diff --git a/.changeset/chat-idle-wait-traces.md b/.changeset/chat-idle-wait-traces.md
deleted file mode 100644
index bd6fb69c1ba..00000000000
--- a/.changeset/chat-idle-wait-traces.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@trigger.dev/sdk": patch
----
-
-Show warm idle time and durable waits separately in chat agent traces. Durable waits now open the waitpoint inspector while waiting and after completion. Message span names are shorter, and repeated session IDs no longer crowd message-wait and default output-stream spans.
diff --git a/.changeset/outer-compaction-last-step-usage.md b/.changeset/outer-compaction-last-step-usage.md
deleted file mode 100644
index 78ea4c344e1..00000000000
--- a/.changeset/outer-compaction-last-step-usage.md
+++ /dev/null
@@ -1,5 +0,0 @@
----
-"@trigger.dev/sdk": patch
----
-
-chat.agent: the between-turns compaction check now receives the last step's token usage (the context the model actually held) instead of the turn's sum over every tool-calling step, so a single tool-using turn no longer compacts a short conversation. The summed figure is still available as `turnUsage` on the event. A head-start handover whose pending tool call completes under the same message id now replaces its spliced partial in the model lane directly instead of falling back to a full reconversion.
diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
index bcb7dfc5334..3c0b5cbd670 100644
--- a/.github/workflows/docs.yml
+++ b/.github/workflows/docs.yml
@@ -5,10 +5,12 @@ on:
branches:
- main
paths:
+ - ".github/workflows/docs.yml"
- "docs/**"
pull_request:
types: [opened, synchronize, reopened]
paths:
+ - ".github/workflows/docs.yml"
- "docs/**"
concurrency:
@@ -30,15 +32,22 @@ jobs:
with:
persist-credentials: false
- - name: 📦 Cache npm
- uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
- with:
- path: |
- ~/.npm
- key: |
- ${{ runner.os }}-mintlify
- restore-keys: |
- ${{ runner.os }}-mintlify
+ - name: 📦 Install Mintlify
+ working-directory: ${{ runner.temp }}
+ env:
+ COREPACK_HOME: ${{ runner.temp }}/mintlify-corepack
+ NPM_CONFIG_CACHE: ${{ runner.temp }}/mintlify-npm-cache
+ NPM_CONFIG_GLOBALCONFIG: /dev/null
+ NPM_CONFIG_USERCONFIG: /dev/null
+ PNPM_HOME: ${{ runner.temp }}/mintlify-pnpm
+ run: |
+ mkdir -p "$RUNNER_TEMP/mintlify-tool"
+ printf '{"private":true}\n' >"$RUNNER_TEMP/mintlify-tool/package.json"
+ corepack pnpm@10.33.2 --dir "$RUNNER_TEMP/mintlify-tool" add \
+ --save-exact \
+ --store-dir "$RUNNER_TEMP/mintlify-pnpm-store" \
+ --registry=https://registry.npmjs.org/ \
+ mintlify@4.0.393
- name: 🔗 Check for broken links
- run: npx mintlify@4.0.393 broken-links
+ run: '"$RUNNER_TEMP/mintlify-tool/node_modules/.bin/mintlify" broken-links'
diff --git a/.server-changes/billing-limit-banner-no-limit-button.md b/.server-changes/billing-limit-banner-no-limit-button.md
deleted file mode 100644
index e12e37d5674..00000000000
--- a/.server-changes/billing-limit-banner-no-limit-button.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-area: webapp
-type: improvement
----
-
-The banner that prompts you to set a billing limit now lets you choose to run without one, so you don't have to open your billing limit settings to dismiss it.
diff --git a/.server-changes/invite-email-case-insensitive.md b/.server-changes/invite-email-case-insensitive.md
deleted file mode 100644
index 25e90aedcca..00000000000
--- a/.server-changes/invite-email-case-insensitive.md
+++ /dev/null
@@ -1,6 +0,0 @@
----
-area: webapp
-type: fix
----
-
-Org member invites now match emails case-insensitively, so an invite whose email casing differs from the invitee's account email can be accepted.
diff --git a/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.render.test.ts b/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.render.test.ts
new file mode 100644
index 00000000000..da71551a2df
--- /dev/null
+++ b/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.render.test.ts
@@ -0,0 +1,45 @@
+import { createElement } from "react";
+import { renderToStaticMarkup } from "react-dom/server";
+import { describe, expect, it } from "vitest";
+import { OperatingSystemContextProvider } from "~/components/primitives/OperatingSystemProvider";
+import { ShortcutsProvider } from "~/components/primitives/ShortcutsProvider";
+import { DiagnosisDocsAction } from "./RunDiagnosisCard";
+
+function markup(label: string) {
+ return renderToStaticMarkup(
+ createElement(
+ OperatingSystemContextProvider,
+ { platform: "mac" },
+ createElement(
+ ShortcutsProvider,
+ null,
+ createElement(DiagnosisDocsAction, {
+ action: {
+ kind: "docs",
+ label,
+ to: "https://example.com/help",
+ destinationHost: "example.com",
+ },
+ })
+ )
+ )
+ );
+}
+
+describe("diagnosis documentation actions", () => {
+ it("bounds and isolates an untrusted label without hiding the destination host", () => {
+ const label = `${"Read documentation ".repeat(20)}\u202eevil.test`;
+ const html = markup(label);
+ const labelStart = html.indexOf('');
+
+ expect(html).toContain('href="https://example.com/help"');
+ expect(html).toContain('target="_blank"');
+ expect(html).toContain('rel="noopener noreferrer"');
+ expect(html).toContain("max-w-[24ch] truncate");
+ expect(html).toContain(label);
+ expect(labelStart).toBeGreaterThan(-1);
+ expect(hostStart).toBeGreaterThan(labelStart);
+ expect(html.slice(hostStart)).toContain("(example.com)");
+ });
+});
diff --git a/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.tsx b/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.tsx
index ffc30052c9f..14f0e66aa25 100644
--- a/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.tsx
+++ b/apps/webapp/app/components/dashboard-agent/RunDiagnosisCard.tsx
@@ -12,11 +12,9 @@ import { useOptionalOrganization } from "~/hooks/useOrganizations";
import { useOptionalProject } from "~/hooks/useProject";
import { cn } from "~/utils/cn";
import { v3RunPath } from "~/utils/pathBuilder";
-import { planDiagnosisActions } from "./diagnosis-actions";
+import { planDiagnosisActions, type PlannedDiagnosisAction } from "./diagnosis-actions";
import { isRunFriendlyId } from "./run-id";
-// No markup comes from the model, so only outbound URLs need checking.
