|
1 | | -import type { ActionFunctionArgs } from "@remix-run/server-runtime"; |
2 | | -import { json } from "@remix-run/server-runtime"; |
3 | | -import { z } from "zod"; |
4 | | -import { authenticateApiRequest } from "~/services/apiAuth.server"; |
| 1 | +import { json, type LoaderFunctionArgs } from "@remix-run/server-runtime"; |
| 2 | +import { isPublicJWT } from "@trigger.dev/core/v3/jwt"; |
| 3 | +import type { ApiAuthenticationResultSuccess } from "~/services/apiAuth.server"; |
| 4 | +import { authenticateBearerWithTelemetry } from "~/services/authTelemetry.server"; |
5 | 5 | import { logger } from "~/services/logger.server"; |
| 6 | +import { apiCors } from "~/utils/apiCors"; |
| 7 | +import { |
| 8 | + assertPacketNamespaceAccess, |
| 9 | + createPacketUploadRoute, |
| 10 | + PacketParamsSchema, |
| 11 | +} from "~/services/packetApi.server"; |
6 | 12 | import { createLoaderApiRoute } from "~/services/routeBuilders/apiBuilder.server"; |
7 | 13 | import { generatePresignedUrl, jsonPacketPresignFailure } from "~/v3/objectStore.server"; |
8 | 14 |
|
9 | | -const ParamsSchema = z.object({ |
10 | | - "*": z.string(), |
11 | | -}); |
| 15 | +const { action } = createPacketUploadRoute({ forceNoPrefix: true }); |
| 16 | +export { action }; |
12 | 17 |
|
13 | | -export async function action({ request, params }: ActionFunctionArgs) { |
14 | | - // Ensure this is a POST request |
15 | | - if (request.method.toUpperCase() !== "PUT") { |
16 | | - return { status: 405, body: "Method Not Allowed" }; |
17 | | - } |
18 | | - |
19 | | - // Next authenticate the request |
20 | | - const authenticationResult = await authenticateApiRequest(request); |
21 | | - |
22 | | - if (!authenticationResult) { |
23 | | - return json({ error: "Invalid or Missing API key" }, { status: 401 }); |
| 18 | +const scopedLoader = createLoaderApiRoute( |
| 19 | + { |
| 20 | + params: PacketParamsSchema, |
| 21 | + allowJWT: true, |
| 22 | + corsStrategy: "all", |
| 23 | + findResource: async () => ({ type: "packets" }), |
| 24 | + authorization: { |
| 25 | + action: "read", |
| 26 | + resource: (packets) => packets, |
| 27 | + }, |
| 28 | + }, |
| 29 | + async ({ params, authentication }) => { |
| 30 | + assertPacketNamespaceAccess(authentication); |
| 31 | + return downloadPacket(authentication, params["*"]); |
24 | 32 | } |
| 33 | +); |
25 | 34 |
|
26 | | - const parsedParams = ParamsSchema.parse(params); |
27 | | - const filename = parsedParams["*"]; |
28 | | - |
| 35 | +async function downloadPacket(authentication: ApiAuthenticationResultSuccess, filename: string) { |
29 | 36 | const signed = await generatePresignedUrl( |
30 | | - authenticationResult.environment.project.externalRef, |
31 | | - authenticationResult.environment.slug, |
| 37 | + authentication.environment.project.externalRef, |
| 38 | + authentication.environment.slug, |
32 | 39 | filename, |
33 | | - "PUT", |
34 | | - { forceNoPrefix: true } |
| 40 | + "GET" |
35 | 41 | ); |
36 | | - |
37 | | - if (!signed.success) { |
38 | | - return jsonPacketPresignFailure(signed); |
39 | | - } |
40 | | - |
41 | | - // Caller can now use this URL to upload to that object. |
42 | | - return json({ presignedUrl: signed.url }); |
| 42 | + return signed.success ? json({ presignedUrl: signed.url }) : jsonPacketPresignFailure(signed); |
43 | 43 | } |
44 | 44 |
