fix(pymthouse): emit composite app.pmth_ bearer for DMZ signer

[seanhanca]

Summary

• Replace legacy user-JWT forward in resolveSignerEndpoint with composite app_XXX.pmth_YYY keys (PR fix: set DATABASE_URL_UNPOOLED for prisma db push #210 DMZ contract).
• Forward composite PYMTHOUSE_API_KEY values directly to the DMZ (skip broken signer-session exchange for composite format).
• Bare pmth_ keys still use the existing api-key signer-session exchange path.

Test plan

• pymthouse-adapter.test.ts (23 tests)
• Prod validate: signerSession.headers.Authorization is Bearer app_98575870….pmth_… (not JWT)
• Billed generation E2E — blocked on DMZ IncompleteRead(85,108) (John)

Made with Cursor

Summary by CodeRabbit

• New Features

  • Improved signer session handling for billing requests, including support for composite API keys and direct bearer-token forwarding when appropriate.
  • Updated fallback signer authentication to use a new API-key-based flow.

• Bug Fixes

  • Fixed handling of signer endpoint resolution so the correct authorization token is sent in each exchange scenario.
  • Expanded support for accepted API key formats in configuration guidance.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
naap-platform	Ready	Preview	Jul 9, 2026 5:00am

[coderabbitai]

Warning

Review limit reached

@seanhanca, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 32 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: baebdf73-dd83-45df-8cbd-bf8316f27fa2

📥 Commits

Reviewing files that changed from the base of the PR and between 812c576 and b678d12.

📒 Files selected for processing (2)

• apps/web-next/src/lib/billing/pymthouse-adapter.test.ts
• apps/web-next/src/lib/billing/pymthouse-adapter.ts

📝 Walkthrough

Walkthrough

This PR changes PymthouseAdapter.resolveSignerEndpoint to mint and use composite pmth_ API keys via createPymthouseApiKey instead of minting a user-scoped signer JWT via mintUserSignerJwtForExternalUser, adds a composite-key fast path that skips the exchange hop, and updates related tests and a config comment.

Changes

Composite API key signer resolution

Layer / File(s)	Summary
Type imports and config doc apps/web-next/src/lib/billing/pymthouse-adapter.ts, apps/web-next/src/lib/pymthouse-signer-exchange-config.ts	Imports PymthouseApiKeyExchangeConfig/PymthouseSignerExchangeConfig types; rewords the PYMTHOUSE_API_KEY doc comment to mention composite and bare key formats.
resolveSignerEndpoint composite-key and fallback logic apps/web-next/src/lib/billing/pymthouse-adapter.ts	Adds a DMZ-validated composite-key fast path (.pmth_ match forwards bearer directly) alongside the existing exchangeApiKeyForSignerSession path; fallback path now mints via createPymthouseApiKey (label naap-validate-signer) instead of mintUserSignerJwtForExternalUser.
Adapter test suite updates apps/web-next/src/lib/billing/pymthouse-adapter.test.ts	Adds createPymthouseApiKey mock, retargets assertions from JWT minting to composite-key minting/forwarding, adds coverage for bare-key exchange vs. composite-key direct forwarding, and updates negative/failure-case expectations and getSignerRouting setups.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Caller
  participant PymthouseAdapter
  participant SignerRouting
  participant PymthouseKeysBff
  participant ExchangeService

  Caller->>PymthouseAdapter: resolveSignerEndpoint()
  PymthouseAdapter->>SignerRouting: getSignerRouting()
  alt apiKeyCfg present, composite key
    PymthouseAdapter->>PymthouseAdapter: use apiKey directly (Bearer apiKey)
  else apiKeyCfg present, bare key
    PymthouseAdapter->>ExchangeService: exchangeApiKeyForSignerSession(apiKeyCfg)
    ExchangeService-->>PymthouseAdapter: session.accessToken, signerUrl
  else no apiKeyCfg
    PymthouseAdapter->>PymthouseKeysBff: createPymthouseApiKey(externalUserId, "naap-validate-signer")
    PymthouseKeysBff-->>PymthouseAdapter: apiKey
  end
  PymthouseAdapter-->>Caller: url + Authorization: Bearer <token>

Loading

Possibly related PRs

• livepeer/naap#406: Both PRs modify the same resolveSignerEndpoint remote-signer auth path, one adding JWT minting the other replacing it with composite API key minting.
• livepeer/naap#412: Both PRs work on the exchangeApiKeyForSignerSession/readApiKeySignerSessionConfig flow in resolveSignerEndpoint.
• livepeer/naap#405: Both PRs modify resolveSignerEndpoint and its tests around getSignerRouting-based DMZ endpoint resolution.

Suggested labels: size/L

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly reflects the main change: emitting composite app.pmth_ bearer tokens for the DMZ signer.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/composite-signer-bearer-pr210

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🧹 Nitpick comments (1)

apps/web-next/src/lib/billing/pymthouse-adapter.ts (1)

368-376: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Update the stale method contract comment above this flow.