-
function Em({ children }: { children: React.ReactNode }) {
return {children};
}
@@ -129,6 +127,23 @@ function EvidenceReference({ reference }: { reference: string }) {
return {reference};
}
+export function DiagnosisDocsAction({
+ action,
+}: {
+ action: Extract;
+}) {
+ return (
+
+
+ {action.label}
+
+
+ ({action.destinationHost})
+
+
+ );
+}
+
function DiagnosisActions({ actions }: { actions: NonNullable }) {
const runPath = useRunPathResolver();
const planned = planDiagnosisActions(actions, {
@@ -141,9 +156,7 @@ function DiagnosisActions({ actions }: { actions: NonNullable
{planned.map((action, i) =>
action.kind === "docs" ? (
-
- {action.label}
-
+
) : (
{action.label}
diff --git a/apps/webapp/app/components/dashboard-agent/diagnosis-actions.test.ts b/apps/webapp/app/components/dashboard-agent/diagnosis-actions.test.ts
index bb458eb8b47..4d9f5c309c5 100644
--- a/apps/webapp/app/components/dashboard-agent/diagnosis-actions.test.ts
+++ b/apps/webapp/app/components/dashboard-agent/diagnosis-actions.test.ts
@@ -27,7 +27,12 @@ describe("planDiagnosisActions", () => {
it("drops only the unresolvable action, keeping the rest", () => {
expect(planDiagnosisActions([viewRun, docs], withoutContext)).toEqual([
- { kind: "docs", label: "Read the docs", to: docs.target },
+ {
+ kind: "docs",
+ label: "Read the docs",
+ to: docs.target,
+ destinationHost: "trigger.dev",
+ },
]);
});
@@ -37,10 +42,35 @@ describe("planDiagnosisActions", () => {
);
});
+ it("derives the displayed host from the resolved destination", () => {
+ expect(
+ planDiagnosisActions(
+ [{ ...docs, target: "https://example.com/help", label: "trigger.dev documentation" }],
+ resolve
+ )
+ ).toEqual([
+ {
+ kind: "docs",
+ label: "trigger.dev documentation",
+ to: "https://example.com/help",
+ destinationHost: "example.com",
+ },
+ ]);
+ });
+
it("drops a docs action with an unsafe target", () => {
expect(planDiagnosisActions([{ ...docs, target: "javascript:alert(1)" }], resolve)).toEqual([]);
});
+ it("drops a docs action when its resolved destination has no hostname", () => {
+ expect(
+ planDiagnosisActions([docs], {
+ ...resolve,
+ docsUrl: () => "blob:https://trigger.dev/id",
+ })
+ ).toEqual([]);
+ });
+
it("drops an action kind it does not know", () => {
expect(planDiagnosisActions([{ ...viewRun, kind: "replay_run" }], resolve)).toEqual([]);
});
diff --git a/apps/webapp/app/components/dashboard-agent/diagnosis-actions.ts b/apps/webapp/app/components/dashboard-agent/diagnosis-actions.ts
index 9d7a256ddd5..02100f082ed 100644
--- a/apps/webapp/app/components/dashboard-agent/diagnosis-actions.ts
+++ b/apps/webapp/app/components/dashboard-agent/diagnosis-actions.ts
@@ -2,11 +2,18 @@ import { isRunFriendlyId } from "./run-id";
export type DiagnosisActionInput = { kind: string; target: string; label: string };
-export type PlannedDiagnosisAction = {
- kind: "view_run" | "docs";
- label: string;
- to: string;
-};
+export type PlannedDiagnosisAction =
+ | {
+ kind: "view_run";
+ label: string;
+ to: string;
+ }
+ | {
+ kind: "docs";
+ label: string;
+ to: string;
+ destinationHost: string;
+ };
/**
* An action whose destination can't be resolved is dropped, never rendered as a
@@ -29,7 +36,14 @@ export function planDiagnosisActions(
}
if (action.kind === "docs") {
const to = resolve.docsUrl(action.target);
- if (to) planned.push({ kind: "docs", label: action.label, to });
+ if (!to) continue;
+
+ try {
+ const destinationHost = new URL(to).hostname;
+ if (destinationHost) {
+ planned.push({ kind: "docs", label: action.label, to, destinationHost });
+ }
+ } catch {}
}
}
diff --git a/apps/webapp/app/models/project.server.ts b/apps/webapp/app/models/project.server.ts
index 64a28f53534..09f5e004706 100644
--- a/apps/webapp/app/models/project.server.ts
+++ b/apps/webapp/app/models/project.server.ts
@@ -1,4 +1,4 @@
-import type { Prisma, Project } from "@trigger.dev/database";
+import type { Prisma, PrismaClientOrTransaction, Project } from "@trigger.dev/database";
import { customAlphabet, nanoid } from "nanoid";
import slug from "slug";
import { $replica, prisma } from "~/db.server";
@@ -146,13 +146,20 @@ export async function createProject(
return project;
}
-export async function findProjectBySlug(orgSlug: string, projectSlug: string, userId: string) {
+export async function findProjectBySlug(
+ orgSlug: string,
+ projectSlug: string,
+ userId: string,
+ db: PrismaClientOrTransaction = $replica
+) {
// Find the project scoped to the organization, making sure the user belongs to that org
- return await $replica.project.findFirst({
+ return await db.project.findFirst({
where: {
slug: projectSlug,
+ deletedAt: null,
organization: {
slug: orgSlug,
+ deletedAt: null,
members: { some: { userId } },
},
},
@@ -166,13 +173,16 @@ export async function findProjectBySlug(orgSlug: string, projectSlug: string, us
export async function findProjectWithOrgFlagsBySlug(
orgSlug: string,
projectSlug: string,
- userId: string
+ userId: string,
+ db: PrismaClientOrTransaction = $replica
) {
- return await $replica.project.findFirst({
+ return await db.project.findFirst({
where: {
slug: projectSlug,
+ deletedAt: null,
organization: {
slug: orgSlug,
+ deletedAt: null,
members: { some: { userId } },
},
},
@@ -180,12 +190,18 @@ export async function findProjectWithOrgFlagsBySlug(
});
}
-export async function findProjectByRef(externalRef: string, userId: string) {
+export async function findProjectByRef(
+ externalRef: string,
+ userId: string,
+ db: PrismaClientOrTransaction = $replica
+) {
// Find the project scoped to the organization, making sure the user belongs to that org
- return await $replica.project.findFirst({
+ return await db.project.findFirst({
where: {
externalRef,
+ deletedAt: null,
organization: {
+ deletedAt: null,
members: { some: { userId } },
},
},
diff --git a/apps/webapp/app/models/runtimeEnvironment.server.ts b/apps/webapp/app/models/runtimeEnvironment.server.ts
index 0fe9f800c22..eb69f94698c 100644
--- a/apps/webapp/app/models/runtimeEnvironment.server.ts
+++ b/apps/webapp/app/models/runtimeEnvironment.server.ts
@@ -421,12 +421,15 @@ export async function findEnvironmentById(id: string): Promise {
- const environment = await $replica.runtimeEnvironment.findFirst({
+ const environment = await db.runtimeEnvironment.findFirst({
where: {
- projectId: projectId,
+ projectId,
slug: envSlug,
+ project: { deletedAt: null },
+ organization: { deletedAt: null },
OR: [
{
type: {
diff --git a/apps/webapp/app/models/vercelIntegration.server.ts b/apps/webapp/app/models/vercelIntegration.server.ts
index 18df860d8d0..277a985678b 100644
--- a/apps/webapp/app/models/vercelIntegration.server.ts
+++ b/apps/webapp/app/models/vercelIntegration.server.ts
@@ -27,6 +27,7 @@ import {
import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
import { isReservedForExternalSync } from "~/v3/environmentVariableRules.server";
import { boundedIn } from "@trigger.dev/database";
+import { toVercelApiError, type VercelApiError } from "~/v3/vercel/vercelApiError";
import {
callVercelWithRecovery,
wrapVercelCallWithRecovery,
@@ -120,70 +121,7 @@ function extractCreateProjectEnvFailures(response: unknown): string[] {
// Error handling
// ---------------------------------------------------------------------------
-export type VercelApiError = {
- message: string;
- authInvalid: boolean;
-};
-
-const VercelErrorSchema = z.union([
- z.object({ status: z.number() }),
- z.object({ response: z.object({ status: z.number() }) }),
- z.object({ statusCode: z.number() }),
-]);
-
-function extractVercelErrorStatus(error: unknown): number | null {
- if (error && typeof error === "object" && "status" in error) {
- const parsed = VercelErrorSchema.safeParse(error);
- if (parsed.success && "status" in parsed.data) {
- return parsed.data.status;
- }
- }
-
- if (error && typeof error === "object" && "response" in error) {
- const parsed = VercelErrorSchema.safeParse(error);
- if (parsed.success && "response" in parsed.data) {
- return parsed.data.response.status;
- }
- }
-
- if (error && typeof error === "object" && "statusCode" in error) {
- const parsed = VercelErrorSchema.safeParse(error);
- if (parsed.success && "statusCode" in parsed.data) {
- return parsed.data.statusCode;
- }
- }
-
- if (typeof error === "string") {
- if (error.includes("401")) return 401;
- if (error.includes("403")) return 403;
- }
-
- return null;
-}
-
-function isVercelAuthError(error: unknown): boolean {
- const status = extractVercelErrorStatus(error);
- return status === 401 || status === 403;
-}
-
-function toVercelApiError(error: unknown): VercelApiError {
- if (isVercelApiErrorShape(error)) return error;
- return {
- message: error instanceof Error ? error.message : "Unknown error",
- authInvalid: isVercelAuthError(error),
- };
-}
-
-function isVercelApiErrorShape(error: unknown): error is VercelApiError {
- return (
- error !== null &&
- typeof error === "object" &&
- "message" in error &&
- "authInvalid" in error &&
- typeof (error as VercelApiError).message === "string" &&
- typeof (error as VercelApiError).authInvalid === "boolean"
- );
-}
+export type { VercelApiError } from "~/v3/vercel/vercelApiError";
// ---------------------------------------------------------------------------
// Schemas & token types
// ---------------------------------------------------------------------------
@@ -597,7 +535,10 @@ export class VercelIntegrationRepository {
logger.warn("Failed to decrypt Vercel env var", {
projectId,
envVarKey: env.key,
- error: result.error instanceof Error ? result.error.message : String(result.error),
+ error: result.error.message,
+ errorType: result.error.errorType,
+ status: result.error.status,
+ authInvalid: result.error.authInvalid,
});
return null;
}
@@ -784,10 +725,10 @@ export class VercelIntegrationRepository {
projectId,
envId,
envKey,
- error:
- getResult.error instanceof Error
- ? getResult.error.message
- : String(getResult.error),
+ error: getResult.error.message,
+ errorType: getResult.error.errorType,
+ status: getResult.error.status,
+ authInvalid: getResult.error.authInvalid,
});
return null;
})
@@ -2096,7 +2037,7 @@ export class VercelIntegrationRepository {
)
.map(() => ({ authInvalid: false }))
.orElse((error) => {
- const isAuthError = isVercelAuthError(error);
+ const isAuthError = toVercelApiError(error).authInvalid;
logger.error("Failed to uninstall Vercel integration", {
installationId,
error: error instanceof Error ? error.message : "Unknown error",
diff --git a/apps/webapp/app/models/vercelSdkRecovery.server.ts b/apps/webapp/app/models/vercelSdkRecovery.server.ts
index 70a388ee328..804edfa8f29 100644
--- a/apps/webapp/app/models/vercelSdkRecovery.server.ts
+++ b/apps/webapp/app/models/vercelSdkRecovery.server.ts
@@ -1,7 +1,8 @@
import { z } from "zod";
import { ResultAsync, okAsync, errAsync } from "neverthrow";
import { logger } from "~/services/logger.server";
-import type { VercelApiError } from "./vercelIntegration.server";
+import { toVercelApiError, type VercelApiError } from "~/v3/vercel/vercelApiError";
+import { vercelErrorLogMetadata } from "~/v3/vercel/vercelErrorLogMetadata";
// ---------------------------------------------------------------------------
// Recovery utilities for Vercel SDK validation errors
@@ -67,8 +68,7 @@ function recoverFromVercelSdkError(
logger.warn("Recovered data from Vercel SDK validation error", {
context: options?.context,
- errorMessage: error instanceof Error ? error.message : String(error),
- errorType: error?.constructor?.name,
+ ...vercelErrorLogMetadata(error),
});
return result.data;
@@ -80,17 +80,26 @@ function recoverFromVercelSdkError(
* On success: returns the SDK result as-is.
