Merge branch 'main' into docs-ai-agents-chat-agent-guide

Author: D-K-P

.server-changes/batch-declarative-schedule-cleanup.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Lower background database load during deployments and dev sessions for projects that use declarative schedules.

.server-changes/faster-schedule-validation-lookup.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: improvement
+---
+
+Creating or updating a schedule, and deploying a project with declarative schedules, is faster in long-lived projects with many deploys.

.server-changes/reject-benchmarking-webhook-addresses.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Reject alert webhook destinations in reserved benchmarking IP ranges.

apps/webapp/app/models/organization.server.ts

@@ -15,6 +15,7 @@ import {
   Prisma as PrismaNamespace,
   prisma,
   type PrismaClientOrTransaction,
+  type PrismaReplicaClient,
 } from "~/db.server";
 import { env } from "~/env.server";
 import { featuresForUrl } from "~/features.server";
@@ -41,22 +42,49 @@ const nanoid = customAlphabet("1234567890abcdef", 4);
  * miss, so replica lag never leaves a real org unresolved, which the dashboard
  * route builder treats as an unauthorized request.
  */
-export async function resolveOrgIdFromSlug(slug: string): Promise<string | null> {
-  const fromReplica = await $replica.organization.findFirst({
+export async function resolveOrgIdFromSlug(
+  slug: string,
+  replicaClient: PrismaReplicaClient = $replica,
+  prismaClient: PrismaClientOrTransaction = prisma
+): Promise<string | null> {
+  const fromReplica = await replicaClient.organization.findFirst({
     where: { slug },
     select: { id: true },
   });
   if (fromReplica) {
     return fromReplica.id;
   }
 
-  const fromPrimary = await prisma.organization.findFirst({
+  const fromPrimary = await prismaClient.organization.findFirst({
     where: { slug },
     select: { id: true },
   });
   return fromPrimary?.id ?? null;
 }
 
+/**
+ * Like `resolveOrgIdFromSlug`, but only resolves an org the user is a member of. `ability.can` is not
+ * a tenant floor (the OSS fallback and the cloud plugin both return a permissive ability for a
+ * non-member), so a route that scopes only by slug lets a non-member reach the handler; the
+ * membership filter here is the tenant floor. Returns null for a non-member, which the dashboard
+ * route builder treats as no scope and fails closed.
+ */
+export async function resolveOrgIdFromSlugForUser(
+  slug: string,
+  userId: string,
+  replicaClient: PrismaReplicaClient = $replica,
+  prismaClient: PrismaClientOrTransaction = prisma
+): Promise<string | null> {
+  const where = { slug, members: { some: { userId } } };
+  const fromReplica = await replicaClient.organization.findFirst({ where, select: { id: true } });
+  if (fromReplica) {
+    return fromReplica.id;
+  }
+
+  const fromPrimary = await prismaClient.organization.findFirst({ where, select: { id: true } });
+  return fromPrimary?.id ?? null;
+}
+
 export async function createOrganization(
   {
     title,

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.sso/route.tsx

@@ -35,6 +35,7 @@ import {
 import { Select, SelectItem } from "~/components/primitives/Select";
 import { Switch } from "~/components/primitives/Switch";
 import { prisma } from "~/db.server";
+import { getUserId } from "~/services/session.server";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { rbac } from "~/services/rbac.server";
 import { ssoController } from "~/services/sso.server";
@@ -53,11 +54,14 @@ export const meta = pageMeta("SSO & Directory Sync");
 
 const Params = z.object({ organizationSlug: z.string() });
 
-async function resolveOrg(slug: string) {
+async function resolveOrg(slug: string, userId: string) {
+  // Scoped to membership: ability.can is not a tenant floor (the cloud RBAC
+  // plugin returns a permissive ability for a non-member), so without the
+  // members filter a non-member reaches the handler for any org slug.
   // Primary (not replica): this scopes the RBAC/entitlement checks, so lag
   // could run them against a stale/missing org.
   return prisma.organization.findFirst({
-    where: { slug },
+    where: { slug, members: { some: { userId } } },
     select: { id: true, title: true },
   });
 }
@@ -117,8 +121,10 @@ const EMPTY_SSO_STATUS = {
 export const loader = dashboardLoader(
   {
     params: Params,
-    context: async (params) => {
-      const org = await resolveOrg(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const org = await resolveOrg(params.organizationSlug, userId);
       return org ? { organizationId: org.id, orgTitle: org.title } : {};
     },
     // Plan-gated before role-gated: non-Enterprise orgs render the upsell for
@@ -211,8 +217,10 @@ const ActionSchema = z.discriminatedUnion("action", [
 export const action = dashboardAction(
   {
     params: Params,
-    context: async (params) => {
-      const org = await resolveOrg(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const org = await resolveOrg(params.organizationSlug, userId);
       return org ? { organizationId: org.id } : {};
     },
     authorization: { action: "manage", resource: { type: "sso" } },

