fix(webapp): schedule & env-var write scoping (reject cross-project/env IDs) (#46)

* fix(webapp): scope schedule lookups by project and environment (TRI-9865)

Closes a cluster of cross-tenant IDORs in the schedule routes and services
by scoping every `findFirst({friendlyId})` to the caller's projectId, and
by gating the env-scoped schedule API on env-visibility so a low-trust
key (e.g. dev) can't see or mutate a schedule whose instances live in a
different env. Foreign environment IDs passed to CheckScheduleService now
fail closed instead of being silently filtered.

Three observable API changes are documented in
.server-changes/tri-9865-tenant-isolation-schedules.md.

Closes TRI-9865, TRI-10040, TRI-10041 (P0); TRI-9854, TRI-9869, TRI-9960,
TRI-9963, TRI-9997 (P1); TRI-9859 (P2).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* refactor(webapp): consolidate schedule env-visibility into tri-state helper

Address review feedback on the TRI-9865 batch:

- Promote findScheduleScopedToEnvironment to a tri-state helper
  getScheduleEnvVisibility returning { status: 'visible' | 'hidden' |
  'missing' }. PUT can disambiguate hidden (refuse, 404) from missing
  (fall through to upsert's create path) without re-implementing the
  visibility logic inline.
- All three call sites (GET / PUT / DELETE in api.v1.schedules.$id)
  now share the single helper.
- Add test coverage for the deduplicationKey branch of
  scheduleWhereClause (covered the sched_-prefix branch only before).
- Add DeleteTaskScheduleService test asserting DECLARATIVE schedules
  cannot be deleted (surfaces as a service-layer error after the
  visibility check passes).
- Rename the misleading "devEnv" test fixture to "stagingEnv" to match
  its actual RuntimeEnvironment type.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* test(webapp): regression tests for schedule environment scoping

Scopes schedule read/update/delete/activate to the caller's environment via a
shared getScheduleEnvVisibility (visible/hidden/missing) helper. Real-Postgres
tests (testcontainers) cover checkSchedule, delete, setActive, and PUT upsert.
Verified RED on the shared visibility guard (cross-env detection flips); GREEN
13/13. Bundles the streamBatchItems timeout bump.

* fix(webapp): reject foreign environment IDs when upserting a schedule

CheckScheduleService.call previously intersected `project.environments`
with the caller-supplied `environmentIds` via `.filter()`, silently
dropping any ID that didn't belong to the authorized project. Downstream
UpsertTaskScheduleService.#createNewSchedule then iterated the raw input
and created TaskScheduleInstance rows pairing the validated projectId
with whichever environmentId the caller sent — including another
tenant's RuntimeEnvironment. When the schedule fires, the engine
triggers against the *referenced* environment, enabling cross-tenant
task execution if the victim env id is known.

Replace the silent intersection with an explicit rejection: build a
map of project.environments by id and throw `ServiceValidationError` on
the first foreign id, so #createNewSchedule and #updateExistingSchedule
never see an environmentId outside the authorized project.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(repro): remove reproducer from PR branch

* test(webapp): regression test for cross-project schedule env scoping

Extracts the env-scoping into a pure resolveProjectScopedEnvironments (returns a
foreign-id flag or the mapped envs) and unit-tests it: all-valid resolves;
foreign id rejected; foreign mixed with valid still rejected (not dropped);
empty ok. Verified RED against the pre-fix silent filter-drop, GREEN with the
rejection. Bundles the streamBatchItems timeout bump.

* fix(webapp): enforce per-env access when creating env vars

The env-vars `new` action passed user-supplied `environmentIds[]`
straight to `repository.create` after a project-membership check.
DEV environments are per-user (`RuntimeEnvironment.orgMember.userId`),
and the dashboard loader filters other members' DEV envs out of the
UI — but the action did not enforce the same filter. A project
member could submit `environmentIds=[my_dev, victim_dev]` plus a
key/value, and the value was injected into the victim's next task
run via `resolveVariablesForEnvironment` (whose secret-store key
prefix is `environmentvariable:<projectId>:<envId>:`).