* On error: attempts recovery via rawValue + schema validation (validation errors only).
*/
+export type VercelSdkCallError = VercelApiError & {
+ errorType: string;
+ status?: number;
+};
+
export function callVercelWithRecovery(
sdkCall: Promise,
schema: z.ZodType,
options?: { context?: string }
-): ResultAsync {
+): ResultAsync {
return ResultAsync.fromPromise(sdkCall, (error) => error).orElse((error) => {
const recovered = recoverFromVercelSdkError(error, schema, options);
if (recovered !== undefined) {
return okAsync(recovered);
}
- return errAsync(error);
+
+ return errAsync({
+ ...toVercelApiError(error),
+ ...vercelErrorLogMetadata(error),
+ });
});
}
@@ -109,8 +118,13 @@ export function wrapVercelCallWithRecovery(
): ResultAsync {
return callVercelWithRecovery(promise, schema, { context: message }).mapErr((error) => {
const apiError = toError(error);
- logger.error(message, { ...context, error, authInvalid: apiError.authInvalid });
- return apiError;
+ logger.error(message, {
+ ...context,
+ errorType: error.errorType,
+ ...(error.status === undefined ? {} : { status: error.status }),
+ authInvalid: apiError.authInvalid,
+ });
+ return { message, authInvalid: apiError.authInvalid };
});
}
diff --git a/apps/webapp/app/presenters/v3/EditSchedulePresenter.server.ts b/apps/webapp/app/presenters/v3/EditSchedulePresenter.server.ts
index 080e35d56a3..d14c18f59f7 100644
--- a/apps/webapp/app/presenters/v3/EditSchedulePresenter.server.ts
+++ b/apps/webapp/app/presenters/v3/EditSchedulePresenter.server.ts
@@ -66,7 +66,9 @@ export class EditSchedulePresenter {
},
where: {
slug: projectSlug,
+ deletedAt: null,
organization: {
+ deletedAt: null,
members: {
some: {
userId,
@@ -76,7 +78,12 @@ export class EditSchedulePresenter {
},
});
- const environment = await findEnvironmentBySlug(project.id, environmentSlug, userId);
+ const environment = await findEnvironmentBySlug(
+ project.id,
+ environmentSlug,
+ userId,
+ this.#prismaClient
+ );
if (!environment) {
throw new ServiceValidationError("No matching environment for project", 404);
}
@@ -120,6 +127,7 @@ export class EditSchedulePresenter {
possibleTimezones: getTimezones(),
schedule: await this.#getExistingSchedule(
friendlyId,
+ project.id,
possibleEnvironments,
project.organizationId,
project.organization.featureFlags
@@ -131,7 +139,7 @@ export class EditSchedulePresenter {
async #getNewSchedulePolicy(organizationId: string, featureFlags: unknown) {
const [defaultWindowDurationSeconds, freeSchedulePolicy] = await Promise.all([
resolveNewScheduleDefaultWindowSeconds(this.#prismaClient, organizationId),
- resolveFreeSchedulePolicyContext({ id: organizationId, featureFlags }),
+ resolveFreeSchedulePolicyContext(this.#prismaClient, { id: organizationId, featureFlags }),
]);
return {
@@ -142,6 +150,7 @@ export class EditSchedulePresenter {
async #getExistingSchedule(
scheduleId: string | undefined,
+ projectId: string,
possibleEnvironments: Environment[],
organizationId: string,
featureFlags: unknown
@@ -174,29 +183,37 @@ export class EditSchedulePresenter {
},
where: {
friendlyId: scheduleId,
+ projectId,
},
});
if (!schedule) {
- return undefined;
+ throw new Response(null, { status: 404 });
}
const minimumWindowDurationSeconds =
schedule.minimumWindowDurationSeconds === null
? null
: resolveMinimumWindowOnUpdate(
- await resolveFreeSchedulePolicyContext({ id: organizationId, featureFlags }),
+ await resolveFreeSchedulePolicyContext(this.#prismaClient, {
+ id: organizationId,
+ featureFlags,
+ }),
schedule.minimumWindowDurationSeconds
).minimumWindowDurationSeconds;
+ const { instances, ...scheduleFields } = schedule;
return {
- ...schedule,
+ ...scheduleFields,
minimumWindowDurationSeconds,
cron: schedule.generatorExpression,
// The form shows only the user-configured value; a blank field lets a captured default
// surface through the placeholder copy rather than appearing as a typed value.
window: formatScheduleWindow(schedule),
- environments: schedule.instances.flatMap((instance) => {
+ // Whether this schedule carries a captured default, so the form copy can say "clearing
+ // returns to the 60-minute default" only for the new cohort, never for a grandfathered row.
+ hasCapturedDefaultWindow: schedule.defaultWindowDurationSeconds !== null,
+ environments: instances.flatMap((instance) => {
const environment = possibleEnvironments.find((env) => env.id === instance.environmentId);
if (!environment) {
logger.error(
diff --git a/apps/webapp/app/presenters/v3/ErrorGroupPresenter.server.ts b/apps/webapp/app/presenters/v3/ErrorGroupPresenter.server.ts
index c2015c20bb4..53a822f7806 100644
--- a/apps/webapp/app/presenters/v3/ErrorGroupPresenter.server.ts
+++ b/apps/webapp/app/presenters/v3/ErrorGroupPresenter.server.ts
@@ -1,5 +1,5 @@
import { type ClickHouse, msToClickHouseInterval } from "@internal/clickhouse";
-import { TimeGranularity } from "~/utils/timeGranularity";
+import { isBoundedChartRange, TimeGranularity } from "~/utils/timeGranularity";
import { ErrorId } from "@trigger.dev/core/v3/isomorphic";
import { type ErrorGroupStatus, type PrismaClientOrTransaction } from "@trigger.dev/database";
import { timeFilterFromTo } from "~/components/runs/v3/SharedFilters";
@@ -187,6 +187,9 @@ export class ErrorGroupPresenter extends BasePresenter {
versions: string[];
}> {
const granularityMs = errorGroupGranularity.getTimeGranularityMs(from, to);
+ if (!isBoundedChartRange(from, to, granularityMs)) {
+ return { data: [], versions: [] };
+ }
const intervalExpr = msToClickHouseInterval(granularityMs);
const queryBuilder =
diff --git a/apps/webapp/app/presenters/v3/ErrorsListPresenter.server.ts b/apps/webapp/app/presenters/v3/ErrorsListPresenter.server.ts
index 55c675cb743..87715efc633 100644
--- a/apps/webapp/app/presenters/v3/ErrorsListPresenter.server.ts
+++ b/apps/webapp/app/presenters/v3/ErrorsListPresenter.server.ts
@@ -1,6 +1,6 @@
import { z } from "zod";
import { type ClickHouse, msToClickHouseInterval } from "@internal/clickhouse";
-import { TimeGranularity } from "~/utils/timeGranularity";
+import { isBoundedChartRange, TimeGranularity } from "~/utils/timeGranularity";
const errorsListGranularity = new TimeGranularity([
{ max: "2h", granularity: "1m" },
@@ -358,6 +358,9 @@ export class ErrorsListPresenter extends BasePresenter {
}
const granularityMs = errorsListGranularity.getTimeGranularityMs(from, to);
+ if (!isBoundedChartRange(from, to, granularityMs)) {
+ return { data: {} };
+ }
const intervalExpr = msToClickHouseInterval(granularityMs);
const queryBuilder = this.clickhouse.errors.createOccurrencesQueryBuilder(intervalExpr);
diff --git a/apps/webapp/app/routes/_app.orgs.$organizationId.subscription.v3.failed/route.tsx b/apps/webapp/app/routes/_app.orgs.$organizationId.subscription.v3.failed/route.tsx
index 77869dc2926..200db0dc187 100644
--- a/apps/webapp/app/routes/_app.orgs.$organizationId.subscription.v3.failed/route.tsx
+++ b/apps/webapp/app/routes/_app.orgs.$organizationId.subscription.v3.failed/route.tsx
@@ -2,6 +2,7 @@ import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
import { z } from "zod";
import { prisma } from "~/db.server";
import { redirectWithErrorMessage } from "~/models/message.server";
+import { requireUserId } from "~/services/session.server";
import { v3BillingPath } from "~/utils/pathBuilder";
const ParamsSchema = z.object({
@@ -9,14 +10,17 @@ const ParamsSchema = z.object({
});
export const loader = async ({ request, params }: LoaderFunctionArgs) => {
+ const userId = await requireUserId(request);
const { organizationId } = ParamsSchema.parse(params);
- const org = await prisma.organization.findUnique({
+ const org = await prisma.organization.findFirst({
select: {
slug: true,
},
where: {
id: organizationId,
+ deletedAt: null,
+ members: { some: { userId } },
},
});
