fix(webapp): run/batch/trigger tenant scoping & batch-resume authorization (#43)

d-cs · carderne · commit 49c951e56606 · 2026-07-09T08:28:37.000+01:00
diff --git a/.server-changes/scope-run-batch-trigger-to-tenant.md b/.server-changes/scope-run-batch-trigger-to-tenant.md
@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Scope run, batch, and trigger lookups to the caller's tenant
diff --git a/apps/webapp/app/routes/resources.batches.$batchId.check-completion.ts b/apps/webapp/app/routes/resources.batches.$batchId.check-completion.ts
@@ -3,8 +3,13 @@ import type { ActionFunction } from "@remix-run/node";
 import { json } from "@remix-run/node";
 import { assertExhaustive } from "@trigger.dev/core/utils";
 import { z } from "zod";
+import { prisma } from "~/db.server";
 import { redirectWithErrorMessage, redirectWithSuccessMessage } from "~/models/message.server";
 import { logger } from "~/services/logger.server";
+import { requireUserId } from "~/services/session.server";
+import { sanitizeRedirectPath } from "~/utils";
+import { runStore } from "~/v3/runStore.server";
+import { findBatchRunIdForUser } from "~/v3/services/batchRunAccess.server";
 import { ResumeBatchRunService } from "~/v3/services/resumeBatchRun.server";
 
 export const checkCompletionSchema = z.object({
@@ -16,6 +21,8 @@ const ParamSchema = z.object({
 });
 
 export const action: ActionFunction = async ({ request, params }) => {
+  // Require a logged-in user; org membership is checked below before resuming.
+  const userId = await requireUserId(request);
   const { batchId } = ParamSchema.parse(params);
 
   const formData = await request.formData();
@@ -25,9 +32,22 @@ export const action: ActionFunction = async ({ request, params }) => {
     return json(submission.reply());
   }
 
+  // Keep the post-action redirect same-origin.
+  const safeRedirectUrl = sanitizeRedirectPath(submission.value.redirectUrl);
+
+  // Only act on a batch in an org the caller belongs to. Accepts either the
+  // friendlyId or the internal id; both forms stay org-scoped.
+  const ownedBatchRunId = await findBatchRunIdForUser(prisma, runStore, batchId, userId);
+
+  if (!ownedBatchRunId) {
+    return redirectWithErrorMessage(safeRedirectUrl, request, "Batch not found");
+  }
+
   try {
     const resumeBatchRunService = new ResumeBatchRunService();
-    const resumeResult = await resumeBatchRunService.call(batchId);
+    // Resume by the resolved internal id: the service looks up strictly by
+    // `{ id }`, so passing a friendlyId param would resolve to nothing.
+    const resumeResult = await resumeBatchRunService.call(ownedBatchRunId);
 
     let message: string | undefined;
 
@@ -52,7 +72,7 @@ export const action: ActionFunction = async ({ request, params }) => {
       }
     }
 
-    return redirectWithSuccessMessage(submission.value.redirectUrl, request, message);
+    return redirectWithSuccessMessage(safeRedirectUrl, request, message);
   } catch (error) {
     if (error instanceof Error) {
       logger.error("Failed to check batch completion", {
@@ -62,10 +82,10 @@ export const action: ActionFunction = async ({ request, params }) => {
           stack: error.stack,
         },
       });
-      return redirectWithErrorMessage(submission.value.redirectUrl, request, error.message);
+      return redirectWithErrorMessage(safeRedirectUrl, request, error.message);
     } else {
       logger.error("Failed to check batch completion", { error });
-      return redirectWithErrorMessage(submission.value.redirectUrl, request, "Unknown error");
+      return redirectWithErrorMessage(safeRedirectUrl, request, "Unknown error");
     }
   }
 };
diff --git a/apps/webapp/app/runEngine/concerns/idempotencyKeys.server.ts b/apps/webapp/app/runEngine/concerns/idempotencyKeys.server.ts
@@ -248,6 +248,22 @@ export class IdempotencyKeyConcern {
 
