Skip to content

chore(webapp,rbac): remove additional API key rollout flags - #4932

Closed
carderne wants to merge 1 commit into
mainfrom
chore/remove-api-key-feature-flags
Closed

carderne wants to merge 1 commit into
mainfrom
chore/remove-api-key-feature-flags

Conversation

@carderne

Copy link
Copy Markdown
Collaborator

Summary

Makes additional API key creation and authentication always available by removing the completed rollout controls. Also removes the disabled-path telemetry and flag-specific tests.

@changeset-bot

changeset-bot Bot commented Sep 14, 2026

Copy link
Copy Markdown

⚠️ No Changeset found

Latest commit: baee7bc

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@coderabbitai

coderabbitai Bot commented Sep 14, 2026

Copy link
Copy Markdown
Contributor

Review Change StackReview Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 98df110f-40c5-4ad5-b6b1-9d4dc80db8ff

📥 Commits

Reviewing files that changed from the base of the PR and between dd55fdb and baee7bc.

📒 Files selected for processing (18)
  • apps/webapp/app/models/api-key.server.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx
  • apps/webapp/app/services/additionalApiKeyIssuance.server.ts
  • apps/webapp/app/services/additionalApiKeyIssuance.ts
  • apps/webapp/app/services/authFeatureControls.server.ts
  • apps/webapp/app/services/authFeatureControls.ts
  • apps/webapp/app/services/authTelemetry.server.ts
  • apps/webapp/app/services/rbac.server.ts
  • apps/webapp/app/v3/featureFlags.ts
  • apps/webapp/test/additionalApiKeyIssuance.test.ts
  • apps/webapp/test/authFeatureControls.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
  • apps/webapp/test/rbacFallbackBranch.test.ts
  • internal-packages/rbac/src/bearerCredentials.ts
  • internal-packages/rbac/src/fallback.ts
  • internal-packages/rbac/src/index.ts
  • test-timings.json
💤 Files with no reviewable changes (9)
  • apps/webapp/test/additionalApiKeyIssuance.test.ts
  • apps/webapp/test/authFeatureControls.test.ts
  • test-timings.json
  • apps/webapp/app/services/additionalApiKeyIssuance.server.ts
  • apps/webapp/app/services/additionalApiKeyIssuance.ts
  • apps/webapp/app/services/authFeatureControls.server.ts
  • apps/webapp/app/v3/featureFlags.ts
  • apps/webapp/app/services/authFeatureControls.ts
  • apps/webapp/app/services/rbac.server.ts

Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (36)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (17, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (14, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (15, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (18, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (13, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (20, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (22, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (7, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (23, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (12, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (10, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (16, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (19, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (21, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (24, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (11, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (9, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (6, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (3, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (2, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (8, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (1, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (5, 24)
  • GitHub Check: webapp / 🧪 Unit Tests: Webapp (4, 24)
  • GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp (2, 2)
  • GitHub Check: internal / 🧪 Unit Tests: Internal
  • GitHub Check: typecheck / typecheck
  • GitHub Check: obsmap / 🧪 Unit Tests: Observability Map
  • GitHub Check: e2e-webapp / 🧪 E2E Tests: Webapp (1, 2)
  • GitHub Check: fk-cascade-guard / fk-cascade-guard
  • GitHub Check: runops-guard / runops-guard
  • GitHub Check: report
  • GitHub Check: code-quality / code-quality
  • GitHub Check: Analyze (javascript-typescript)
  • GitHub Check: audit
  • GitHub Check: 🛡️ E2E Auth Tests (full)
🧰 Additional context used
📓 Path-based instructions (10)
Never use `request.signal` to detect client disconnects.

📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • apps/webapp/app/models/api-key.server.ts
Test files must not import `app/env.server.ts`; pass configuration as options instead.

📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)

Files:

  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
For dashboard changes, visually verify the running Remix app with Chrome DevTools MCP, using snapshots, screenshots, interaction, and console-message checks as appropriate.

📄 CodeRabbit inference engine (apps/webapp/CLAUDE.md)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx
  • apps/webapp/app/models/api-key.server.ts
Use zod for validation in packages/core and apps/webapp

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx
  • apps/webapp/app/models/api-key.server.ts
Do not import `env.server.ts` directly or indirectly into test files; instead pass environment-dependent values through options/parameters to make code testable

📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)

Files:

  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
Access environment variables through the `env` export of `env.server.ts` instead of directly accessing `process.env` Use subpath exports from `@trigger.dev/core` package instead of importing from the root `@trigger.dev/core` path

📄 CodeRabbit inference engine (.cursor/rules/webapp.mdc)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx
  • apps/webapp/app/models/api-key.server.ts
Use vitest for all tests in the Trigger.dev repository