Now query `runtimeEnvironment.findMany` with the same OR clause
`findEnvironmentBySlug` uses — non-DEV envs in the project, or DEV
envs owned by the requesting user — and refuse the submission if
any submitted ID is missing from the result.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore(repro): remove reproducer from PR branch

* test(webapp): regression test for env-var DEV-environment ownership

Extracts the per-env writability rule into a pure findUnauthorizedEnvironmentId
(shared env types writable by any member; DEV only by its owner; unknown id
rejected) and unit-tests it. Route now fetches the candidate envs and applies
the helper. Verified RED against the pre-fix no-check behaviour, GREEN with it.
Bundles the streamBatchItems timeout bump.

* fix(webapp): reject mixed valid/foreign environmentIds in env-var create/edit

The create()/edit() guard used `environmentIds.every((v) => !inProject(v))`, which
only errors when EVERY id is foreign — a single in-project id short-circuited it, so
a mixed array passed and the write loop stored values/secrets against another tenant's
environment. Switch to `.some` so any foreign id rejects the whole request.

Adds RED→GREEN cross-tenant regression tests and bumps the streamBatchItems CI timeout.

* test(webapp): isolate schedule scoping tests from the global prisma singleton

The checkSchedule/deleteTaskSchedule/setActiveOnTaskSchedule regression tests
imported the full services, which pull in ~/db.server; its eager global-prisma
$connect() becomes an unhandled rejection in a unit-test job with no reachable
global database, failing vitest even though every test passes.

Make schedules.server a leaf (type-only Prisma imports) and rewrite the three
tests to exercise the project/environment scoping primitives directly against the
container DB (scheduleWhereClause, scheduleUniqWhereClause,
resolveProjectScopedEnvironments) instead of importing the services.

* fix(webapp): enforce DEV-env ownership on env-var edit and delete

The per-user DEV-env write check was only on the create route; the edit/delete
value actions passed a user-controlled environmentId straight to the repository,
which only checks project membership — letting a member overwrite or delete an
env-var value in another member's DEV environment. Gate both actions with the
same findUnauthorizedEnvironmentId check the create route uses.

* format

* chore: consolidate server-change and tighten comments

* fix(webapp): use .some for schedule env visibility and gate activate/deactivate

A schedule can be bound to several environments at once, and the schedule
list surfaces a schedule for any environment it has an instance in. The
per-schedule visibility check required every instance to be in the caller's
environment, so a multi-environment schedule was listed but returned 404 on
GET/PUT/DELETE for the same key. Match the list's semantics: a schedule is
visible when it has at least one instance in the caller's environment.

Also apply the same environment-visibility gate to the activate and
deactivate endpoints, which previously scoped only by project and let a key
scoped to one environment enable/disable a schedule that runs only in another
environment of the same project.

* fix(webapp): reject empty-string foreign environment id instead of dropping it

The foreign-id guard used a truthiness check, so an empty-string environment
id (a foreign id) was falsy and fell through to the accepted path, where it
was silently dropped rather than rejected. Use an explicit undefined check so
any foreign id, including the empty string, is reported and rejected.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-authored-by: Chris Arderne <chris@trigger.dev>

Author: 3 people

.server-changes/scope-schedule-and-env-var-writes.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Scope schedule and environment-variable writes to the caller's project and environment

apps/webapp/app/models/schedules.server.ts

@@ -1,4 +1,4 @@
-import type { Prisma } from "~/db.server";
+import type { Prisma, PrismaClientOrTransaction, TaskSchedule } from "@trigger.dev/database";
 
 export function scheduleUniqWhereClause(
   projectId: string,
@@ -35,3 +35,48 @@ export function scheduleWhereClause(
     deduplicationKey: scheduleId,
   };
 }
+
+/**
+ * Resolve a schedule's visibility for an environment-scoped caller.
+ *
+ *   - "visible": the schedule exists in the project and has at least one
+ *     instance bound to `environmentId` (or has no instances yet).
+ *   - "hidden": the schedule exists but none of its instances live in the
+ *     caller's environment.
+ *   - "missing": no schedule exists for the (project, scheduleId) pair.
+ *
+ * A schedule can be bound to several environments at once, so visibility
+ * mirrors the "some instance is in this environment" rule the schedule
+ * list uses: a schedule that is listed for a key must also be readable
+ * and mutable by that key. This still rejects cross-environment access to
+ * schedules the caller has no instance in, and `scheduleWhereClause`
+ * already confines the lookup to the caller's project.
+ *
+ * The tri-state lets PUT (upsert) disambiguate "hidden" (refuse) from
+ * "missing" (fall through to create). DELETE/GET treat hidden and
+ * missing the same way.
+ */
+export type ScheduleEnvVisibility =
+  | { status: "visible"; schedule: TaskSchedule }
+  | { status: "hidden" }
+  | { status: "missing" };
+
+export async function getScheduleEnvVisibility(
+  prisma: PrismaClientOrTransaction,
+  projectId: string,
+  scheduleId: string,
+  environmentId: string
+): Promise<ScheduleEnvVisibility> {
+  const schedule = await prisma.taskSchedule.findFirst({
+    where: scheduleWhereClause(projectId, scheduleId),
+    include: { instances: { select: { environmentId: true } } },
+  });
+
+  if (!schedule) return { status: "missing" };
+
+  const { instances, ...rest } = schedule;
+  if (instances.length === 0) return { status: "visible", schedule: rest };
+  const scoped = instances.some((i) => i.environmentId === environmentId);
+  if (!scoped) return { status: "hidden" };
+  return { status: "visible", schedule: rest };
+}

