fix(webapp): cap project JWT lifetime at 24 hours

Project JWT minting now rejects expiration times longer than 24 hours,
using the same validation as the API-key JWT mint route. Delegated
tokens remain limited by their own expiry.

Mono-RevId: 6ffd715d174118c1262296258c240b92c62cc766

Author: carderne

.server-changes/cap-project-jwt-lifetime.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Project JWT minting now rejects expiration times longer than 24 hours.

apps/webapp/app/routes/api.v1.auth.jwt.ts

@@ -2,10 +2,10 @@ import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { generateJWT as internal_generateJWT } from "@trigger.dev/core/v3";
 import { resolveJwtSigningKey, scopesWithinAbility } from "@trigger.dev/rbac";
-import parseDuration from "parse-duration";
 import { z } from "zod";
 import { authenticateBearerWithTelemetry } from "~/services/authTelemetry.server";
 import { isApiKeyInGraceWindow, presentedBearerToken } from "~/services/apiKeyGraceWindow.server";
+import { validateJwtExpiration } from "~/services/jwtExpiration.server";
 import { logger } from "~/services/logger.server";
 import { publicTokenSubject } from "~/services/publicTokenSubject.server";
 
@@ -18,35 +18,6 @@ const RequestBodySchema = z.object({
   expirationTime: z.union([z.number(), z.string()]).optional(),
 });
 
-const DEFAULT_EXPIRY = "1h";
-// A minted public JWT may be valid for at most 24 hours. A caller-controlled,
-// uncapped `expirationTime` ("100y") would otherwise mint a token that no key
-// rotation can revoke — public JWTs are not invalidated by rotating the
-// environment's key. The cap is the compensating control for that.
-const MAX_EXPIRY_SECONDS = 24 * 60 * 60;
-
-// A requested `expirationTime` above this (epoch seconds, ~2001) is an absolute
-// timestamp; a smaller number is a relative offset in seconds.
-const EXPIRY_EPOCH_THRESHOLD_SECONDS = 1_000_000_000;
-
-// Resolve the requested expiry to an absolute epoch-second timestamp so it can
-// be capped. Returns undefined when a string can't be parsed as a duration.
-function resolveRequestedExpirySeconds(
-  expirationTime: number | string | undefined,
-  nowSec: number
-): number | undefined {
-  if (typeof expirationTime === "number") {
-    return expirationTime > EXPIRY_EPOCH_THRESHOLD_SECONDS
-      ? expirationTime
-      : nowSec + expirationTime;
-  }
-  const durationMs = parseDuration(expirationTime ?? DEFAULT_EXPIRY);
-  if (durationMs == null) {
-    return undefined;
-  }
-  return nowSec + Math.floor(durationMs / 1000);
-}
-
 export async function action({ request }: LoaderFunctionArgs) {
   try {
     // Authenticate through the RBAC bearer controller (not the legacy
@@ -108,15 +79,9 @@ export async function action({ request }: LoaderFunctionArgs) {
     }
 
     const nowSec = Math.floor(Date.now() / 1000);
-    const requestedAbsSec = resolveRequestedExpirySeconds(parsedBody.data.expirationTime, nowSec);
-    if (requestedAbsSec === undefined) {
-      return json({ error: "Invalid expiration time" }, { status: 400 });
-    }
-    if (requestedAbsSec <= nowSec) {
-      return json({ error: "Expiration time must be in the future" }, { status: 400 });
-    }
-    if (requestedAbsSec - nowSec > MAX_EXPIRY_SECONDS) {
-      return json({ error: "Expiration time cannot exceed 24 hours" }, { status: 400 });
+    const expiry = validateJwtExpiration(parsedBody.data.expirationTime, nowSec);
+    if (expiry.error !== undefined) {
+      return json({ error: expiry.error }, { status: 400 });
     }
 
     const claims = {
@@ -132,7 +97,7 @@ export async function action({ request }: LoaderFunctionArgs) {
     const jwt = await internal_generateJWT({
       secretKey: resolveJwtSigningKey(authenticationResult.environment),
       payload: claims,
-      expirationTime: requestedAbsSec,
+      expirationTime: expiry.expirationTime,
     });
 
     return json({ token: jwt });