diff --git a/apps/webapp/app/routes/admin.api.v1.runs-replication.backfill.ts b/apps/webapp/app/routes/admin.api.v1.runs-replication.backfill.ts
index 150fcaca3ee..e072e07a0c7 100644
--- a/apps/webapp/app/routes/admin.api.v1.runs-replication.backfill.ts
+++ b/apps/webapp/app/routes/admin.api.v1.runs-replication.backfill.ts
@@ -53,7 +53,14 @@ export async function action({ request }: ActionFunctionArgs) {
}))
);
- logger.info("Backfilled runs", { runs });
+ logger.info("Backfilled runs", {
+ runCount: runs.length,
+ runs: runs.map((run) => ({
+ id: run.id,
+ friendlyId: run.friendlyId,
+ status: run.status,
+ })),
+ });
return json({
success: true,
diff --git a/apps/webapp/app/routes/api.v1.auth.jwt.ts b/apps/webapp/app/routes/api.v1.auth.jwt.ts
index c38cdeb14ac..715f20e6fb2 100644
--- a/apps/webapp/app/routes/api.v1.auth.jwt.ts
+++ b/apps/webapp/app/routes/api.v1.auth.jwt.ts
@@ -1,9 +1,12 @@
import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
import { json } from "@remix-run/server-runtime";
-import { authenticateApiRequest } from "~/services/apiAuth.server";
-import { logger } from "~/services/logger.server";
-import { z } from "zod";
import { generateJWT as internal_generateJWT } from "@trigger.dev/core/v3";
+import { resolveJwtSigningKey, scopesWithinAbility } from "@trigger.dev/rbac";
+import parseDuration from "parse-duration";
+import { z } from "zod";
+import { authenticateBearerWithTelemetry } from "~/services/authTelemetry.server";
+import { isApiKeyInGraceWindow, presentedBearerToken } from "~/services/apiKeyGraceWindow.server";
+import { logger } from "~/services/logger.server";
const RequestBodySchema = z.object({
claims: z
@@ -14,12 +17,63 @@ const RequestBodySchema = z.object({
expirationTime: z.union([z.number(), z.string()]).optional(),
});
+const DEFAULT_EXPIRY = "1h";
+// A minted public JWT may be valid for at most 24 hours. A caller-controlled,
+// uncapped `expirationTime` ("100y") would otherwise mint a token that no key
+// rotation can revoke — public JWTs are not invalidated by rotating the
+// environment's key. The cap is the compensating control for that.
+const MAX_EXPIRY_SECONDS = 24 * 60 * 60;
+
+// A requested `expirationTime` above this (epoch seconds, ~2001) is an absolute
+// timestamp; a smaller number is a relative offset in seconds.
+const EXPIRY_EPOCH_THRESHOLD_SECONDS = 1_000_000_000;
+
+// Resolve the requested expiry to an absolute epoch-second timestamp so it can
+// be capped. Returns undefined when a string can't be parsed as a duration.
+function resolveRequestedExpirySeconds(
+ expirationTime: number | string | undefined,
+ nowSec: number
+): number | undefined {
+ if (typeof expirationTime === "number") {
+ return expirationTime > EXPIRY_EPOCH_THRESHOLD_SECONDS
+ ? expirationTime
+ : nowSec + expirationTime;
+ }
+ const durationMs = parseDuration(expirationTime ?? DEFAULT_EXPIRY);
+ if (durationMs == null) {
+ return undefined;
+ }
+ return nowSec + Math.floor(durationMs / 1000);
+}
+
export async function action({ request }: LoaderFunctionArgs) {
try {
- // Next authenticate the request
- const authenticationResult = await authenticateApiRequest(request);
+ // Authenticate through the RBAC bearer controller (not the legacy
+ // `authenticateApiRequest`): it exposes both the key's own ability (used
+ // to clamp requested scopes below) and how the key resolved (used to
+ // refuse grace-window keys). JWTs are not allowed to mint more JWTs.
+ const authenticationResult = await authenticateBearerWithTelemetry(request, {
+ allowJWT: false,
+ });
- if (!authenticationResult) {
+ if (!authenticationResult.ok) {
+ return json({ error: "Invalid or Missing API key" }, { status: authenticationResult.status });
+ }
+
+ // A revoked key still authenticates through the grace window (by design,
+ // for zero-downtime rotation). It must not mint new JWTs: those are signed
+ // with the *replacement* key (see below), so a token minted in the grace
+ // window keeps validating after rotation — revoking the key would not cut
+ // the caller off. Refuse the mint so rotation actually revokes.
+ //
+ // Detected by a direct RevokedApiKey lookup on the presenting bearer rather
+ // than the auth layer's `resolution.lookupPath`: the RBAC plugin path (cloud)
+ // resolves a grace-window key but does not surface a "root_rotated" marker,
+ // so keying off resolution would silently no-op there. This check is
+ // uniform across the plugin and OSS-fallback auth paths.
+ const presentedApiKey = presentedBearerToken(request);
+
+ if (presentedApiKey && (await isApiKeyInGraceWindow(presentedApiKey))) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}
@@ -32,19 +86,49 @@ export async function action({ request }: LoaderFunctionArgs) {
);
}
+ // A minted token must not be more powerful than the key that minted it.
+ // The downstream JWT auth builds its ability purely from the token's
+ // inline `scopes`, so caller-supplied scopes are validated against the
+ // key's own ability — a restricted key can't widen its grant by minting.
+ const requestedScopes = parsedBody.data.claims?.scopes ?? [];
+ const scopeCheck = scopesWithinAbility(requestedScopes, authenticationResult.ability);
+ if (!scopeCheck.ok) {
+ return json(
+ {
+ error: "Requested scopes exceed the API key's access",
+ code: "scopes_exceed_key_access",
+ deniedScopes: scopeCheck.deniedScopes,
+ },
+ { status: 403 }
+ );
+ }
+
+ const nowSec = Math.floor(Date.now() / 1000);
+ const requestedAbsSec = resolveRequestedExpirySeconds(parsedBody.data.expirationTime, nowSec);
+ if (requestedAbsSec === undefined) {
+ return json({ error: "Invalid expiration time" }, { status: 400 });
+ }
+ if (requestedAbsSec <= nowSec) {
+ return json({ error: "Expiration time must be in the future" }, { status: 400 });
+ }
+ if (requestedAbsSec - nowSec > MAX_EXPIRY_SECONDS) {
+ return json({ error: "Expiration time cannot exceed 24 hours" }, { status: 400 });
+ }
+
const claims = {
sub: authenticationResult.environment.id,
pub: true,
- ...parsedBody.data.claims,
+ ...(requestedScopes.length > 0 ? { scopes: requestedScopes } : {}),
};
- // Sign with the environment's current canonical key, not the raw header key,
- // so JWTs minted with a revoked (grace-window) key still validate — validation
- // in jwtAuth.server.ts uses environment.apiKey.
+ // Sign with the environment's current canonical signing key (the parent
+ // env's key for branches), so JWTs validate through jwtAuth.server.ts.
+ // Pass the absolute, capped `exp` — not the original caller string — so
+ // the cap above is enforced against the same value that sets the claim.
const jwt = await internal_generateJWT({
- secretKey: authenticationResult.environment.apiKey,
+ secretKey: resolveJwtSigningKey(authenticationResult.environment),
payload: claims,
- expirationTime: parsedBody.data.expirationTime ?? "1h",
+ expirationTime: requestedAbsSec,
});
return json({ token: jwt });
diff --git a/apps/webapp/app/routes/api.v1.packets.$.ts b/apps/webapp/app/routes/api.v1.packets.$.ts
index ff2cc7607a7..f5358c9fb63 100644
--- a/apps/webapp/app/routes/api.v1.packets.$.ts
+++ b/apps/webapp/app/routes/api.v1.packets.$.ts
@@ -2,6 +2,7 @@ import type { ActionFunctionArgs } from "@remix-run/server-runtime";
import { json } from "@remix-run/server-runtime";
import { z } from "zod";
import { authenticateApiRequest } from "~/services/apiAuth.server";
+import { logger } from "~/services/logger.server";
import { createLoaderApiRoute } from "~/services/routeBuilders/apiBuilder.server";
import { generatePresignedUrl, jsonPacketPresignFailure } from "~/v3/objectStore.server";
@@ -51,6 +52,15 @@ export const loader = createLoaderApiRoute(
async ({ params, authentication }) => {
const filename = params["*"];
+ // Public tokens should use /api/v1/runs/:runId/packets/:field, which authorizes
+ // against the owning run. Access here is kept for clients on older SDKs.