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables.new/route.tsx

@@ -55,6 +55,7 @@ import {
 } from "~/utils/pathBuilder";
 import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
 import { EnvironmentVariableKey } from "~/v3/environmentVariables/repository";
+import { findUnauthorizedEnvironmentId } from "~/v3/writableEnvironments";
 
 const Variable = z.object({
   key: EnvironmentVariableKey,
@@ -164,6 +165,31 @@ export const action = dashboardAction(
       return json(submission.reply({ formErrors: ["Project not found"] }));
     }
 
+    // The submitted `environmentIds` are user-supplied. Shared env types are
+    // writable by any member; a DEV env only by its owner. See
+    // findUnauthorizedEnvironmentId.
+    const submittedEnvs = await prisma.runtimeEnvironment.findMany({
+      where: {
+        projectId: project.id,
+        id: { in: submission.value.environmentIds },
+      },
+      select: { id: true, type: true, orgMember: { select: { userId: true } } },
+    });
+    const unauthorizedEnvironmentId = findUnauthorizedEnvironmentId(
+      submittedEnvs,
+      submission.value.environmentIds,
+      userId
+    );
+    if (unauthorizedEnvironmentId) {
+      return json(
+        submission.reply({
+          fieldErrors: {
+            environmentIds: ["One or more of the selected environments is not writable by you."],
+          },
+        })
+      );
+    }
+
     const repository = new EnvironmentVariablesRepository(prisma);
     const result = await repository.create(project.id, {
       ...submission.value,

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.environment-variables/route.tsx

@@ -78,6 +78,7 @@ import {
   v3NewEnvironmentVariablesPath,
 } from "~/utils/pathBuilder";
 import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
+import { findUnauthorizedEnvironmentId } from "~/v3/writableEnvironments";
 import {
   DeleteEnvironmentVariableValue,
   EditEnvironmentVariableValue,
@@ -267,6 +268,24 @@ export const action = dashboardAction(
       return json(submission.reply({ formErrors: ["Project not found"] }));
     }
 
+    // Per-env write gate for the mutating value actions: `environmentId` is a
+    // user-supplied hidden field and the repository only checks project
+    // membership. Mirrors the create route's check.
+    if (submission.value.action === "edit" || submission.value.action === "delete") {
+      const submittedEnvs = await prisma.runtimeEnvironment.findMany({
+        where: { projectId: project.id, id: submission.value.environmentId },
+        select: { id: true, type: true, orgMember: { select: { userId: true } } },
+      });
+      const unauthorizedEnvironmentId = findUnauthorizedEnvironmentId(
+        submittedEnvs,
+        [submission.value.environmentId],
+        userId
+      );
+      if (unauthorizedEnvironmentId) {
+        return json(submission.reply({ formErrors: ["This environment is not writable by you."] }));
+      }
+    }
+
     switch (submission.value.action) {
       case "edit": {
         const repository = new EnvironmentVariablesRepository(prisma);

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.schedules.$scheduleParam/route.tsx

