[Fix] Ordinary tasks can access environment management tools

apps/api/src/handlers/environments/createEnvironment.ts

@@ -13,12 +13,15 @@ import {
   users,
 } from '@roomote/db/server';
 import {
+  type EnvironmentManagementAction,
   type TaskPayload,
+  canPerformEnvironmentManagementAction,
   environmentConfigSchema,
   getAmbiguousEnvironmentRepositoryError,
   getDuplicateEnvironmentRepositoryConfigError,
   getMissingEnvironmentRepositoryError,
   getEnvironmentRepositoryInstallationError,
+  resolveEnvironmentManagementMode,
 } from '@roomote/types';
 import { captureActivationEnvironmentSaved } from '@roomote/telemetry/server';
 
@@ -35,6 +38,8 @@ export const EVAL_ENVIRONMENT_WRITE_ERROR =
   'isEval is reserved for internal eval environments.';
 export const ENVIRONMENT_ADMIN_REQUIRED_ERROR =
   'Admin access is required to create or update environments.';
+export const ENVIRONMENT_TASK_CAPABILITY_ERROR =
+  'This task is not allowed to perform that environment action.';
 
 type PostgresErrorLike = {
   code?: string;
@@ -140,6 +145,39 @@ export async function canAdministerEnvironments(
   return user?.role === 'admin' && user.deletedAt == null;
 }
 
+export async function canTaskRunManageEnvironments(
+  auth: McpAuth,
+  action: EnvironmentManagementAction,
+): Promise<boolean> {
+  if (auth.authContext.tokenType !== 'run') {
+    return true;
+  }
+
+  const runId = extractRunId(auth);
+  if (!runId) {
+    return false;
+  }
+
+  const taskRun = await db.query.taskRuns.findFirst({
+    where: eq(taskRuns.id, runId),
+    columns: { payload: true, payloadKind: true },
+    with: { task: { columns: { workflow: true } } },
+  });
+
+  if (!taskRun) {
+    return false;
+  }
+
+  return canPerformEnvironmentManagementAction(
+    resolveEnvironmentManagementMode({
+      payloadKind: taskRun.payloadKind,
+      payload: taskRun.payload,
+      workflow: taskRun.task.workflow,
+    }),
+    action,
+  );
+}
+
 /**
  * When environment creation/update is triggered by a running task run, persist
  * the resulting environment id on that job payload so the UI can resolve
@@ -234,6 +272,10 @@ export async function createEnvironment(
     return c.json({ error: ENVIRONMENT_ADMIN_REQUIRED_ERROR }, 403);
   }
 
+  if (!(await canTaskRunManageEnvironments(auth, 'create'))) {
+    return c.json({ error: ENVIRONMENT_TASK_CAPABILITY_ERROR }, 403);
+  }
+
   let body: unknown;
 
   try {

apps/api/src/handlers/environments/recordVerification.ts

@@ -7,7 +7,11 @@ import {
   recordEnvironmentVerification,
   taskRuns,
 } from '@roomote/db/server';
-import { getEnvironmentDefinitionIdFromPayload } from '@roomote/types';
+import {
+  canPerformEnvironmentManagementAction,
+  getEnvironmentDefinitionIdFromPayload,
+  resolveEnvironmentManagementMode,
+} from '@roomote/types';
 
 import type { Variables } from '../../types';
 import type { McpAuth } from '../mcp/middleware';
@@ -81,7 +85,8 @@ async function resolveVerificationCaller(
 
   const taskRun = await db.query.taskRuns.findFirst({
     where: eq(taskRuns.id, runId),
-    columns: { taskId: true, payload: true },
+    columns: { taskId: true, payload: true, payloadKind: true },
+    with: { task: { columns: { workflow: true } } },
   });
 
   if (!taskRun?.taskId) {
@@ -93,6 +98,16 @@ async function resolveVerificationCaller(
   }
 
   const payload = taskRun.payload as Record<string, unknown>;
+  const mode = resolveEnvironmentManagementMode({
+    payloadKind: taskRun.payloadKind,
+    payload,
+    workflow: taskRun.task.workflow,
+  });
+
+  if (!canPerformEnvironmentManagementAction(mode, 'record_verification')) {
+    return null;
+  }
+
   const marker = payload.verifiesEnvironmentId;
 
   const authorizedEnvironmentId =

apps/api/src/handlers/environments/updateEnvironment.ts

@@ -21,9 +21,11 @@ import { logHandlerError } from '../utils';
 import {
   DUPLICATE_ENVIRONMENT_NAME_ERROR,
   ENVIRONMENT_ADMIN_REQUIRED_ERROR,
+  ENVIRONMENT_TASK_CAPABILITY_ERROR,
   EVAL_ENVIRONMENT_WRITE_ERROR,
   attachEnvironmentIdToTaskRun,
   canAdministerEnvironments,
+  canTaskRunManageEnvironments,
   getEnvironmentRepositoryConfigError,
   isEnvironmentNameUniqueViolation,
   resolveCallingVerificationTaskId,
@@ -50,6 +52,10 @@ export async function updateEnvironment(
     return c.json({ error: ENVIRONMENT_ADMIN_REQUIRED_ERROR }, 403);
   }
 
+  if (!(await canTaskRunManageEnvironments(auth, 'update'))) {
+    return c.json({ error: ENVIRONMENT_TASK_CAPABILITY_ERROR }, 403);
+  }
+
   const id = c.req.param('id');
 
   if (!id) {

apps/api/src/handlers/tasks/launchTask.ts

@@ -267,6 +267,13 @@ export async function launchTask(
 
     const basePayload = {
       ...workspacePayload,
+      ...(requestedType === 'environment-definition'
+        ? {
+            environmentManagementMode: body.environmentId
+              ? ('update' as const)
+              : ('create' as const),
+          }
+        : {}),
       ...(sourceControlProvider ? { sourceControlProvider } : {}),
       branch: body.branch,
       sha: body.sha,

apps/web/src/trpc/commands/environments/index.ts

@@ -937,6 +937,7 @@ export async function startEnvironmentDefinitionTaskCommand(
       type: TaskPayloadKind.StandardTask,
       payload: {
         ...workspacePayload,
+        environmentManagementMode: input.environmentId ? 'update' : 'create',
         ...(input.environmentId
           ? { environmentDefinitionId: input.environmentId }
           : {}),
@@ -1107,6 +1108,7 @@ export async function retryEnvironmentVerificationCommand(
             repo: ALL_REPOSITORIES,
             environmentId: environment.id,
             verifiesEnvironmentId: environment.id,
+            environmentManagementMode: 'verify',
             description: prompt,
           },
         },

apps/web/src/trpc/commands/preview-settings/index.ts

@@ -665,6 +665,7 @@ export async function startPreviewSetupTaskCommand(
           repo: ALL_REPOSITORIES,
           environmentId: environment.id,
           environmentDefinitionId: environment.id,
+          environmentManagementMode: 'update',
           description: prompt,
         },
       },