+ if (authentication.type === "PUBLIC_JWT") {
+ logger.info("Legacy packet download with public token", {
+ environmentId: authentication.environment.id,
+ projectId: authentication.environment.projectId,
+ });
+ }
+
const signed = await generatePresignedUrl(
authentication.environment.project.externalRef,
authentication.environment.slug,
diff --git a/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts b/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
index c32fec3c871..8ae5af8f7c2 100644
--- a/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
+++ b/apps/webapp/app/routes/api.v1.projects.$projectRef.$env.regenerate-api-key.ts
@@ -5,7 +5,6 @@ import { regenerateApiKey, RootApiKeyNotVisibleError } from "~/models/api-key.se
import {
authenticatedEnvironmentForAuthentication,
authenticateRequest,
- branchNameFromRequest,
} from "~/services/apiAuth.server";
import { authorizePatEnvironmentAccess } from "~/services/environmentVariableApiAccess.server";
import { logger } from "~/services/logger.server";
@@ -39,11 +38,15 @@ export async function action({ request, params }: ActionFunctionArgs) {
return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
}
+ if (request.headers.has("x-trigger-branch")) {
+ return json({ error: "Branch-scoped key rotation is not supported" }, { status: 400 });
+ }
+
const environment = await authenticatedEnvironmentForAuthentication(
authenticationResult,
projectRef,
env,
- branchNameFromRequest(request)
+ undefined
);
// Rotating the key requires env-tier write:apiKeys — same gate the
diff --git a/apps/webapp/app/routes/api.v1.runs.$runId.packets.$field.ts b/apps/webapp/app/routes/api.v1.runs.$runId.packets.$field.ts
new file mode 100644
index 00000000000..d8c7d44f0b3
--- /dev/null
+++ b/apps/webapp/app/routes/api.v1.runs.$runId.packets.$field.ts
@@ -0,0 +1,80 @@
+import { json } from "@remix-run/server-runtime";
+import { z } from "zod";
+import { $replica } from "~/db.server";
+import { anyResource, createLoaderApiRoute } from "~/services/routeBuilders/apiBuilder.server";
+import { generatePresignedUrl, jsonPacketPresignFailure } from "~/v3/objectStore.server";
+import { runStore } from "~/v3/runStore.server";
+
+const ParamsSchema = z.object({
+ runId: z.string(),
+ field: z.enum(["payload", "output"]),
+});
+
+const select = {
+ friendlyId: true,
+ taskIdentifier: true,
+ runTags: true,
+ payload: true,
+ payloadType: true,
+ output: true,
+ outputType: true,
+ batch: { select: { friendlyId: true } },
+} as const;
+
+function storedPacketPath(
+ run: { payload: string; payloadType: string; output: string | null; outputType: string },
+ field: "payload" | "output"
+): string | null {
+ const [data, dataType] =
+ field === "payload" ? [run.payload, run.payloadType] : [run.output, run.outputType];
+ return dataType === "application/store" && data ? data : null;
+}
+
+export const loader = createLoaderApiRoute(
+ {
+ params: ParamsSchema,
+ allowJWT: true,
+ corsStrategy: "all",
+ findResource: async (params, authentication) => {
+ const where = {
+ friendlyId: params.runId,
+ runtimeEnvironmentId: authentication.environment.id,
+ };
+ const args = { select };
+
+ // The replica may not have the stored output yet for a run that just completed.
+ let run = await runStore.findRun(where, args, $replica);
+ if (!run || !storedPacketPath(run, params.field)) {
+ run = await runStore.findRunOnPrimary(where, args);
+ }
+ if (!run) return null;
+
+ const packetPath = storedPacketPath(run, params.field);
+ return packetPath ? { ...run, packetPath } : null;
+ },
+ authorization: {
+ action: "read",
+ resource: (run) =>
+ anyResource([
+ { type: "runs", id: run.friendlyId },
+ { type: "tasks", id: run.taskIdentifier },
+ ...run.runTags.map((tag) => ({ type: "tags", id: tag })),
+ ...(run.batch ? [{ type: "batch", id: run.batch.friendlyId }] : []),
+ ]),
+ },
+ },
+ async ({ authentication, resource }) => {
+ const signed = await generatePresignedUrl(
+ authentication.environment.project.externalRef,
+ authentication.environment.slug,
+ resource.packetPath,
+ "GET"
+ );
+
+ if (!signed.success) {
+ return jsonPacketPresignFailure(signed);
+ }
+
+ return json({ presignedUrl: signed.url });
+ }
+);
diff --git a/apps/webapp/app/routes/api.v1.runs.$runId.spans.$spanId.ts b/apps/webapp/app/routes/api.v1.runs.$runId.spans.$spanId.ts
index 5f4c35c1556..9e9e462e6b2 100644
--- a/apps/webapp/app/routes/api.v1.runs.$runId.spans.$spanId.ts
+++ b/apps/webapp/app/routes/api.v1.runs.$runId.spans.$spanId.ts
@@ -9,6 +9,7 @@ import { getTaskEventStoreTableForRun } from "~/v3/taskEventStore.server";
import { findRunByIdWithMollifierFallback } from "~/v3/mollifier/readFallback.server";
import { buildSyntheticSpanDetailBody } from "~/v3/mollifier/syntheticApiResponses.server";
import { runStore } from "~/v3/runStore.server";
+import { canReadRunWithAliases } from "~/utils/runReadAuthorization";
const ParamsSchema = z.object({
runId: z.string(),
@@ -79,7 +80,7 @@ export const loader = createLoaderApiRoute(
},
},
},
- async ({ params, resource: resolved, authentication }) => {
+ async ({ params, resource: resolved, authentication, ability }) => {
if (resolved.source === "buffer") {
// Buffered runs have exactly one valid spanId — the queued span the
// mollifier gate recorded at trigger time, which becomes the run's
@@ -126,6 +127,8 @@ export const loader = createLoaderApiRoute(
select: {
friendlyId: true,
taskIdentifier: true,
+ runTags: true,
+ batchId: true,
status: true,
createdAt: true,
},
@@ -137,6 +140,10 @@ export const loader = createLoaderApiRoute(
$replica
);
+ const authorizedTriggeredRuns = triggeredRuns.filter((run) =>
+ canReadRunWithAliases(ability, run)
+ );
+
const properties =
span.properties &&
typeof span.properties === "object" &&
@@ -182,8 +189,8 @@ export const loader = createLoaderApiRoute(
}
: undefined,
triggeredRuns:
- triggeredRuns.length > 0
- ? triggeredRuns.map((r) => ({
+ authorizedTriggeredRuns.length > 0
+ ? authorizedTriggeredRuns.map((r) => ({
runId: r.friendlyId,
taskIdentifier: r.taskIdentifier,
status: r.status,
diff --git a/apps/webapp/app/routes/api.v1.sessions.$sessionId.snapshot-url.ts b/apps/webapp/app/routes/api.v1.sessions.$sessionId.snapshot-url.ts
index ba98160f22b..58296dbd9fd 100644
--- a/apps/webapp/app/routes/api.v1.sessions.$sessionId.snapshot-url.ts
+++ b/apps/webapp/app/routes/api.v1.sessions.$sessionId.snapshot-url.ts
@@ -16,7 +16,6 @@ const ParamsSchema = z.object({
const routeConfig = {
params: ParamsSchema,
- allowJWT: true,
corsStrategy: "all" as const,
findResource: async (
params: z.infer,
@@ -44,6 +43,7 @@ const route = createActionApiRoute(
{
...routeConfig,
method: "PUT",
+ allowJWT: false,
authorization: {
action: "write",
resource: (params, _, __, ___, session) => sessionResource(params.sessionId, session),
diff --git a/apps/webapp/app/routes/api.v1.tasks.$taskId.trigger.ts b/apps/webapp/app/routes/api.v1.tasks.$taskId.trigger.ts
index 3bfd3548b0a..5bd225c486a 100644
--- a/apps/webapp/app/routes/api.v1.tasks.$taskId.trigger.ts
+++ b/apps/webapp/app/routes/api.v1.tasks.$taskId.trigger.ts
@@ -63,6 +63,10 @@ const { action, loader } = createActionApiRoute(
corsStrategy: "all",
},
async ({ body, headers, params, authentication, ability }) => {
+ if (authentication.type !== "PRIVATE" && body.options?.payloadType === "application/store") {
+ return json({ error: "Stored payloads require a private API key" }, { status: 403 });
+ }
+
const {
"idempotency-key": idempotencyKey,
"idempotency-key-ttl": idempotencyKeyTTL,
diff --git a/apps/webapp/app/routes/api.v1.tasks.batch.ts b/apps/webapp/app/routes/api.v1.tasks.batch.ts
index 2ea5ebb3b22..194955b7bef 100644
--- a/apps/webapp/app/routes/api.v1.tasks.batch.ts
+++ b/apps/webapp/app/routes/api.v1.tasks.batch.ts
@@ -41,6 +41,13 @@ const { action, loader } = createActionApiRoute(
corsStrategy: "all",
},
async ({ body, headers, params, authentication }) => {
+ if (
+ authentication.type !== "PRIVATE" &&
+ body.items.some((item) => item.options?.payloadType === "application/store")
+ ) {
+ return json({ error: "Stored payloads require a private API key" }, { status: 403 });
+ }
+
if (!body.items.length) {
return json({ error: "Batch cannot be triggered with no items" }, { status: 400 });
}
diff --git a/apps/webapp/app/routes/api.v2.tasks.batch.ts b/apps/webapp/app/routes/api.v2.tasks.batch.ts
index 07d476edc51..1467d99b01c 100644
--- a/apps/webapp/app/routes/api.v2.tasks.batch.ts
+++ b/apps/webapp/app/routes/api.v2.tasks.batch.ts
@@ -49,6 +49,13 @@ const { action, loader } = createActionApiRoute(
corsStrategy: "all",
},
async ({ body, headers, params, authentication, ability }) => {
+ if (
+ authentication.type !== "PRIVATE" &&
+ body.items.some((item) => item.options?.payloadType === "application/store")
+ ) {
