chore(webapp): observe session creation permission compatibility

Add measure-only session creation permission telemetry without changing
authorization behavior.

Mono-RevId: 555e88513a2ce6fec570c8800555ec6f20cdd0c3

Author: carderne

apps/webapp/app/routes/api.v1.sessions.ts

@@ -32,6 +32,7 @@ import {
   createLoaderApiRoute,
   everyResource,
 } from "~/services/routeBuilders/apiBuilder.server";
+import { recordSessionCreateAuthorization } from "~/services/sessionAuthorizationTelemetry.server";
 import { ServiceValidationError } from "~/v3/services/common.server";
 import { runStore } from "~/v3/runStore.server";
 
@@ -170,7 +171,7 @@ const { action } = createActionApiRoute(
     },
     corsStrategy: "all",
   },
-  async ({ authentication, body }) => {
+  async ({ authentication, body, ability, request }) => {
     try {
       if (body.externalId && !isSafeSessionExternalId(body.externalId)) {
         return json(
@@ -218,6 +219,8 @@ const { action } = createActionApiRoute(
         );
       }
 
+      recordSessionCreateAuthorization(ability, session, request, authentication.environment);
+
       // Session is task-bound — every session has a live run by
       // construction. `ensureRunForSession` is idempotent: on the
       // cached path it sees `currentRunId` is alive and returns it

apps/webapp/app/services/sessionAuthorizationTelemetry.server.test.ts

@@ -0,0 +1,89 @@
+import { trace } from "@opentelemetry/api";
+import {
+  BasicTracerProvider,
+  InMemorySpanExporter,
+  SimpleSpanProcessor,
+} from "@opentelemetry/sdk-trace-base";
+import { buildJwtAbility, withActionAliases } from "@trigger.dev/rbac";
+import { describe, expect, it } from "vitest";
+import {
+  recordSessionCreateAuthorization,
+  sessionCreateAuthorizationOutcome,
+} from "~/services/sessionAuthorizationTelemetry.server";
+
+describe("session creation authorization observation", () => {
+  it.each([
+    [["write:sessions"], "missing_task_trigger"],
+    [["write:sessions:chat-1"], "missing_both"],
+    [["trigger:tasks:chat"], "missing_session_write"],
+    [["write:tasks:chat"], "missing_session_write"],
+    [["write:sessions", "trigger:tasks:chat"], "both_allowed"],
+    [["write:sessions", "trigger:tasks:other"], "missing_task_trigger"],
+    [["write:sessions", "write:tasks:chat"], "both_allowed"],
+    [["write:sessions", "trigger:tasks"], "both_allowed"],
+    [["admin"], "both_allowed"],
+    [["write:all"], "both_allowed"],
+  ] as const)("classifies %j as %s", (scopes, expected) => {
+    expect(
+      sessionCreateAuthorizationOutcome(withActionAliases(buildJwtAbility([...scopes])), "chat")
+    ).toBe(expected);
+  });
+
+  it("attributes only would-deny events without exporting the credential or task", async () => {
+    const exporter = new InMemorySpanExporter();
+    const provider = new BasicTracerProvider({
+      spanProcessors: [new SimpleSpanProcessor(exporter)],
+    });
+    trace.setGlobalTracerProvider(provider);
+    const credential = `tr_prod_sk_${"a".repeat(24)}`;
+    const request = new Request("https://example.com/api/v1/sessions", {
+      method: "POST",
+      headers: { Authorization: `Bearer ${credential}` },
+      body: JSON.stringify({ taskIdentifier: "requested-task" }),
+    });
+    const environment = {
+      id: "env-1",
+      organizationId: "org-1",
+      projectId: "project-1",
+      type: "PRODUCTION" as const,
+    };
+
+    try {
+      recordSessionCreateAuthorization(
+        withActionAliases(buildJwtAbility(["write:tasks:chat"])),
+        { taskIdentifier: "chat" },
+        request,
+        environment
+      );
+      recordSessionCreateAuthorization(
+        buildJwtAbility(["admin"]),
+        { taskIdentifier: "chat" },
+        request,
+        environment
+      );
+      recordSessionCreateAuthorization(
+        withActionAliases(buildJwtAbility(["write:sessions", "trigger:tasks:requested-task"])),
+        { taskIdentifier: "stored-task" },
+        request,
+        environment
+      );
+      const spans = exporter.getFinishedSpans();
+      expect(spans).toHaveLength(2);
+      expect(spans[1].attributes["session.authorization.outcome"]).toBe("missing_task_trigger");
+      expect(spans[0].name).toBe("session.create.authorization_would_deny");
+      expect(spans[0].attributes).toMatchObject({
+        forceRecording: true,
+        "$trigger.org.id": "org-1",
+        "$trigger.project.id": "project-1",
+        "$trigger.env.id": "env-1",
+        "session.authorization.credential_kind": "additional_api_key",
+        "session.authorization.outcome": "missing_session_write",
+      });
+      expect(JSON.stringify(spans[0].attributes)).not.toContain(credential);
+      expect(Object.values(spans[0].attributes)).not.toContain("chat");
+    } finally {
+      trace.disable();
+      await provider.shutdown();
+    }
+  });
+});

