feat(webapp): record admin API calls, dashboard actions and admin PAT mints through an admin audit plugin

Adds an optional admin audit plugin contract to the webapp. When
`ADMIN_AUDIT_ENABLED` is set and a plugin is installed, the webapp
records every admin API request, every admin dashboard mutation and
every personal access token minted by an admin: the actor (user and
token id, never the token value), source IP, method, path, status,
duration and a redacted summary of the request body.

```ts
import type { AdminAuditPlugin } from "@trigger.dev/plugins";

const plugin: AdminAuditPlugin = {
  create: ({ appOrigin }) => ({
    record: (event) => console.log(appOrigin, event.activity, event.actor.userId, event.http?.path),
    flush: async () => {},
  }),
};
export default plugin;
```

Without a plugin, or with the flag unset, nothing is recorded.

Mono-RevId: fc34ea9e9a51db019358d4e9f84f3763bc16a0fe

Author: ericallam

apps/webapp/app/env.server.ts

@@ -2826,6 +2826,9 @@ const EnvironmentSchema = z
     // login path.
     SSO_DATABASE_WRITER_CONNECTION_LIMIT: z.coerce.number().int().default(2),
     SSO_DATABASE_READER_CONNECTION_LIMIT: z.coerce.number().int().default(5),
+
+    /** Records admin API calls, admin dashboard mutations and admin PAT minting through the admin audit plugin. */
+    ADMIN_AUDIT_ENABLED: BoolEnv.default(false),
     // Emit a console.log when the SSO fallback is selected because no
     // plugin is installed. Default off so OSS deployments stay quiet.
     SSO_LOG_FALLBACK: BoolEnv.default(false),

apps/webapp/app/routes/account.tokens/route.tsx

@@ -37,6 +37,7 @@ import {
 import { SimpleTooltip } from "~/components/primitives/Tooltip";
 import { redirectWithSuccessMessage } from "~/models/message.server";
 import { prisma } from "~/db.server";
+import { extractClientIp } from "~/utils/extractClientIp.server";
 import { rbac } from "~/services/rbac.server";
 import {
   type CreatedPersonalAccessToken,
@@ -212,6 +213,10 @@ export const action: ActionFunction = async ({ request }) => {
           name: submission.value.tokenName,
           userId,
           roleId: submittedRoleId,
+          auditSource: {
+            ip: extractClientIp(request.headers.get("x-forwarded-for")),
+            userAgent: request.headers.get("user-agent"),
+          },
         });
 
         return json({ ...submission.reply(), payload: { token: tokenResult } });

apps/webapp/app/routes/admin.api.v1.deployments.template-builds.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { tryCatch } from "@trigger.dev/core/v3";
@@ -12,7 +13,7 @@ const BodySchema = z.object({
   force: z.boolean().default(false),
 });
 
-export async function action({ request }: ActionFunctionArgs) {
+async function handleAction({ request }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   if (request.method.toUpperCase() !== "POST") {
@@ -43,3 +44,5 @@ export async function action({ request }: ActionFunctionArgs) {
 
   return json({ results });
 }
+
+export const action = withAdminAudit(handleAction);

apps/webapp/app/routes/admin.api.v1.environments.$environmentId.burst-factor.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import { type ActionFunctionArgs, json } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { prisma } from "~/db.server";
@@ -13,7 +14,7 @@ const RequestBodySchema = z.object({
   burstFactor: z.number().positive(),
 });
 
-export async function action({ request, params }: ActionFunctionArgs) {
+async function handleAction({ request, params }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const { environmentId } = ParamsSchema.parse(params);
@@ -31,3 +32,5 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   return json({ success: true });
 }
+
+export const action = withAdminAudit(handleAction);

apps/webapp/app/routes/admin.api.v1.environments.$environmentId.engine.repair-queues.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import pMap from "p-map";
@@ -17,7 +18,7 @@ const BodySchema = z.object({
   queues: z.array(z.string()).default([]),
 });
 
