fix(webapp): restore scope-auth path and harden auth telemetry

Revert authenticateApiKeyWithScope to rbac.authenticateAuthorizeBearer
(the kill switch still applies via the rbac controller), and make the
auth telemetry tolerate a missing resolution from test doubles. Also
register the v3/apiKeys subpath in core's typesVersions for node10.

Author: carderne

apps/webapp/app/services/apiAuth.server.ts

@@ -30,10 +30,8 @@ import {
 } from "./organizationAccessToken.server";
 import { isPublicJWT, validatePublicJwtKey } from "./realtime/jwtAuth.server";
 import { isDefaultDevBranch, sanitizeBranchName } from "@trigger.dev/core/v3/utils/gitBranch";
-import {
-  authenticateBearerWithTelemetry,
-  observeLegacyBearerAuthentication,
-} from "~/services/authTelemetry.server";
+import { rbac } from "./rbac.server";
+import { observeLegacyBearerAuthentication } from "~/services/authTelemetry.server";
 
 const ClaimsSchema = z.object({
   scopes: z.array(z.string()).optional(),
@@ -309,10 +307,13 @@ export async function authenticateApiKeyWithScope(
     return { ok: false, status: 401, error: "Invalid or Missing API key" };
   }
 
-  const result = await authenticateBearerWithTelemetry(request, { allowJWT });
-  if (!result.ok) return result;
-  if (!result.ability.can(action, resource)) {
-    return { ok: false, status: 403, error: "Unauthorized" };
+  const result = await rbac.authenticateAuthorizeBearer(
+    request,
+    { action, resource },
+    { allowJWT }
+  );
+  if (!result.ok) {
+    return result;
   }
 
   return {

apps/webapp/app/services/authTelemetry.server.ts

@@ -46,12 +46,15 @@ export async function authenticateBearerWithTelemetry(
 
   try {
     const result = await rbac.authenticateBearer(request, options);
+    // The host LazyController always attaches `resolution`; fall back to the
+    // format-based classification if a caller (e.g. a test double) omits it.
+    const resolution = result.resolution ?? classified;
     final = {
-      credentialKind: result.resolution.credentialKind,
-      lookupPath: result.resolution.lookupPath,
+      credentialKind: resolution.credentialKind,
+      lookupPath: resolution.lookupPath,
       result: result.ok
         ? "success"
-        : result.resolution.lookupPath === "additional_skipped"
+        : resolution.lookupPath === "additional_skipped"
           ? "disabled"
           : result.status === 403
             ? "forbidden"

packages/core/package.json

@@ -152,6 +152,9 @@
       "v3/jwt": [
         "dist/commonjs/v3/jwt.d.ts"
       ],
+      "v3/apiKeys": [
+        "dist/commonjs/v3/apiKeys.d.ts"
+      ],
       "v3/runEngineWorker": [
         "dist/commonjs/v3/runEngineWorker/index.d.ts"
       ],