apps/webapp/app/services/sessionAuthorizationTelemetry.server.ts

@@ -0,0 +1,70 @@
+import { getMeter, getTracer, ROOT_CONTEXT } from "@internal/tracing";
+import type { AuthenticatedEnvironment } from "@trigger.dev/core/v3/auth/environment";
+import { isAdditionalApiKey } from "@trigger.dev/core/v3/apiKeys";
+import { isPublicJWT } from "@trigger.dev/core/v3/jwt";
+import type { RbacAbility } from "@trigger.dev/rbac";
+import { singleton } from "~/utils/singleton";
+import { logger } from "~/services/logger.server";
+
+const checks = singleton("sessionCreateAuthorizationChecks", () =>
+  getMeter("session-authorization").createCounter("session.create.authorization_checks", {
+    description:
+      "Session creation requests admitted by current authorization, by proposed permission outcome",
+  })
+);
+
+export function sessionCreateAuthorizationOutcome(ability: RbacAbility, taskIdentifier: string) {
+  const sessionWrite = ability.can("write", { type: "sessions" });
+  const taskTrigger = ability.can("trigger", { type: "tasks", id: taskIdentifier });
+
+  if (sessionWrite && taskTrigger) return "both_allowed";
+  if (!sessionWrite && !taskTrigger) return "missing_both";
+  return sessionWrite ? "missing_task_trigger" : "missing_session_write";
+}
+
+export function recordSessionCreateAuthorization(
+  ability: RbacAbility,
+  session: { taskIdentifier: string },
+  request: Request,
+  environment: Pick<AuthenticatedEnvironment, "id" | "organizationId" | "projectId" | "type">
+) {
+  const token =
+    request.headers
+      .get("Authorization")
+      ?.replace(/^Bearer /, "")
+      .trim() ?? "";
+  const credentialKind = isPublicJWT(token)
+    ? "public_jwt"
+    : isAdditionalApiKey(token)
+      ? "additional_api_key"
+      : token.startsWith("tr_")
+        ? "root_api_key"
+        : "unknown";
+
+  try {
+    const outcome = sessionCreateAuthorizationOutcome(ability, session.taskIdentifier);
+    checks.add(1, { credential_kind: credentialKind, outcome });
+    if (outcome === "both_allowed") return;
+
+    // Force-record an independent root span so request sampling cannot hide affected tenants.
+    getTracer("session-authorization")
+      .startSpan(
+        "session.create.authorization_would_deny",
+        {
+          attributes: {
+            forceRecording: true,
+            "$trigger.org.id": environment.organizationId,
+            "$trigger.project.id": environment.projectId,
+            "$trigger.env.id": environment.id,
+            "$trigger.env.type": environment.type,
+            "session.authorization.credential_kind": credentialKind,
+            "session.authorization.outcome": outcome,
+          },
+        },
+        ROOT_CONTEXT
+      )
+      .end();
+  } catch {
+    logger.debug("Session authorization observation failed");
+  }
+}

apps/webapp/vitest.config.ts

@@ -19,6 +19,7 @@ export default defineConfig({
       "app/runEngine/concerns/**/*.test.ts",
       "app/runEngine/services/**/*.test.ts",
       "app/services/realtime/**/*.test.ts",
+      "app/services/sessionAuthorizationTelemetry.server.test.ts",
       "app/services/previewAutoArchive.server.test.ts",
       "app/services/provisionBillingCustomer.server.test.ts",
       "app/services/clickhouse/**/*.test.ts",