test(webapp): give the container-backed user-actor scope tests their own timeout

Author: kathiekiwi

apps/webapp/app/routes/api.v1.projects.$projectRef.runs.ts

@@ -52,9 +52,7 @@ export const loader = createLoaderPATApiRoute(
       project,
       searchParams,
       apiVersion,
-      scope.scoped
-        ? { id: scope.environmentId, organizationId: scope.organizationId }
-        : undefined
+      scope.scoped ? { id: scope.environmentId, organizationId: scope.organizationId } : undefined
     );
 
     if (!result) {

apps/webapp/app/services/personalAccessToken.server.ts

@@ -6,11 +6,7 @@ import { logger } from "./logger.server";
 import { rbac } from "./rbac.server";
 import { decryptToken, encryptToken, hashToken } from "~/utils/tokens.server";
 import { env } from "~/env.server";
-import {
-  isUserActorToken,
-  type UserActorClaims,
-  verifyUserActorToken,
-} from "@trigger.dev/rbac";
+import { isUserActorToken, type UserActorClaims, verifyUserActorToken } from "@trigger.dev/rbac";
 
 const tokenValueLength = 40;
 //lowercase only, removed 0 and l to avoid confusion

apps/webapp/test/userActorProjectWideScope.test.ts

@@ -57,15 +57,20 @@ vi.mock("~/services/clickhouse/clickhouseFactoryInstance.server", () => ({
 
 // The run list itself isn't under test — which environment the presenter is handed is.
 vi.mock("~/presenters/v3/ApiRunListPresenter.server", async () => {
-  const actual = await vi.importActual<
-    typeof import("~/presenters/v3/ApiRunListPresenter.server")
-  >("~/presenters/v3/ApiRunListPresenter.server");
+  const actual: any = await vi.importActual("~/presenters/v3/ApiRunListPresenter.server");
   return {
     ApiRunListSearchParams: actual.ApiRunListSearchParams,
     ApiRunListPresenter: class {
-      async call(_project: unknown, _searchParams: unknown, _apiVersion: unknown, environment?: any) {
+      async call(
+        _project: unknown,
+        _searchParams: unknown,
+        _apiVersion: unknown,
+        environment?: any
+      ) {
         ctx.presenterEnvironments.push(
-          environment ? { id: environment.id, organizationId: environment.organizationId } : undefined
+          environment
+            ? { id: environment.id, organizationId: environment.organizationId }
+            : undefined
         );
         return { data: [] };
       }
@@ -77,7 +82,10 @@ vi.mock("~/presenters/v3/ApiRunListPresenter.server", async () => {
 vi.mock("~/services/rbac.server", async () => {
   const { buildJwtAbility, verifyUserActorToken } = await import("@trigger.dev/rbac");
   const bearerOf = (request: Request) =>
-    request.headers.get("Authorization")?.replace(/^Bearer /, "").trim() ?? "";
+    request.headers
+      .get("Authorization")
+      ?.replace(/^Bearer /, "")
+      .trim() ?? "";
 
   return {
     rbac: {
@@ -205,25 +213,30 @@ postgresTest(
 
     expect(scoped.status).toBe(200);
     expect(scoped.body.map((env: any) => env.id)).toEqual([seeded.envA.id]);
-  }
+  },
+  60_000
 );
 
-postgresTest("a user-actor token sees only its own environment's runs", async ({ prisma }) => {
-  ctx.prisma = prisma;
-  ctx.presenterEnvironments = [];
-  const seeded = await seedProject(prisma);
-  ctx.patUserId = seeded.user.id;
+postgresTest(
+  "a user-actor token sees only its own environment's runs",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    ctx.presenterEnvironments = [];
+    const seeded = await seedProject(prisma);
+    ctx.patUserId = seeded.user.id;
 
-  const scoped = await call(runsLoader, {
-    projectRef: seeded.project.externalRef,
-    token: await agentToken(seeded.user.id, seeded.envA.id),
-  });
+    const scoped = await call(runsLoader, {
+      projectRef: seeded.project.externalRef,
+      token: await agentToken(seeded.user.id, seeded.envA.id),
+    });
 