       //We're using `andWait` so we need to block the parent run with a waitpoint
       if (resumeParentOnCompletion && parentRunId) {
+        // `parentRunId` comes from the request body and isn't re-validated
+        // here, so confirm the parent run is in the caller's environment
+        // before wiring a waitpoint against it.
+        const parentRunInternalId = RunId.fromFriendlyId(parentRunId);
+        const parentRunInCallerEnv = await runStore.findRun(
+          {
+            id: parentRunInternalId,
+            runtimeEnvironmentId: request.environment.id,
+          },
+          { select: { id: true } },
+          this.prisma
+        );
+        if (!parentRunInCallerEnv) {
+          throw new ServiceValidationError("Parent run not found in the calling environment", 404);
+        }
+
         // Get or create waitpoint lazily (existing run may not have one if it was standalone)
         let associatedWaitpoint = existingRun.associatedWaitpoint;
         if (!associatedWaitpoint) {
@@ -276,7 +292,7 @@ export class IdempotencyKeyConcern {
                   : event.spanId;
 
             await this.engine.blockRunWithWaitpoint({
-              runId: RunId.fromFriendlyId(parentRunId),
+              runId: parentRunInternalId,
               waitpoints: associatedWaitpoint!.id,
               spanIdToComplete: spanId,
               batch: request.options?.batchId
diff --git a/apps/webapp/app/v3/services/batchRunAccess.server.ts b/apps/webapp/app/v3/services/batchRunAccess.server.ts
@@ -0,0 +1,50 @@
+import type { RunStore } from "@internal/run-store";
+import { BatchId } from "@trigger.dev/core/v3/isomorphic";
+import type { PrismaClientOrTransaction } from "@trigger.dev/database";
+
+/**
+ * Resolve the BatchTaskRun id for `batchId` (accepting either the friendlyId or
+ * the internal id) only if `userId` is a member of the batch's owning
+ * organization. Returns null otherwise. Batch lookup goes through runStore so
+ * batches resident in either run-store database are visible.
+ */
+export async function findBatchRunIdForUser(
+  prisma: PrismaClientOrTransaction,
+  store: RunStore,
+  batchId: string,
+  userId: string
+): Promise<string | null> {
+  const batchRunId = toBatchRunId(batchId);
+  if (!batchRunId) return null;
+
+  const batchRun = await store.findBatchTaskRunById(batchRunId);
+  if (!batchRun) return null;
+
+  return (await userCanAccessEnvironment(prisma, batchRun.runtimeEnvironmentId, userId))
+    ? batchRun.id
+    : null;
+}
+
+function toBatchRunId(batchId: string): string | null {
+  try {
+    return BatchId.toId(batchId);
+  } catch {
+    return null;
+  }
+}
+
+async function userCanAccessEnvironment(
+  prisma: PrismaClientOrTransaction,
+  runtimeEnvironmentId: string,
+  userId: string
+): Promise<boolean> {
+  const environment = await prisma.runtimeEnvironment.findFirst({
+    where: {
+      id: runtimeEnvironmentId,
+      organization: { members: { some: { userId } } },
+    },
+    select: { id: true },
+  });
+
+  return !!environment;
+}
diff --git a/apps/webapp/app/v3/services/batchTriggerV3.server.ts b/apps/webapp/app/v3/services/batchTriggerV3.server.ts
@@ -20,6 +20,7 @@ import { env } from "~/env.server";
 import { findEnvironmentById } from "~/models/runtimeEnvironment.server";
 import { batchTaskRunItemStatusForRunStatus } from "~/models/taskRun.server";
 import type { AuthenticatedEnvironment } from "~/services/apiAuth.server";
+import { dependentAttemptWhere } from "./dependentAttemptScope";
 import { logger } from "~/services/logger.server";
 import { getEntitlement } from "~/services/platform.v3.server";
 import { controlPlaneResolver } from "~/v3/runOpsMigration/controlPlaneResolver.server";
@@ -193,7 +194,8 @@ export class BatchTriggerV3Service extends BaseService {
 