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
Use function declarations instead of default exports

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • internal-packages/rbac/src/fallback.ts
  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • internal-packages/rbac/src/bearerCredentials.ts
  • apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx
  • internal-packages/rbac/src/index.ts
  • apps/webapp/app/models/api-key.server.ts
Use types over interfaces for TypeScript Avoid using enums; prefer string unions or const objects instead

📄 CodeRabbit inference engine (.github/copilot-instructions.md)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • internal-packages/rbac/src/fallback.ts
  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • internal-packages/rbac/src/bearerCredentials.ts
  • apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx
  • internal-packages/rbac/src/index.ts
  • apps/webapp/app/models/api-key.server.ts
When creating or editing OTEL metrics (counters, histograms, gauges), ensure metric attributes have low cardinality by using only enums, booleans, bounded error codes, or bounded shard IDs Do not use high-cardinality attributes in OTEL metr...

📄 CodeRabbit inference engine (.cursor/rules/otel-metrics.mdc)

Files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • internal-packages/rbac/src/fallback.ts
  • apps/webapp/test/rbacFallbackBranch.test.ts
  • apps/webapp/test/createEnvironmentApiKey.test.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
  • internal-packages/rbac/src/bearerCredentials.ts
  • internal-packages/rbac/src/index.ts
  • apps/webapp/app/models/api-key.server.ts
🧠 Learnings (1)
📚 Learning: 2026-06-04T18:16:35.386Z
Learnt from: nicktrn
Repo: triggerdotdev/trigger.dev PR: 3836
File: apps/supervisor/src/backpressure/backpressureMonitor.ts:3-5
Timestamp: 2026-06-04T18:16:35.386Z
Learning: When reviewing TypeScript in this repo, apply the rule “prefer type aliases over interfaces” only to data/object shapes and union/intersection type modeling. If an interface is being used as a behavioral contract for collaborators to implement (e.g., method-shape interfaces that define required behavior, such as `BackpressureLogger` / `BackpressureSignalSource` in `apps/supervisor/src/backpressure/backpressureMonitor.ts`), keep it as an `interface` and do not flag it as a type-alias-vs-interface violation.

Applied to files:

  • apps/webapp/app/services/authTelemetry.server.ts
  • apps/webapp/app/models/runtimeEnvironment.server.ts
🔇 Additional comments (9)
apps/webapp/app/models/api-key.server.ts (1)

229-229: LGTM!

apps/webapp/app/routes/_app.orgs.$organizationSlug.projects.$projectParam.env.$envParam.apikeys/route.tsx (1)

137-137: LGTM!

Also applies to: 140-140, 365-371

apps/webapp/test/createEnvironmentApiKey.test.ts (1)

31-36: LGTM!

apps/webapp/test/rbacFallbackBranch.test.ts (1)

17-18: LGTM!

apps/webapp/app/models/runtimeEnvironment.server.ts (1)

103-103: LGTM!

Also applies to: 114-114, 275-275, 277-277, 289-289, 291-291

internal-packages/rbac/src/bearerCredentials.ts (1)

73-73: LGTM!

Also applies to: 209-209

internal-packages/rbac/src/fallback.ts (1)

81-81: LGTM!

internal-packages/rbac/src/index.ts (1)

146-146: LGTM!

apps/webapp/app/services/authTelemetry.server.ts (1)

14-14: LGTM!

Also applies to: 45-45, 91-92, 95-95, 102-102


Walkthrough

The change removes additional API key issuance and lookup feature flags. API key creation no longer checks issuance eligibility. The API keys route always renders the creation dialog and attempts creation after permission checks. Runtime environment and RBAC authentication always resolve additional API keys. Disabled lookup and issuance result states are removed from types and telemetry. Related services, feature-flag entries, and tests are deleted or updated.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to baee7

Additional API key creation and authentication are enabled as intended, with existing permission and credential checks retained. No actionable merge risk remains.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the main change, but it omits the required issue reference, checklist, testing steps, changelog entry, and screenshots section. Add the required template sections. Provide the issue reference, complete the checklist, describe the tests that were run, add a short changelog entry, and state whether screenshots are applicable.
Docstring Coverage ⚠️ Warning Docstring coverage is 40.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 10 functions across 9 files. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the main change: removal of additional API key rollout flags across the webapp and RBAC packages.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
📝 Generate docstrings 💡
  • Create stacked PR
  • Commit on current branch
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/remove-api-key-feature-flags

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Devin Review found 1 potential issue.

Devin Review

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Missing server release note

Additional API keys become available to every organization, but the PR adds no required .server-changes/ entry.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

@carderne carderne closed this Sep 14, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant