fix(webapp): require a scope on the project runtimes query

listCurrentProductionProjectRuntimes took organizationId and userId as
optional and spread each filter conditionally, so a call passing neither
would have narrowed to `version: "V3", deletedAt: null` and returned
every V3 project on the instance.

The scope is now a required union of exactly one of the two, so a
scopeless call cannot typecheck, and the runtime-updates loader throws a
404 on a missing organizationId instead of relying on the route
builder's fail-closed scope check.

Author: claude

apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.runtime-updates/route.tsx

@@ -14,7 +14,7 @@ export const loader = dashboardLoader(
   {
     params: OrganizationParamsSchema,
     // Membership-scoped resolve, like the Team settings loader: the RBAC gate below enforces the
-    // role, this is the tenant floor. An unresolved org yields no scope, which fails closed.
+    // role, this is the tenant floor. An unresolved org yields no scope, which the loader rejects.
     context: async (params, request) => {
       const userId = await getUserId(request);
       if (!userId) return {};
@@ -28,9 +28,12 @@ export const loader = dashboardLoader(
     },
   },
   async ({ context, params }) => {
-    const runtimes = await listCurrentProductionProjectRuntimes({
-      organizationId: context.organizationId,
-    });
+    const organizationId = context.organizationId;
+    if (!organizationId) {
+      throw new Response("Not Found", { status: 404 });
+    }
+
+    const runtimes = await listCurrentProductionProjectRuntimes({ organizationId });
 
     const needsUpdate: ProjectRuntimeRow[] = [];
     const otherProjects: ProjectRuntimeRow[] = [];

apps/webapp/app/services/projectRuntimeUpdates.server.ts

@@ -2,23 +2,25 @@ import { NODE_RUNTIME_UPDATE_MAJOR, nodeMajor } from "@trigger.dev/core/v3";
 import { CURRENT_DEPLOYMENT_LABEL } from "@trigger.dev/core/v3/isomorphic";
 import { prisma } from "~/db.server";
 
-type Options = {
-  organizationId?: string;
-  userId?: string;
-};
+/**
+ * The scope is required and exactly one of the two applies: without it the `where` below would
+ * collapse to every V3 project on the instance, so a scopeless call must not typecheck.
+ */
+type Scope =
+  | { organizationId: string; userId?: never }
+  | { userId: string; organizationId?: never };
 
-export async function listCurrentProductionProjectRuntimes({ organizationId, userId }: Options) {
+export async function listCurrentProductionProjectRuntimes(scope: Scope) {
   const projects = await prisma.project.findMany({
     where: {
-      ...(organizationId ? { organizationId } : {}),
-      ...(userId
-        ? {
+      ...(scope.organizationId !== undefined
+        ? { organizationId: scope.organizationId }
+        : {
             organization: {
               deletedAt: null,
-              members: { some: { userId } },
+              members: { some: { userId: scope.userId } },
             },
-          }
-        : {}),
+          }),
       version: "V3",
       deletedAt: null,
     },