    expect(result.body.error).toContain("dashboard");
+    expect(mocks.createOrganization).not.toHaveBeenCalled();
   });
 
   // The env gate runs before the capability gate, so an install with the API disabled tells

internal-packages/database/prisma/migrations/20260928170000_add_org_member_user_id_index/migration.sql

@@ -0,0 +1 @@
+CREATE INDEX CONCURRENTLY IF NOT EXISTS "OrgMember_userId_idx" ON "OrgMember"("userId");