fix(webapp): preserve related run summaries for scoped reads

Author: carderne

apps/webapp/app/presenters/v3/ApiRetrieveRunPresenter.server.ts

@@ -14,7 +14,6 @@ import { parsePacketAsJson } from "@trigger.dev/core/v3/utils/ioSerialization";
 import { BatchId } from "@trigger.dev/core/v3/isomorphic";
 import { getUserProvidedIdempotencyKey } from "@trigger.dev/core/v3/serverOnly";
 import type { Prisma, TaskRunAttemptStatus, TaskRunStatus } from "@trigger.dev/database";
-import type { RbacAbility } from "@trigger.dev/rbac";
 import assertNever from "assert-never";
 import type { API_VERSIONS, RunStatusUnspecifiedApiVersion } from "~/api/versions";
 import { CURRENT_API_VERSION } from "~/api/versions";
@@ -84,24 +83,6 @@ type CommonRelatedRunWithVersion = CommonRelatedRun & {
 // ReturnType<typeof findRun>) so findRun can return a synthesised buffered
 // run without the type becoming self-referential. Exported so the
 // buffer-synthesis helper below can match this shape under unit test.
-function canReadRelatedRun(
-  ability: RbacAbility | undefined,
-  run: CommonRelatedRunWithVersion
-): boolean {
-  if (!ability) return true;
-
-  const resources = [
-    { type: "runs", id: run.friendlyId },
-    { type: "tasks", id: run.taskIdentifier },
-    ...run.runTags.map((tag) => ({ type: "tags", id: tag })),
-  ];
-  if (run.batch?.friendlyId) {
-    resources.push({ type: "batch", id: run.batch.friendlyId });
-  }
-
-  return ability.can("read", resources);
-}
-
 export type FoundRun = CommonRelatedRunWithVersion & {
   traceId: string;
   payload: string;
@@ -231,7 +212,7 @@ export class ApiRetrieveRunPresenter {
     return synthesiseFoundRunFromBuffer(buffered);
   }
 
-  public async call(taskRun: FoundRun, env: AuthenticatedEnvironment, ability?: RbacAbility) {
+  public async call(taskRun: FoundRun, env: AuthenticatedEnvironment) {
     return startSpanWithEnv(tracer, "ApiRetrieveRunPresenter.call", env, async () => {
       let $payload: any;
       let $payloadPresignedUrl: string | undefined;
@@ -308,19 +289,19 @@ export class ApiRetrieveRunPresenter {
         attemptCount:
           taskRun.engine === "V1" ? taskRun.attempts.length : (taskRun.attemptNumber ?? 0),
         attempts: [],
+        // Related runs are an embedded projection of the authorized run, not independent reads.
+        // Preserve the established response shape for run-scoped credentials.
         relatedRuns: {
-          root:
-            taskRun.rootTaskRun && canReadRelatedRun(ability, taskRun.rootTaskRun)
-              ? await createCommonRunStructure(taskRun.rootTaskRun, this.apiVersion)
-              : undefined,
-          parent:
-            taskRun.parentTaskRun && canReadRelatedRun(ability, taskRun.parentTaskRun)
-              ? await createCommonRunStructure(taskRun.parentTaskRun, this.apiVersion)
-              : undefined,
+          root: taskRun.rootTaskRun
+            ? await createCommonRunStructure(taskRun.rootTaskRun, this.apiVersion)
+            : undefined,
+          parent: taskRun.parentTaskRun
+            ? await createCommonRunStructure(taskRun.parentTaskRun, this.apiVersion)
+            : undefined,
           children: await Promise.all(
-            taskRun.childRuns
-              .filter((run) => canReadRelatedRun(ability, run))
-              .map(async (run) => await createCommonRunStructure(run, this.apiVersion))
+            taskRun.childRuns.map(
+              async (run) => await createCommonRunStructure(run, this.apiVersion)
+            )
           ),
         },
       };

apps/webapp/app/routes/api.v3.runs.$runId.ts

@@ -31,9 +31,9 @@ export const loader = createLoaderApiRoute(
       },
     },
   },
-  async ({ authentication, ability, resource, apiVersion }) => {
+  async ({ authentication, resource, apiVersion }) => {
     const presenter = new ApiRetrieveRunPresenter(apiVersion);
-    const result = await presenter.call(resource, authentication.environment, ability);
+    const result = await presenter.call(resource, authentication.environment);
 
     if (!result) {
       return json(

apps/webapp/test/apiRetrieveRunPresenter.readroute.test.ts

@@ -2,7 +2,6 @@ import { postgresTest, heteroPostgresTest } from "@internal/testcontainers";
 import { PostgresRunStore } from "@internal/run-store";
 import type { Prisma, PrismaClient } from "@trigger.dev/database";
 import { generateRunOpsId } from "@trigger.dev/core/v3/isomorphic";
-import type { RbacAbility } from "@trigger.dev/rbac";
 import { beforeEach, describe, expect, vi } from "vitest";
 
 // `resolveSchedule` reads the module-level `prisma` (control-plane handle).
@@ -384,28 +383,6 @@ describe("ApiRetrieveRunPresenter.findRun store-routed read (single-DB invariant
       expect(out.relatedRuns.root?.id).toBe(tree.rootFriendlyId);
       expect(out.relatedRuns.children.map((c) => c.id)).toEqual([tree.childFriendlyId]);
       expect(out.attemptCount).toBe(found!.attemptNumber ?? 0);
-
-      const selectedTaskAbility: RbacAbility = {
-        can: (action, resource) => {
-          const resources = Array.isArray(resource) ? resource : [resource];
-          return (
-            action === "read" &&
-            resources.some(
-              (candidate) => candidate.type === "tasks" && candidate.id === found!.taskIdentifier
-            )
-          );
-        },
-        canSuper: () => false,
-      };
-      const scopedOut = await new ApiRetrieveRunPresenter(CURRENT_API_VERSION).call(
-        found!,
-        env,
-        selectedTaskAbility
-      );
-
-      expect(scopedOut.relatedRuns.parent?.id).toBe(tree.parentFriendlyId);
-      expect(scopedOut.relatedRuns.root?.id).toBe(tree.rootFriendlyId);
-      expect(scopedOut.relatedRuns.children).toEqual([]);
     }
   );