feat: add createActionPATApiRoute builder and use it for set-default-region

Author: nicktrn

apps/webapp/app/routes/api.v1.projects.$projectRef.default-region.ts

@@ -1,13 +1,9 @@
-import type { ActionFunctionArgs } from "@remix-run/server-runtime";
 import { json } from "@remix-run/server-runtime";
 import { tryCatch } from "@trigger.dev/core/utils";
 import { z } from "zod";
 import { prisma } from "~/db.server";
 import { RegionsPresenter } from "~/presenters/v3/RegionsPresenter.server";
-import { logger } from "~/services/logger.server";
-import { authorizePatOrganizationAccess } from "~/services/organizationApiAccess.server";
-import { authenticateApiRequestWithPersonalAccessToken } from "~/services/personalAccessToken.server";
-import { ServiceValidationError } from "~/v3/services/baseService.server";
+import { createActionPATApiRoute } from "~/services/routeBuilders/apiBuilder.server";
 import { SetDefaultRegionService } from "~/v3/services/setDefaultRegion.server";
 
 const ParamsSchema = z.object({
@@ -19,106 +15,75 @@ const SetDefaultRegionRequestBody = z.object({
   region: z.string().min(1),
 });
 
-export async function action({ request, params }: ActionFunctionArgs) {
-  // Clearing the default is unsupported: SetDefaultRegionService has no path to
-  // unset defaultWorkerGroupId, so DELETE is intentionally not implemented.
-  if (request.method.toUpperCase() !== "PUT") {
-    return json({ error: "Method Not Allowed" }, { status: 405 });
-  }
-
-  const parsedParams = ParamsSchema.safeParse(params);
-
-  if (!parsedParams.success) {
-    return json({ error: "Invalid Params" }, { status: 400 });
-  }
-
-  try {
-    const authenticationResult = await authenticateApiRequestWithPersonalAccessToken(request);
-
-    if (!authenticationResult) {
-      return json({ error: "Invalid or Missing Access Token" }, { status: 401 });
-    }
-
+// Clearing the default is unsupported: SetDefaultRegionService has no path to
+// unset defaultWorkerGroupId, so only PUT is implemented (other methods 405).
+export const action = createActionPATApiRoute(
+  {
+    method: "PUT",
+    params: ParamsSchema,
+    body: SetDefaultRegionRequestBody,
+    // Resolve the org (id only, no membership) so the plugin can compute the
+    // caller's role floor for the manage:project gate below.
+    context: async ({ projectRef }) => {
+      const project = await prisma.project.findFirst({
+        where: { externalRef: projectRef, deletedAt: null },
+        select: { organizationId: true },
+      });
+      return project ? { organizationId: project.organizationId } : {};
+    },
+    authorization: { action: "manage", resource: () => ({ type: "project" }) },
+  },
+  async ({ params, body, authentication }) => {
+    // Membership floor: resolve scoped to the caller so a non-member gets a 404
+    // (the authorization block enforces the role; this enforces membership).
     const project = await prisma.project.findFirst({
       where: {
-        externalRef: parsedParams.data.projectRef,
+        externalRef: params.projectRef,
         organization: {
           deletedAt: null,
-          members: { some: { userId: authenticationResult.userId } },
+          members: { some: { userId: authentication.userId } },
         },
         deletedAt: null,
       },
-      select: { id: true, slug: true, organizationId: true },
+      select: { id: true, slug: true },
     });
 
     if (!project) {
       return json({ error: "Project not found" }, { status: 404 });
     }
 
-    const denied = await authorizePatOrganizationAccess({
-      request,
-      organizationId: project.organizationId,
-      resource: "project",
-      action: "manage",
-    });
-    if (denied) {
-      return denied;
-    }
-
-    let rawBody: unknown;
-    try {
-      rawBody = await request.json();
-    } catch {
-      return json({ error: "Invalid request body" }, { status: 400 });
-    }
-
-    const body = SetDefaultRegionRequestBody.safeParse(rawBody);
-
-    if (!body.success) {
-      return json({ error: "Invalid request body" }, { status: 400 });
-    }
-
     // Resolve the region name to a worker group id the same way the dashboard
     // does — through the presenter, which filters to regions this project can
     // actually use (allowed queues / hidden / compute access). PAT users are
     // never admins here.
     const presenter = new RegionsPresenter();
     const [presenterError, result] = await tryCatch(
-      presenter.call({ userId: authenticationResult.userId, projectSlug: project.slug })
+      presenter.call({ userId: authentication.userId, projectSlug: project.slug })
     );
 
     if (presenterError) {
       return json({ error: presenterError.message }, { status: 400 });
     }
 
-    const region = result.regions.find((r) => r.name === body.data.region);
+    const region = result.regions.find((r) => r.name === body.region);
 
     if (!region) {
       return json(
         {
-          error: `Region '${body.data.region}' not found`,
+          error: `Region '${body.region}' not found`,
           availableRegions: result.regions.map((r) => r.name),
         },
         { status: 400 }
       );
     }
 
-    try {
-      const updated = await new SetDefaultRegionService().call({
-        projectId: project.id,
-        regionId: region.id,
-      });
+    // SetDefaultRegionService throws ServiceValidationError; the builder maps it
+    // to its status (default 400).
+    const updated = await new SetDefaultRegionService().call({
+      projectId: project.id,
+      regionId: region.id,
+    });
 
-      return json({ id: updated.id, name: updated.name });
-    } catch (error) {
-      if (error instanceof ServiceValidationError) {
-        return json({ error: error.message }, { status: 400 });
-      }
-      throw error;
-    }
-  } catch (error) {
-    if (error instanceof Response) throw error;
-    logger.error("Failed to set default region", { error });
-    return json({ error: "Internal Server Error" }, { status: 500 });
+    return json({ id: updated.id, name: updated.name });
   }
-}
+);