fix(webapp): authorize dashboard agent feedback without the agent's chat store

Fixes the dashboard agent's `submit_feedback` reports failing when the
request is served by a deployment where the API runs separately from the
dashboard. The feedback route no longer looks the chat up in the agent's
own database; it authorizes the report from the agent's token and the
environment it was issued for.

Mono-RevId: 0784bed04b292bca83f097297f7020f05953577d

Author: ericallam

apps/webapp/app/routes/api.v1.dashboard-agent.feedback.ts

@@ -1,15 +1,16 @@
 import { json, type ActionFunctionArgs } from "@remix-run/server-runtime";
 import { DASHBOARD_AGENT_FEEDBACK_LIMITS } from "@internal/dashboard-agent-contracts";
 import { z } from "zod";
-import { resolveAgentAlertContext } from "~/services/dashboardAgentAlertContext.server";
+import { authorizeWatchEnvironmentById } from "~/services/dashboardAgentWatches.server";
 import { logger } from "~/services/logger.server";
 import { telemetry } from "~/services/telemetry.server";
 import { authenticateUatOrApiRequest } from "~/services/uatRoutePreamble.server";
 
 /**
  * `POST` records the agent's report of a problem with its own tools or the docs. Only the
  * agent's delegated user-actor token is accepted, and the user, organization, project and
- * environment all come from it and the chat, never from the body.
+ * environment all come from it, never from the body. The chat id is only a property on the
+ * event: this route is served by the API service too, which has no agent chat store.
  */
 
 const FeedbackBodySchema = z.object({
@@ -40,20 +41,19 @@ export async function action({ request }: ActionFunctionArgs) {
     return json({ error: "Invalid request", code: "invalid_request" }, { status: 400 });
   }
 
-  const context = await resolveAgentAlertContext({
+  const environment = await authorizeWatchEnvironmentById({
     userId: actor.userId,
     environmentId: actor.environmentId,
-    chatId: body.data.chatId,
   });
-  if (!context.ok) {
-    return json({ error: context.error, code: context.code }, { status: 404 });
+  if (!environment) {
+    return json({ error: "Environment not found", code: "invalid_target" }, { status: 404 });
   }
 
   const recorded = telemetry.dashboardAgent.feedback({
     userId: actor.userId,
-    organizationId: context.environment.organizationId,
-    projectId: context.environment.project.id,
-    environmentId: context.environment.id,
+    organizationId: environment.organizationId,
+    projectId: environment.project.id,
+    environmentId: environment.id,
     chatId: body.data.chatId,
     message: body.data.message,
     toolName: body.data.toolName,

apps/webapp/test/dashboardAgentFeedbackRoute.test.ts

@@ -2,15 +2,15 @@ import { beforeEach, describe, expect, it, vi } from "vitest";
 
 const mocks = vi.hoisted(() => ({
   authenticate: vi.fn(),
-  resolveContext: vi.fn(),
+  authorizeEnvironment: vi.fn(),
   feedback: vi.fn(),
 }));
 
 vi.mock("~/services/uatRoutePreamble.server", () => ({
   authenticateUatOrApiRequest: mocks.authenticate,
 }));
-vi.mock("~/services/dashboardAgentAlertContext.server", () => ({
-  resolveAgentAlertContext: mocks.resolveContext,
+vi.mock("~/services/dashboardAgentWatches.server", () => ({
+  authorizeWatchEnvironmentById: mocks.authorizeEnvironment,
 }));
 vi.mock("~/services/telemetry.server", () => ({
   telemetry: { dashboardAgent: { feedback: mocks.feedback } },
@@ -38,7 +38,7 @@ function post(body: unknown) {
 
 beforeEach(() => {
   mocks.authenticate.mockReset().mockResolvedValue({ userActor: AGENT_ACTOR });
-  mocks.resolveContext.mockReset().mockResolvedValue({ ok: true, environment: ENVIRONMENT });
+  mocks.authorizeEnvironment.mockReset().mockResolvedValue(ENVIRONMENT);
   mocks.feedback.mockReset().mockReturnValue(true);
 });
 
@@ -53,10 +53,9 @@ describe("POST /api/v1/dashboard-agent/feedback", () => {
     });
 
     expect(response.status).toBe(200);
-    expect(mocks.resolveContext).toHaveBeenCalledWith({
+    expect(mocks.authorizeEnvironment).toHaveBeenCalledWith({
       userId: "user_1",
       environmentId: "env_1",
-      chatId: "chat_1",
     });
     expect(mocks.feedback).toHaveBeenCalledWith({
       userId: "user_1",
@@ -81,14 +80,10 @@ describe("POST /api/v1/dashboard-agent/feedback", () => {
     expect(mocks.feedback).not.toHaveBeenCalled();
   });
 
-  it("records nothing for a chat the user doesn't own", async () => {
-    mocks.resolveContext.mockResolvedValue({
-      ok: false,
-      code: "chat_not_found",
-      error: "Chat not found",
-    });
+  it("records nothing for an environment the user can no longer reach", async () => {
+    mocks.authorizeEnvironment.mockResolvedValue(null);
 
-    const response = await post({ chatId: "chat_other", message: "hi" });
+    const response = await post({ chatId: "chat_1", message: "hi" });
 
     expect(response.status).toBe(404);
     expect(mocks.feedback).not.toHaveBeenCalled();