apps/webapp/app/routes/api.v1.projects.$projectRef.$env.jwt.ts

@@ -8,7 +8,6 @@ import {
   verifyUserActorToken,
   type UserActorClaims,
 } from "@trigger.dev/rbac";
-import parseDuration from "parse-duration";
 import { z } from "zod";
 import {
   authenticatedEnvironmentForAuthentication,
@@ -18,6 +17,7 @@ import {
 } from "~/services/apiAuth.server";
 import { env as appEnv } from "~/env.server";
 import { assertSourcePatActive } from "~/services/personalAccessToken.server";
+import { validateJwtExpiration } from "~/services/jwtExpiration.server";
 import { logger } from "~/services/logger.server";
 import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
 import { publicTokenSubject } from "~/services/publicTokenSubject.server";
@@ -36,27 +36,6 @@ const RequestBodySchema = z.object({
   expirationTime: z.union([z.number(), z.string()]).optional(),
 });
 
-// A requested `expirationTime` above this (epoch seconds, ~2001) is an absolute
-// timestamp; a smaller number is a relative offset in seconds.
-const EXPIRY_EPOCH_THRESHOLD_SECONDS = 1_000_000_000;
-const DEFAULT_EXPIRY = "1h";
-
-// Resolve the requested expiry to an absolute epoch-second timestamp so it can be
-// clamped against a delegated token's own expiry.
-function resolveRequestedExpirySeconds(
-  expirationTime: number | string | undefined,
-  nowSec: number
-): number {
-  if (typeof expirationTime === "number") {
-    return expirationTime > EXPIRY_EPOCH_THRESHOLD_SECONDS
-      ? expirationTime
-      : nowSec + expirationTime;
-  }
-  const durationMs = parseDuration(expirationTime ?? DEFAULT_EXPIRY);
-  const seconds = durationMs != null ? Math.floor(durationMs / 1000) : 60 * 60;
-  return nowSec + seconds;
-}
-
 export async function action({ request, params }: ActionFunctionArgs) {
   try {
     const bearer = request.headers
@@ -194,14 +173,17 @@ export async function action({ request, params }: ActionFunctionArgs) {
         : {}),
     };
 
-    // A delegated token can't mint a longer-lived JWT than itself: clamp the
-    // requested expiry to the token's own `exp`. Non-UAT callers are unchanged.
     const nowSec = Math.floor(Date.now() / 1000);
-    const requestedAbsSec = resolveRequestedExpirySeconds(parsedBody.data.expirationTime, nowSec);
+    const expiry = validateJwtExpiration(parsedBody.data.expirationTime, nowSec);
+    if (expiry.error !== undefined) {
+      return json({ error: expiry.error }, { status: 400 });
+    }
+
+    // A delegated token can't mint a longer-lived JWT than itself.
     const expirationTime =
       isUat && userActor?.expiresAt !== undefined
-        ? Math.min(requestedAbsSec, userActor.expiresAt)
-        : (parsedBody.data.expirationTime ?? DEFAULT_EXPIRY);
+        ? Math.min(expiry.expirationTime, userActor.expiresAt)
+        : expiry.expirationTime;
 
     const jwt = await internal_generateJWT({
       secretKey: runtimeEnv.apiKey,

apps/webapp/app/services/jwtExpiration.server.ts

@@ -0,0 +1,35 @@
+import parseDuration from "parse-duration";
+
+const DEFAULT_EXPIRY = "1h";
+const MAX_EXPIRY_SECONDS = 24 * 60 * 60;
+// Preserve the mint routes' numeric convention: epoch timestamps above ~2001,
+// relative seconds otherwise.
+const EXPIRY_EPOCH_THRESHOLD_SECONDS = 1_000_000_000;
+
+export function validateJwtExpiration(
+  expirationTime: number | string | undefined,
+  nowSec: number
+): { expirationTime: number; error?: never } | { error: string; expirationTime?: never } {
+  let expiresAt: number;
+  if (typeof expirationTime === "number") {
+    expiresAt =
+      expirationTime > EXPIRY_EPOCH_THRESHOLD_SECONDS ? expirationTime : nowSec + expirationTime;
+  } else {
+    const durationMs = parseDuration(expirationTime ?? DEFAULT_EXPIRY);
+    if (durationMs == null) {
+      return { error: "Invalid expiration time" };
+    }
+    expiresAt = nowSec + Math.floor(durationMs / 1000);
+  }
+
+  if (!Number.isFinite(expiresAt)) {
+    return { error: "Invalid expiration time" };
+  }
+  if (expiresAt <= nowSec) {
+    return { error: "Expiration time must be in the future" };
+  }
+  if (expiresAt - nowSec > MAX_EXPIRY_SECONDS) {
+    return { error: "Expiration time cannot exceed 24 hours" };
+  }
+  return { expirationTime: expiresAt };
+}

