feat(webapp): pass database writer and reader config to the RBAC plugin

The host now resolves writer and read-replica URLs from its env (the same
fallback chain its own Prisma clients use) and hands them to an installed
RBAC plugin at create time, with separate connection limits for writes
(default 2) and reads (default 5). A plugin that owns its own database
client can then route per-request auth reads to the read replica instead
of holding them on the primary.

Author: matt-aitken

apps/webapp/app/env.server.ts

@@ -2072,6 +2072,12 @@ const EnvironmentSchema = z
     // Force RBAC to not use the plugin
     RBAC_FORCE_FALLBACK: BoolEnv.default(false),
 
+    // Per-process pool sizes for an RBAC plugin that owns its own database
+    // client (the fallback queries through Prisma and ignores these). Writes
+    // are rare role mutations; reads run on the per-request auth hot path.
+    RBAC_DATABASE_WRITER_CONNECTION_LIMIT: z.coerce.number().int().default(2),
+    RBAC_DATABASE_READER_CONNECTION_LIMIT: z.coerce.number().int().default(5),
+
     // Force SSO to not use the plugin (contributors without the cloud
     // plugin installed can opt in to a clean OSS-only experience).
     SSO_FORCE_FALLBACK: BoolEnv.default(false),

apps/webapp/app/services/rbac.server.ts

@@ -27,5 +27,18 @@ export const rbac = plugin.create(
   { primary: prisma, replica: $replica as PrismaClient },
   // SESSION_SECRET signs delegated user-actor tokens; the plugin verifies
   // them with it in authenticateUserActor.
-  { forceFallback: env.RBAC_FORCE_FALLBACK, userActorSecret: env.SESSION_SECRET }
+  {
+    forceFallback: env.RBAC_FORCE_FALLBACK,
+    userActorSecret: env.SESSION_SECRET,
+    // A plugin that owns its own database client gets the same
+    // writer/replica topology the webapp's Prisma clients use (see
+    // getClient/getReplicaClient in db.server.ts): control-plane URLs win,
+    // and with no replica configured reads share the writer.
+    database: {
+      writerUrl: env.CONTROL_PLANE_DATABASE_URL ?? env.DATABASE_URL,
+      readerUrl: env.CONTROL_PLANE_DATABASE_READ_REPLICA_URL ?? env.DATABASE_READ_REPLICA_URL,
+      writerConnectionLimit: env.RBAC_DATABASE_WRITER_CONNECTION_LIMIT,
+      readerConnectionLimit: env.RBAC_DATABASE_READER_CONNECTION_LIMIT,
+    },
+  }
 );

internal-packages/rbac/src/index.ts

@@ -1,6 +1,7 @@
 import type {
   Permission,
   RbacAbility,
+  RbacDatabaseConfig,
   Role,
   RbacResource,
   RoleAssignmentResult,
@@ -33,6 +34,11 @@ export type RbacCreateOptions = {
   // Platform secret used to verify delegated user-actor tokens (tr_uat_).
   // Threaded through to the plugin / fallback's authenticateUserActor.
   userActorSecret?: string;
+  // Writer/reader connection URLs + pool sizes for a plugin that owns its
+  // own database client, resolved by the host from its env so the plugin
+  // follows the host's writer/replica topology. The fallback ignores this —
+  // it queries through the Prisma clients passed as `RbacPrismaInput`.
+  database?: RbacDatabaseConfig;
 };
 
 // Route actions that historically authorised via the legacy checkAuthorization's
@@ -88,7 +94,10 @@ class LazyController implements RoleBaseAccessController {
       const module = await import(moduleName);
       const plugin: RoleBasedAccessControlPlugin = module.default;
       console.log("RBAC: using plugin implementation");
-      return plugin.create({ userActorSecret: options?.userActorSecret });
+      return plugin.create({
+        userActorSecret: options?.userActorSecret,
+        database: options?.database,
+      });
     } catch (err) {
       // The dynamic import either succeeded or failed for one of two
       // distinct reasons. Distinguishing them is critical for debugging

packages/plugins/src/index.ts

@@ -16,6 +16,7 @@ export type {
   UserActorAuthResult,
   UserActorClaims,
   RbacPluginConfig,
+  RbacDatabaseConfig,
   SystemRole,
   AuthenticatedEnvironment,
 } from "./rbac.js";

packages/plugins/src/rbac.ts

@@ -430,6 +430,23 @@ export type RbacPluginConfig = {
   // Platform secret the host signs user-actor tokens with; the plugin uses
   // it to verify them in `authenticateUserActor`. Omitted → UAT auth 401s.
   userActorSecret?: string;
+  // Database connections for a plugin that owns its own client. The host
+  // resolves the URLs from its env so the plugin follows the same
+  // writer/replica topology the host uses. Omitted → the plugin falls back
+  // to its own defaults.
+  database?: RbacDatabaseConfig;
+};
+
+export type RbacDatabaseConfig = {
+  // Primary (writer) connection URL. Mutations and read-your-writes
+  // management reads run here.
+  writerUrl: string;
+  // Read-replica URL for the per-request auth reads. Omitted → those reads
+  // share the writer connection.
+  readerUrl?: string;
+  // Per-process pool sizes. Omitted → plugin defaults (writer 2, reader 5).
+  writerConnectionLimit?: number;
+  readerConnectionLimit?: number;
 };
 
 export interface RoleBasedAccessControlPlugin {