fix(webapp,rbac): render API key scopes from policy presets

Author: carderne

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

@@ -5,6 +5,7 @@ export type ApiKeyPreset = {
   available: boolean;
   label: string;
   description: string;
+  scopes?: string[];
   usesTaskSelection?: boolean;
 };
 

apps/webapp/app/services/apiKeyPresetValidation.server.ts

@@ -0,0 +1,49 @@
+export type ApiKeyScopePreviewPreset = {
+  label: string;
+  scopes?: string[];
+  usesTaskSelection?: boolean;
+};
+
+export type ApiKeyScopePreview = {
+  fullAccess: boolean;
+  scopes: string[];
+};
+
+export function getApiKeyScopePreview({
+  preset,
+  taskScope,
+  selectedTasks,
+}: {
+  preset?: ApiKeyScopePreviewPreset;
+  taskScope?: "all" | "selected";
+  selectedTasks: string[];
+}): ApiKeyScopePreview {
+  const scopes = preset?.scopes;
+  if (!scopes) {
+    return { fullAccess: false, scopes: [] };
+  }
+
+  const fullAccess = scopes.includes("admin");
+  const selectedTaskScope =
+    preset?.usesTaskSelection && taskScope === "selected" && selectedTasks.length > 0;
+
+  return {
+    fullAccess,
+    scopes: fullAccess
+      ? []
+      : scopes.flatMap((scope) => expandTaskScope(scope, selectedTaskScope, selectedTasks)),
+  };
+}
+
+function expandTaskScope(scope: string, selectedTaskScope: boolean, selectedTasks: string[]): string[] {
+  const parts = scope.split(":");
+  if (!selectedTaskScope || parts.length !== 2 || parts[1] !== "tasks") {
+    return [scope];
+  }
+
+  const shown = selectedTasks.slice(0, 3).map((task) => `${scope}:${task}`);
+  if (selectedTasks.length > 3) {
+    shown.push(`… +${selectedTasks.length - 3} more`);
+  }
+  return shown;
+}

apps/webapp/app/utils/apiKeyScopePreview.ts

@@ -0,0 +1,40 @@
+import { describe, expect, it } from "vitest";
+import { getApiKeyScopePreview } from "~/utils/apiKeyScopePreview";
+
+describe("getApiKeyScopePreview", () => {
+  it("renders a plugin-defined preset from its scopes without treating it as full access", () => {
+    const preview = getApiKeyScopePreview({
+      preset: {
+        label: "Log viewer",
+        scopes: ["read:logs"],
+        usesTaskSelection: false,
+      },
+      selectedTasks: [],
+    });
+
+    expect(preview).toEqual({
+      fullAccess: false,
+      scopes: ["read:logs"],
+    });
+  });
+
+  it("expands selected task scopes from the plugin-generated template", () => {
+    const preview = getApiKeyScopePreview({
+      preset: {
+        label: "Task operator",
+        scopes: ["trigger:tasks", "read:tasks", "batchTrigger:batch"],
+        usesTaskSelection: true,
+      },
+      taskScope: "selected",
+      selectedTasks: ["send-email", "sync-customer"],
+    });
+
+    expect(preview.scopes).toEqual([
+      "trigger:tasks:send-email",
+      "trigger:tasks:sync-customer",
+      "read:tasks:send-email",
+      "read:tasks:sync-customer",
+      "batchTrigger:batch",
+    ]);
+  });
+});

apps/webapp/test/apiKeyScopePreview.test.ts

@@ -105,6 +105,7 @@ containerTest(
         id: "RESTRICTED_TEST_PRESET",
         label: "Restricted access",
         description: "Restricted test access",
+        scopes: ["read:deployments"],
         usesTaskSelection: false,
         available: true,
       },

apps/webapp/test/apiKeysPresenter.test.ts

@@ -264,10 +264,19 @@ describe("API-key policy controller composition", () => {
 });
 
 describe("API-key policy fallback", () => {
-  it("prepares explicit standalone full access and exposes no preset catalogue", async () => {
+  it("prepares explicit standalone full access and exposes its scope preview", async () => {
     const controller = loader.create(prismaPlaceholder, { forceFallback: true });
 
-    await expect(controller.apiKeyPresets("org_123")).resolves.toBeNull();
+    await expect(controller.apiKeyPresets("org_123")).resolves.toEqual([
+      {
+        id: "FULL_ACCESS",
+        label: "No restrictions",
+        description: "Full access to this environment, matching the root API key.",
+        scopes: ["admin"],
+        usesTaskSelection: false,
+        available: true,
+      },
+    ]);
     await expect(
       controller.prepareApiKeyPolicy({ organizationId: "org_123", presetId: "FULL_ACCESS" })
     ).resolves.toEqual({

internal-packages/rbac/src/apiKeyPolicies.test.ts

@@ -223,23 +223,32 @@ class RoleBaseAccessFallbackController implements RoleBaseAccessController {
   }
 
   async apiKeyPresets(_organizationId: string) {
-    return null;
+    return [
+      {
+        id: FULL_ACCESS_PRESET_ID,
+        label: "No restrictions",
+        description: "Full access to this environment, matching the root API key.",
+        scopes: ["admin"],
+        usesTaskSelection: false,
+        available: true,
+      },
+    ];
   }
 
   async prepareApiKeyPolicy(params: {
     organizationId: string;
     presetId: string;
     taskIdentifiers?: string[];
   }) {
-    // Without a plugin there is no preset catalogue, so full access is the only
-    // policy on offer — but the caller still has to ask for it by name. Any
-    // other preset, or any task selection, is a restricted key and unavailable.
+    // Full access is the only policy on offer without a plugin, but the caller
+    // still has to ask for it by name. Any other preset, or any task selection,
+    // is a restricted key and unavailable.
     if (params.presetId !== FULL_ACCESS_PRESET_ID || (params.taskIdentifiers?.length ?? 0) > 0) {
       return { ok: false as const, error: "API key access presets are not available" };
     }
 
-    // `presetId: null` because this install has no catalogue to reference — the
-    // key is full-access, not an instance of a named preset.
+    // Persist no preset ID: this is the standalone full-access policy rather
+    // than an enterprise plugin-defined preset.
     return {
       ok: true as const,
       policy: { presetId: null, scopes: ["admin"] },

internal-packages/rbac/src/fallback.ts

@@ -23,6 +23,12 @@ export type ApiKeyPreset = {
   id: string;
   label: string;
   description: string;
+  /**
+   * The plugin-generated, all-task scope template for this preset. The host
+   * uses it only to preview the policy before creation; `prepareApiKeyPolicy`
+   * remains the authorization source of truth.
+   */
+  scopes: string[];
   usesTaskSelection: boolean;
   available: boolean;
 };