chore(webapp,rbac): remove additional API key rollout flags

Author: carderne

apps/webapp/app/models/api-key.server.ts

@@ -8,7 +8,6 @@ import { customAlphabet } from "nanoid";
 import { MAX_API_KEY_TASK_IDENTIFIERS } from "~/consts";
 import { $transaction, boundedIn, prisma } from "~/db.server";
 import { RuntimeEnvironmentType } from "~/database-types";
-import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
 import { apiKeyTelemetry, type ApiKeyTelemetry } from "~/services/apiKeyTelemetry.server";
 import { rbac } from "~/services/rbac.server";
 import { generateAdditionalApiKey, generateRootApiKey } from "~/utils/apiKeys";
@@ -225,15 +224,10 @@ export async function createEnvironmentApiKey(
   {
     prismaClient = prisma,
     rbacController = rbac,
-    issuanceAllowed,
     telemetryRecorder = apiKeyTelemetry,
   }: {
-    prismaClient?: Pick<
-      PrismaClient,
-      "apiKey" | "featureFlag" | "organization" | "runtimeEnvironment" | "taskIdentifier"
-    >;
+    prismaClient?: Pick<PrismaClient, "apiKey" | "runtimeEnvironment" | "taskIdentifier">;
     rbacController?: Pick<HostRbacController, "prepareApiKeyPolicy">;
-    issuanceAllowed?: (organizationId: string) => Promise<boolean>;
     telemetryRecorder?: ApiKeyTelemetry;
   } = {}
 ) {
@@ -249,13 +243,6 @@ export async function createEnvironmentApiKey(
     throw new Error("Environment not found");
   }
 
-  const canIssue =
-    issuanceAllowed ??
-    ((organizationId) => canIssueAdditionalApiKeys(organizationId, prismaClient));
-  if (!(await canIssue(environment.organizationId))) {
-    throw new Error("Creating additional API keys is not enabled.");
-  }
-
   if (expiresAt && expiresAt.getTime() <= Date.now()) {
     throw new Error("Expiration must be in the future");
   }

apps/webapp/app/models/runtimeEnvironment.server.ts

@@ -10,7 +10,6 @@ import { BuildRuntime } from "@trigger.dev/core/v3";
 import { isAdditionalApiKey } from "@trigger.dev/core/v3/apiKeys";
 import { isDefaultDevBranch, sanitizeBranchName } from "@trigger.dev/core/v3/utils/gitBranch";
 import { scopesGrantFullAccess } from "@trigger.dev/rbac";
-import { authFeatureControls } from "~/services/authFeatureControls.server";
 
 export type { RuntimeEnvironment };
 
@@ -101,7 +100,7 @@ export function toAuthenticated(
 
 export type ApiKeyEnvironmentResolution =
   | { ok: true; environment: AuthenticatedEnvironment }
-  | { ok: false; reason: "not-found" | "restricted" | "disabled" };
+  | { ok: false; reason: "not-found" | "restricted" };
 
 /**
  * Resolve an environment from a raw API key for legacy routes that do not
@@ -112,8 +111,7 @@ export type ApiKeyEnvironmentResolution =
 async function resolveEnvironmentByApiKey(
   apiKey: string,
   branchName: string | undefined,
-  tx: PrismaClientOrTransaction,
-  additionalApiKeyLookupEnabled: () => boolean
+  tx: PrismaClientOrTransaction
 ): Promise<ApiKeyEnvironmentResolution> {
   const branch = sanitizeBranchName(branchName) ?? undefined;
 
@@ -131,9 +129,6 @@ async function resolveEnvironmentByApiKey(
 
   const now = new Date();
   const routesToAdditionalKey = isAdditionalApiKey(apiKey);
-  if (routesToAdditionalKey && !additionalApiKeyLookupEnabled()) {
-    return { ok: false, reason: "disabled" };
-  }
 
   let rootEnvironment = routesToAdditionalKey
     ? null
@@ -277,15 +272,9 @@ async function resolveEnvironmentByApiKey(
 export async function findEnvironmentByApiKey(
   apiKey: string,
   branchName: string | undefined,
-  tx: PrismaClientOrTransaction = $replica,
-  additionalApiKeyLookupEnabled = authFeatureControls.additionalApiKeyLookupEnabled
+  tx: PrismaClientOrTransaction = $replica
 ): Promise<AuthenticatedEnvironment | null> {
-  const resolution = await resolveEnvironmentByApiKey(
-    apiKey,
-    branchName,
-    tx,
-    additionalApiKeyLookupEnabled
-  );
+  const resolution = await resolveEnvironmentByApiKey(apiKey, branchName, tx);
   return resolution.ok ? resolution.environment : null;
 }
 
