fix(webapp,rbac): stop exposing environment ids in public access tokens

Public access tokens no longer carry the environment id in their subject
claim. The subject is now the environment id encrypted with a key
derived from the server encryption key, so a token held by a browser
does not reveal internal ids. Tokens minted before this change keep
working.

Mono-RevId: 28c843699d1f5278225549bd010cfd23dac46572

Author: ericallam

apps/webapp/app/env.server.ts

@@ -416,6 +416,7 @@ const EnvironmentSchema = z
         "ENCRYPTION_KEY must be exactly 32 bytes"
       )
       .refine(isNotInsecureSecret, INSECURE_SECRET_MESSAGE),
+    PUBLIC_TOKEN_SEALED_SUBJECT_ENABLED: BoolEnv.default(false),
     // Enables the AWS_KMS secret store provider. Callers opt in per secret; everything else
     // stays encrypted with ENCRYPTION_KEY.
     SECRET_STORE_AWS_KMS_KEY_ID: z.string().optional(),

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.playground.$agentParam/route.tsx

@@ -65,6 +65,7 @@ export const handle: Handle = {
   agentPageContext: (data) => playgroundAgentPageContext(data),
 };
 import { pageMeta } from "~/utils/pageTitle";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 export const meta = pageMeta(({ params }) => [params.agentParam ?? "Agent", "Playground"]);
 
@@ -127,7 +128,7 @@ export const loader = async ({ request, params }: LoaderFunctionArgs) => {
         jwt = await internal_generateJWT({
           secretKey: extractJwtSigningSecretKey(environment),
           payload: {
-            sub: environment.id,
+            sub: publicTokenSubject(environment.id),
             pub: true,
             scopes: [`read:runs:${conv.runFriendlyId}`, `write:inputStreams:${conv.runFriendlyId}`],
           },

apps/webapp/app/routes/api.v1.auth.jwt.claims.ts

@@ -2,6 +2,7 @@ import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { authenticateApiRequest } from "~/services/apiAuth.server";
 import { logger } from "~/services/logger.server";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 export async function action({ request }: LoaderFunctionArgs) {
   try {
@@ -13,7 +14,7 @@ export async function action({ request }: LoaderFunctionArgs) {
     }
 
     const claims = {
-      sub: authenticationResult.environment.id,
+      sub: publicTokenSubject(authenticationResult.environment.id),
       pub: true,
     };
 

apps/webapp/app/routes/api.v1.auth.jwt.ts

@@ -7,6 +7,7 @@ import { z } from "zod";
 import { authenticateBearerWithTelemetry } from "~/services/authTelemetry.server";
 import { isApiKeyInGraceWindow, presentedBearerToken } from "~/services/apiKeyGraceWindow.server";
 import { logger } from "~/services/logger.server";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 const RequestBodySchema = z.object({
   claims: z
@@ -119,7 +120,7 @@ export async function action({ request }: LoaderFunctionArgs) {
     }
 
     const claims = {
-      sub: authenticationResult.environment.id,
+      sub: publicTokenSubject(authenticationResult.environment.id),
       pub: true,
       ...(requestedScopes.length > 0 ? { scopes: requestedScopes } : {}),
     };

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.jwt.ts

@@ -20,6 +20,7 @@ import { env as appEnv } from "~/env.server";
 import { assertSourcePatActive } from "~/services/personalAccessToken.server";
 import { logger } from "~/services/logger.server";
 import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 const ParamsSchema = z.object({
   projectRef: z.string(),
@@ -185,7 +186,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
         : undefined);
 
     const claims = {
-      sub: runtimeEnv.id,
+      sub: publicTokenSubject(runtimeEnv.id),
       pub: true,
       ...(scopes ? { scopes } : {}),
       ...(actorUserId

apps/webapp/app/routes/api.v1.tasks.$taskId.trigger.ts

@@ -30,6 +30,7 @@ import { sanitizeTriggerSource } from "~/utils/triggerSource";
 import { runStore } from "~/v3/runStore.server";
 import { ServiceValidationError } from "~/v3/services/baseService.server";
 import { OutOfEntitlementError, TriggerTaskService } from "~/v3/services/triggerTask.server";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 const ParamsSchema = z.object({
   taskId: z.string(),
@@ -220,7 +221,7 @@ async function responseHeaders(
   const { environment, realtime } = authentication;
 
   const claims = {
-    sub: environment.id,
+    sub: publicTokenSubject(environment.id),
     pub: true,
     scopes: [`read:runs:${run.friendlyId}`, `write:inputStreams:${run.friendlyId}`],
     realtime,