apps/webapp/test/auth-jwt-mint.e2e.full.test.ts

@@ -16,6 +16,7 @@
 import { describe, expect, it } from "vitest";
 import { getTestServer } from "./helpers/sharedTestServer";
 import { seedTestEnvironment } from "./helpers/seedTestEnvironment";
+import { seedTestUserProject } from "./helpers/seedTestUserProject";
 
 const ROUTE = "/api/v1/auth/jwt";
 
@@ -37,6 +38,39 @@ function decodePayload(token: string): Record<string, unknown> {
   return JSON.parse(Buffer.from(base64, "base64").toString("utf8"));
 }
 
+describe("POST /api/v1/projects/:projectRef/:env/jwt", () => {
+  // Catches: PAT exchange bypassing the TTL cap or signing a different exp than it validated.
+  it("bounds PAT-minted JWTs to 24 hours", async () => {
+    const server = getTestServer();
+    const { project, pat } = await seedTestUserProject(server.prisma);
+    const exchange = (expirationTime?: string | number) =>
+      server.webapp.fetch(`/api/v1/projects/${project.externalRef}/dev/jwt`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${pat.token}`,
+          "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ expirationTime }),
+      });
+
+    for (const expirationTime of [undefined, "24h", 86400]) {
+      const before = Math.floor(Date.now() / 1000);
+      const response = await exchange(expirationTime);
+      expect(response.status).toBe(200);
+      const { token } = (await response.json()) as { token: string };
+      const exp = decodePayload(token).exp as number;
+      const expectedTtl = expirationTime === undefined ? 3600 : 86400;
+      expect(exp).toBeGreaterThanOrEqual(before + expectedTtl);
+      expect(exp).toBeLessThanOrEqual(Math.floor(Date.now() / 1000) + expectedTtl);
+    }
+
+    for (const expirationTime of ["100y", 86401, Math.floor(Date.now() / 1000) + 172800]) {
+      const response = await exchange(expirationTime);
+      expect(response.status).toBe(400);
+    }
+  });
+});
+
 describe("POST /api/v1/auth/jwt", () => {
   it("mints a token for a valid root key, echoing the requested scopes", async () => {
     const server = getTestServer();

apps/webapp/test/jwtExpiration.test.ts

@@ -0,0 +1,25 @@
+import { describe, expect, it } from "vitest";
+import { validateJwtExpiration } from "../app/services/jwtExpiration.server";
+
+const now = 1_800_000_000;
+
+describe("JWT expiration", () => {
+  // Catches: alternate duration/numeric inputs bypassing the cap or invalid input silently defaulting.
+  it.each(["100y", 86401, now + 86401, "invalid", 0, -1, now - 1, Infinity, NaN])(
+    "rejects invalid or out-of-bounds expiration %s",
+    (expirationTime) => {
+      expect(validateJwtExpiration(expirationTime, now).error).toBeDefined();
+    }
+  );
+
+  // Catches: parsing changing the signed absolute expiry or rejecting the exact 24-hour boundary.
+  it.each([
+    [undefined, now + 3600],
+    ["1h", now + 3600],
+    ["24h", now + 86400],
+    [86400, now + 86400],
+    [now + 86400, now + 86400],
+  ] as const)("resolves %s to an absolute capped expiry", (input, expected) => {
+    expect(validateJwtExpiration(input, now)).toEqual({ expirationTime: expected });
+  });
+});

apps/webapp/test/uatEnvironmentClaim.test.ts

@@ -695,7 +695,7 @@ describe("env JWT exchange — capless ceiling and TTL clamp", () => {
     const tokenExp = nowSec + 600;
     const token = await mintUat({ expirationTime: tokenExp });
 
-    const payload = await exchange(token, { expirationTime: "365d" });
+    const payload = await exchange(token, { expirationTime: "24h" });
 
     expect(payload.exp).toBeLessThanOrEqual(tokenExp + 1);
     expect(payload.exp).toBeGreaterThan(nowSec + 500);