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.team/route.tsx

@@ -37,7 +37,8 @@ import { useOrganization } from "~/hooks/useOrganizations";
 import { useUser } from "~/hooks/useUser";
 import { removeTeamMember } from "~/models/removeTeamMember.server";
 import { redirectWithSuccessMessage } from "~/models/message.server";
-import { resolveOrgIdFromSlug } from "~/models/organization.server";
+import { resolveOrgIdFromSlugForUser } from "~/models/organization.server";
+import { getUserId } from "~/services/session.server";
 import { TeamPresenter } from "~/presenters/TeamPresenter.server";
 import { getCurrentPlan, getSelfServePurchaseBlockReason } from "~/services/platform.v3.server";
 import { rbac } from "~/services/rbac.server";
@@ -66,8 +67,10 @@ const Params = z.object({
 export const loader = dashboardLoader(
   {
     params: Params,
-    context: async (params) => {
-      const orgId = await resolveOrgIdFromSlug(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const orgId = await resolveOrgIdFromSlugForUser(params.organizationSlug, userId);
       return orgId ? { organizationId: orgId } : {};
     },
     authorization: { action: "read", resource: { type: "members" } },
@@ -127,8 +130,10 @@ const SetRoleSchema = z.object({
 export const action = dashboardAction(
   {
     params: Params,
-    context: async (params) => {
-      const orgId = await resolveOrgIdFromSlug(params.organizationSlug);
+    context: async (params, request) => {
+      const userId = await getUserId(request);
+      if (!userId) return {};
+      const orgId = await resolveOrgIdFromSlugForUser(params.organizationSlug, userId);
       return orgId ? { organizationId: orgId } : {};
     },
     // No top-level authorization — different intents have different

apps/webapp/app/v3/services/alerts/safeWebhookUrl.server.ts

@@ -42,6 +42,8 @@ function isUnsafeIPv4(host: string): boolean {
   if (a === 169 && b === 254) return true;
   // 100.64/10 carrier-grade NAT
   if (a === 100 && b >= 64 && b <= 127) return true;
+  // 198.18/15 benchmarking
+  if (a === 198 && b >= 18 && b <= 19) return true;
   // 224/4 multicast
   if (a >= 224 && a <= 239) return true;
   // 240/4 reserved

apps/webapp/app/v3/services/checkSchedule.server.ts

@@ -45,6 +45,9 @@ export class CheckScheduleService extends BaseService {
         slug: schedule.taskIdentifier,
         projectId: projectId,
       },
+      select: {
+        triggerSource: true,
+      },
       orderBy: {
         createdAt: "desc",
       },

apps/webapp/app/v3/services/createBackgroundWorker.server.ts

@@ -775,27 +775,40 @@ export async function syncDeclarativeSchedules(
     },
   });
 
+  const scheduleIdsToDelete: string[] = [];
+  const scheduleIdsToDetachFromEnvironment: string[] = [];
+
   for (const schedule of potentiallyDeletableSchedules) {
     const canDeleteSchedule =
       schedule.instances.length === 0 ||
       schedule.instances.every((instance) => instance.environmentId === environment.id);
 
