fix(webapp): keep a delegated token's claims on the authenticated identity

The direct PAT authentication path returned identity only, so a user-actor token
reaching it (admin routes and other direct callers) lost its environment scope. The
claims now ride on the authentication result itself.

Author: kathiekiwi

apps/webapp/app/services/apiAuth.server.ts

@@ -409,15 +409,11 @@ function getApiKeyResult(apiKey: string): {
 }
 
 /**
- * The authenticated user-actor. A user-actor token authenticates as its user, so it carries the
- * same `userId` a PAT does — plus the token's verified claims, on the actor itself, so any layer
- * holding the actor holds its environment scope. A caller that only forwards `{ userId }` would
- * silently drop the scope, which is what this shape prevents.
+ * The authenticated user-actor. A user-actor token authenticates as its user, so it is the same
+ * shape a PAT authenticates to — that shape now carries the token's verified claims itself, so
+ * any layer holding the actor holds its environment scope.
  */
-export type UserActorAuthenticatedActor = PersonalAccessTokenAuthenticationResult & {
-  /** Verified claims. Present only when the caller presented a user-actor token. */
-  userActor?: UserActorClaims;
-};
+export type UserActorAuthenticatedActor = PersonalAccessTokenAuthenticationResult;
 
 export type AuthenticationResult =
   | {

apps/webapp/app/services/personalAccessToken.server.ts

@@ -6,7 +6,11 @@ import { logger } from "./logger.server";
 import { rbac } from "./rbac.server";
 import { decryptToken, encryptToken, hashToken } from "~/utils/tokens.server";
 import { env } from "~/env.server";
-import { isUserActorToken } from "@trigger.dev/rbac";
+import {
+  isUserActorToken,
+  type UserActorClaims,
+  verifyUserActorToken,
+} from "@trigger.dev/rbac";
 
 const tokenValueLength = 40;
 //lowercase only, removed 0 and l to avoid confusion
@@ -115,6 +119,11 @@ export async function revokePersonalAccessToken(tokenId: string, userId: string)
 
 export type PersonalAccessTokenAuthenticationResult = {
   userId: string;
+  /**
+   * Verified claims when the caller presented a delegated user-actor token. They ride on the
+   * result so no caller can hold the actor without its environment scope.
+   */
+  userActor?: UserActorClaims;
 };
 
 /**
@@ -171,7 +180,14 @@ export async function authenticateApiRequestWithPersonalAccessToken(
   // The plugin verifies it (identity path → no org context to floor against).
   if (isUserActorToken(token)) {
     const result = await rbac.authenticateUserActor(request, {});
-    return result.ok ? { userId: result.userId } : undefined;
+    if (!result.ok) return undefined;
+
+    // The claims travel with the identity: a caller that only saw `{ userId }` would act with no
+    // environment scope to enforce. A plugin on an older contract omits them, so verify here.
+    const userActor = result.claims ?? (await verifyUserActorToken(env.SESSION_SECRET, token));
+    if (!userActor) return undefined;
+
+    return { userId: result.userId, userActor };
   }
 
   return authenticatePersonalAccessToken(token);