@@ -297,10 +286,9 @@ export async function findEnvironmentByApiKey(
 export async function findEnvironmentByApiKeyWithResolution(
   apiKey: string,
   branchName: string | undefined,
-  tx: PrismaClientOrTransaction = $replica,
-  additionalApiKeyLookupEnabled = authFeatureControls.additionalApiKeyLookupEnabled
+  tx: PrismaClientOrTransaction = $replica
 ): Promise<ApiKeyEnvironmentResolution> {
-  return resolveEnvironmentByApiKey(apiKey, branchName, tx, additionalApiKeyLookupEnabled);
+  return resolveEnvironmentByApiKey(apiKey, branchName, tx);
 }
 
 export type PrivateApiKeyRateLimitScope = {

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx

@@ -64,14 +64,12 @@ import {
   typedJsonWithErrorMessage,
   typedJsonWithSuccessMessage,
 } from "~/models/message.server";
-import { resolveOrgIdFromSlug } from "~/models/organization.server";
 import { findProjectBySlug } from "~/models/project.server";
 import { findEnvironmentBySlug } from "~/models/runtimeEnvironment.server";
 import { ApiKeysPresenter } from "~/presenters/v3/ApiKeysPresenter.server";
 import { useFeatures } from "~/hooks/useFeatures";
 import { useOrganization } from "~/hooks/useOrganizations";
 import { useShowSelfServe } from "~/hooks/useShowSelfServe";
-import { canIssueAdditionalApiKeys } from "~/services/additionalApiKeyIssuance.server";
 import {
   validateCreateApiKeyPreset,
   type ApiKeyPreset,
@@ -135,25 +133,18 @@ export const loader = dashboardLoader(
   {
     params: EnvironmentParamSchema,
     searchParams: ApiKeySearchParams,
-    context: async (params) => {
-      const organizationId = await resolveOrgIdFromSlug(params.organizationSlug);
-      return organizationId ? { organizationId } : {};
-    },
   },
-  async ({ params, searchParams, user, ability, context }) => {
+  async ({ params, searchParams, user, ability }) => {
     try {
       const presenter = new ApiKeysPresenter();
-      const [data, additionalApiKeyIssuanceEnabled, isRbacPluginAvailable] = await Promise.all([
+      const [data, isRbacPluginAvailable] = await Promise.all([
         presenter.call({
           userId: user.id,
           organizationSlug: params.organizationSlug,
           projectSlug: params.projectParam,
           environmentSlug: params.envParam,
           showRevoked: searchParams.showRevoked,
         }),
-        context.organizationId
-          ? canIssueAdditionalApiKeys(context.organizationId)
-          : Promise.resolve(false),
         rbac.isUsingPlugin(),
       ]);
 
@@ -176,7 +167,6 @@ export const loader = dashboardLoader(
         apiKeys: canReadApiKeys ? data.apiKeys : [],
         canReadApiKeys,
         canWriteApiKeys,
-        additionalApiKeyIssuanceEnabled,
         isRbacPluginAvailable,
         showRevoked: searchParams.showRevoked ?? false,
         loadedAt: Date.now(),
@@ -194,10 +184,6 @@ export const loader = dashboardLoader(
 export const action = dashboardAction(
   {
     params: EnvironmentParamSchema,
-    context: async (params) => {
-      const organizationId = await resolveOrgIdFromSlug(params.organizationSlug);
-      return organizationId ? { organizationId } : {};
-    },
     // The environment tier is only known after resolving the route params,
     // so write:apiKeys is enforced in the handler before any mutation.
   },
@@ -241,15 +227,6 @@ export const action = dashboardAction(
     try {
       switch (submission.data.action) {
         case "create": {
-          if (!(await canIssueAdditionalApiKeys(project.organizationId))) {
-            const message = "Creating additional API keys is not enabled.";
-            return typedJsonWithErrorMessage(
-              { ok: false as const, error: message },
-              request,
-              message
-            );
-          }
-
           const presets = await rbac.apiKeyPresets(project.organizationId);
           const preset = validateCreateApiKeyPreset({
             presets,
@@ -321,7 +298,6 @@ export default function Page() {
     apiKeys,
     canReadApiKeys,
     canWriteApiKeys,
-    additionalApiKeyIssuanceEnabled,
     isRbacPluginAvailable,
     showRevoked,
     hasVercelIntegration,
@@ -386,15 +362,13 @@ export default function Page() {
                   />
                 ) : null}
                 <RevokedFilter checked={showRevoked} />
-                {additionalApiKeyIssuanceEnabled ? (
-                  <NewApiKeyDialog
-                    canWrite={canWriteApiKeys}
-                    availableTasks={availableTasks}
-                    presets={presets}
-                    isRbacPluginAvailable={isRbacPluginAvailable}
-                    environment={apiKeyEnvironmentLabel}
-                  />
-                ) : null}
+                <NewApiKeyDialog
+                  canWrite={canWriteApiKeys}
+                  availableTasks={availableTasks}
+                  presets={presets}
+                  isRbacPluginAvailable={isRbacPluginAvailable}
+                  environment={apiKeyEnvironmentLabel}
+                />
               </div>
             </div>
 