-export async function action({ request, params }: ActionFunctionArgs) {
+async function handleAction({ request, params }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const parsedParams = ParamsSchema.parse(params);
@@ -86,3 +87,5 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   return json({ environment: repairEnvironmentResults, queues: repairResults });
 }
+
+export const action = withAdminAudit(handleAction);

apps/webapp/app/routes/admin.api.v1.environments.$environmentId.engine.report.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
@@ -21,7 +22,7 @@ const SearchParamsSchema = z.object({
     .optional(),
 });
 
-export async function loader({ request, params }: LoaderFunctionArgs) {
+async function handleLoader({ request, params }: LoaderFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const parsedParams = ParamsSchema.parse(params);
@@ -80,3 +81,5 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
 
   return json(report);
 }
+
+export const loader = withAdminAudit(handleLoader);

apps/webapp/app/routes/admin.api.v1.environments.$environmentId.schedules.recover.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
@@ -9,7 +10,7 @@ const ParamsSchema = z.object({
   environmentId: z.string(),
 });
 
-export async function action({ request, params }: ActionFunctionArgs) {
+async function handleAction({ request, params }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const parsedParams = ParamsSchema.parse(params);
@@ -38,3 +39,5 @@ export async function action({ request, params }: ActionFunctionArgs) {
     results,
   });
 }
+
+export const action = withAdminAudit(handleAction);

apps/webapp/app/routes/admin.api.v1.environments.$environmentId.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import type { ActionFunctionArgs, LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { z } from "zod";
@@ -17,7 +18,7 @@ const RequestBodySchema = z.object({
   orgMaximumConcurrencyLimit: z.number(),
 });
 
-export async function action({ request, params }: ActionFunctionArgs) {
+async function handleAction({ request, params }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const parsedParams = ParamsSchema.parse(params);
@@ -61,7 +62,7 @@ const SearchParamsSchema = z.object({
   queue: z.string().optional(),
 });
 
-export async function loader({ request, params }: LoaderFunctionArgs) {
+async function handleLoader({ request, params }: LoaderFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const parsedParams = ParamsSchema.parse(params);
@@ -109,3 +110,6 @@ export async function loader({ request, params }: LoaderFunctionArgs) {
 
   return json({ id: environment.id, concurrencyLimit, currentConcurrency });
 }
+
+export const loader = withAdminAudit(handleLoader);
+export const action = withAdminAudit(handleAction);

apps/webapp/app/routes/admin.api.v1.feature-flags.ts

@@ -1,3 +1,4 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { prisma } from "~/db.server";
@@ -11,7 +12,7 @@ import {
 } from "~/v3/featureFlags.server";
 import { validatePartialFeatureFlags } from "~/v3/featureFlags";
 
-export async function action({ request }: ActionFunctionArgs) {
+async function handleAction({ request }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   try {
@@ -55,3 +56,5 @@ export async function action({ request }: ActionFunctionArgs) {
     );
   }
 }
+
+export const action = withAdminAudit(handleAction);

apps/webapp/app/routes/admin.api.v1.llm-models.$modelId.ts

@@ -1,9 +1,10 @@
+import { withAdminAudit } from "~/services/adminAudit/adminAudit.server";
 import { type ActionFunctionArgs, type LoaderFunctionArgs, json } from "@remix-run/server-runtime";
 import { z } from "zod";
 import { prisma } from "~/db.server";
 import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
 
-export async function loader({ request, params }: LoaderFunctionArgs) {
+async function handleLoader({ request, params }: LoaderFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const model = await prisma.llmModel.findUnique({
@@ -55,7 +56,7 @@ const UpdateModelSchema = z.object({
     .optional(),
 });
 
-export async function action({ request, params }: ActionFunctionArgs) {
+async function handleAction({ request, params }: ActionFunctionArgs) {
   await requireAdminApiRequest(request);
 
   const modelId = params.modelId!;
@@ -162,3 +163,6 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   return json({ model: updated });
 }
+
+export const loader = withAdminAudit(handleLoader);
+export const action = withAdminAudit(handleAction);