Merge branch 'main' into fix/debounce-max-duration-ceiling

Author: matt-aitken

.changeset/batch-trigger-debounce.md

@@ -0,0 +1,15 @@
+---
+"@trigger.dev/sdk": patch
+"@trigger.dev/react-hooks": patch
+---
+
+`debounce` now works when you pass an array of items to `batchTrigger` or `batchTriggerAndWait`, and when you trigger from `useTaskTrigger`. Previously the option was accepted by the types and dropped before the request was sent, so every trigger created its own run instead of collapsing onto the debounce key.
+
+```ts
+await myTask.batchTrigger([
+  { payload: { id: "a" }, options: { debounce: { key: "same-key", delay: "30s" } } },
+  { payload: { id: "b" }, options: { debounce: { key: "same-key", delay: "30s" } } },
+]);
+```
+
+The streaming (async iterable) forms of the batch calls were already forwarding `debounce` correctly.

.server-changes/additional-api-key-rate-limit-bucket.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+API rate limits now apply per environment, so creating extra API keys no longer increases how many requests an environment can make.

.server-changes/api-key-deploy-envvars-presets.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+Self-hosted deployments can now create multiple full-access API keys for each environment.

.server-changes/public-token-additional-api-keys.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+Additional environment API keys can now create scoped public access tokens.

apps/webapp/app/consts.ts

@@ -10,6 +10,7 @@ export const RUN_CHUNK_EXECUTION_BUFFER = 350;
 export const MAX_RUN_CHUNK_EXECUTION_LIMIT = 120000; // 2 minutes
 export const VERCEL_RESPONSE_TIMEOUT_STATUS_CODES = [408, 504];
 export const MAX_BATCH_TRIGGER_ITEMS = 100;
+export const MAX_API_KEY_TASK_IDENTIFIERS = 10;
 export const MAX_TASK_RUN_ATTEMPTS = 250;
 export const BULK_ACTION_RUN_LIMIT = 250;
 export const MAX_JOB_RUN_EXECUTION_COUNT = 250;

apps/webapp/app/models/api-key.server.ts

@@ -1,7 +1,13 @@
-import type { RuntimeEnvironment } from "@trigger.dev/database";
-import { prisma } from "~/db.server";
+import type { PrismaClient, RuntimeEnvironment } from "@trigger.dev/database";
+import type { HostRbacController } from "@trigger.dev/rbac";
 import { customAlphabet } from "nanoid";
+import { MAX_API_KEY_TASK_IDENTIFIERS } from "~/consts";
+import { prisma } from "~/db.server";
 import { RuntimeEnvironmentType } from "~/database-types";
+import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
+import { apiKeyTelemetry, type ApiKeyTelemetry } from "~/services/apiKeyTelemetry.server";
+import { rbac } from "~/services/rbac.server";
+import { generateAdditionalApiKey, generateRootApiKey } from "~/utils/apiKeys";
 import { controlPlaneResolver } from "~/v3/runOpsMigration/controlPlaneResolver.server";
 
 const apiKeyId = customAlphabet(
@@ -94,8 +100,168 @@ export async function regenerateApiKey({ userId, environmentId }: RegenerateAPIK
   return updatedEnviroment;
 }
 