@@ -6,7 +6,6 @@ import { z } from "zod";
 import { ExitIcon } from "~/assets/icons/ExitIcon";
 import { LinkButton } from "~/components/primitives/Buttons";
 import { ScheduleInspector } from "~/components/schedules/ScheduleInspector";
-import { prisma } from "~/db.server";
 import { useEnvironment } from "~/hooks/useEnvironment";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { useProject } from "~/hooks/useProject";
@@ -78,11 +77,7 @@ export const action = async ({ request, params }: ActionFunctionArgs) => {
   // `_format=json` → return JSON instead of redirecting; caller stays put.
   const wantsJson = formData.get("_format") === "json";
 
-  const project = await prisma.project.findFirst({
-    where: {
-      slug: projectParam,
-    },
-  });
+  const project = await findProjectBySlug(organizationSlug, projectParam, userId);
 
   if (!project) {
     const message = `No project found with slug ${projectParam}`;

apps/webapp/app/routes/api.v1.schedules.$scheduleId.activate.ts

@@ -2,7 +2,7 @@ import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { prisma } from "~/db.server";
-import { scheduleUniqWhereClause, scheduleWhereClause } from "~/models/schedules.server";
+import { getScheduleEnvVisibility, scheduleUniqWhereClause } from "~/models/schedules.server";
 import { ViewSchedulePresenter } from "~/presenters/v3/ViewSchedulePresenter.server";
 import { authenticateApiRequest } from "~/services/apiAuth.server";
 import { logger } from "~/services/logger.server";
@@ -34,14 +34,17 @@ export async function action({ request, params }: ActionFunctionArgs) {
   }
 
   try {
-    const existingSchedule = await prisma.taskSchedule.findFirst({
-      where: scheduleWhereClause(
-        authenticationResult.environment.projectId,
-        parsedParams.data.scheduleId
-      ),
-    });
-
-    if (!existingSchedule) {
+    // Env-scoped API keys can only toggle schedules that have an instance in
+    // their own environment. Without this a key scoped to one environment
+    // could enable/disable a schedule that only runs in another environment
+    // of the same project.
+    const visibility = await getScheduleEnvVisibility(
+      prisma,
+      authenticationResult.environment.projectId,
+      parsedParams.data.scheduleId,
+      authenticationResult.environment.id
+    );
+    if (visibility.status !== "visible") {
       return json({ error: "Schedule not found" }, { status: 404 });
     }
 

apps/webapp/app/routes/api.v1.schedules.$scheduleId.deactivate.ts

@@ -2,7 +2,7 @@ import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { prisma } from "~/db.server";
-import { scheduleUniqWhereClause, scheduleWhereClause } from "~/models/schedules.server";
+import { getScheduleEnvVisibility, scheduleUniqWhereClause } from "~/models/schedules.server";
 import { ViewSchedulePresenter } from "~/presenters/v3/ViewSchedulePresenter.server";
 import { authenticateApiRequest } from "~/services/apiAuth.server";
 import { logger } from "~/services/logger.server";
@@ -34,14 +34,17 @@ export async function action({ request, params }: ActionFunctionArgs) {
   }
 
   try {
-    const existingSchedule = await prisma.taskSchedule.findFirst({
-      where: scheduleWhereClause(
-        authenticationResult.environment.projectId,
-        parsedParams.data.scheduleId
-      ),
-    });
-
-    if (!existingSchedule) {
+    // Env-scoped API keys can only toggle schedules that have an instance in
+    // their own environment. Without this a key scoped to one environment
+    // could enable/disable a schedule that only runs in another environment
+    // of the same project.
+    const visibility = await getScheduleEnvVisibility(
+      prisma,
+      authenticationResult.environment.projectId,
+      parsedParams.data.scheduleId,
+      authenticationResult.environment.id
+    );
+    if (visibility.status !== "visible") {
       return json({ error: "Schedule not found" }, { status: 404 });
     }
 