|
45 | | -export const loader = createLoaderApiRoute( |
46 | | - { |
47 | | - params: ParamsSchema, |
48 | | - allowJWT: true, |
49 | | - corsStrategy: "all", |
50 | | - findResource: async () => 1, // This is a dummy function, we don't need to find a resource |
51 | | - }, |
52 | | - async ({ params, authentication }) => { |
53 | | - const filename = params["*"]; |
| 45 | +export async function loader(args: LoaderFunctionArgs) { |
| 46 | + const { request, params } = args; |
| 47 | + const bearer = request.headers |
| 48 | + .get("Authorization") |
| 49 | + ?.replace(/^Bearer /, "") |
| 50 | + .trim(); |
| 51 | + if (request.method === "OPTIONS" || !bearer || !isPublicJWT(bearer)) { |
| 52 | + return scopedLoader(args); |
| 53 | + } |
54 | 54 |
|
55 | | - // Public tokens should use /api/v1/runs/:runId/packets/:field, which authorizes |
56 | | - // against the owning run. Access here is kept for clients on older SDKs. |
57 | | - if (authentication.type === "PUBLIC_JWT") { |
58 | | - logger.info("Legacy packet download with public token", { |
59 | | - environmentId: authentication.environment.id, |
60 | | - projectId: authentication.environment.projectId, |
61 | | - }); |
| 55 | + // ponytail: legacy public-JWT GET remains in every environment, including DEVELOPMENT's shared |
| 56 | + // packet namespace, until the SEC-762 diagnostic log drains. Other credentials use packet abilities. |
| 57 | + try { |
| 58 | + const result = await authenticateBearerWithTelemetry(request, { allowJWT: true }); |
| 59 | + if (!result.ok) { |
| 60 | + return apiCors(request, json({ error: result.error }, { status: result.status })); |
62 | 61 | } |
63 | | - |
64 | | - const signed = await generatePresignedUrl( |
65 | | - authentication.environment.project.externalRef, |
66 | | - authentication.environment.slug, |
67 | | - filename, |
68 | | - "GET" |
69 | | - ); |
70 | | - |
71 | | - if (!signed.success) { |
72 | | - return jsonPacketPresignFailure(signed); |
| 62 | + if (result.subject.type !== "publicJWT") { |
| 63 | + return apiCors(request, json({ error: "Invalid Public Access Token" }, { status: 401 })); |
73 | 64 | } |
74 | | - |
75 | | - // Caller can now use this URL to fetch that object. |
76 | | - return json({ presignedUrl: signed.url }); |
| 65 | + const authentication: ApiAuthenticationResultSuccess = { |
| 66 | + ok: true, |
| 67 | + apiKey: result.environment.apiKey, |
| 68 | + type: "PUBLIC_JWT", |
| 69 | + environmentScoped: true, |
| 70 | + credentialKind: result.resolution.credentialKind, |
| 71 | + environment: result.environment, |
| 72 | + }; |
| 73 | + const parsed = PacketParamsSchema.safeParse(params); |
| 74 | + if (!parsed.success) { |
| 75 | + return apiCors(request, json({ error: "Params Error" }, { status: 400 })); |
| 76 | + } |
| 77 | + logger.info("Legacy packet download with public token", { |
| 78 | + environmentId: authentication.environment.id, |
| 79 | + projectId: authentication.environment.projectId, |
| 80 | + environmentType: authentication.environment.type, |
| 81 | + }); |
| 82 | + return apiCors(request, await downloadPacket(authentication, parsed.data["*"])); |
| 83 | + } catch (error) { |
| 84 | + if (error instanceof Response) return apiCors(request, error); |
| 85 | + throw error; |
77 | 86 | } |
78 | | -); |
| 87 | +} |
0 commit comments