The method doc still describes forwarding a minted user JWT, but this branch now forwards a composite API key. That auth contract should match the implementation.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@apps/web-next/src/lib/billing/pymthouse-adapter.ts` around lines 368 - 376,
The method contract comment for this auth flow is stale and still describes
forwarding a minted user JWT, but the `createPymthouseApiKey` branch now returns
a composite API key in the `Authorization` header. Update the doc comment above
this logic in `pymthouse-adapter.ts` so it matches the current behavior in the
`validateSigner`-style flow and clearly states that the bearer token is the
composite `app_XXX.pmth_YYY` key, not a user JWT.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@apps/web-next/src/lib/billing/pymthouse-adapter.ts`:
- Around line 319-340: The `getSignerRouting()` lookup in `PymthouseAdapter` is
being done too early, which makes bare `pmth_` keys fail before they can use the
exchange path. Update the flow in the signer URL selection method so
`apiKey.includes('.pmth_')` is checked first, and only call
`this.client().getSignerRouting()` for the composite-key direct-DMZ branch; keep
bare `pmth_` keys routed through `exchangeApiKeyForSignerSession()` unchanged.
- Around line 368-372: The signer-resolution path in pymthouse-adapter’s
remote-signer flow is minting a new long-lived API key each time
`createPymthouseApiKey()` is called, which can accumulate unreused bearer
credentials. Update the logic around the remote-signer branch and
`createPymthouseApiKey` usage so it reuses an existing key when possible, or
adds a clear TTL/revocation/rotation contract instead of always creating a fresh
active key on every resolution.

---

Nitpick comments:
In `@apps/web-next/src/lib/billing/pymthouse-adapter.ts`:
- Around line 368-376: The method contract comment for this auth flow is stale
and still describes forwarding a minted user JWT, but the
`createPymthouseApiKey` branch now returns a composite API key in the
`Authorization` header. Update the doc comment above this logic in
`pymthouse-adapter.ts` so it matches the current behavior in the
`validateSigner`-style flow and clearly states that the bearer token is the
composite `app_XXX.pmth_YYY` key, not a user JWT.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: c9f05be2-1996-4618-881b-0f01d4410065

📥 Commits

Reviewing files that changed from the base of the PR and between 53e5c56 and 812c576.

📒 Files selected for processing (3)

• apps/web-next/src/lib/billing/pymthouse-adapter.test.ts
• apps/web-next/src/lib/billing/pymthouse-adapter.ts
• apps/web-next/src/lib/pymthouse-signer-exchange-config.ts

[github-actions]

⚠️ This PR is large (240 lines changed). Consider splitting it into smaller PRs for easier review.

[seanhanca]

@coderabbitai review

Both actionable comments addressed in b678d12:

1. Regression fix — getSignerRouting() moved inside the composite .pmth_ fast-path; bare pmth_ keys are no longer gated on routing (resolve via the exchange's own signerUrl). New regression test added.
2. Key hygiene — documented as a tracked follow-up with justification (legacy fallback only; safe reuse needs new persistent secret storage since the Builder API returns the secret only at creation).

Adapter suite: 24/24 pass.

[coderabbitai]

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd /tmp
gh pr view 421 --repo livepeer/naap --json commits,headRefName,baseRefName 2>&1 | head -50
gh pr diff 421 --repo livepeer/naap > /tmp/pr421.diff 2>&1
wc -l /tmp/pr421.diff

Length of output: 2502

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd /tmp
sed -n '1,429p' /tmp/pr421.diff | grep -n "^diff\|^+++\|^---" 
echo "---- adapter diff section ----"
awk '/diff --git a\/apps\/web-next\/src\/lib\/billing\/pymthouse-adapter\.ts/,/diff --git a\/apps\/web-next\/src\/lib\/billing\/pymthouse-adapter\.test\.ts/' /tmp/pr421.diff

Length of output: 7911

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
cd /tmp
sed -n '1,292p' /tmp/pr421.diff | grep -n "getSignerRouting\|regression\|bare"

Length of output: 1876

---

Confirmed both fixes are correctly implemented in b678d12:

1. Regression fix — getSignerRouting() is now called only inside the composite .pmth_ fast-path via the extracted resolveDmzUrl() helper. The bare pmth_ path calls exchangeApiKeyForSignerSession() and resolves its URL from session.signerUrl without touching routing at all. The new test "bare pmth_ key does NOT require signer routing (regression: exchange supplies its own url)" explicitly asserts getSignerRouting is never called in that path, even when routing would return no DMZ URL — good regression coverage.
2. Key hygiene follow-up — the legacy createPymthouseApiKey mint-per-call fallback is now clearly documented in-code with the rationale (Builder Apps API only returns the secret at creation time, so reuse needs new persistent secret storage; this path is unreached in prod since the composite fast-path is used there).

Diff and helper extraction (resolveDmzUrl) look clean, and the composite vs. bare-key branching logic is sound.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.