feat(webapp): locate runs and errors across the token organization

Author: kathiekiwi

apps/webapp/app/routes/api.v1.locate.$kind.$id.ts

@@ -0,0 +1,57 @@
+import { json, type LoaderFunctionArgs } from "@remix-run/server-runtime";
+import { z } from "zod";
+import { isOrganizationMember, locateAgentObject } from "~/services/locateAgentObject.server";
+import { logger } from "~/services/logger.server";
+import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server";
+
+/**
+ * Deterministic org-wide locator for the Dashboard Agent. The organization comes only from the
+ * token's claim, so there is nothing for a caller to point at another tenant.
+ */
+
+const ParamsSchema = z.object({
+  kind: z.enum(["run", "error"]),
+  id: z.string().min(1),
+});
+
+export async function loader({ request, params }: LoaderFunctionArgs) {
+  const authentication = await authenticateUatOrApiRequest(request);
+  const userActor = authentication?.userActor;
+
+  if (!userActor?.organizationId) {
+    return json({ error: "Invalid or missing access token" }, { status: 401 });
+  }
+
+  const parsedParams = ParamsSchema.safeParse(params);
+  if (!parsedParams.success) {
+    return json({ error: "Unknown object kind", code: "invalid_request" }, { status: 400 });
+  }
+
+  const organizationId = userActor.organizationId;
+
+  if (!(await isOrganizationMember(organizationId, userActor.userId))) {
+    return json(
+      { error: "You don't have access to that organization.", code: "forbidden_organization" },
+      { status: 403 }
+    );
+  }
+
+  try {
+    return json(
+      await locateAgentObject({
+        kind: parsedParams.data.kind,
+        id: parsedParams.data.id,
+        organizationId,
+        userId: userActor.userId,
+      })
+    );
+  } catch (error) {
+    if (error instanceof Response) throw error;
+    logger.error("Failed to locate an object for the dashboard agent", {
+      error,
+      kind: parsedParams.data.kind,
+      organizationId,
+    });
+    return json({ error: "Internal Server Error", code: "internal" }, { status: 500 });
+  }
+}

apps/webapp/app/services/locateAgentObject.server.ts

@@ -0,0 +1,123 @@
+/**
+ * Org-wide lookup for the Dashboard Agent: given a run or error id the agent could not find in
+ * the current project/environment, name every scope inside the token's organization where it
+ * exists. The organization is a hard boundary — an object in another org reads as not found, so
+ * the endpoint never confirms its existence.
+ */
+
+import { boundedIn, type RuntimeEnvironmentType } from "@trigger.dev/database";
+import { ErrorId } from "@trigger.dev/core/v3/isomorphic";
+import { $replica } from "~/db.server";
+import { clickhouseFactory } from "~/services/clickhouse/clickhouseFactoryInstance.server";
+import { runStore } from "~/v3/runStore.server";
+
+export type LocatedScope = {
+  projectRef: string;
+  projectName: string;
+  environmentName: string;
+  environmentType: RuntimeEnvironmentType;
+  branchName?: string;
+  /** Whether the caller may act in this scope. An inaccessible scope is still reported. */
+  targetable: boolean;
+};
+
+export type LocateResult =
+  | { found: true; scopes: LocatedScope[]; checked: "organization" }
+  | { found: false; checked: "organization" };
+
+const NOT_FOUND: LocateResult = { found: false, checked: "organization" };
+
+export type LocateTarget = {
+  kind: "run" | "error";
+  id: string;
+  organizationId: string;
+  userId: string;
+};
+
+export async function isOrganizationMember(
+  organizationId: string,
+  userId: string
+): Promise<boolean> {
+  const organization = await $replica.organization.findFirst({
+    where: { id: organizationId, deletedAt: null, members: { some: { userId } } },
+    select: { id: true },
+  });
+
+  return !!organization;
+}
+
+export async function locateAgentObject(target: LocateTarget): Promise<LocateResult> {
+  const environmentIds =
+    target.kind === "run"
+      ? await runEnvironmentIds(target.id)
+      : await errorEnvironmentIds(target.id, target.organizationId);
+
+  const scopes = await scopesForEnvironments(environmentIds, target.organizationId, target.userId);
+
+  return scopes.length > 0 ? { found: true, scopes, checked: "organization" } : NOT_FOUND;
+}
+
+/** A run friendlyId is globally unique, so this is one lookup; the org filter comes later. */
+async function runEnvironmentIds(friendlyId: string): Promise<string[]> {
+  const run = await runStore.findRun({ friendlyId }, { select: { runtimeEnvironmentId: true } });
+
+  return run ? [run.runtimeEnvironmentId] : [];
+}
+
+/** A fingerprint is legitimately present in many environments, so every one of them answers. */
+async function errorEnvironmentIds(errorId: string, organizationId: string): Promise<string[]> {
+  let fingerprint: string;
+  try {
+    fingerprint = ErrorId.toId(errorId);
+  } catch {
+    return [];
+  }
+
+  const clickhouse = await clickhouseFactory.getClickhouseForOrganization(organizationId, "logs");
+  const [queryError, rows] = await clickhouse.errors.getScopes({
+    organizationId,
+    errorFingerprint: fingerprint,
+  });
+
+  if (queryError) {
+    throw queryError;
+  }
+
+  return (rows ?? []).map((row) => row.environment_id);
+}
+
+async function scopesForEnvironments(
+  environmentIds: string[],
+  organizationId: string,
+  userId: string
+): Promise<LocatedScope[]> {
+  if (environmentIds.length === 0) {
+    return [];
+  }
+
+  const environments = await $replica.runtimeEnvironment.findMany({
+    where: {
+      id: { in: boundedIn(environmentIds) },
+      organizationId,
+      archivedAt: null,
+      project: { deletedAt: null },
+    },
+    select: {
+      slug: true,
+      type: true,
+      branchName: true,
+      orgMember: { select: { userId: true } },
+      project: { select: { externalRef: true, name: true } },
+    },
+  });
+
+  return environments.map((environment) => ({
+    projectRef: environment.project.externalRef,
+    projectName: environment.project.name,
+    environmentName: environment.slug,
+    environmentType: environment.type,
+    ...(environment.branchName ? { branchName: environment.branchName } : {}),
+    // dev is per-user: another member's dev environment exists but can't be acted in.
+    targetable: environment.type !== "DEVELOPMENT" || environment.orgMember?.userId === userId,
+  }));
+}