fixes for review comments

Author: carderne

apps/webapp/app/presenters/v3/ApiKeysPresenter.server.ts

@@ -69,7 +69,7 @@ export class ApiKeysPresenter {
     const keyEnvironmentId = environment.parentEnvironmentId ?? environment.id;
 
     const [keyEnvironment, vercelIntegration] = await Promise.all([
-      this.#prismaClient.runtimeEnvironment.findUniqueOrThrow({
+      this.#prismaClient.runtimeEnvironment.findFirstOrThrow({
         where: { id: keyEnvironmentId },
         select: {
           id: true,

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

@@ -75,8 +75,11 @@ import { resolveOrgIdFromSlug } from "~/models/organization.server";
 import { findProjectBySlug } from "~/models/project.server";
 import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
 import { ApiKeysPresenter } from "~/presenters/v3/ApiKeysPresenter.server";
-import { FULL_ACCESS_PRESET_ID } from "@trigger.dev/rbac";
 import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
+import {
+  validateCreateApiKeyPreset,
+  type ApiKeyPreset,
+} from "~/services/apiKeyPresetValidation.server";
 import { rbac } from "~/services/rbac.server";
 import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
 import { cn } from "~/utils/cn";
@@ -88,8 +91,6 @@ const ApiKeySearchParams = z.object({
   showRevoked: z.preprocess((value) => value === "true" || value === true, z.boolean()).optional(),
 });
 
-type ApiKeyPreset = NonNullable<Awaited<ReturnType<typeof rbac.apiKeyPresets>>>[number];
-
 const CreateApiKeySchema = z.object({
   action: z.literal("create"),
   name: z.string().trim().min(1).max(64),
@@ -115,59 +116,6 @@ const ApiKeyActionSchema = z.discriminatedUnion("action", [
   z.object({ action: z.literal("revoke"), apiKeyId: z.string().min(1) }),
 ]);
 
-function validateCreateApiKeyPreset({
-  presets,
-  presetId,
-  taskScope,
-  taskIdentifiers,
-  hasTaskParameters,
-}: {
-  presets: ApiKeyPreset[] | null;
-  presetId?: string;
-  taskScope?: "all" | "selected";
-  taskIdentifiers: string[];
-  hasTaskParameters: boolean;
-}): { presetId: string; usesTaskSelection: boolean } {
-  // Always resolves to a concrete preset id. "No preset chosen" means full
-  // access, and saying so here keeps that decision visible at the call site
-  // instead of relying on a default inside prepareApiKeyPolicy.
-  const fullAccess = { presetId: FULL_ACCESS_PRESET_ID, usesTaskSelection: false };
-
-  if (presets === null) {
-    if (presetId !== undefined || hasTaskParameters) {
-      throw new Error("API key access presets are not available");
-    }
-    return fullAccess;
-  }
-
-  if (!presetId) {
-    if (hasTaskParameters) {
-      throw new Error("A preset is required when selecting tasks");
-    }
-    return fullAccess;
-  }
-
-  const preset = presets.find((candidate) => candidate.id === presetId);
-  if (!preset) {
-    throw new Error("Invalid API key access preset");
-  }
-  if (!preset.available) {
-    throw new Error("This API key access preset is not available on your plan");
-  }
-
-  if (!preset.usesTaskSelection && hasTaskParameters) {
-    throw new Error("This API key access preset does not support task selection");
-  }
-  if (preset.usesTaskSelection && taskScope === "selected" && taskIdentifiers.length === 0) {
-    throw new Error("Select at least one task");
-  }
-  if (preset.usesTaskSelection && taskScope !== "selected" && taskIdentifiers.length > 0) {
-    throw new Error("Task identifiers require selected task scope");
-  }
-
-  return { presetId: preset.id, usesTaskSelection: preset.usesTaskSelection ?? false };
-}
-
 type ApiKeyActionData =
   | { ok: true; action: "create"; apiKey: string }
   | { ok: false; error: string };

apps/webapp/app/services/additionalApiKeyIssuance.server.ts

@@ -10,7 +10,7 @@ export async function canIssueAdditionalApiKeys(
   prismaClient: IssuancePrismaClient = prisma
 ): Promise<boolean> {
   const [organization, globalFlags] = await Promise.all([
-    prismaClient.organization.findUnique({
+    prismaClient.organization.findFirst({
       where: { id: organizationId },
       select: { featureFlags: true },
     }),

apps/webapp/app/services/apiAuth.server.ts

@@ -299,7 +299,9 @@ export async function authenticateApiKeyWithScope(
     action,
     resource,
     allowJWT = false,
-  }: { action: string; resource: RbacResource; allowJWT?: boolean }
+  }: { action: string; resource: RbacResource; allowJWT?: boolean },
+  authorizeBearer: typeof authenticateAuthorizeBearerWithTelemetry =
+    authenticateAuthorizeBearerWithTelemetry
 ): Promise<
   | { ok: true; authentication: ApiAuthenticationResultSuccess }
   | { ok: false; status: 401 | 403; error: string }
@@ -309,11 +311,7 @@ export async function authenticateApiKeyWithScope(
     return { ok: false, status: 401, error: "Invalid or Missing API key" };
   }
 