+export async function createEnvironmentApiKey(
+  {
+    environmentId,
+    taskEnvironmentId,
+    userId,
+    name,
+    expiresAt,
+    presetId,
+    taskIdentifiers,
+  }: {
+    environmentId: string;
+    taskEnvironmentId: string;
+    userId: string;
+    name: string;
+    expiresAt?: Date;
+    presetId: string;
+    taskIdentifiers?: string[];
+  },
+  {
+    prismaClient = prisma,
+    rbacController = rbac,
+    issuanceAllowed,
+    telemetryRecorder = apiKeyTelemetry,
+  }: {
+    prismaClient?: Pick<
+      PrismaClient,
+      "apiKey" | "featureFlag" | "organization" | "runtimeEnvironment" | "taskIdentifier"
+    >;
+    rbacController?: Pick<HostRbacController, "prepareApiKeyPolicy">;
+    issuanceAllowed?: (organizationId: string) => Promise<boolean>;
+    telemetryRecorder?: ApiKeyTelemetry;
+  } = {}
+) {
+  const environment = await prismaClient.runtimeEnvironment.findFirst({
+    where: {
+      id: environmentId,
+      organization: { members: { some: { userId } } },
+    },
+    select: { id: true, type: true, organizationId: true },
+  });
+
+  if (!environment) {
+    throw new Error("Environment not found");
+  }
+
+  const canIssue =
+    issuanceAllowed ??
+    ((organizationId) => canIssueAdditionalApiKeys(organizationId, prismaClient));
+  if (!(await canIssue(environment.organizationId))) {
+    throw new Error("Creating additional API keys is not enabled.");
+  }
+
+  if (expiresAt && expiresAt.getTime() <= Date.now()) {
+    throw new Error("Expiration must be in the future");
+  }
+
+  const selectedTasks = [...new Set(taskIdentifiers?.map((task) => task.trim()).filter(Boolean))];
+
+  if (selectedTasks.length > MAX_API_KEY_TASK_IDENTIFIERS) {
+    throw new Error(`You can select at most ${MAX_API_KEY_TASK_IDENTIFIERS} tasks for an API key`);
+  }
+  if (selectedTasks.length > 0) {
+    const matchingTasks = await prismaClient.taskIdentifier.count({
+      where: {
+        runtimeEnvironmentId: taskEnvironmentId,
+        slug: { in: selectedTasks },
+        runtimeEnvironment: {
+          OR: [{ id: environment.id }, { parentEnvironmentId: environment.id }],
+        },
+      },
+    });
+
+    if (matchingTasks !== selectedTasks.length) {
+      throw new Error("One or more selected tasks are not available in this environment");
+    }
+  }
+
+  let prepared: Awaited<ReturnType<typeof rbacController.prepareApiKeyPolicy>>;
+  try {
+    prepared = await rbacController.prepareApiKeyPolicy({
+      organizationId: environment.organizationId,
+      presetId,
+      taskIdentifiers: selectedTasks.length > 0 ? selectedTasks : undefined,
+    });
+  } catch (error) {
+    telemetryRecorder.recordOperation("prepare_policy", "error", "policy_error");
+    throw error;
+  }
+
+  if (!prepared.ok) {
+    telemetryRecorder.recordOperation("prepare_policy", "rejected", "policy_rejected");
+    throw new Error(prepared.error);
+  }
+  telemetryRecorder.recordOperation("prepare_policy", "success");
+
+  const generated = generateAdditionalApiKey(environment.type);
+  const apiKey = await (async () => {
+    try {
+      return await prismaClient.apiKey.create({
+        data: {
+          name,
+          keyHash: generated.keyHash,
+          lastFour: generated.lastFour,
+          runtimeEnvironmentId: environment.id,
+          createdByUserId: userId,
+          expiresAt,
+          presetId: prepared.policy.presetId,
+          scopes: prepared.policy.scopes,
+        },
+      });
+    } catch (error) {
+      telemetryRecorder.recordOperation("create", "error", "database_error");
+      throw error;
+    }
+  })();
+  telemetryRecorder.recordOperation("create", "success");
+
+  return { apiKey, plaintext: generated.apiKey };
+}
+
+export async function revokeEnvironmentApiKey(
+  {
+    environmentId,
+    apiKeyId,
+  }: {
+    environmentId: string;
+    apiKeyId: string;
+  },
+  {
+    prismaClient = prisma,
+    telemetryRecorder = apiKeyTelemetry,
+  }: {
+    prismaClient?: Pick<PrismaClient, "apiKey">;
+    telemetryRecorder?: ApiKeyTelemetry;
+  } = {}
+) {
+  const result = await (async () => {
+    try {
+      return await prismaClient.apiKey.updateMany({
+        where: {
+          id: apiKeyId,
+          runtimeEnvironmentId: environmentId,
+          revokedAt: null,
+        },
+        data: { revokedAt: new Date() },
+      });
+    } catch (error) {
+      telemetryRecorder.recordOperation("revoke", "error", "database_error");
+      throw error;
+    }
+  })();
+
+  if (result.count !== 1) {
+    telemetryRecorder.recordOperation("revoke", "rejected", "not_found_or_revoked");
+    throw new Error("API key not found or already revoked");
+  }
+
+  telemetryRecorder.recordOperation("revoke", "success");
+}
+
 export function createApiKeyForEnv(envType: RuntimeEnvironment["type"]) {
-  return `tr_${envSlug(envType)}_${apiKeyId(20)}`;
+  return generateRootApiKey(envType).apiKey;
 }
 