+ return json({ error: "Stored payloads require a private API key" }, { status: 403 });
+ }
+
if (!body.items.length) {
return json({ error: "Batch cannot be triggered with no items" }, { status: 400 });
}
diff --git a/apps/webapp/app/routes/api.v3.batches.$batchId.items.ts b/apps/webapp/app/routes/api.v3.batches.$batchId.items.ts
index 9e2bd510256..972ed47ee73 100644
--- a/apps/webapp/app/routes/api.v3.batches.$batchId.items.ts
+++ b/apps/webapp/app/routes/api.v3.batches.$batchId.items.ts
@@ -95,7 +95,8 @@ export async function action({ request, params }: ActionFunctionArgs) {
const itemsIterator = await authorizedBatchItemStream(
streamToAsyncIterable(parsedStream),
authResult.ability,
- batchId
+ batchId,
+ authResult.subject.type !== "publicJWT"
);
// Process the stream
diff --git a/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.promote.ts b/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.promote.ts
index 529f627e5fb..182814af41b 100644
--- a/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.promote.ts
+++ b/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.promote.ts
@@ -5,6 +5,7 @@ import { $replica, prisma } from "~/db.server";
import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/message.server";
import { logger } from "~/services/logger.server";
import { dashboardAction } from "~/services/routeBuilders/dashboardBuilder";
+import { sanitizeRedirectPath } from "~/utils";
import { ChangeCurrentDeploymentService } from "~/v3/services/changeCurrentDeployment.server";
export const promoteSchema = z.object({
@@ -43,6 +44,8 @@ export const action = dashboardAction(
return json(submission.reply());
}
+ const redirectUrl = sanitizeRedirectPath(submission.value.redirectUrl);
+
try {
const project = await prisma.project.findFirst({
where: {
@@ -58,7 +61,7 @@ export const action = dashboardAction(
});
if (!project) {
- return redirectWithErrorMessage(submission.value.redirectUrl, request, "Project not found");
+ return redirectWithErrorMessage(redirectUrl, request, "Project not found");
}
const deployment = await prisma.workerDeployment.findFirst({
@@ -69,18 +72,14 @@ export const action = dashboardAction(
});
if (!deployment) {
- return redirectWithErrorMessage(
- submission.value.redirectUrl,
- request,
- "Deployment not found"
- );
+ return redirectWithErrorMessage(redirectUrl, request, "Deployment not found");
}
const promoteService = new ChangeCurrentDeploymentService();
await promoteService.call(deployment, "promote");
return redirectWithSuccessMessage(
- submission.value.redirectUrl,
+ redirectUrl,
request,
`Promoted deployment version ${deployment.version} to current.`
);
diff --git a/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.rollback.ts b/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.rollback.ts
index 3caed9013b3..3f4a04e4b51 100644
--- a/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.rollback.ts
+++ b/apps/webapp/app/routes/resources.$projectId.deployments.$deploymentShortCode.rollback.ts
@@ -5,6 +5,7 @@ import { $replica, prisma } from "~/db.server";
import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/message.server";
import { logger } from "~/services/logger.server";
import { dashboardAction } from "~/services/routeBuilders/dashboardBuilder";
+import { sanitizeRedirectPath } from "~/utils";
import { ChangeCurrentDeploymentService } from "~/v3/services/changeCurrentDeployment.server";
export const rollbackSchema = z.object({
@@ -43,6 +44,8 @@ export const action = dashboardAction(
return json(submission.reply());
}
+ const redirectUrl = sanitizeRedirectPath(submission.value.redirectUrl);
+
try {
const project = await prisma.project.findFirst({
where: {
@@ -58,7 +61,7 @@ export const action = dashboardAction(
});
if (!project) {
- return redirectWithErrorMessage(submission.value.redirectUrl, request, "Project not found");
+ return redirectWithErrorMessage(redirectUrl, request, "Project not found");
}
const deployment = await prisma.workerDeployment.findFirst({
@@ -69,21 +72,13 @@ export const action = dashboardAction(
});
if (!deployment) {
- return redirectWithErrorMessage(
- submission.value.redirectUrl,
- request,
- "Deployment not found"
- );
+ return redirectWithErrorMessage(redirectUrl, request, "Deployment not found");
}
const rollbackService = new ChangeCurrentDeploymentService();
await rollbackService.call(deployment, "rollback");
- return redirectWithSuccessMessage(
- submission.value.redirectUrl,
- request,
- "Rolled back deployment"
- );
+ return redirectWithSuccessMessage(redirectUrl, request, "Rolled back deployment");
} catch (error) {
if (error instanceof Error) {
logger.error("Failed to roll back deployment", {
diff --git a/apps/webapp/app/routes/resources.feedback.ts b/apps/webapp/app/routes/resources.feedback.ts
index 41f0f24249d..34e3ca941d6 100644
--- a/apps/webapp/app/routes/resources.feedback.ts
+++ b/apps/webapp/app/routes/resources.feedback.ts
@@ -4,6 +4,7 @@ import { uiComponent } from "@team-plain/ui-components";
import { z } from "zod";
import { redirectWithSuccessMessage } from "~/models/message.server";
import { requireUser } from "~/services/session.server";
+import { sanitizeRedirectPath } from "~/utils";
import { sendToPlain } from "~/utils/plain.server";
export const feedbackTypes = {
@@ -77,6 +78,7 @@ export async function action({ request }: ActionFunctionArgs) {
}
const inquiry = feedbackTypes[submission.value.feedbackType as FeedbackType];
+ const redirectPath = sanitizeRedirectPath(submission.value.path);
try {
await sendToPlain({
userId: user.id,
@@ -110,7 +112,7 @@ export async function action({ request }: ActionFunctionArgs) {
});
return redirectWithSuccessMessage(
- submission.value.path,
+ redirectPath,
request,
"Thanks for your feedback! We'll get back to you soon."
);
diff --git a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.github.tsx b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.github.tsx
index 97947f81354..65af7ba4765 100644
--- a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.github.tsx
+++ b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.github.tsx
@@ -58,6 +58,7 @@ import {
import { resolveOrgIdFromSlug } from "~/models/organization.server";
import { findProjectBySlug } from "~/models/project.server";
import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
+import { env } from "~/env.server";
import { GitHubSettingsPresenter } from "~/presenters/v3/GitHubSettingsPresenter.server";
import { logger } from "~/services/logger.server";
import { triggerInitialDeployment } from "~/services/platform.v3.server";
@@ -73,6 +74,7 @@ import {
v3ProjectSettingsIntegrationsPath,
} from "~/utils/pathBuilder";
import { type BranchTrackingConfig } from "~/v3/github";
+import { sanitizeGitHubSettingsRedirect } from "~/v3/github/githubSettingsRedirect.server";
// ============================================================================
// Types
@@ -238,10 +240,13 @@ export const action = dashboardAction(
const { projectId, organizationId } = membershipResultOrFail.value;
const { action: actionType } = submission.value;
+ const redirectUrl =
+ sanitizeGitHubSettingsRedirect(submission.value.redirectUrl, env.APP_ORIGIN) ??
+ v3ProjectSettingsIntegrationsPath({ slug: organizationSlug }, project, environment);
// Handle connect-repo action
if (actionType === "connect-repo") {
- const { repositoryId, installationId, redirectUrl } = submission.value;
+ const { repositoryId, installationId } = submission.value;
const resultOrFail = await projectSettingsService.connectGitHubRepo(
projectId,
@@ -306,8 +311,6 @@ export const action = dashboardAction(
// Handle disconnect-repo action
if (actionType === "disconnect-repo") {
- const { redirectUrl } = submission.value;
-
const resultOrFail = await projectSettingsService.disconnectGitHubRepo(projectId);
if (resultOrFail.isOk()) {
@@ -330,8 +333,7 @@ export const action = dashboardAction(
// Handle update-git-settings action
if (actionType === "update-git-settings") {
- const { productionBranch, stagingBranch, previewDeploymentsEnabled, redirectUrl } =
- submission.value;
+ const { productionBranch, stagingBranch, previewDeploymentsEnabled } = submission.value;
const resultOrFail = await projectSettingsService.updateGitSettings(
projectId,
diff --git a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.query.ai-title.tsx b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.query.ai-title.tsx
index badfae28218..2b76bd3b973 100644
--- a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.query.ai-title.tsx
+++ b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.query.ai-title.tsx
@@ -13,10 +13,10 @@ import { AIQueryTitleService } from "~/v3/services/aiQueryTitleService.server";
// `/resources/*` isn't covered by the global apiRateLimiter (`/api/*` only),
// so this endpoint needs its own per-route limiter and length cap.