-  expect(scoped.status).toBe(200);
-  expect(ctx.presenterEnvironments).toEqual([
-    { id: seeded.envA.id, organizationId: seeded.organization.id },
-  ]);
-});
+    expect(scoped.status).toBe(200);
+    expect(ctx.presenterEnvironments).toEqual([
+      { id: seeded.envA.id, organizationId: seeded.organization.id },
+    ]);
+  },
+  60_000
+);
 
 postgresTest(
   "a user-actor token asking for another environment is refused, not overridden",
@@ -242,47 +255,56 @@ postgresTest(
     expect(conflicting.status).toBe(403);
     expect(conflicting.body.code).toBe("forbidden_environment");
     expect(ctx.presenterEnvironments).toEqual([]);
-  }
+  },
+  60_000
 );
 
-postgresTest("a claimless user-actor token gets nothing project-wide", async ({ prisma }) => {
-  ctx.prisma = prisma;
-  const seeded = await seedProject(prisma);
-  ctx.patUserId = seeded.user.id;
+postgresTest(
+  "a claimless user-actor token gets nothing project-wide",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    const seeded = await seedProject(prisma);
+    ctx.patUserId = seeded.user.id;
 
-  // Any delegated client, not just the agent: a project-wide route has no scope to narrow to.
-  const claimless = await call(environmentsLoader, {
-    projectRef: seeded.project.externalRef,
-    token: await agentToken(seeded.user.id, undefined, "mcp"),
-  });
+    // Any delegated client, not just the agent: a project-wide route has no scope to narrow to.
+    const claimless = await call(environmentsLoader, {
+      projectRef: seeded.project.externalRef,
+      token: await agentToken(seeded.user.id, undefined, "mcp"),
+    });
 
-  expect(claimless.status).toBe(403);
-  expect(claimless.body.code).toBe("forbidden_environment");
-});
+    expect(claimless.status).toBe(403);
+    expect(claimless.body.code).toBe("forbidden_environment");
+  },
+  60_000
+);
 
-postgresTest("a personal access token still gets the project-wide answer", async ({ prisma }) => {
-  ctx.prisma = prisma;
-  ctx.presenterEnvironments = [];
-  const seeded = await seedProject(prisma);
-  ctx.patUserId = seeded.user.id;
+postgresTest(
+  "a personal access token still gets the project-wide answer",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    ctx.presenterEnvironments = [];
+    const seeded = await seedProject(prisma);
+    ctx.patUserId = seeded.user.id;
 
-  const environments = await call(environmentsLoader, {
-    projectRef: seeded.project.externalRef,
-    token: PAT,
-  });
+    const environments = await call(environmentsLoader, {
+      projectRef: seeded.project.externalRef,
+      token: PAT,
+    });
 
-  expect(environments.status).toBe(200);
-  expect(environments.body.map((env: any) => env.id).sort()).toEqual(
-    [seeded.envA.id, seeded.envB.id].sort()
-  );
+    expect(environments.status).toBe(200);
+    expect(environments.body.map((env: any) => env.id).sort()).toEqual(
+      [seeded.envA.id, seeded.envB.id].sort()
+    );
 
-  const runs = await call(runsLoader, {
-    projectRef: seeded.project.externalRef,
-    token: PAT,
-    search: `?filter[env]=${seeded.envB.slug}`,
-  });
+    const runs = await call(runsLoader, {
+      projectRef: seeded.project.externalRef,
+      token: PAT,
+      search: `?filter[env]=${seeded.envB.slug}`,
+    });
 
