fix delete preview branches and api url fallback

Author: carderne

apps/webapp/app/routes/api.v1.projects.$projectRef.branches.archive.ts

@@ -2,7 +2,7 @@ import { type ActionFunctionArgs, json } from "@remix-run/server-runtime";
 import { tryCatch } from "@trigger.dev/core";
 import { z } from "zod";
 import { prisma } from "~/db.server";
-import { authenticateRequest } from "~/services/apiAuth.server";
+import { authenticateRequestWithScopedApiKey } from "~/services/apiAuth.server";
 import { ArchiveBranchService } from "~/services/archiveBranch.server";
 import { logger } from "~/services/logger.server";
 import { toBranchableEnvironmentType } from "~/utils/branchableEnvironment";
@@ -24,15 +24,25 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   logger.info("Archive branch", { url: request.url, params });
 
-  const authenticationResult = await authenticateRequest(request, {
+  const authentication = await authenticateRequestWithScopedApiKey(request, {
     personalAccessToken: true,
     organizationAccessToken: true,
-    apiKey: false,
+    apiKey: {
+      action: "write",
+      resource: { type: "branches" },
+      allowPreviewParent: true,
+    },
   });
 
-  if (!authenticationResult) {
-    return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
+  if (!authentication.ok) {
+    return json({ error: authentication.error }, { status: authentication.status });
   }
+  const authenticationResult = authentication.authentication;
+
+  const apiKeyEnvironment =
+    authenticationResult.type === "apiKey" && authenticationResult.result.ok
+      ? authenticationResult.result.environment
+      : undefined;
 
   const parsedParams = ParamsSchema.safeParse(params);
 
@@ -54,25 +64,44 @@ export async function action({ request, params }: ActionFunctionArgs) {
 
   const { env, branch } = parsed.data;
 
+  // API keys can only archive Preview branches
+  if (
+    authenticationResult.type === "apiKey" &&
+    (!apiKeyEnvironment ||
+      apiKeyEnvironment.type !== "PREVIEW" ||
+      apiKeyEnvironment.parentEnvironmentId !== null ||
+      env !== "preview")
+  ) {
+    return json(
+      { error: "API keys must belong to the parent Preview environment." },
+      { status: 403 }
+    );
+  }
+
   const environmentType = toBranchableEnvironmentType(env);
+
+  const organizationFilter =
+    authenticationResult.type === "organizationAccessToken"
+      ? { id: authenticationResult.result.organizationId }
+      : authenticationResult.type === "apiKey"
+        ? { id: apiKeyEnvironment!.organizationId }
+        : {
+            members: {
+              some: {
+                userId: authenticationResult.result.userId,
+              },
+            },
+          };
+
   const environments = await prisma.runtimeEnvironment.findMany({
     select: {
       id: true,
       archivedAt: true,
     },
     where: {
-      organization:
-        authenticationResult.type === "organizationAccessToken"
-          ? { id: authenticationResult.result.organizationId }
-          : {
-              members: {
-                some: {
-                  userId: authenticationResult.result.userId,
-                },
-              },
-            },
+      organization: organizationFilter,
       // Dev branches are per-org-member: only the owner may archive their own.
-      ...(authenticationResult.type !== "organizationAccessToken" &&
+      ...(authenticationResult.type === "personalAccessToken" &&
       environmentType === "DEVELOPMENT"
         ? { orgMember: { userId: authenticationResult.result.userId } }
         : {}),
@@ -91,7 +120,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
   const activeEnvironments = environments.filter((env) => env.archivedAt === null);
 
   if (
-    authenticationResult.type === "organizationAccessToken" &&
+    authenticationResult.type !== "personalAccessToken" &&
     environmentType === "DEVELOPMENT" &&
     activeEnvironments.length > 1
   ) {
@@ -110,15 +139,21 @@ export async function action({ request, params }: ActionFunctionArgs) {
     return json({ error: "Branch already archived" }, { status: 400 });
   }
 
