Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

feat(webapp): extend admin workers endpoint and unify admin api auth #3390

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
nicktrn merged 2 commits into from
Apr 16, 2026
Merged

feat(webapp): extend admin workers endpoint and unify admin api auth #3390

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c3619bf
feat(webapp): extend admin workers endpoint and add PAT admin helper
nicktrn Apr 15, 2026
d8d9835
refactor(webapp): unify admin api route auth via shared helper
nicktrn Apr 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions 6 .server-changes/admin-workers-endpoint.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
---
area: webapp
type: improvement
---

Admin worker groups API: add GET loader and expose more fields on POST.
23 changes: 2 additions & 21 deletions 23 apps/webapp/app/routes/admin.api.v1.environments.$environmentId.engine.repair-queues.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import { ActionFunctionArgs, json } from "@remix-run/server-runtime";
import pMap from "p-map";
import { z } from "zod";
import { $replica, prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { determineEngineVersion } from "~/v3/engineVersion.server";
import { engine } from "~/v3/runEngine.server";

Expand All @@ -16,26 +16,7 @@ const BodySchema = z.object({
});

export async function action({ request, params }: ActionFunctionArgs) {
// Next authenticate the request
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({
where: {
id: authenticationResult.userId,
},
});

if (!user) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

if (!user.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

const parsedParams = ParamsSchema.parse(params);

Expand Down
23 changes: 2 additions & 21 deletions 23 apps/webapp/app/routes/admin.api.v1.environments.$environmentId.engine.report.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { json, LoaderFunctionArgs } from "@remix-run/server-runtime";
import { z } from "zod";
import { $replica, prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { determineEngineVersion } from "~/v3/engineVersion.server";
import { engine } from "~/v3/runEngine.server";

Expand All @@ -16,26 +16,7 @@ const SearchParamsSchema = z.object({
});

export async function loader({ request, params }: LoaderFunctionArgs) {
// Next authenticate the request
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({
where: {
id: authenticationResult.userId,
},
});

if (!user) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

if (!user.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

const parsedParams = ParamsSchema.parse(params);

Expand Down
23 changes: 2 additions & 21 deletions 23 apps/webapp/app/routes/admin.api.v1.environments.$environmentId.schedules.recover.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,34 +1,15 @@
import { ActionFunctionArgs, json, LoaderFunctionArgs } from "@remix-run/server-runtime";
import { z } from "zod";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { scheduleEngine } from "~/v3/scheduleEngine.server";

const ParamsSchema = z.object({
environmentId: z.string(),
});

export async function action({ request, params }: ActionFunctionArgs) {
// Next authenticate the request
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({
where: {
id: authenticationResult.userId,
},
});

if (!user) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

if (!user.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

const parsedParams = ParamsSchema.parse(params);

Expand Down
44 changes: 3 additions & 41 deletions 44 apps/webapp/app/routes/admin.api.v1.environments.$environmentId.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { ActionFunctionArgs, json, LoaderFunctionArgs } from "@remix-run/server-runtime";
import { z } from "zod";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { engine } from "~/v3/runEngine.server";
import { updateEnvConcurrencyLimits } from "~/v3/runQueue.server";

Expand All @@ -15,26 +15,7 @@ const RequestBodySchema = z.object({
});

export async function action({ request, params }: ActionFunctionArgs) {
// Next authenticate the request
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({
where: {
id: authenticationResult.userId,
},
});

if (!user) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

if (!user.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

const parsedParams = ParamsSchema.parse(params);

Expand Down Expand Up @@ -71,26 +52,7 @@ const SearchParamsSchema = z.object({
});

export async function loader({ request, params }: LoaderFunctionArgs) {
// Next authenticate the request
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({
where: {
id: authenticationResult.userId,
},
});

if (!user) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

if (!user.admin) {
return json({ error: "You must be an admin to get this endpoint" }, { status: 403 });
}
await requireAdminApiRequest(request);

const parsedParams = ParamsSchema.parse(params);

Expand Down
23 changes: 2 additions & 21 deletions 23 apps/webapp/app/routes/admin.api.v1.feature-flags.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,30 +1,11 @@
import { ActionFunctionArgs, json } from "@remix-run/server-runtime";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { makeSetMultipleFlags } from "~/v3/featureFlags.server";
import { validatePartialFeatureFlags } from "~/v3/featureFlags";

export async function action({ request }: ActionFunctionArgs) {
// Next authenticate the request
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findFirst({
where: {
id: authenticationResult.userId,
},
});

if (!user) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

if (!user.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

try {
// Parse the request body
Expand Down
19 changes: 2 additions & 17 deletions 19 apps/webapp/app/routes/admin.api.v1.gc.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,8 +2,7 @@ import { type DataFunctionArgs } from "@remix-run/node";
import { PerformanceObserver } from "node:perf_hooks";
import { runInNewContext } from "node:vm";
import v8 from "v8";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";

async function waitTillGcFinishes() {
let resolver: (value: PerformanceEntry) => void;
Expand Down Expand Up @@ -36,21 +35,7 @@ async function waitTillGcFinishes() {
}

export async function loader({ request }: DataFunctionArgs) {
const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);

if (!authenticationResult) {
throw new Response("You must be an admin to perform this action", { status: 403 });
}

const user = await prisma.user.findFirst({
where: {
id: authenticationResult.userId,
},
});

if (!user?.admin) {
throw new Response("You must be an admin to perform this action", { status: 403 });
}
await requireAdminApiRequest(request);

const entry = await waitTillGcFinishes();