-  // No forced environment: the request's own filter decides, as before.
-  expect(runs.status).toBe(200);
-  expect(ctx.presenterEnvironments).toEqual([undefined]);
-});
+    // No forced environment: the request's own filter decides, as before.
+    expect(runs.status).toBe(200);
+    expect(ctx.presenterEnvironments).toEqual([undefined]);
+  },
+  60_000
+);

apps/webapp/test/userActorTokenClaimsAndScopes.test.ts

@@ -36,7 +36,10 @@ vi.mock("~/services/logger.server", () => ({
 vi.mock("~/services/rbac.server", async () => {
   const { buildJwtAbility, verifyUserActorToken } = await import("@trigger.dev/rbac");
   const bearerOf = (request: Request) =>
-    request.headers.get("Authorization")?.replace(/^Bearer /, "").trim() ?? "";
+    request.headers
+      .get("Authorization")
+      ?.replace(/^Bearer /, "")
+      .trim() ?? "";
 
   return {
     rbac: {
@@ -195,56 +198,69 @@ postgresTest(
 
     expect(denied.status).toBe(403);
     expect(denied.body.token).toBeUndefined();
-  }
+  },
+  60_000
 );
 
-postgresTest("a capless delegated token exchanges for a read-only JWT", async ({ prisma }) => {
-  ctx.prisma = prisma;
-  const seeded = await seedProject(prisma);
+postgresTest(
+  "a capless delegated token exchanges for a read-only JWT",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    const seeded = await seedProject(prisma);
 
-  const minted = await exchange({
-    projectRef: seeded.project.externalRef,
-    env: "prod",
-    token: await token({ userId: seeded.user.id, environmentId: seeded.prod.id }),
-  });
+    const minted = await exchange({
+      projectRef: seeded.project.externalRef,
+      env: "prod",
+      token: await token({ userId: seeded.user.id, environmentId: seeded.prod.id }),
+    });
 
-  expect(minted.status).toBe(200);
-  expect(payloadOf(minted.body.token).scopes).toEqual(["read:all"]);
-});
+    expect(minted.status).toBe(200);
+    expect(payloadOf(minted.body.token).scopes).toEqual(["read:all"]);
+  },
+  60_000
+);
 
-postgresTest("the exchange clamps requested scopes to the token's cap", async ({ prisma }) => {
-  ctx.prisma = prisma;
-  const seeded = await seedProject(prisma);
-
-  const minted = await exchange({
-    projectRef: seeded.project.externalRef,
-    env: "prod",
-    token: await token({
-      userId: seeded.user.id,
-      environmentId: seeded.prod.id,
-      cap: ["read:runs", "read:apiKeys"],
-    }),
-    scopes: ["read:runs", "write:runs"],
-  });
+postgresTest(
+  "the exchange clamps requested scopes to the token's cap",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    const seeded = await seedProject(prisma);
 
-  expect(minted.status).toBe(200);
-  expect(payloadOf(minted.body.token).scopes).toEqual(["read:runs"]);
-});
+    const minted = await exchange({
+      projectRef: seeded.project.externalRef,
+      env: "prod",
+      token: await token({
+        userId: seeded.user.id,
+        environmentId: seeded.prod.id,
+        cap: ["read:runs", "read:apiKeys"],
+      }),
+      scopes: ["read:runs", "write:runs"],
+    });
 
-postgresTest("the exchange only mints for the claimed environment", async ({ prisma }) => {
-  ctx.prisma = prisma;
-  const seeded = await seedProject(prisma);
-
-  const other = await exchange({
-    projectRef: seeded.project.externalRef,
-    env: "staging",
-    token: await token({
-      userId: seeded.user.id,
-      environmentId: seeded.prod.id,
-      cap: ["read:runs", "read:apiKeys"],
-    }),
-  });
+    expect(minted.status).toBe(200);
+    expect(payloadOf(minted.body.token).scopes).toEqual(["read:runs"]);
+  },
+  60_000
+);
 
-  expect(other.status).toBe(403);
-  expect(other.body.token).toBeUndefined();
-});
+postgresTest(
+  "the exchange only mints for the claimed environment",
+  async ({ prisma }) => {
+    ctx.prisma = prisma;
+    const seeded = await seedProject(prisma);
+
+    const other = await exchange({
+      projectRef: seeded.project.externalRef,
+      env: "staging",
+      token: await token({
+        userId: seeded.user.id,
+        environmentId: seeded.prod.id,
+        cap: ["read:runs", "read:apiKeys"],
+      }),
+    });
+
+    expect(other.status).toBe(403);
+    expect(other.body.token).toBeUndefined();
+  },
+  60_000
+);