feat(webapp): enforce scopes for environment API keys

[carderne]

Summary

Environment API keys backed by the additional-key table can authenticate API requests using their stored effective scopes. Revoked and expired keys are rejected, branch environments retain their existing routing behavior, and last-used timestamps are updated on a throttled best-effort basis.

Design

API route builders receive the resolved ability and reject restricted keys on routes without an authorization declaration. Existing deployment, environment variable, queue, run, task, batch, session, and waitpoint routes declare the resources they access.

Trigger and batch responses return server-signed public access tokens, so additional keys never need access to the environment signing secret. Root-key rotation also keeps public tokens valid for the existing grace window.

Deployment notes

The schema migration must be present before this code is deployed. Because bearer resolution runs on every authenticated request, deploy the resolver with additional-key lookup disabled, verify root-key and public-token parity, then enable lookup before any additional keys can be issued.

The multi-task authorization tightening changes the result for narrowly scoped tokens that request tasks outside their grants. Observe would-deny results before enforcing that check. Request-idempotency keys are also newly isolated by environment and task, so a retry crossing the deployment boundary may execute once more before old cache entries expire.

Follow-ups

• Add a system-wide kill switch for additional-key lookup, defaulted off for the initial deployment.
• Add authentication observability by credential kind, result, latency, and lookup path without recording credential values.
• Add would-deny observability and an independent enforcement switch for multi-task authorization.
• Add an independent switch for server-issued batch tokens while root-key parity is verified.
• Confirm every API route reachable by a restricted key has an explicit authorization declaration or intentionally fails closed.
• Verify root-key rotation, revoked-key grace, and public-token validation through each bearer resolver path.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fe974bab-4f69-45e7-90a0-2a36f3cb37cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/multi-keys-auth

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[changeset-bot]

⚠️ No Changeset found

Latest commit: 3895239

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@trigger.dev/build

npm i https://pkg.pr.new/@trigger.dev/build@3895239

trigger.dev

npm i https://pkg.pr.new/trigger.dev@3895239

@trigger.dev/core

npm i https://pkg.pr.new/@trigger.dev/core@3895239

@trigger.dev/python

npm i https://pkg.pr.new/@trigger.dev/python@3895239

@trigger.dev/react-hooks

npm i https://pkg.pr.new/@trigger.dev/react-hooks@3895239

@trigger.dev/redis-worker

npm i https://pkg.pr.new/@trigger.dev/redis-worker@3895239

@trigger.dev/rsc

npm i https://pkg.pr.new/@trigger.dev/rsc@3895239

@trigger.dev/schema-to-json

npm i https://pkg.pr.new/@trigger.dev/schema-to-json@3895239

@trigger.dev/sdk

npm i https://pkg.pr.new/@trigger.dev/sdk@3895239

commit: 3895239