fix(webapp): attribute env-authed API calls to the acting user (TRI-11095)

The env JWT exchange now stamps a signed `act` claim (acting user + client
kind), auth surfaces it as `actor`, and the tenant context prefers it over
`orgMember`, which only exists on dev environments. Identity only — the JWT
still authorizes as the environment.

Author: kathiekiwi

.server-changes/api-actions-record-who.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Actions taken through the API, like resolving an error, now record which team member made them in every environment, not just development.

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.jwt.ts

@@ -99,17 +99,23 @@ export async function action({ request, params }: ActionFunctionArgs) {
     // authentication result. Either way downstream handlers read `act.sub`
     // (e.g. the errors API records who resolved/ignored an error). An org
     // access token has no user, so `act` is omitted.
+    //
+    // `act.client` names the kind of caller that did the exchange, for
+    // attribution only. A UAT already carries its own `client` (e.g.
+    // "dashboard-agent"), so pass it through; a PAT exchange has none, and
+    // gets the same default the UAT mint route uses.
     const actorUserId =
       userActorId ??
       (authenticationResult.type === "personalAccessToken"
         ? authenticationResult.result.userId
         : undefined);
+    const actorClient = userActor?.client ?? "personal-access-token";
 
     const claims = {
       sub: runtimeEnv.id,
       pub: true,
       ...(scopes ? { scopes } : {}),
-      ...(actorUserId ? { act: { sub: actorUserId } } : {}),
+      ...(actorUserId ? { act: { sub: actorUserId, client: actorClient } } : {}),
     };
 
     const jwt = await internal_generateJWT({

apps/webapp/app/services/apiAuth.server.ts

@@ -44,6 +44,16 @@ const ClaimsSchema = z.object({
       skipColumns: z.array(z.string()).optional(),
     })
     .optional(),
+  // Delegation stamped at env-JWT exchange time: who the exchange was done for
+  // (`sub`) and what kind of caller did it (`client`). Identity only — it must
+  // never feed the ability. Authorization comes from `sub` (the environment)
+  // and `scopes` alone, so `act` can't widen what a token can do.
+  act: z
+    .object({
+      sub: z.string(),
+      client: z.string().optional(),
+    })
+    .optional(),
 });
 
 // Re-export the slim shape defined in @trigger.dev/core. Single source of
@@ -74,6 +84,7 @@ export type ApiAuthenticationResultSuccess = {
   // API keys (no user) and JWTs minted without delegation.
   actor?: {
     sub: string;
+    client?: string;
   };
 };
 
@@ -187,6 +198,7 @@ export async function authenticateApiKey(
         environment: validationResults.environment,
         oneTimeUse: parsedClaims.success ? parsedClaims.data.otu : false,
         realtime: parsedClaims.success ? parsedClaims.data.realtime : undefined,
+        actor: parsedClaims.success ? parsedClaims.data.act : undefined,
       };
     }
   }
@@ -279,6 +291,7 @@ async function authenticateApiKeyWithFailure(
         environment: validationResults.environment,
         oneTimeUse: parsedClaims.success ? parsedClaims.data.otu : false,
         realtime: parsedClaims.success ? parsedClaims.data.realtime : undefined,
+        actor: parsedClaims.success ? parsedClaims.data.act : undefined,
       };
     }
   }

apps/webapp/app/services/routeBuilders/apiBuilder.server.ts

@@ -422,7 +422,10 @@ export function createLoaderApiRoute<
       const apiVersion = getApiVersion(request);
 
       const result = await tenantContext.run(
-        tenantContextFromAuthEnvironment(authenticationResult.environment),
+        tenantContextFromAuthEnvironment(
+          authenticationResult.environment,
+          authenticationResult.actor
+        ),
         () =>
           handler({
             params: parsedParams,
@@ -1278,7 +1281,10 @@ export function createActionApiRoute<
       }
 
       const result = await tenantContext.run(
-        tenantContextFromAuthEnvironment(authenticationResult.environment),
+        tenantContextFromAuthEnvironment(
+          authenticationResult.environment,
+          authenticationResult.actor
+        ),
         () =>
           handler({
             params: parsedParams,
@@ -1543,7 +1549,10 @@ export function createMultiMethodApiRoute<
 