 export function createPkApiKeyForEnv(envType: RuntimeEnvironment["type"]) {

apps/webapp/app/models/runtimeEnvironment.server.ts

@@ -301,6 +301,89 @@ export async function findEnvironmentByApiKeyWithResolution(
   return resolveEnvironmentByApiKey(apiKey, branchName, tx, additionalApiKeyLookupEnabled);
 }
 
+export type PrivateApiKeyRateLimitScope = {
+  environmentId: string;
+  apiRateLimiterConfig: unknown;
+};
+
+export async function resolvePrivateApiKeyRateLimitScope(
+  apiKey: string,
+  tx: PrismaClientOrTransaction = $replica
+): Promise<PrivateApiKeyRateLimitScope | null> {
+  const now = new Date();
+
+  if (isAdditionalApiKey(apiKey)) {
+    const match = await tx.apiKey.findFirst({
+      where: {
+        keyHash: hashApiKey(apiKey),
+        revokedAt: null,
+        OR: [{ expiresAt: null }, { expiresAt: { gt: now } }],
+      },
+      select: {
+        runtimeEnvironment: {
+          select: {
+            id: true,
+            project: { select: { deletedAt: true } },
+            organization: { select: { apiRateLimiterConfig: true } },
+          },
+        },
+      },
+    });
+
+    if (!match?.runtimeEnvironment || match.runtimeEnvironment.project.deletedAt) {
+      return null;
+    }
+
+    return {
+      environmentId: match.runtimeEnvironment.id,
+      apiRateLimiterConfig: match.runtimeEnvironment.organization.apiRateLimiterConfig,
+    };
+  }
+
+  const environment = await tx.runtimeEnvironment.findFirst({
+    where: { apiKey },
+    select: {
+      id: true,
+      project: { select: { deletedAt: true } },
+      organization: { select: { apiRateLimiterConfig: true } },
+    },
+  });
+
+  if (environment) {
+    if (environment.project.deletedAt) {
+      return null;
+    }
+
+    return {
+      environmentId: environment.id,
+      apiRateLimiterConfig: environment.organization.apiRateLimiterConfig,
+    };
+  }
+
+  const revokedApiKey = await tx.revokedApiKey.findFirst({
+    where: { apiKey, expiresAt: { gt: now } },
+    select: {
+      runtimeEnvironment: {
+        select: {
+          id: true,
+          project: { select: { deletedAt: true } },
+          organization: { select: { apiRateLimiterConfig: true } },
+        },
+      },
+    },
+  });
+
+  const revokedEnvironment = revokedApiKey?.runtimeEnvironment;
+  if (!revokedEnvironment || revokedEnvironment.project.deletedAt) {
+    return null;
+  }
+
+  return {
+    environmentId: revokedEnvironment.id,
+    apiRateLimiterConfig: revokedEnvironment.organization.apiRateLimiterConfig,
+  };
+}
+
 /**
  * @deprecated We don't use public API keys (`pk_*` tokens) anymore — public
  * access goes through public JWTs (see `isPublicJWT` / `validatePublicJwtKey`).