fix(webapp): keep the project-wide answer for an environment-agnostic user-actor token

Binding a delegated token to its environment claim on the project-wide
routes also refused any token that carries no claim at all, which the
public PAT exchange used by MCP and the CLI is allowed to issue. Line the
project-wide helper up with its neighbours: a claimless dashboard-agent
token is still refused, everything else stays project-wide.

Author: kathiekiwi

apps/webapp/app/services/userActorEnvironment.server.ts

@@ -73,8 +73,9 @@ export async function assertUserActorScope(
 }
 
 /**
- * The environment a project-wide route must narrow to. `scoped: false` is every non-delegated
- * caller (session, PAT, org token) — project-wide, unchanged.
+ * The environment a project-wide route must narrow to. `scoped: false` is every caller with no
+ * environment claim to narrow to — a session, a PAT, an org token, or an environment-agnostic
+ * UAT — and stays project-wide, unchanged.
  */
 export type UserActorEnvironmentScope =
   | { scoped: false }
@@ -85,10 +86,11 @@ export type UserActorEnvironmentScope =
  * across a project. Without this, an environment-scoped token reads every environment its user
  * is a member of — the claim would only bind the per-environment routes.
  *
- * Throws a 403 Response when the claim can't be honoured: no claim (nothing to narrow to), a
- * claim outside the target project, or a request filter that names anything else. A conflicting
- * filter is refused rather than overridden, so a caller never gets another environment's shape
- * of answer under its own filter.
+ * Throws a 403 Response when a claim can't be honoured: a claim outside the target project, or a
+ * request filter that names anything else. A conflicting filter is refused rather than overridden,
+ * so a caller never gets another environment's shape of answer under its own filter. A token with
+ * no claim keeps the project-wide answer, as the public PAT exchange's MCP and CLI callers expect —
+ * except a dashboard-agent token, which always carries one, so its absence is a bug.
  */
 export async function resolveUserActorEnvironmentScope(
   userActor: UserActorClaims | undefined,
@@ -97,7 +99,8 @@ export async function resolveUserActorEnvironmentScope(
   if (!userActor) return { scoped: false };
 
   if (!userActor.environmentId) {
-    throw forbiddenEnvironment("This token isn't scoped to an environment.");
+    assertClaimIsOptional(userActor);
+    return { scoped: false };
   }
 
   const environment = await $replica.runtimeEnvironment.findFirst({

apps/webapp/test/userActorProjectWideScope.test.ts

@@ -260,16 +260,16 @@ postgresTest(
 );
 
 postgresTest(
-  "a claimless user-actor token gets nothing project-wide",
+  "a claimless dashboard-agent token is refused",
   async ({ prisma }) => {
     ctx.prisma = prisma;
     const seeded = await seedProject(prisma);
     ctx.patUserId = seeded.user.id;
 
-    // Any delegated client, not just the agent: a project-wide route has no scope to narrow to.
+    // The agent always mints per-environment, so a claimless one of its own is a bug, not a flow.
     const claimless = await call(environmentsLoader, {
       projectRef: seeded.project.externalRef,
-      token: await agentToken(seeded.user.id, undefined, "mcp"),
+      token: await agentToken(seeded.user.id, undefined),
     });
 
     expect(claimless.status).toBe(403);
@@ -278,6 +278,39 @@ postgresTest(
   60_000
 );
 
+postgresTest(
+  "a claimless user-actor token from another client still gets the project-wide answer",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    ctx.presenterEnvironments = [];
+    const seeded = await seedProject(prisma);
+    ctx.patUserId = seeded.user.id;
+
+    // The public PAT exchange used by MCP and the CLI may issue an environment-agnostic token.
+    // Narrowing it would be a breaking change, so it reads the whole project as it always has.
+    const environments = await call(environmentsLoader, {
+      projectRef: seeded.project.externalRef,
+      token: await agentToken(seeded.user.id, undefined, "mcp"),
+    });
+
+    expect(environments.status).toBe(200);
+    expect(environments.body.map((env: any) => env.id).sort()).toEqual(
+      [seeded.envA.id, seeded.envB.id].sort()
+    );
+
+    const runs = await call(runsLoader, {
+      projectRef: seeded.project.externalRef,
+      token: await agentToken(seeded.user.id, undefined, "mcp"),
+      search: `?filter[env]=${seeded.envB.slug}`,
+    });
+
+    // No forced environment, and its own filter is honoured rather than refused.
+    expect(runs.status).toBe(200);
+    expect(ctx.presenterEnvironments).toEqual([undefined]);
+  },
+  60_000
+);
+
 postgresTest(
   "a personal access token still gets the project-wide answer",
   async ({ prisma }) => {