apps/webapp/app/routes/api.v2.tasks.batch.ts

@@ -27,6 +27,7 @@ import { clientSafeErrorMessage } from "~/utils/prismaErrors";
 import { HeadersSchema } from "./api.v1.tasks.$taskId.trigger";
 import { determineRealtimeStreamsVersion } from "~/services/realtime/v1StreamsGlobal.server";
 import { extractJwtSigningSecretKey } from "~/services/realtime/jwtAuth.server";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 const { action, loader } = createActionApiRoute(
   {
@@ -215,7 +216,7 @@ async function responseHeaders(
   environment: AuthenticatedEnvironment
 ): Promise<Record<string, string>> {
   const claims = {
-    sub: environment.id,
+    sub: publicTokenSubject(environment.id),
     pub: true,
     scopes: [`read:batch:${batch.id}`],
   };
@@ -227,7 +228,7 @@ async function responseHeaders(
   });
 
   return {
-    "x-trigger-jwt-claims": JSON.stringify({ sub: environment.id, pub: true }),
+    "x-trigger-jwt-claims": JSON.stringify({ sub: publicTokenSubject(environment.id), pub: true }),
     "x-trigger-jwt": jwt,
   };
 }

apps/webapp/app/routes/api.v3.batches.ts

@@ -28,6 +28,7 @@ import { ServiceValidationError } from "~/v3/services/baseService.server";
 import { OutOfEntitlementError } from "~/v3/services/triggerTask.server";
 import { engine } from "~/v3/runEngine.server";
 import { HeadersSchema } from "./api.v1.tasks.$taskId.trigger";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 /**
  * Phase 1 of 2-phase batch API: Create a batch.
@@ -261,15 +262,15 @@ async function responseHeaders(
   const jwt = await generateJWT({
     secretKey: extractJwtSigningSecretKey(environment),
     payload: {
-      sub: environment.id,
+      sub: publicTokenSubject(environment.id),
       pub: true,
       scopes,
     },
     expirationTime: "1h",
   });
 
   return {
-    "x-trigger-jwt-claims": JSON.stringify({ sub: environment.id, pub: true }),
+    "x-trigger-jwt-claims": JSON.stringify({ sub: publicTokenSubject(environment.id), pub: true }),
     "x-trigger-jwt": jwt,
   };
 }

apps/webapp/app/services/authTelemetry.server.ts

@@ -6,7 +6,7 @@ import {
   SDK_CREDENTIAL_OPERATION_HEADER,
   SDK_CREDENTIAL_REASON_HEADER,
 } from "@trigger.dev/core/v3";
-import { isPublicJWT } from "@trigger.dev/core/v3/jwt";
+import { extractJWTSub, isPublicJWT } from "@trigger.dev/core/v3/jwt";
 import { isDefaultDevBranch, sanitizeBranchName } from "@trigger.dev/core/v3/utils/gitBranch";
 import type { BearerAuthOptions, BearerAuthResult } from "@trigger.dev/plugins";
 import type {
@@ -17,6 +17,7 @@ import type {
   RbacResource,
   RoleBaseAccessController,
 } from "@trigger.dev/rbac";
+import { isSealedPublicTokenSubject } from "@trigger.dev/rbac";
 import { authenticateRunToken } from "~/services/oidc/runTokenAuth.server";
 import { isRunTokenFormat } from "~/services/oidc/runTokenVerify";
 import { rbac } from "~/services/rbac.server";
@@ -220,7 +221,11 @@ function classifyCredential(
     return { credentialKind: "legacy_public_key", lookupPath: "legacy_public" };
   }
   if (allowJWT && isPublicJWT(token)) {
-    return { credentialKind: "public_jwt", lookupPath: "jwt_current" };
+    const sub = extractJWTSub(token);
+    return {
+      credentialKind: "public_jwt",
+      lookupPath: sub && !isSealedPublicTokenSubject(sub) ? "jwt_legacy_subject" : "jwt_current",
+    };
   }
   if (isAdditionalApiKey(token)) {
     return { credentialKind: "additional_api_key", lookupPath: "additional" };

apps/webapp/app/services/publicAccessTokenResponse.server.ts

@@ -1,5 +1,6 @@
 import { generateJWT } from "@trigger.dev/core/v3";
 import { resolveJwtSigningKey } from "@trigger.dev/rbac";
+import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
 export type PublicAccessTokenEnvironment = {
   id: string;
@@ -19,15 +20,15 @@ export async function publicAccessTokenResponseHeaders({
   const jwt = await generateJWT({
     secretKey: resolveJwtSigningKey(environment),
     payload: {
-      sub: environment.id,
+      sub: publicTokenSubject(environment.id),
       pub: true,
       scopes,
     },
     expirationTime,
   });
 
   return {
-    "x-trigger-jwt-claims": JSON.stringify({ sub: environment.id, pub: true }),
+    "x-trigger-jwt-claims": JSON.stringify({ sub: publicTokenSubject(environment.id), pub: true }),
     "x-trigger-jwt": jwt,
   };
 }