apps/webapp/app/routes/api.v1.schedules.$scheduleId.ts

@@ -5,7 +5,7 @@ import { UpdateScheduleOptions } from "@trigger.dev/core/v3";
 import { z } from "zod";
 import { Prisma, prisma } from "~/db.server";
 import { clientSafeErrorMessage } from "~/utils/prismaErrors";
-import { scheduleUniqWhereClause } from "~/models/schedules.server";
+import { getScheduleEnvVisibility, scheduleUniqWhereClause } from "~/models/schedules.server";
 import { ViewSchedulePresenter } from "~/presenters/v3/ViewSchedulePresenter.server";
 import { authenticateApiRequest } from "~/services/apiAuth.server";
 import { logger } from "~/services/logger.server";
@@ -38,6 +38,16 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   switch (method) {
     case "DELETE": {
+      const visibility = await getScheduleEnvVisibility(
+        prisma,
+        authenticationResult.environment.projectId,
+        parsedParams.data.scheduleId,
+        authenticationResult.environment.id
+      );
+      if (visibility.status !== "visible") {
+        return json({ error: "Schedule not found" }, { status: 404 });
+      }
+
       try {
         const deletedSchedule = await prisma.taskSchedule.delete({
           where: scheduleUniqWhereClause(
@@ -76,6 +86,19 @@ export async function action({ request, params }: ActionFunctionArgs) {
         return json({ error: "Invalid request body", issues: body.error.issues }, { status: 400 });
       }
 
+      // Env-scoped API keys can't see or mutate a schedule whose
+      // instances live in a different environment. "hidden" → refuse;
+      // "missing" → fall through to the upsert's create path.
+      const visibility = await getScheduleEnvVisibility(
+        prisma,
+        authenticationResult.environment.projectId,
+        parsedParams.data.scheduleId,
+        authenticationResult.environment.id
+      );
+      if (visibility.status === "hidden") {
+        return json({ error: "Schedule not found" }, { status: 404 });
+      }
+
       const service = new UpsertTaskScheduleService();
 
       try {
@@ -137,6 +160,16 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
     );
   }
 
+  const visibility = await getScheduleEnvVisibility(
+    prisma,
+    authenticationResult.environment.projectId,
+    parsedParams.data.scheduleId,
+    authenticationResult.environment.id
+  );
+  if (visibility.status !== "visible") {
+    return json({ error: "Schedule not found" }, { status: 404 });
+  }
+
   const presenter = new ViewSchedulePresenter();
 
   const result = await presenter.call({

apps/webapp/app/v3/environmentVariables/environmentVariablesRepository.server.ts

@@ -82,7 +82,10 @@ export class EnvironmentVariablesRepository implements Repository {
       return { success: false as const, error: "Project not found" };
     }
 
-    if (options.environmentIds.every((v) => !project.environments.some((e) => e.id === v))) {
+    // Reject if ANY supplied environmentId is outside the caller's project.
+    // `.some` (not `.every`) so one in-project id can't let a mixed array
+    // through.
+    if (options.environmentIds.some((v) => !project.environments.some((e) => e.id === v))) {
       return { success: false as const, error: `Environment not found` };
     }
 
@@ -291,7 +294,9 @@ export class EnvironmentVariablesRepository implements Repository {
       return { success: false as const, error: "Project not found" };
     }
 
-    if (options.values.every((v) => !project.environments.some((e) => e.id === v.environmentId))) {
+    // Same guard as `create()`: reject if ANY supplied environmentId is
+    // outside the caller's project (`.some`, not `.every`).
+    if (options.values.some((v) => !project.environments.some((e) => e.id === v.environmentId))) {
       return { success: false as const, error: `Environment not found` };
     }
 

apps/webapp/app/v3/services/checkSchedule.server.ts

@@ -1,6 +1,7 @@
 import { ZodError } from "zod";
 import { CronPattern } from "../schedules";
 import { BaseService, ServiceValidationError } from "./baseService.server";
+import { resolveProjectScopedEnvironments } from "./resolveProjectScopedEnvironments";
 import { getLimit } from "~/services/platform.v3.server";
 import { getTimezones } from "~/utils/timezones.server";
 import { env } from "~/env.server";
@@ -82,7 +83,19 @@ export class CheckScheduleService extends BaseService {
       throw new ServiceValidationError("Project not found");
     }
 
-    const environments = project.environments.filter((env) => environmentIds.includes(env.id));
+    // Reject (don't silently drop) any environmentId that doesn't belong to the
+    // authorized project.
+    const scopedEnvironments = resolveProjectScopedEnvironments(
+      environmentIds,
+      project.environments
+    );
+    if (scopedEnvironments.kind === "foreign") {
+      throw new ServiceValidationError(
+        `Environment ${scopedEnvironments.foreignEnvironmentId} does not belong to this project.`
+      );
+    }
+
+    const environments = scopedEnvironments.environments;
     if (environments.some((env) => env.archivedAt)) {
       throw new ServiceValidationError("Can't add or edit a schedule for an archived branch");
     }