       // Dispatch to method handler
       const result = await tenantContext.run(
-        tenantContextFromAuthEnvironment(authenticationResult.environment),
+        tenantContextFromAuthEnvironment(
+          authenticationResult.environment,
+          authenticationResult.actor
+        ),
         () =>
           methodConfig.handler({
             params: parsedParams,

apps/webapp/app/services/tenantContext.server.ts

@@ -35,9 +35,15 @@ export const tenantContext = {
   },
 };
 
-export function tenantContextFromAuthEnvironment(env: AuthenticatedEnvironment): TenantContext {
+// `actor` is the env JWT's delegation claim, when the request carried one. It
+// wins over `orgMember`: that only exists on dev environments, so an env-authed
+// call against a shared prod/staging env is otherwise attributed to nobody.
+export function tenantContextFromAuthEnvironment(
+  env: AuthenticatedEnvironment,
+  actor?: { sub: string }
+): TenantContext {
   return {
-    userId: env.orgMember?.userId,
+    userId: actor?.sub ?? env.orgMember?.userId,
     orgSlug: env.organization.slug,
     projectSlug: env.project.slug,
     envSlug: env.slug,

apps/webapp/test/apiAuthActorClaim.test.ts

@@ -0,0 +1,110 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { buildJwtAbility } from "@trigger.dev/rbac";
+
+const jwtMocks = vi.hoisted(() => ({
+  validatePublicJwtKey: vi.fn<(...args: any[]) => Promise<any>>(),
+}));
+
+vi.mock("@internal/tracing", () => ({
+  getMeter: () => ({
+    createCounter: () => ({ add: vi.fn() }),
+    createHistogram: () => ({ record: vi.fn() }),
+    createObservableGauge: () => ({ addCallback: vi.fn() }),
+  }),
+}));
+vi.mock("~/services/rbac.server", () => ({ rbac: { authenticateBearer: vi.fn() } }));
+vi.mock("~/db.server", () => ({ prisma: {}, $replica: {} }));
+vi.mock("~/env.server", () => ({ env: { SESSION_SECRET: "test-session-secret" } }));
+vi.mock("~/models/project.server", () => ({ findProjectByRef: vi.fn() }));
+vi.mock("~/models/runtimeEnvironment.server", () => ({
+  authIncludeBase: {},
+  authIncludeWithParent: {},
+  findEnvironmentByApiKey: vi.fn(),
+  findEnvironmentByApiKeyWithResolution: vi.fn(),
+  findEnvironmentByPublicApiKey: vi.fn(),
+  toAuthenticated: vi.fn(),
+}));
+vi.mock("~/services/personalAccessToken.server", () => ({
+  authenticateApiRequestWithPersonalAccessToken: vi.fn(),
+  isPersonalAccessToken: () => false,
+}));
+vi.mock("~/services/organizationAccessToken.server", () => ({
+  authenticateApiRequestWithOrganizationAccessToken: vi.fn(),
+  isOrganizationAccessToken: () => false,
+}));
+vi.mock("~/services/realtime/jwtAuth.server", () => ({
