feat(webapp): disable root API key visibility

New environments no longer display root API keys. Existing environments
can permanently disable root key visibility while retaining standard key
rotation behavior.

Mono-RevId: 521947a794d7bf82803a97fad014b497a8c9ca26

Author: carderne

.server-changes/root-api-key-visibility.md

@@ -0,0 +1,6 @@
+---
+area: webapp
+type: feature
+---
+
+Additional API keys are now enabled by default. New environments no longer display root API keys, and existing environments can permanently disable their visibility

apps/webapp/app/models/api-key.server.ts

@@ -1,8 +1,12 @@
-import type { PrismaClient, RuntimeEnvironment } from "@trigger.dev/database";
+import type {
+  PrismaClient,
+  PrismaTransactionClient,
+  RuntimeEnvironment,
+} from "@trigger.dev/database";
 import type { HostRbacController } from "@trigger.dev/rbac";
 import { customAlphabet } from "nanoid";
 import { MAX_API_KEY_TASK_IDENTIFIERS } from "~/consts";
-import { boundedIn, prisma } from "~/db.server";
+import { $transaction, boundedIn, prisma } from "~/db.server";
 import { RuntimeEnvironmentType } from "~/database-types";
 import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
 import { apiKeyTelemetry, type ApiKeyTelemetry } from "~/services/apiKeyTelemetry.server";
@@ -17,87 +21,187 @@ const apiKeyId = customAlphabet(
 
 const REVOKED_API_KEY_GRACE_PERIOD_MS = 24 * 60 * 60 * 1000;
 
-type RegenerateAPIKeyInput = {
+type RootApiKeyMutationInput = {
   userId: string;
   environmentId: string;
 };
 
-export async function regenerateApiKey({ userId, environmentId }: RegenerateAPIKeyInput) {
-  const environment = await prisma.runtimeEnvironment.findUnique({
+export class RootApiKeyNotVisibleError extends Error {
+  constructor() {
+    super("The root API key is no longer visible");
+    this.name = "RootApiKeyNotVisibleError";
+  }
+}
+
+async function findRootApiKeyEnvironment(
+  { userId, environmentId }: RootApiKeyMutationInput,
+  prismaClient: PrismaClient
+) {
+  const requestedEnvironment = await prismaClient.runtimeEnvironment.findFirst({
     where: {
       id: environmentId,
+      organization: { members: { some: { userId } } },
+      OR: [
+        { type: { not: RuntimeEnvironmentType.DEVELOPMENT } },
+        {
+          type: RuntimeEnvironmentType.DEVELOPMENT,
+          orgMember: { userId },
+        },
+      ],
     },
-    include: {
-      organization: true,
-      project: true,
-    },
+    select: { id: true, parentEnvironmentId: true },
   });
 
-  if (!environment) {
-    throw new Error("Environment does not exist");
+  if (!requestedEnvironment) {
+    throw new Error("User does not have permission to manage this root API key");
   }
 
-  // check if the user is part of the org
-  const organization = await prisma.organization.findFirst({
+  const environment = await prismaClient.runtimeEnvironment.findFirst({
     where: {
-      id: environment.organization.id,
-      members: { some: { userId } },
+      id: requestedEnvironment.parentEnvironmentId ?? requestedEnvironment.id,
+      organization: { members: { some: { userId } } },
+      OR: [
+        { type: { not: RuntimeEnvironmentType.DEVELOPMENT } },
+        {
+          type: RuntimeEnvironmentType.DEVELOPMENT,
+          orgMember: { userId },
+        },
+      ],
+    },
+    select: {
+      id: true,
+      apiKey: true,
+      pkApiKey: true,
+      rootApiKeyHiddenAt: true,
+      type: true,
+      projectId: true,
+      branchName: true,
     },
   });
 
-  if (!organization) {
-    throw new Error("User does not have permission to regenerate API key");
+  if (!environment) {
+    throw new Error("User does not have permission to manage this root API key");
   }
 
-  // check if it is the user's dev environment
-  if (environment.type === RuntimeEnvironmentType.DEVELOPMENT) {
-    if (!environment.orgMemberId) {
-      throw new Error("User does not have permission to regenerate API key");
-    }
+  if (environment.rootApiKeyHiddenAt) {
+    throw new RootApiKeyNotVisibleError();
+  }
 
-    const orgMember = await prisma.orgMember.findFirst({
-      where: {
-        organizationId: organization.id,
-        userId: userId,
-        id: environment.orgMemberId,
-      },
-    });
+  return environment;
+}
+
+async function lockVisibleRootApiKeyEnvironment(
+  prismaClient: PrismaTransactionClient,
+  environmentId: string
+) {
+  const [environment] = await prismaClient.$queryRaw<
+    Array<{ apiKey: string; rootApiKeyHiddenAt: Date | null }>
+  >`
+    SELECT "apiKey", "rootApiKeyHiddenAt"
+    FROM "public"."RuntimeEnvironment"
+    WHERE "id" = ${environmentId}
+    FOR UPDATE
+  `;
+
+  if (!environment || environment.rootApiKeyHiddenAt) {
+    throw new RootApiKeyNotVisibleError();
+  }
+
+  return environment;
+}
 
