feat: gate scoped access tokens by entitlement

Author: brendan-kellam

packages/shared/src/entitlements.ts

@@ -52,6 +52,7 @@ const ALL_ENTITLEMENTS = [
     "oauth",
     "ask",
     "mcp",
+    "scoped-access-tokens",
     "scim"
 ] as const;
 export type Entitlement = (typeof ALL_ENTITLEMENTS)[number];

packages/web/src/ee/features/scopedAccessTokens/api.test.ts

@@ -3,6 +3,7 @@ import { afterEach, beforeEach, describe, expect, test, vi } from 'vitest';
 const mocks = vi.hoisted(() => ({
     authContext: undefined as unknown,
     generateScopedAccessToken: vi.fn(),
+    hasEntitlement: vi.fn(),
 }));
 
 vi.mock('@/middleware/sew', () => ({
@@ -13,6 +14,10 @@ vi.mock('@/middleware/withAuth', () => ({
     withAuth: vi.fn((callback: (context: unknown) => unknown) => callback(mocks.authContext)),
 }));
 
+vi.mock('@/lib/entitlements', () => ({
+    hasEntitlement: mocks.hasEntitlement,
+}));
+
 vi.mock('@sourcebot/shared', () => ({
     generateScopedAccessToken: mocks.generateScopedAccessToken,
 }));
@@ -61,6 +66,7 @@ beforeEach(() => {
         token: 'sbst_secret',
         hash: 'token-hash',
     });
+    mocks.hasEntitlement.mockReturnValue(true);
 });
 
 afterEach(() => {
@@ -82,6 +88,26 @@ describe('createScopedAccessTokenRequestSchema', () => {
 });
 
 describe('createScopedAccessToken', () => {
+    test('rejects minting before repository lookup when the entitlement is unavailable', async () => {
+        const prisma = createPrismaMock([{ id: REPO_A_ID }]);
+        mocks.authContext = {
+            org: { id: 1 },
+            user: { id: 'user-id' },
+            prisma,
+        };
+        mocks.hasEntitlement.mockReturnValue(false);
+
+        await expect(createScopedAccessToken({ repoIds: [REPO_A_ID] })).resolves.toEqual({
+            statusCode: 403,
+            errorCode: 'INSUFFICIENT_PERMISSIONS',
+            message: 'Scoped access tokens are not available in your current plan.',
+        });
+        expect(mocks.hasEntitlement).toHaveBeenCalledWith('scoped-access-tokens');
+        expect(prisma.repo.findMany).not.toHaveBeenCalled();
+        expect(mocks.generateScopedAccessToken).not.toHaveBeenCalled();
+        expect(prisma.scopedAccessToken.create).not.toHaveBeenCalled();
+    });
+
     test('creates an API-key-authenticated token with an exact one-hour lifetime', async () => {
         const prisma = createPrismaMock([
             { id: REPO_B_ID },
@@ -176,6 +202,24 @@ describe('createScopedAccessToken', () => {
 });
 
 describe('revokeScopedAccessToken', () => {
+    test('rejects revocation before deletion when the entitlement is unavailable', async () => {
+        const prisma = createPrismaMock([]);
+        mocks.authContext = {
+            org: { id: 1 },
+            user: { id: 'user-id' },
+            prisma,
+        };
+        mocks.hasEntitlement.mockReturnValue(false);
+
+        await expect(revokeScopedAccessToken('token-id')).resolves.toEqual({
+            statusCode: 403,
+            errorCode: 'INSUFFICIENT_PERMISSIONS',
+            message: 'Scoped access tokens are not available in your current plan.',
+        });
+        expect(mocks.hasEntitlement).toHaveBeenCalledWith('scoped-access-tokens');
+        expect(prisma.scopedAccessToken.deleteMany).not.toHaveBeenCalled();
+    });
+
     test('deletes only a token owned by the API-key user in the current org', async () => {
         const prisma = createPrismaMock([]);
         mocks.authContext = {

packages/web/src/ee/features/scopedAccessTokens/api.ts

@@ -1,4 +1,5 @@
 import { ErrorCode } from '@/lib/errorCodes';
+import { hasEntitlement } from '@/lib/entitlements';
 import type { ServiceError } from '@/lib/serviceError';
 import { sew } from '@/middleware/sew';
 import { withAuth } from '@/middleware/withAuth';
@@ -26,10 +27,27 @@ export interface RevokeScopedAccessTokenResponse {
     success: true;
 }
 