apps/webapp/app/services/additionalApiKeyIssuance.server.ts

@@ -8,11 +8,10 @@ import type {
   HostBearerAuthResult,
   RbacResource,
 } from "@trigger.dev/rbac";
-import { authFeatureControls } from "~/services/authFeatureControls.server";
 import { rbac } from "~/services/rbac.server";
 import { singleton } from "~/utils/singleton";
 
-type ApiAuthResult = "success" | "invalid" | "forbidden" | "disabled" | "error";
+type ApiAuthResult = "success" | "invalid" | "forbidden" | "error";
 
 const telemetry = singleton("apiAuthTelemetry", () => {
   const meter = getMeter("api-auth");
@@ -24,17 +23,6 @@ const telemetry = singleton("apiAuthTelemetry", () => {
     unit: "ms",
   });
 
-  meter
-    .createObservableGauge("api_auth.rollout_mode", {
-      description: "Active API authentication rollout modes",
-    })
-    .addCallback((result) => {
-      result.observe(1, {
-        control: "additional_key_lookup",
-        mode: authFeatureControls.additionalApiKeyLookupEnabled() ? "enabled" : "disabled",
-      });
-    });
-
   return { attempts, duration };
 });
 
@@ -54,13 +42,7 @@ export async function authenticateBearerWithTelemetry(
     final = {
       credentialKind: resolution.credentialKind,
       lookupPath: resolution.lookupPath,
-      result: result.ok
-        ? "success"
-        : resolution.lookupPath === "additional_skipped"
-          ? "disabled"
-          : result.status === 403
-            ? "forbidden"
-            : "invalid",
+      result: result.ok ? "success" : result.status === 403 ? "forbidden" : "invalid",
     };
     recordAuthAttempt("rbac", final.credentialKind, final.lookupPath, final.result);
     return result;
@@ -102,27 +84,22 @@ export async function observeLegacyBearerAuthentication<T extends { ok: boolean
 ): Promise<T> {
   const startedAt = performance.now();
   const classified = classifyCredential(request, true);
-  const lookupPath: BearerLookupPath =
-    classified.credentialKind === "additional_api_key" &&
-    !authFeatureControls.additionalApiKeyLookupEnabled()
-      ? "additional_skipped"
-      : classified.lookupPath;
   let result: ApiAuthResult = "error";
 
   try {
     const value = await operation();
-    result = value?.ok ? "success" : lookupPath === "additional_skipped" ? "disabled" : "invalid";
-    recordAuthAttempt("legacy", classified.credentialKind, lookupPath, result);
+    result = value?.ok ? "success" : "invalid";
+    recordAuthAttempt("legacy", classified.credentialKind, classified.lookupPath, result);
     return value;
   } catch (error) {
-    recordAuthAttempt("legacy", classified.credentialKind, lookupPath, result);
+    recordAuthAttempt("legacy", classified.credentialKind, classified.lookupPath, result);
     throw error;
   } finally {
     telemetry.duration.record(performance.now() - startedAt, {
       resolver: "legacy",
       credential_kind: classified.credentialKind,
       result,
-      lookup_path: lookupPath,
+      lookup_path: classified.lookupPath,
     });
   }
 }

apps/webapp/app/services/additionalApiKeyIssuance.ts

@@ -2,7 +2,6 @@ import { $replica, prisma } from "~/db.server";
 import type { PrismaClient } from "@trigger.dev/database";
 import plugin from "@trigger.dev/rbac";
 import { env } from "~/env.server";
-import { authFeatureControls } from "~/services/authFeatureControls.server";
 
 // plugin.create() is synchronous — returns a lazy controller that resolves
 // any installed RBAC plugin on first call. Top-level await is not used
@@ -31,7 +30,6 @@ export const rbac = plugin.create(
   {
     forceFallback: env.RBAC_FORCE_FALLBACK,
     userActorSecret: env.SESSION_SECRET,
-    additionalApiKeyLookupEnabled: authFeatureControls.additionalApiKeyLookupEnabled,
     // A plugin that owns its own database client gets the same
     // writer/replica topology the webapp's Prisma clients use (see
     // getClient/getReplicaClient in db.server.ts): control-plane URLs win,