-  const result = await authenticateAuthorizeBearerWithTelemetry(
-    request,
-    { action, resource },
-    { allowJWT }
-  );
+  const result = await authorizeBearer(request, { action, resource }, { allowJWT });
   if (!result.ok) {
     return result;
   }

apps/webapp/app/services/apiKeyPresetValidation.server.ts

@@ -0,0 +1,59 @@
+import { FULL_ACCESS_PRESET_ID } from "@trigger.dev/rbac";
+
+export type ApiKeyPreset = {
+  id: string;
+  available: boolean;
+  label: string;
+  description: string;
+  usesTaskSelection?: boolean;
+};
+
+export function validateCreateApiKeyPreset({
+  presets,
+  presetId,
+  taskScope,
+  taskIdentifiers,
+  hasTaskParameters,
+}: {
+  presets: ApiKeyPreset[] | null;
+  presetId?: string;
+  taskScope?: "all" | "selected";
+  taskIdentifiers: string[];
+  hasTaskParameters: boolean;
+}): { presetId: string; usesTaskSelection: boolean } {
+  const fullAccess = { presetId: FULL_ACCESS_PRESET_ID, usesTaskSelection: false };
+
+  if (presets === null) {
+    if (presetId !== undefined || hasTaskParameters) {
+      throw new Error("API key access presets are not available");
+    }
+    return fullAccess;
+  }
+
+  if (!presetId) {
+    if (hasTaskParameters) {
+      throw new Error("A preset is required when selecting tasks");
+    }
+    return fullAccess;
+  }
+
+  const preset = presets.find((candidate) => candidate.id === presetId);
+  if (!preset) {
+    throw new Error("Invalid API key access preset");
+  }
+  if (!preset.available) {
+    throw new Error("This API key access preset is not available on your plan");
+  }
+
+  if (!preset.usesTaskSelection && hasTaskParameters) {
+    throw new Error("This API key access preset does not support task selection");
+  }
+  if (preset.usesTaskSelection && taskScope === "selected" && taskIdentifiers.length === 0) {
+    throw new Error("Select at least one task");
+  }
+  if (preset.usesTaskSelection && taskScope !== "selected" && taskIdentifiers.length > 0) {
+    throw new Error("Task identifiers require selected task scope");
+  }
+
+  return { presetId: preset.id, usesTaskSelection: preset.usesTaskSelection ?? false };
+}

apps/webapp/app/services/environmentVariableApiAccess.server.ts

@@ -32,12 +32,18 @@ export function presentedApiKeyFromAuthentication(
  * Keep PAT/OAT authentication on the legacy path while routing machine API
  * keys through the RBAC controller, where plugin grants are applied.
  */
+type AuthenticationDependencies = {
+  authenticateRequest: typeof authenticateRequest;
+  authenticateApiKeyWithScope: typeof authenticateApiKeyWithScope;
+};
+
 export async function authenticateEnvironmentScopedApiRequest(
   request: Request,
   action: "read" | "write",
-  resource: EnvironmentScopedResource
+  resource: EnvironmentScopedResource,
+  dependencies: AuthenticationDependencies = { authenticateRequest, authenticateApiKeyWithScope }
 ): Promise<EnvironmentScopedAuthentication> {
-  const userOrOrganizationAuthentication = await authenticateRequest(request, {
+  const userOrOrganizationAuthentication = await dependencies.authenticateRequest(request, {
     personalAccessToken: true,
     organizationAccessToken: true,
     apiKey: false,
@@ -46,7 +52,7 @@ export async function authenticateEnvironmentScopedApiRequest(
     return { ok: true, authentication: userOrOrganizationAuthentication };
   }
 
-  const apiKeyAuthentication = await authenticateApiKeyWithScope(request, {
+  const apiKeyAuthentication = await dependencies.authenticateApiKeyWithScope(request, {
     action,
     resource: { type: resource },
   });
@@ -63,9 +69,10 @@ export async function authenticateEnvironmentScopedApiRequest(
 /** Env var API routes: PAT/OAT on the legacy path, machine keys via RBAC. */
 export function authenticateEnvVarApiRequest(
   request: Request,
-  action: "read" | "write"
+  action: "read" | "write",
+  dependencies?: AuthenticationDependencies
 ): Promise<EnvironmentScopedAuthentication> {
-  return authenticateEnvironmentScopedApiRequest(request, action, "envvars");
+  return authenticateEnvironmentScopedApiRequest(request, action, "envvars", dependencies);
 }
 
 const RESOURCE_LABELS: Record<EnvironmentScopedResource, string> = {