     if (canDeleteSchedule) {
-      //we can delete schedules with no instances other than ones for the current environment
-      await prisma.taskSchedule.delete({
-        where: {
-          id: schedule.id,
+      scheduleIdsToDelete.push(schedule.id);
+    } else if (schedule.instances.some((instance) => instance.environmentId === environment.id)) {
+      scheduleIdsToDetachFromEnvironment.push(schedule.id);
+    }
+  }
+
+  if (scheduleIdsToDelete.length > 0) {
+    await prisma.taskSchedule.deleteMany({
+      where: {
+        id: {
+          in: scheduleIdsToDelete,
         },
-      });
-    } else {
-      //otherwise we delete the instance (other environments remain untouched)
-      await prisma.taskScheduleInstance.deleteMany({
-        where: {
-          taskScheduleId: schedule.id,
-          environmentId: environment.id,
+      },
+    });
+  }
+
+  if (scheduleIdsToDetachFromEnvironment.length > 0) {
+    await prisma.taskScheduleInstance.deleteMany({
+      where: {
+        taskScheduleId: {
+          in: scheduleIdsToDetachFromEnvironment,
         },
-      });
-    }
+        environmentId: environment.id,
+      },
+    });
   }
 }
 

apps/webapp/test/auth-dashboard.e2e.full.test.ts

@@ -2,6 +2,8 @@
 // Each test seeds a User + session cookie via seedTestUser / seedTestSession
 // (helpers/seedTestSession.ts) and hits the shared webapp container.
 
+import { randomBytes } from "node:crypto";
+import type { PrismaClient } from "@trigger.dev/database";
 import { describe, expect, it } from "vitest";
 import { getTestServer } from "./helpers/sharedTestServer";
 import { seedTestSession, seedTestUser } from "./helpers/seedTestSession";
@@ -115,4 +117,66 @@ describe("Dashboard", () => {
       expect(new URL(location, "http://localhost").pathname).toBe("/");
     });
   });
+
+  // Cross-tenant tenant floor on org settings routes. settings/roles is the case
+  // the route-level membership scoping (SSO/Team) did NOT cover, so it exercises
+  // the RBAC fallback's org-membership floor specifically: the fallback ability
+  // is permissive (can: () => true), so that floor is the only thing stopping a
+  // non-member from reading the org's role and permission catalogue.
+  //
+  // The request hits the route's own loader directly via Remix's `?_data`, which
+  // is the exact exploit shape: a plain document GET 404s at the org layout
+  // (membership) and never reaches this leaf, so it wouldn't test the leaf floor.
+  // Both users have confirmedBasicDetails set so the `_app` onboarding redirect
+  // can't stand in for the deny.
+  describe("Org settings — cross-tenant tenant floor (settings/roles)", () => {
+    const ROLES_ROUTE_ID = "routes/_app.orgs.$organizationSlug.settings.roles";
+    const rolesData = (slug: string) =>
+      `/orgs/${slug}/settings/roles?_data=${encodeURIComponent(ROLES_ROUTE_ID)}`;
+
+    async function seedConfirmedUser(prisma: PrismaClient) {
+      const user = await seedTestUser(prisma);
+      await prisma.user.update({ where: { id: user.id }, data: { confirmedBasicDetails: true } });
+      return user;
+    }
+
+    async function seedOrgWithOwner() {
+      const server = getTestServer();
+      const owner = await seedConfirmedUser(server.prisma);
+      const org = await server.prisma.organization.create({
+        data: {
+          title: "E2E tenant-floor org",
+          slug: `e2e-tenant-${randomBytes(6).toString("hex")}`,
+          members: { create: { userId: owner.id, role: "ADMIN" } },
+        },
+      });
+      return { server, owner, org };
+    }
+
+    it("denies a non-member: no roles catalogue leaked", async () => {
+      const { server, org } = await seedOrgWithOwner();
+      const outsider = await seedConfirmedUser(server.prisma);
+      const cookie = await seedTestSession({ userId: outsider.id });
+      const res = await server.webapp.fetch(rolesData(org.slug), {
+        redirect: "manual",
+        headers: { Cookie: cookie },
+      });
+      const body = await res.text();
+      // With the tenant floor a non-member is denied (a redirect), so they never
+      // get the loader's 200 payload. Before the fix the permissive ability let
+      // the loader return the org's role/permission catalogue.
+      expect(res.status).not.toBe(200);
+      expect(body).not.toContain("manage:members");
+    });
+
+    it("allows a member: the loader returns the catalogue", async () => {
+      const { server, owner, org } = await seedOrgWithOwner();
+      const cookie = await seedTestSession({ userId: owner.id });
+      const res = await server.webapp.fetch(rolesData(org.slug), {
+        redirect: "manual",
+        headers: { Cookie: cookie },
+      });
+      expect(res.status).toBe(200);
+    });
+  });
 });