-    if (!orgMember) {
-      throw new Error("User does not have permission to regenerate API key");
+export async function regenerateApiKey(
+  input: RootApiKeyMutationInput,
+  { prismaClient = prisma }: { prismaClient?: PrismaClient } = {}
+) {
+  const environment = await findRootApiKeyEnvironment(input, prismaClient);
+  const newApiKey = createApiKeyForEnv(environment.type);
+  const newPkApiKey = createPkApiKeyForEnv(environment.type);
+  const revokedApiKeyExpiresAt = new Date(Date.now() + REVOKED_API_KEY_GRACE_PERIOD_MS);
+
+  const updatedEnvironment = await $transaction(
+    prismaClient,
+    "regenerate root API key",
+    async (tx) => {
+      const currentEnvironment = await lockVisibleRootApiKeyEnvironment(tx, environment.id);
+
+      await tx.runtimeEnvironment.update({
+        where: { id: environment.id },
+        data: {
+          apiKey: newApiKey,
+          pkApiKey: newPkApiKey,
+        },
+      });
+
+      await tx.revokedApiKey.create({
+        data: {
+          apiKey: currentEnvironment.apiKey,
+          runtimeEnvironmentId: environment.id,
+          expiresAt: revokedApiKeyExpiresAt,
+        },
+      });
+
+      return { ...environment, apiKey: newApiKey, pkApiKey: newPkApiKey };
     }
+  );
+
+  if (!updatedEnvironment) {
+    throw new Error("The root API key could not be regenerated");
   }
 
-  // generate and store new keys
+  controlPlaneResolver.invalidateEnvironment(environment.id);
+
+  return updatedEnvironment;
+}
+
+export async function disableRootApiKeyVisibility(
+  input: RootApiKeyMutationInput,
+  { prismaClient = prisma }: { prismaClient?: PrismaClient } = {}
+) {
+  const environment = await findRootApiKeyEnvironment(input, prismaClient);
   const newApiKey = createApiKeyForEnv(environment.type);
   const newPkApiKey = createPkApiKeyForEnv(environment.type);
+  const rootApiKeyHiddenAt = new Date();
 
-  const revokedApiKeyExpiresAt = new Date(Date.now() + REVOKED_API_KEY_GRACE_PERIOD_MS);
+  const updatedEnvironment = await $transaction(
+    prismaClient,
+    "disable root API key visibility",
+    async (tx) => {
+      const currentEnvironment = await lockVisibleRootApiKeyEnvironment(tx, environment.id);
 
-  const updatedEnviroment = await prisma.$transaction(async (tx) => {
-    await tx.revokedApiKey.create({
-      data: {
-        apiKey: environment.apiKey,
-        runtimeEnvironmentId: environment.id,
-        expiresAt: revokedApiKeyExpiresAt,
-      },
-    });
+      await tx.runtimeEnvironment.update({
+        where: { id: environment.id },
+        data: {
+          apiKey: newApiKey,
+          pkApiKey: newPkApiKey,
+          rootApiKeyHiddenAt,
+        },
+      });
+
+      await tx.revokedApiKey.create({
+        data: {
+          apiKey: currentEnvironment.apiKey,
+          runtimeEnvironmentId: environment.id,
+          expiresAt: new Date(Date.now() + REVOKED_API_KEY_GRACE_PERIOD_MS),
+        },
+      });
 
-    return tx.runtimeEnvironment.update({
-      data: {
+      return {
+        ...environment,
         apiKey: newApiKey,
         pkApiKey: newPkApiKey,
-      },
-      where: {
-        id: environmentId,
-      },
-    });
-  });
+        rootApiKeyHiddenAt,
+      };
+    }
+  );
+
+  if (!updatedEnvironment) {
+    throw new Error("Root API key visibility could not be disabled");
+  }
 
-  // The env's apiKey changed in the control-plane; drop any cached copy.
-  controlPlaneResolver.invalidateEnvironment(environmentId);
+  controlPlaneResolver.invalidateEnvironment(environment.id);
 
-  return updatedEnviroment;
+  return updatedEnvironment;
 }
 
 export async function createEnvironmentApiKey(

apps/webapp/app/models/organization.server.ts

@@ -227,6 +227,7 @@ export async function createEnvironment({
       slug,
       apiKey,
       pkApiKey,
+      rootApiKeyHiddenAt: new Date(),
       shortcode,
       autoEnableInternalSources: type !== "DEVELOPMENT",
       maximumConcurrencyLimit: limit,

apps/webapp/app/presenters/v3/ApiKeysPresenter.server.ts

@@ -70,6 +70,7 @@ export class ApiKeysPresenter {
         select: {
           id: true,
           apiKey: true,
+          rootApiKeyHiddenAt: true,
           type: true,
           apiKeys: {
             where: showRevoked ? undefined : { revokedAt: null },
@@ -119,20 +120,23 @@ export class ApiKeysPresenter {
     ]);
     const presetsById = new Map(presets?.map((preset) => [preset.id, preset]));
     const { taskIdentifiers, organizationId: _organizationId, ...environmentData } = environment;
+    const rootApiKey = keyEnvironment.rootApiKeyHiddenAt
+      ? null
+      : {
+          id: keyEnvironment.id,
+          name: "Root API key",
+          value: keyEnvironment.apiKey,
+          obfuscated: obfuscateApiKey(keyEnvironment.type, keyEnvironment.apiKey.slice(-4)),
+        };
 
     return {
       environment: {
         ...environmentData,
-        apiKey: keyEnvironment.apiKey,
+        apiKey: rootApiKey?.value ?? null,
         keyEnvironmentId,
       },
       availableTasks: taskIdentifiers.map((task) => task.slug),
-      rootApiKey: {
-        id: keyEnvironment.id,
-        name: "Root API key",
-        value: keyEnvironment.apiKey,
-        obfuscated: obfuscateApiKey(keyEnvironment.type, keyEnvironment.apiKey.slice(-4)),
-      },
+      rootApiKey,
       apiKeys: keyEnvironment.apiKeys.map((apiKey, index) => {
         const { presetId, scopes, ...apiKeyData } = apiKey;
         const description = policyDescriptions[index];