+const checkScopedAccessTokenEntitlement = async (): Promise<ServiceError | null> => {
+    if (await hasEntitlement('scoped-access-tokens')) {
+        return null;
+    }
+
+    return {
+        statusCode: StatusCodes.FORBIDDEN,
+        errorCode: ErrorCode.INSUFFICIENT_PERMISSIONS,
+        message: 'Scoped access tokens are not available in your current plan.',
+    } satisfies ServiceError;
+};
+
 export const createScopedAccessToken = async (
     request: CreateScopedAccessTokenRequest,
 ): Promise<CreateScopedAccessTokenResponse | ServiceError> => sew(() =>
     withAuth(async ({ org, user, prisma }) => {
+        const entitlementError = await checkScopedAccessTokenEntitlement();
+        if (entitlementError) {
+            return entitlementError;
+        }
+
         // Treat duplicate IDs as one scope entry while preserving request order.
         const repositoryIds = [...new Set(request.repoIds)];
         const repositories = await prisma.repo.findMany({
@@ -85,6 +103,11 @@ export const revokeScopedAccessToken = async (
     id: string,
 ): Promise<RevokeScopedAccessTokenResponse | ServiceError> => sew(() =>
     withAuth(async ({ org, user, prisma }) => {
+        const entitlementError = await checkScopedAccessTokenEntitlement();
+        if (entitlementError) {
+            return entitlementError;
+        }
+
         const { count } = await prisma.scopedAccessToken.deleteMany({
             where: {
                 id,

packages/web/src/middleware/withAuth.test.ts

@@ -123,7 +123,9 @@ beforeEach(() => {
     vi.mocked(userScopedPrismaClientExtension).mockReset();
     mocks.auth.mockResolvedValue(null);
     mocks.headers.mockResolvedValue(new Headers());
-    mocks.hasEntitlement.mockReturnValue(false);
+    mocks.hasEntitlement.mockImplementation(
+        (entitlement: string) => entitlement === 'scoped-access-tokens',
+    );
     mocks.isAnonymousAccessAvailable.mockReturnValue(false);
     // getAuthContext fires `prisma.user.update().catch(...)` and
     // `prisma.userToOrg.updateMany().catch(...)` to bump lastActiveAt; without a
@@ -229,6 +231,20 @@ describe('getAuthenticatedUser', () => {
     });
 
     describe('scoped access token Bearer authentication', () => {
+        test('should return undefined before token lookup without the entitlement', async () => {
+            prisma.scopedAccessToken.findUnique.mockResolvedValue(createMockScopedAccessToken());
+            mocks.hasEntitlement.mockReturnValue(false);
+            setMockHeaders(new Headers({ 'Authorization': 'Bearer sbst_scopedtoken' }));
+
+            const result = await getAuthenticatedUser();
+
+            expect(result).toBeUndefined();
+            expect(mocks.hasEntitlement.mock.calls[0]?.[0]).toBe('scoped-access-tokens');
+            expect(prisma.scopedAccessToken.findUnique).not.toHaveBeenCalled();
+            expect(prisma.scopedAccessToken.update).not.toHaveBeenCalled();
+            expect(prisma.apiKey.findUnique).not.toHaveBeenCalled();
+        });
+
         test('should return the token creator and scoped access token principal for a valid token', async () => {
             const scopedAccessToken = createMockScopedAccessToken();
             prisma.scopedAccessToken.findUnique.mockResolvedValue(scopedAccessToken);

packages/web/src/middleware/withAuth.ts

@@ -321,6 +321,10 @@ export const getAuthenticatedUser = async (): Promise<AuthResult | undefined> =>
         }
 
         if (bearerToken.startsWith(SCOPED_ACCESS_TOKEN_PREFIX)) {
+            if (!await hasEntitlement('scoped-access-tokens')) {
+                return undefined;
+            }
+
             const secret = bearerToken.slice(SCOPED_ACCESS_TOKEN_PREFIX.length);
             if (!secret) {
                 return undefined;