-const MAX_QUERY_LENGTH = 10_000;
+const QuerySchema = z.string().min(1, "Query is required").max(10_000);
const RequestSchema = z.object({
- query: z.string().min(1, "Query is required").max(MAX_QUERY_LENGTH),
+ query: QuerySchema,
queryId: z.string().optional(),
});
@@ -74,10 +74,35 @@ export async function action({ request, params }: ActionFunctionArgs) {
}
const { query, queryId } = submission.data;
+ let queryToTitle = query;
+
+ if (queryId) {
+ const storedQuery = await prisma.customerQuery.findFirst({
+ where: { id: queryId, organizationId: project.organizationId, userId },
+ select: { query: true },
+ });
+
+ if (!storedQuery) {
+ return json(
+ { success: false as const, error: "Query not found", title: null },
+ { status: 404 }
+ );
+ }
+
+ const authoritativeQuery = QuerySchema.safeParse(storedQuery.query);
+ if (!authoritativeQuery.success) {
+ return json(
+ { success: false as const, error: "Invalid request data", title: null },
+ { status: 400 }
+ );
+ }
+
+ queryToTitle = authoritativeQuery.data;
+ }
const service = new AIQueryTitleService(openai(env.AI_RUN_FILTER_MODEL ?? "gpt-4o-mini"));
- const result = await service.generateTitle(query);
+ const result = await service.generateTitle(queryToTitle);
if (!result.success) {
return json({ success: false as const, error: result.error, title: null }, { status: 500 });
@@ -88,10 +113,17 @@ export async function action({ request, params }: ActionFunctionArgs) {
// If a queryId was provided, update the CustomerQuery record with the title
if (queryId) {
- await prisma.customerQuery.update({
- where: { id: queryId, organizationId: project.organizationId },
+ const updated = await prisma.customerQuery.updateMany({
+ where: { id: queryId, organizationId: project.organizationId, userId },
data: { title },
});
+
+ if (updated.count === 0) {
+ return json(
+ { success: false as const, error: "Query not found", title: null },
+ { status: 404 }
+ );
+ }
}
return json({ success: true as const, title, error: null });
diff --git a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.ai-filter.tsx b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.ai-filter.tsx
index 679bd19da93..613e01f40a5 100644
--- a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.ai-filter.tsx
+++ b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.ai-filter.tsx
@@ -154,7 +154,7 @@ export async function action({ request, params }: ActionFunctionArgs) {
const [error, result] = await tryCatch(service.call(text, environment.id));
if (error) {
- return json({ success: false, error: error.message }, { status: 400 });
+ return json({ success: false, error: "Unable to create filters" }, { status: 400 });
}
return json(result);
diff --git a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.bulkaction.tsx b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.bulkaction.tsx
index 28e815701c4..38030cb84ea 100644
--- a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.bulkaction.tsx
+++ b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.runs.bulkaction.tsx
@@ -58,6 +58,7 @@ import { RUNS_BULK_INSPECTOR_UI_SEARCH_PARAMS } from "~/routes/_app.orgs.$organi
import { logger } from "~/services/logger.server";
import { dashboardAction, dashboardLoader } from "~/services/routeBuilders/dashboardBuilder";
import { checkPermissions } from "~/services/routeBuilders/permissions.server";
+import { sanitizeRedirectPath } from "~/utils";
import { cn } from "~/utils/cn";
import { EnvironmentParamSchema, v3BulkActionPath } from "~/utils/pathBuilder";
import { BulkActionService } from "~/v3/services/bulk/BulkActionV2.server";
@@ -187,6 +188,8 @@ export const action = dashboardAction(
return redirectWithErrorMessage("/", request, "Invalid bulk action");
}
+ const failedRedirect = sanitizeRedirectPath(submission.value.failedRedirect);
+
// "Don't override" keeps each run's original region — drop it so it isn't
// stored as a real override.
if (submission.value.region === REPLAY_REGION_NO_OVERRIDE_VALUE) {
@@ -222,7 +225,7 @@ export const action = dashboardAction(
});
return redirectWithErrorMessage(
- submission.value.failedRedirect,
+ failedRedirect,
request,
`Failed to create bulk action: ${error.message}`
);
diff --git a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.schedules.new/route.tsx b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.schedules.new/route.tsx
index 404a39d9a1e..647fb704617 100644
--- a/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.schedules.new/route.tsx
+++ b/apps/webapp/app/routes/resources.orgs.$organizationSlug.projects.$projectParam.env.$envParam.schedules.new/route.tsx
@@ -519,10 +519,9 @@ export function UpsertScheduleForm({
{environmentTitle(environment, environment.userName)}
}
- defaultChecked={
- schedule?.instances.find((i) => i.environmentId === environment.id) !==
- undefined
- }
+ defaultChecked={schedule?.environments.some(
+ (scheduledEnvironment) => scheduledEnvironment.id === environment.id
+ )}
variant="button"
/>
))
diff --git a/apps/webapp/app/routes/resources.platform-notifications.$id.clicked.tsx b/apps/webapp/app/routes/resources.platform-notifications.$id.clicked.tsx
index 8ddf9adbc64..a40b6246b73 100644
--- a/apps/webapp/app/routes/resources.platform-notifications.$id.clicked.tsx
+++ b/apps/webapp/app/routes/resources.platform-notifications.$id.clicked.tsx
@@ -11,7 +11,10 @@ export async function action({ request, params }: ActionFunctionArgs) {
return json({ success: false }, { status: 400 });
}
- await recordNotificationClicked({ notificationId, userId });
+ const recorded = await recordNotificationClicked({ notificationId, userId });
+ if (!recorded) {
+ return json({ success: false }, { status: 404 });
+ }
return json({ success: true });
}
diff --git a/apps/webapp/app/routes/resources.platform-notifications.$id.dismiss.tsx b/apps/webapp/app/routes/resources.platform-notifications.$id.dismiss.tsx
index e6a475692d9..fc855ba7564 100644
--- a/apps/webapp/app/routes/resources.platform-notifications.$id.dismiss.tsx
+++ b/apps/webapp/app/routes/resources.platform-notifications.$id.dismiss.tsx
@@ -11,7 +11,10 @@ export async function action({ request, params }: ActionFunctionArgs) {
return json({ success: false }, { status: 400 });
}
- await dismissNotification({ notificationId, userId });
+ const recorded = await dismissNotification({ notificationId, userId });
+ if (!recorded) {
+ return json({ success: false }, { status: 404 });
+ }
return json({ success: true });
}
diff --git a/apps/webapp/app/routes/resources.platform-notifications.$id.seen.tsx b/apps/webapp/app/routes/resources.platform-notifications.$id.seen.tsx
index 652d4ee99c0..557e53c8cd7 100644
--- a/apps/webapp/app/routes/resources.platform-notifications.$id.seen.tsx
+++ b/apps/webapp/app/routes/resources.platform-notifications.$id.seen.tsx
@@ -11,7 +11,10 @@ export async function action({ request, params }: ActionFunctionArgs) {
return json({ success: false }, { status: 400 });
}
- await recordNotificationSeen({ notificationId, userId });
+ const recorded = await recordNotificationSeen({ notificationId, userId });
+ if (!recorded) {
+ return json({ success: false }, { status: 404 });
+ }
return json({ success: true });
}
diff --git a/apps/webapp/app/routes/resources.sessions.$sessionParam.close.ts b/apps/webapp/app/routes/resources.sessions.$sessionParam.close.ts
index b0f820fccc7..92a5003d749 100644
--- a/apps/webapp/app/routes/resources.sessions.$sessionParam.close.ts
+++ b/apps/webapp/app/routes/resources.sessions.$sessionParam.close.ts
@@ -6,6 +6,7 @@ import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/m
import { resolveSessionByIdOrExternalId } from "~/services/realtime/sessions.server";
import { logger } from "~/services/logger.server";
import { requireUserId } from "~/services/session.server";
+import { sanitizeRedirectPath } from "~/utils";
export const closeSessionSchema = z.object({
redirectUrl: z.string(),
@@ -28,7 +29,8 @@ export const action: ActionFunction = async ({ request, params }) => {
return json(submission.reply());
}
- const { redirectUrl, environmentId, reason } = submission.value;
+ const { environmentId, reason } = submission.value;
+ const redirectUrl = sanitizeRedirectPath(submission.value.redirectUrl);
const trimmedReason = reason?.trim();
const closedReason =
trimmedReason && trimmedReason.length > 0 ? trimmedReason : "closed-from-dashboard";
diff --git a/apps/webapp/app/routes/resources.taskruns.$runParam.cancel.ts b/apps/webapp/app/routes/resources.taskruns.$runParam.cancel.ts
index 7610f2c099c..698b73e4388 100644
--- a/apps/webapp/app/routes/resources.taskruns.$runParam.cancel.ts
+++ b/apps/webapp/app/routes/resources.taskruns.$runParam.cancel.ts
@@ -9,6 +9,7 @@ import { CancelTaskRunService } from "~/v3/services/cancelTaskRun.server";
import { getMollifierBuffer } from "~/v3/mollifier/mollifierBuffer.server";
import { runStore } from "~/v3/runStore.server";
import { controlPlaneResolver } from "~/v3/runOpsMigration/controlPlaneResolver.server";
+import { sanitizeRedirectPath } from "~/utils";
export const cancelSchema = z.object({
redirectUrl: z.string(),
@@ -75,6 +76,8 @@ export const action = dashboardAction(
return json(submission.reply());
}
+ const redirectUrl = sanitizeRedirectPath(submission.value.redirectUrl);
+
try {
// Keyed by friendlyId only so the store routes to the owning run-ops DB.