+  isPublicJWT: (token: string) => token.startsWith("jwt_"),
+  validatePublicJwtKey: jwtMocks.validatePublicJwtKey,
+}));
+vi.mock("~/services/logger.server", () => ({
+  logger: { debug: vi.fn(), error: vi.fn(), warn: vi.fn() },
+}));
+
+import { authenticateApiKey } from "~/services/apiAuth.server";
+
+const environment = { id: "env_1", apiKey: "tr_prod_abc" };
+
+function claims(extra: Record<string, unknown> = {}) {
+  return { sub: environment.id, pub: true, scopes: ["read:runs"], ...extra };
+}
+
+async function authenticate(jwtClaims: Record<string, unknown>) {
+  jwtMocks.validatePublicJwtKey.mockResolvedValue({
+    ok: true,
+    environment,
+    claims: jwtClaims,
+  });
+  const result = await authenticateApiKey("jwt_token", { allowJWT: true });
+  if (!result) throw new Error("expected authentication to succeed");
+  return result;
+}
+
+describe("PUBLIC_JWT authentication — actor claim", () => {
+  beforeEach(() => {
+    jwtMocks.validatePublicJwtKey.mockReset();
+  });
+
+  it("surfaces actor when the JWT carries act", async () => {
+    const result = await authenticate(
+      claims({ act: { sub: "usr_42", client: "dashboard-agent" } })
+    );
+
+    expect(result.actor).toEqual({ sub: "usr_42", client: "dashboard-agent" });
+  });
+
+  it("accepts act without a client", async () => {
+    const result = await authenticate(claims({ act: { sub: "usr_42" } }));
+
+    expect(result.actor).toEqual({ sub: "usr_42" });
+  });
+
+  it("leaves actor undefined when the JWT has no act", async () => {
+    const result = await authenticate(claims());
+
+    expect(result.actor).toBeUndefined();
+  });
+
+  it("ignores a malformed act rather than failing the request", async () => {
+    const result = await authenticate(claims({ act: { client: "dashboard-agent" } }));
+
+    expect(result.ok).toBe(true);
+    expect(result.actor).toBeUndefined();
+  });
+
+  it("does not let act widen authorization", async () => {
+    // Authorization comes from sub + scopes only. An act claim stuffed with
+    // extra scopes is identity data and grants nothing.
+    const forged = claims({
+      act: { sub: "usr_42", client: "dashboard-agent", scopes: ["admin"] },
+    });
+    const result = await authenticate(forged);
+
+    expect(result.environment.id).toBe(environment.id);
+    expect(result.actor).toEqual({ sub: "usr_42", client: "dashboard-agent" });
+
+    const ability = buildJwtAbility(forged.scopes);
+    expect(ability.rules).toEqual(buildJwtAbility(["read:runs"]).rules);
+    expect(ability.can("read", { type: "runs" })).toBe(true);
+    expect(ability.can("write", { type: "runs" })).toBe(false);
+  });
+});