+  let orgFilter:
+    | { type: "userMembership"; userId: string }
+    | { type: "orgId"; organizationId: string };
+  if (authenticationResult.type === "personalAccessToken") {
+    orgFilter = { type: "userMembership", userId: authenticationResult.result.userId };
+  } else if (authenticationResult.type === "organizationAccessToken") {
+    orgFilter = { type: "orgId", organizationId: authenticationResult.result.organizationId };
+  } else {
+    orgFilter = { type: "orgId", organizationId: apiKeyEnvironment!.organizationId };
+  }
+
   const service = new ArchiveBranchService();
-  const result = await service.call(
-    authenticationResult.type === "organizationAccessToken"
-      ? { type: "orgId", organizationId: authenticationResult.result.organizationId }
-      : { type: "userMembership", userId: authenticationResult.result.userId },
-    {
-      environmentId: environment.id,
-    }
-  );
+  const result = await service.call(orgFilter, {
+    environmentId: environment.id,
+  });
 
   if (result.success) {
     return json(result);

packages/cli-v3/src/deploy/auth.test.ts

@@ -1,5 +1,11 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
+
+vi.mock("../utilities/configFiles.js", () => ({
+  readAuthConfigProfile: vi.fn(() => undefined),
+}));
+
 import { authenticateForDeploy, userIdForDeploy } from "./auth.js";
+import { readAuthConfigProfile } from "../utilities/configFiles.js";
 
 describe("authenticateForDeploy", () => {
   it("gives TRIGGER_SECRET_KEY precedence without logging in", async () => {
@@ -58,6 +64,42 @@ describe("authenticateForDeploy", () => {
     });
   });
 
+  it("falls back to the saved profile's API URL for self-hosted instances", async () => {
+    vi.mocked(readAuthConfigProfile).mockReturnValueOnce({
+      apiUrl: "https://trigger.internal.example.com",
+    });
+
+    const result = await authenticateForDeploy({
+      secretKey: "tr_prod_sk_deploy",
+      profile: "selfhosted",
+      silent: true,
+      login: async () => ({ ok: false, error: "should not be called" }),
+    });
+
+    expect(result).toMatchObject({
+      dashboardUrl: "https://trigger.internal.example.com",
+      auth: { apiUrl: "https://trigger.internal.example.com" },
+    });
+  });
+
+  it("prefers an explicit API URL over the saved profile", async () => {
+    vi.mocked(readAuthConfigProfile).mockReturnValueOnce({
+      apiUrl: "https://trigger.internal.example.com",
+    });
+
+    const result = await authenticateForDeploy({
+      secretKey: "tr_prod_sk_deploy",
+      apiUrl: "https://api.trigger.dev",
+      profile: "selfhosted",
+      silent: true,
+      login: async () => ({ ok: false, error: "should not be called" }),
+    });
+
+    expect(result).toMatchObject({
+      auth: { apiUrl: "https://api.trigger.dev" },
+    });
+  });
+
   it("keeps login authentication when no secret key is set", async () => {
     let loginOptions: unknown;
     const result = await authenticateForDeploy({

packages/cli-v3/src/deploy/auth.ts

@@ -1,4 +1,5 @@
 import { CLOUD_API_URL, CLOUD_WEB_URL } from "../consts.js";
+import { readAuthConfigProfile } from "../utilities/configFiles.js";
 import type { LoginResult, LoginResultOk } from "../utilities/session.js";
 
 const personalTokenPrefix = "tr_pat_";
@@ -38,7 +39,8 @@ export async function authenticateForDeploy({
   silent: boolean;
   login: LoginForDeploy;
 }): Promise<LoginResult | DeployAuthorization> {
-  const resolvedApiUrl = apiUrl ?? CLOUD_API_URL;
+  const authConfig = readAuthConfigProfile(profile);
+  const resolvedApiUrl = apiUrl ?? authConfig?.apiUrl ?? CLOUD_API_URL;
 
   if (!secretKey) {
     return login({