// The project-scope + membership auth is a control-plane concern resolved
@@ -116,7 +119,7 @@ export const action = dashboardAction(
if (taskRun && authorized) {
const cancelRunService = new CancelTaskRunService();
await cancelRunService.call(taskRun);
- return redirectWithSuccessMessage(submission.value.redirectUrl, request, `Canceled run`);
+ return redirectWithSuccessMessage(redirectUrl, request, `Canceled run`);
}
// PG miss — try the mollifier buffer (customer cancelled a buffered run
@@ -146,7 +149,7 @@ export const action = dashboardAction(
cancelReason: "Canceled by user",
});
if (result === "applied_to_snapshot") {
- return redirectWithSuccessMessage(submission.value.redirectUrl, request, `Canceled run`);
+ return redirectWithSuccessMessage(redirectUrl, request, `Canceled run`);
}
// "not_found" or "busy" — both indicate the drainer raced us between
// the getEntry check above and mutateSnapshot. On "not_found" the
@@ -155,7 +158,7 @@ export const action = dashboardAction(
// retry — by then the PG row exists and the regular cancel path at
// the top of this action takes over.
return redirectWithErrorMessage(
- submission.value.redirectUrl,
+ redirectUrl,
request,
"Run is materialising — retry in a moment"
);
@@ -169,14 +172,14 @@ export const action = dashboardAction(
},
});
return redirectWithErrorMessage(
- submission.value.redirectUrl,
+ redirectUrl,
request,
`Failed to cancel run, ${error.message}`
);
} else {
logger.error("Failed to cancel run", { error });
return redirectWithErrorMessage(
- submission.value.redirectUrl,
+ redirectUrl,
request,
`Failed to cancel run, ${JSON.stringify(error)}`
);
diff --git a/apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts b/apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts
index 73e45b94d5d..c409575a146 100644
--- a/apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts
+++ b/apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts
@@ -10,6 +10,7 @@ import { displayableEnvironment } from "~/models/runtimeEnvironment.server";
import { logger } from "~/services/logger.server";
import { requireUser } from "~/services/session.server";
import { dashboardAction } from "~/services/routeBuilders/dashboardBuilder";
+import { sanitizeRedirectPath } from "~/utils";
import { sortEnvironments } from "~/utils/environmentSort";
import { v3RunSpanPath } from "~/utils/pathBuilder";
import { ReplayTaskRunService } from "~/v3/services/replayTaskRun.server";
@@ -325,6 +326,8 @@ export const action = dashboardAction(
return json(submission.reply());
}
+ const failedRedirect = sanitizeRedirectPath(submission.value.failedRedirect);
+
try {
// Run-ops read keyed by friendlyId only; membership auth is re-checked on the
// control plane below, keyed off the resolved run's projectId.
@@ -372,11 +375,7 @@ export const action = dashboardAction(
select: { id: true },
});
if (!member) {
- return redirectWithErrorMessage(
- submission.value.failedRedirect,
- request,
- "Run not found"
- );
+ return redirectWithErrorMessage(failedRedirect, request, "Run not found");
}
const synthetic = await findRunByIdWithMollifierFallback({
runId: runParam,
@@ -401,7 +400,7 @@ export const action = dashboardAction(
}
if (!taskRun) {
- return redirectWithErrorMessage(submission.value.failedRedirect, request, "Run not found");
+ return redirectWithErrorMessage(failedRedirect, request, "Run not found");
}
// A replay can target a different environment, but only within the source
@@ -421,11 +420,7 @@ export const action = dashboardAction(
select: { id: true },
});
if (!overrideEnvironment) {
- return redirectWithErrorMessage(
- submission.value.failedRedirect,
- request,
- "Environment not found"
- );
+ return redirectWithErrorMessage(failedRedirect, request, "Environment not found");
}
}
@@ -451,11 +446,7 @@ export const action = dashboardAction(
});
if (!newRun) {
- return redirectWithErrorMessage(
- submission.value.failedRedirect,
- request,
- "Failed to replay run"
- );
+ return redirectWithErrorMessage(failedRedirect, request, "Failed to replay run");
}
const runPath = v3RunSpanPath(
@@ -486,15 +477,11 @@ export const action = dashboardAction(
stack: error.stack,
},
});
- return redirectWithErrorMessage(submission.value.failedRedirect, request, error.message);
+ return redirectWithErrorMessage(failedRedirect, request, error.message);
}
logger.error("Failed to replay run", { error });
- return redirectWithErrorMessage(
- submission.value.failedRedirect,
- request,
- JSON.stringify(error)
- );
+ return redirectWithErrorMessage(failedRedirect, request, JSON.stringify(error));
}
}
);
diff --git a/apps/webapp/app/routes/tests.sse.stream.ts b/apps/webapp/app/routes/tests.sse.stream.ts
deleted file mode 100644
index c4fc62c89ab..00000000000
--- a/apps/webapp/app/routes/tests.sse.stream.ts
+++ /dev/null
@@ -1,67 +0,0 @@
-import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
-import { z } from "zod";
-import { logger } from "~/services/logger.server";
-import { sse } from "~/utils/sse.server";
-
-export async function loader({ request }: LoaderFunctionArgs) {
- const url = new URL(request.url);
- const searchParams = Object.fromEntries(url.searchParams.entries());
-
- const options = z
- .object({
- minDelay: z.coerce.number().int(),
- maxDelay: z.coerce.number().int(),
- undefinedProbability: z.coerce.number().min(0).max(1).default(0.1),
- })
- .parse(searchParams);
-
- logger.debug("Test SSE stream", { options });
-
- let lastSignals = calculateChangeSignals(Date.now());
-
- return sse({
- request,
- run: async (send, stop) => {
- const result = await dateForUpdates(options);
-
- if (!result) {
- return stop();
- }
-
- const newSignals = calculateChangeSignals(result);
-
- if (lastSignals.ts !== newSignals.ts) {
- send({ data: JSON.stringify(newSignals) });
- }
-
- lastSignals = newSignals;
- },
- });
-}
-
-async function dateForUpdates(opts: {
- minDelay: number;
- maxDelay: number;
- undefinedProbability: number;
-}): Promise {
- // Randomly await between minDelay and maxDelay
- await new Promise((resolve) => {
- setTimeout(resolve, Math.random() * (opts.maxDelay - opts.minDelay) + opts.minDelay);
- });
-
- // There should be about a x% chance that this returns undefined
- if (Math.random() < opts.undefinedProbability) {
- logger.debug("Test SSE dataForUpdates returning undefined");
-
- return undefined;
- }
-
- // Randomly return true or false
- return Date.now();
-}
-
-function calculateChangeSignals(ts: number) {
- return {
- ts,
- };
-}
diff --git a/apps/webapp/app/routes/tests.sse.tsx b/apps/webapp/app/routes/tests.sse.tsx
deleted file mode 100644
index 65dafd3b7ae..00000000000
--- a/apps/webapp/app/routes/tests.sse.tsx
+++ /dev/null
@@ -1,37 +0,0 @@
-import { useLoaderData } from "@remix-run/react";
-import type { LoaderFunctionArgs } from "@remix-run/server-runtime";
-import { useEventSource } from "~/hooks/useEventSource";
-import { z } from "zod";
-
-export async function loader({ request }: LoaderFunctionArgs) {
- const url = new URL(request.url);
- const params = Object.fromEntries(url.searchParams.entries());
-
- const config = z
- .object({
- minDelay: z.coerce.number().int().min(0).max(10000).default(1000),
- maxDelay: z.coerce.number().int().min(0).max(10000).default(2000),
- undefinedProbability: z.coerce.number().min(0).max(1).default(0.1),
- })
- .parse(params);
-
- return config;
-}
-
-export default function SSETest() {
- const { minDelay, maxDelay, undefinedProbability } = useLoaderData();
-
- const events = useEventSource(
- `/tests/sse/stream?minDelay=${minDelay}&maxDelay=${maxDelay}&undefinedProbability=${undefinedProbability}`,
- {
- event: "message",
- }
- );
-
- return (
-
-
SSE Test
-
{events ?? "No events"}
-