apps/webapp/test/envJwtActorClaim.test.ts

@@ -0,0 +1,103 @@
+import { beforeEach, describe, expect, it, vi } from "vitest";
+
+const mocks = vi.hoisted(() => ({
+  authenticateUatOrApiRequest: vi.fn<(...args: any[]) => Promise<any>>(),
+  authorizePatEnvironmentAccess: vi.fn<(...args: any[]) => Promise<any>>(),
+}));
+
+vi.mock("~/services/uatRoutePreamble.server", () => ({
+  authenticateUatOrApiRequest: mocks.authenticateUatOrApiRequest,
+}));
+vi.mock("~/services/environmentVariableApiAccess.server", () => ({
+  authorizePatEnvironmentAccess: mocks.authorizePatEnvironmentAccess,
+}));
+vi.mock("~/services/apiAuth.server", () => ({
+  authenticatedEnvironmentForAuthentication: vi.fn(async () => environment),
+  branchNameFromRequest: () => undefined,
+}));
+vi.mock("~/services/logger.server", () => ({
+  logger: { debug: vi.fn(), error: vi.fn(), warn: vi.fn() },
+}));
+
+import { validateJWT } from "@trigger.dev/core/v3/jwt";
+import { action } from "~/routes/api.v1.projects.$projectRef.$env.jwt";
+
+const environment = {
+  id: "env_1234",
+  apiKey: "tr_prod_abcdefghijklmnop",
+  organizationId: "org_1234",
+  type: "PRODUCTION" as const,
+  project: { id: "proj_1234" },
+};
+
+const params = { projectRef: "proj_abc", env: "prod" };
+
+function request(body: unknown = {}) {
+  return new Request("https://example.com/api/v1/projects/proj_abc/prod/jwt", {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+}
+
+async function mintedClaims(body?: unknown) {
+  const response = await action({ request: request(body), params, context: {} as any });
+  const { token } = (await response.json()) as { token: string };
+  const result = await validateJWT(token, environment.apiKey);
+  if (!result.ok) throw new Error("minted token failed validation");
+  return result.payload as Record<string, any>;
+}
+
+describe("env JWT exchange — act claim", () => {
+  beforeEach(() => {
+    mocks.authenticateUatOrApiRequest.mockReset();
+    mocks.authorizePatEnvironmentAccess.mockReset();
+    mocks.authorizePatEnvironmentAccess.mockResolvedValue(undefined);
+  });
+
+  it("stamps the PAT's user with the personal-access-token client", async () => {
+    mocks.authenticateUatOrApiRequest.mockResolvedValue({
+      authenticationResult: { type: "personalAccessToken", result: { userId: "usr_42" } },
+    });
+
+    const claims = await mintedClaims();
+
+    expect(claims.act).toEqual({ sub: "usr_42", client: "personal-access-token" });
+    // Authorization is unchanged: the JWT still authorizes as the environment.
+    expect(claims.sub).toBe(environment.id);
+  });
+
+  it("passes through a user-actor token's own client", async () => {
+    mocks.authenticateUatOrApiRequest.mockResolvedValue({
+      authenticationResult: { type: "personalAccessToken", result: { userId: "usr_7" } },
+      userActor: { userId: "usr_7", client: "dashboard-agent", cap: ["read:runs"] },
+    });
+
+    const claims = await mintedClaims({ claims: { scopes: ["read:runs"] } });
+
+    expect(claims.act).toEqual({ sub: "usr_7", client: "dashboard-agent" });
+    expect(claims.scopes).toEqual(["read:runs"]);
+  });
+
+  it("omits act for an org access token (no user)", async () => {
+    mocks.authenticateUatOrApiRequest.mockResolvedValue({
+      authenticationResult: {
+        type: "organizationAccessToken",
+        result: { organizationId: "org_1" },
+      },
+    });
+
+    const claims = await mintedClaims();
+
+    expect(claims.act).toBeUndefined();
+    expect(claims.sub).toBe(environment.id);
+  });
+
+  it("401s without a token", async () => {
+    mocks.authenticateUatOrApiRequest.mockResolvedValue(undefined);
+
+    const response = await action({ request: request(), params, context: {} as any });
+
+    expect(response.status).toBe(401);
+  });
+});

apps/webapp/test/tenantContextFromAuthEnvironment.test.ts

@@ -45,4 +45,18 @@ describe("tenantContextFromAuthEnvironment", () => {
   it("does not propagate impersonating (auth environments are real, not impersonated)", () => {
     expect(tenantContextFromAuthEnvironment(envWithOrgMember).impersonating).toBeUndefined();
   });
+
+  it("prefers the JWT actor over orgMember", () => {
+    const ctx = tenantContextFromAuthEnvironment(envWithOrgMember, { sub: "usr_99" });
+    expect(ctx.userId).toBe("usr_99");
+  });
+
+  it("attributes a shared env with no orgMember to the JWT actor", () => {
+    const ctx = tenantContextFromAuthEnvironment(envWithoutOrgMember, { sub: "usr_99" });
+    expect(ctx.userId).toBe("usr_99");
+  });
+
+  it("falls back to orgMember when there is no actor", () => {
+    expect(tenantContextFromAuthEnvironment(envWithOrgMember, undefined).userId).toBe("usr_42");
+  });
 });