refactor: share the public-token JWT scope decoder; make @trigger.dev/plugins internal#3919
Conversation
…/plugins internal Move buildJwtAbility into @trigger.dev/plugins as the single decoder for public-token scope strings, and re-export it from @trigger.dev/rbac so the built-in fallback and any auth plugin decode tokens identically. Scope ids split on only the first two colons, so a resource id that itself contains colons (e.g. a tag like "user:123") is matched in full rather than truncated at the first segment. Make @trigger.dev/plugins private (unpublished) and add a source export condition, so consumers bundle it from source per-commit like @trigger.dev/core instead of resolving a published version.
|
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (4)
📜 Recent review details⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (30)
🧰 Additional context used📓 Path-based instructions (4)**/*.{js,ts,tsx,jsx,css,json,md}📄 CodeRabbit inference engine (AGENTS.md)
Files:
**/*.{ts,tsx}📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
**/*.{ts,tsx,js,jsx}📄 CodeRabbit inference engine (.github/copilot-instructions.md)
Files:
**/*.ts📄 CodeRabbit inference engine (.cursor/rules/otel-metrics.mdc)
Files:
🧠 Learnings (8)📚 Learning: 2026-03-22T13:26:12.060ZApplied to files:
📚 Learning: 2026-03-22T19:24:14.403ZApplied to files:
📚 Learning: 2026-05-18T08:21:27.694ZApplied to files:
📚 Learning: 2026-05-18T08:21:27.694ZApplied to files:
📚 Learning: 2026-06-04T18:16:35.386ZApplied to files:
📚 Learning: 2026-06-09T17:58:04.699ZApplied to files:
📚 Learning: 2026-05-01T15:45:05.096ZApplied to files:
📚 Learning: 2026-05-09T08:07:24.612ZApplied to files:
🔇 Additional comments (7)
WalkthroughThis pull request consolidates JWT scope-string parsing logic into the shared plugins package. The 🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install timed out. The project may have too many dependencies for the sandbox. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
2 participants
What
buildJwtAbility— the decoder for public-token scope strings (read:tags:…,read:runs:run_abc,admin, …) — now lives in@trigger.dev/pluginsas the single source of truth.@trigger.dev/rbacre-exports it, so the built-in fallback and any auth plugin interpret a token identically.Scope strings are split on only the first two colons (
action:type:id), so a resource id that itself contains colons — e.g. a tag likeuser:123— is matched in full rather than truncated to its first segment. (The fallback already did this; this makes it the one shared implementation.)@trigger.dev/pluginsis now private (unpublished) and gains a@triggerdotdev/sourceexport condition, so consumers bundle it from source per-commit like@trigger.dev/coreinstead of resolving a published version — no cross-version coordination.Why
Two hand-maintained copies of the scope grammar drift, and the difference silently changes what a token grants. One shared decoder removes that class of bug.
Notes
@trigger.dev/pluginsis now private and@trigger.dev/rbacis internal — neither is published.internal-packages/rbac/src/ability.test.ts(now exercising the shared function).