           const dependentAttempt = body?.dependentAttempt
             ? await this._prisma.taskRunAttempt.findFirst({
-                where: { friendlyId: body.dependentAttempt },
+                // Scope to the caller's environment (see dependentAttemptWhere).
+                where: dependentAttemptWhere(body.dependentAttempt, environment.id),
                 include: {
                   taskRun: {
                     select: {
diff --git a/apps/webapp/app/v3/services/dependentAttemptScope.ts b/apps/webapp/app/v3/services/dependentAttemptScope.ts
@@ -0,0 +1,17 @@
+import type { Prisma } from "@trigger.dev/database";
+
+/**
+ * Where-clause for resolving a dependent/parent TaskRunAttempt by friendlyId,
+ * scoped to the caller's environment via the related run. The env scope keeps a
+ * foreign friendlyId from resolving onto the new batch. Standalone builder so
+ * the scope can be asserted directly in tests.
+ */
+export function dependentAttemptWhere(
+  friendlyId: string,
+  environmentId: string
+): Prisma.TaskRunAttemptWhereInput {
+  return {
+    friendlyId,
+    taskRun: { runtimeEnvironmentId: environmentId },
+  };
+}
diff --git a/apps/webapp/app/v3/services/triggerTaskV1.server.ts b/apps/webapp/app/v3/services/triggerTaskV1.server.ts
@@ -31,6 +31,7 @@ import { isFinalAttemptStatus, isFinalRunStatus } from "../taskStatus";
 import { startActiveSpan } from "../tracer.server";
 import { clampMaxDuration } from "../utils/maxDuration";
 import { BaseService, ServiceValidationError } from "./baseService.server";
+import { attemptInEnvironmentWhere, batchRunInEnvironmentWhere } from "./triggerV1Scoping";
 import { EnqueueDelayedRunService } from "./enqueueDelayedRun.server";
 import { enqueueRun } from "./enqueueRun.server";
 import { ExpireEnqueuedRunService } from "./expireEnqueuedRun.server";
@@ -165,7 +166,7 @@ export class TriggerTaskServiceV1 extends BaseService {
 
       const dependentAttempt = body.options?.dependentAttempt
         ? await this._prisma.taskRunAttempt.findFirst({
-            where: { friendlyId: body.options.dependentAttempt },
+            where: attemptInEnvironmentWhere(body.options.dependentAttempt, environment.id),
             include: {
               taskRun: {
                 select: {
@@ -205,7 +206,7 @@ export class TriggerTaskServiceV1 extends BaseService {
 
       const parentAttempt = body.options?.parentAttempt
         ? await this._prisma.taskRunAttempt.findFirst({
-            where: { friendlyId: body.options.parentAttempt },
+            where: attemptInEnvironmentWhere(body.options.parentAttempt, environment.id),
             include: {
               taskRun: {
                 select: {
@@ -223,7 +224,7 @@ export class TriggerTaskServiceV1 extends BaseService {
 
       const dependentBatchRun = body.options?.dependentBatch
         ? await this._prisma.batchTaskRun.findFirst({
-            where: { friendlyId: body.options.dependentBatch },
+            where: batchRunInEnvironmentWhere(body.options.dependentBatch, environment.id),
             include: {
               dependentTaskAttempt: {
                 include: {
@@ -270,7 +271,7 @@ export class TriggerTaskServiceV1 extends BaseService {
 
       const parentBatchRun = body.options?.parentBatch
         ? await this._prisma.batchTaskRun.findFirst({
-            where: { friendlyId: body.options.parentBatch },
+            where: batchRunInEnvironmentWhere(body.options.parentBatch, environment.id),
             include: {
               dependentTaskAttempt: {
                 include: {
diff --git a/apps/webapp/app/v3/services/triggerV1Scoping.ts b/apps/webapp/app/v3/services/triggerV1Scoping.ts
@@ -0,0 +1,20 @@
+import type { Prisma } from "@trigger.dev/database";
+
+// Where-clauses for resolving caller-supplied parent/dependent attempt & batch
+// friendlyIds in the V1 trigger path, scoped to the caller's environment so a
+// foreign friendlyId can't be wired onto the new run/batch. Standalone builders
+// so the scope can be asserted directly in tests.
+
+export function attemptInEnvironmentWhere(
+  friendlyId: string,
+  environmentId: string
+): Prisma.TaskRunAttemptWhereInput {
+  return { friendlyId, taskRun: { runtimeEnvironmentId: environmentId } };
+}
+
+export function batchRunInEnvironmentWhere(
+  friendlyId: string,
+  environmentId: string
+): Prisma.BatchTaskRunWhereInput {
+  return { friendlyId, runtimeEnvironmentId: environmentId };
+}
diff --git a/apps/webapp/app/v3/services/worker/workerGroupAccess.ts b/apps/webapp/app/v3/services/worker/workerGroupAccess.ts
@@ -0,0 +1,19 @@
+import { WorkerInstanceGroupType } from "@trigger.dev/database";
+
+/**
+ * Whether a worker group may be used by the calling project.
+ *
+ * MANAGED groups are shared across projects. UNMANAGED groups are per-project
+ * (masterQueue is `${projectId}-${name}`), so a project may only use an
+ * UNMANAGED group whose `projectId` matches it. Dependency-free so it can be
+ * unit-tested directly.
+ */
+export function isWorkerGroupAllowedForProject(
+  workerGroup: { type: WorkerInstanceGroupType; projectId: string | null },
+  projectId: string
+): boolean {
+  if (workerGroup.type === WorkerInstanceGroupType.UNMANAGED) {
+    return workerGroup.projectId === projectId;
+  }
+  return true;
+}
diff --git a/apps/webapp/app/v3/services/worker/workerGroupService.server.ts b/apps/webapp/app/v3/services/worker/workerGroupService.server.ts
@@ -1,6 +1,7 @@
 import type { WorkerInstanceGroup, WorkloadType } from "@trigger.dev/database";
 import { WorkerInstanceGroupType } from "@trigger.dev/database";
 import { WithRunEngine } from "../baseService.server";
+import { isWorkerGroupAllowedForProject } from "./workerGroupAccess";
 import { WorkerGroupTokenService } from "./workerGroupTokenService.server";
 import { logger } from "~/services/logger.server";
 import { FEATURE_FLAG } from "~/v3/featureFlags";
@@ -252,6 +253,13 @@ export class WorkerGroupService extends WithRunEngine {
         throw new Error(`The region you specified doesn't exist ("${regionOverride}").`);
       }
 
+      // The masterQueue-only lookup above can resolve another project's
+      // UNMANAGED group, so reject groups not usable by this project
+      // (see isWorkerGroupAllowedForProject).
+      if (!isWorkerGroupAllowedForProject(workerGroup, project.id)) {
+        throw new Error(`The region you specified isn't available to you ("${regionOverride}").`);
+      }
+
       // If they're restricted, check they have access
       if (project.allowedWorkerQueues.length > 0) {
         if (project.allowedWorkerQueues.includes(workerGroup.masterQueue)) {
diff --git a/apps/webapp/test/batchRunAccess.test.ts b/apps/webapp/test/batchRunAccess.test.ts
@@ -0,0 +1,56 @@
+import { setupAuthenticatedEnvironment } from "@internal/run-engine/tests";
+import { PostgresRunStore } from "@internal/run-store";
+import { containerTest } from "@internal/testcontainers";
+import { BatchId } from "@trigger.dev/core/v3/isomorphic";
+import { describe, expect, vi } from "vitest";
+import { findBatchRunIdForUser } from "~/v3/services/batchRunAccess.server";
+
+vi.setConfig({ testTimeout: 60_000 });
+
+const rand = () => Math.random().toString(36).slice(2, 10);
+
+// The batch-resume route was previously unauthenticated. This is the org-scoped
+// ownership gate: a user may only resolve a batch in an org they belong to.
+describe("findBatchRunIdForUser", () => {
+  containerTest(
+    "resolves a batch for an org member, by friendlyId and by internal id",
+    async ({ prisma }) => {
+      const store = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+      const env = await setupAuthenticatedEnvironment(prisma, "PRODUCTION");
+      const member = await prisma.user.create({
+        data: { email: `member_${rand()}@example.com`, authenticationMethod: "MAGIC_LINK" },
+      });
+      await prisma.orgMember.create({
+        data: { organizationId: env.organizationId, userId: member.id },
+      });
+      const batchId = BatchId.generate();
+      const batch = await prisma.batchTaskRun.create({
+        data: { id: batchId.id, friendlyId: batchId.friendlyId, runtimeEnvironmentId: env.id },
+      });
+
+      expect(await findBatchRunIdForUser(prisma, store, batch.friendlyId, member.id)).toBe(
+        batch.id
+      );
+      expect(await findBatchRunIdForUser(prisma, store, batch.id, member.id)).toBe(batch.id);
+    }
+  );
+
+  containerTest(
+    "returns null for a user who is not a member of the batch's org",
+    async ({ prisma }) => {
+      const store = new PostgresRunStore({ prisma, readOnlyPrisma: prisma });
+      const env = await setupAuthenticatedEnvironment(prisma, "PRODUCTION");
+      const batchId = BatchId.generate();
+      const batch = await prisma.batchTaskRun.create({
+        data: { id: batchId.id, friendlyId: batchId.friendlyId, runtimeEnvironmentId: env.id },
+      });
+      // A user who exists but isn't a member of the org.
+      const stranger = await prisma.user.create({
+        data: { email: `stranger_${rand()}@example.com`, authenticationMethod: "MAGIC_LINK" },
+      });
+
+      expect(await findBatchRunIdForUser(prisma, store, batch.friendlyId, stranger.id)).toBeNull();
+      expect(await findBatchRunIdForUser(prisma, store, batch.id, stranger.id)).toBeNull();
+    }
+  );
+});
diff --git a/apps/webapp/test/dependentAttemptScope.test.ts b/apps/webapp/test/dependentAttemptScope.test.ts
@@ -0,0 +1,22 @@
+import { describe, expect, it } from "vitest";
+import { dependentAttemptWhere } from "../app/v3/services/dependentAttemptScope.js";
+
+// The dependent-attempt lookup must be scoped to the caller's environment via
+// the related run — a where clause missing that constraint lets a foreign
+// attempt friendlyId resolve (the cross-tenant bug). This pins the scope on the
+// query itself.
+describe("dependentAttemptWhere", () => {
+  it("scopes the attempt lookup to the environment via the related run", () => {
+    const where = dependentAttemptWhere("attempt_abc", "env_caller");
+    expect(where.friendlyId).toBe("attempt_abc");
+    expect(where.taskRun).toEqual({ runtimeEnvironmentId: "env_caller" });
+  });
+
+  it("threads the exact environment id through (no cross-env match)", () => {
+    const where = dependentAttemptWhere("attempt_abc", "env_A");
+    // The env constraint must reference the caller's env, not be absent/empty.
+    expect((where.taskRun as { runtimeEnvironmentId?: string })?.runtimeEnvironmentId).toBe(
+      "env_A"
+    );
+  });
+});
diff --git a/apps/webapp/test/engine/idempotencyParentRunScope.test.ts b/apps/webapp/test/engine/idempotencyParentRunScope.test.ts
diff --git a/apps/webapp/test/triggerV1Scoping.test.ts b/apps/webapp/test/triggerV1Scoping.test.ts
diff --git a/apps/webapp/test/workerGroupAccess.test.ts b/apps/webapp/test/workerGroupAccess.test.ts