Expand Down
20 changes: 3 additions & 17 deletions 20 apps/webapp/app/routes/admin.api.v1.llm-models.$modelId.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,10 @@
import { type ActionFunctionArgs, type LoaderFunctionArgs, json } from "@remix-run/server-runtime";
import { z } from "zod";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";

async function requireAdmin(request: Request) {
const authResult = await authenticateApiRequestWithPersonalAccessToken(request);
if (!authResult) {
throw json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({ where: { id: authResult.userId } });
if (!user?.admin) {
throw json({ error: "You must be an admin to perform this action" }, { status: 403 });
}

return user;
}
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";

export async function loader({ request, params }: LoaderFunctionArgs) {
await requireAdmin(request);
await requireAdminApiRequest(request);

const model = await prisma.llmModel.findUnique({
where: { id: params.modelId },
Expand Down Expand Up @@ -69,7 +55,7 @@ const UpdateModelSchema = z.object({
});

export async function action({ request, params }: ActionFunctionArgs) {
await requireAdmin(request);
await requireAdminApiRequest(request);

const modelId = params.modelId!;

Expand Down
19 changes: 2 additions & 17 deletions 19 apps/webapp/app/routes/admin.api.v1.llm-models.missing.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,24 +1,9 @@
import { type LoaderFunctionArgs, json } from "@remix-run/server-runtime";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { getMissingLlmModels } from "~/services/admin/missingLlmModels.server";

async function requireAdmin(request: Request) {
const authResult = await authenticateApiRequestWithPersonalAccessToken(request);
if (!authResult) {
throw json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({ where: { id: authResult.userId } });
if (!user?.admin) {
throw json({ error: "You must be an admin to perform this action" }, { status: 403 });
}

return user;
}

export async function loader({ request }: LoaderFunctionArgs) {
await requireAdmin(request);
await requireAdminApiRequest(request);

const url = new URL(request.url);
const lookbackHours = parseInt(url.searchParams.get("lookbackHours") ?? "24", 10);
Expand Down
13 changes: 2 additions & 11 deletions 13 apps/webapp/app/routes/admin.api.v1.llm-models.reload.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,9 @@
import { type ActionFunctionArgs, json } from "@remix-run/server-runtime";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { llmPricingRegistry } from "~/v3/llmPricingRegistry.server";

export async function action({ request }: ActionFunctionArgs) {
const authResult = await authenticateApiRequestWithPersonalAccessToken(request);
if (!authResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({ where: { id: authResult.userId } });
if (!user?.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

if (!llmPricingRegistry) {
return json({ error: "LLM cost tracking is disabled" }, { status: 400 });
Expand Down
12 changes: 2 additions & 10 deletions 12 apps/webapp/app/routes/admin.api.v1.llm-models.seed.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,11 @@
import { type ActionFunctionArgs, json } from "@remix-run/server-runtime";
import { seedLlmPricing, syncLlmCatalog } from "@internal/llm-model-catalog";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { llmPricingRegistry } from "~/v3/llmPricingRegistry.server";

export async function action({ request }: ActionFunctionArgs) {
const authResult = await authenticateApiRequestWithPersonalAccessToken(request);
if (!authResult) {
return json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({ where: { id: authResult.userId } });
if (!user?.admin) {
return json({ error: "You must be an admin to perform this action" }, { status: 403 });
}
await requireAdminApiRequest(request);

const url = new URL(request.url);
const action = url.searchParams.get("action") ?? "seed";
Expand Down
20 changes: 3 additions & 17 deletions 20 apps/webapp/app/routes/admin.api.v1.llm-models.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,25 +1,11 @@
import { type ActionFunctionArgs, type LoaderFunctionArgs, json } from "@remix-run/server-runtime";
import { z } from "zod";
import { prisma } from "~/db.server";
import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
import { requireAdminApiRequest } from "~/services/personalAccessToken.server";
import { generateFriendlyId } from "~/v3/friendlyIdentifiers";

async function requireAdmin(request: Request) {
const authResult = await authenticateApiRequestWithPersonalAccessToken(request);
if (!authResult) {
throw json({ error: "Invalid or Missing API key" }, { status: 401 });
}

const user = await prisma.user.findUnique({ where: { id: authResult.userId } });
if (!user?.admin) {
throw json({ error: "You must be an admin to perform this action" }, { status: 403 });
}

return user;
}

export async function loader({ request }: LoaderFunctionArgs) {
await requireAdmin(request);
await requireAdminApiRequest(request);

const url = new URL(request.url);
const page = parseInt(url.searchParams.get("page") ?? "1");
Expand Down Expand Up @@ -75,7 +61,7 @@ const CreateModelSchema = z.object({
});

export async function action({ request }: ActionFunctionArgs) {
await requireAdmin(request);
await requireAdminApiRequest(request);

if (request.method !== "POST") {
return json({ error: "Method not allowed" }, { status: 405 });
Expand Down
Loading
Loading
Morty Proxy This is a proxified and sanitized view of the page, visit original site.