fix(webapp): keep environment rate-limit buckets consistent

Use environment identifiers when displaying remaining API capacity and ignore additional keys tied to deleted projects.

Author: carderne

apps/webapp/app/models/runtimeEnvironment.server.ts

@@ -323,13 +323,14 @@ export async function resolvePrivateApiKeyRateLimitScope(
         runtimeEnvironment: {
           select: {
             id: true,
+            project: { select: { deletedAt: true } },
             organization: { select: { apiRateLimiterConfig: true } },
           },
         },
       },
     });
 
-    if (!match?.runtimeEnvironment) {
+    if (!match?.runtimeEnvironment || match.runtimeEnvironment.project.deletedAt) {
       return null;
     }
 

apps/webapp/app/presenters/v3/LimitsPresenter.server.ts

@@ -1,6 +1,5 @@
 import { Ratelimit } from "@upstash/ratelimit";
 import type { RuntimeEnvironmentType } from "@trigger.dev/database";
-import { createHash } from "node:crypto";
 import { env } from "~/env.server";
 import { getCurrentPlan } from "~/services/platform.v3.server";
 import {
@@ -90,13 +89,11 @@ export class LimitsPresenter extends BasePresenter {
     projectId,
     environmentId,
     environmentType,
-    environmentApiKey,
   }: {
     organizationId: string;
     projectId: string;
     environmentId: string;
     environmentType: RuntimeEnvironmentType;
-    environmentApiKey: string;
   }): Promise<LimitsResult> {
     // Get organization with all limit-related fields
     const organization = await this._replica.organization.findFirstOrThrow({
@@ -168,10 +165,10 @@ export class LimitsPresenter extends BasePresenter {
       where: { organizationId },
     });
 
-    // Get current rate limit tokens for this environment's API key
+    // Get current rate limit tokens for this environment's API bucket
     const apiRateLimitTokens = await getRateLimitRemainingTokens(
       "api",
-      environmentApiKey,
+      environmentId,
       apiRateLimitConfig
     );
     // Batch rate limiter uses environment ID directly (not hashed) with a different key prefix
@@ -454,20 +451,14 @@ function resolveBatchConcurrencyConfig(batchConcurrencyConfig?: unknown): {
 
 /**
  * Query the current remaining tokens for a rate limiter using the Upstash getRemaining method.
- * This uses the same configuration and hashing logic as the rate limit middleware.
+ * The API limiter uses the environment ID as the bucket identifier for private API keys.
  */
 async function getRateLimitRemainingTokens(
   keyPrefix: string,
-  apiKey: string,
+  identifier: string,
   config: RateLimiterConfig
 ): Promise<number | null> {
   try {
-    // Hash the authorization header the same way the rate limiter does
-    const authorizationValue = `Bearer ${apiKey}`;
-    const hash = createHash("sha256");
-    hash.update(authorizationValue);
-    const hashedKey = hash.digest("hex");
-
     // Create a Ratelimit instance with the same configuration
     const limiter = createLimiterFromConfig(config);
     const ratelimit = new Ratelimit({
@@ -478,9 +469,9 @@ async function getRateLimitRemainingTokens(
       prefix: `ratelimit:${keyPrefix}`,
     });
 
-    // Use the getRemaining method to get the current remaining tokens
+    // Use the same identifier as the API rate-limit middleware.
     // getRemaining returns a Promise<number>
-    const remaining = await ratelimit.getRemaining(hashedKey);
+    const remaining = await ratelimit.getRemaining(identifier);
     return remaining;
   } catch (error) {
     logger.warn("Failed to get rate limit remaining tokens", {

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.limits/route.tsx

@@ -84,7 +84,6 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
       projectId: project.id,
       environmentId: environment.id,
       environmentType: environment.type,
-      environmentApiKey: environment.apiKey,
     })
   );
 

apps/webapp/test/findEnvironmentByApiKey.test.ts

@@ -399,4 +399,30 @@ describe("findEnvironmentByApiKey — additional and disabled keys", () => {
       ).resolves.toMatchObject({ id: environment.id });
     }
   );
+
+  postgresTest("does not resolve additional keys for deleted projects", async ({ prisma }) => {
+    const { organization, project, user } = await createTestOrgProjectWithMember(prisma);
+    const environment = await createEnv(prisma, project.id, organization.id, {
+      type: "PRODUCTION",
+    });
+    const additional = generateAdditionalApiKey("PRODUCTION").apiKey;
+
+    await prisma.apiKey.create({
+      data: {
+        name: "Deleted project key",
+        keyHash: hashApiKey(additional),
+        lastFour: additional.slice(-4),
+        runtimeEnvironmentId: environment.id,
+        createdByUserId: user.id,
+        presetId: null,
+        scopes: ["admin"],
+      },
+    });
+    await prisma.project.update({
+      where: { id: project.id },
+      data: { deletedAt: new Date() },
+    });
+
+    await expect(resolvePrivateApiKeyRateLimitScope(additional, prisma)).resolves.toBeNull();
+  });
 });