feat(dashboard api): user/team provisioning handlers

.env.gcp.template

@@ -81,6 +81,9 @@ DASHBOARD_API_COUNT=
 SUPABASE_DB_CONNECTION_STRING=
 # Enable dashboard-api auth user sync background worker (default: false)
 ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER=
+# Enable dashboard-api billing/team provisioning sink (default: false)
+# Set via Terraform env var so it doesn't need Makefile wiring.
+TF_VAR_enable_billing_http_team_provision_sink=
 
 # Filestore cache for builds shared across cluster (default:false)
 FILESTORE_CACHE_ENABLED=

iac/modules/job-dashboard-api/main.tf

@@ -2,6 +2,7 @@ locals {
   base_env = {
     GIN_MODE                                = "release"
     ENVIRONMENT                             = var.environment
+    ADMIN_TOKEN                             = var.admin_token
     POSTGRES_CONNECTION_STRING              = var.postgres_connection_string
     AUTH_DB_CONNECTION_STRING               = var.auth_db_connection_string
     AUTH_DB_READ_REPLICA_CONNECTION_STRING  = var.auth_db_read_replica_connection_string
@@ -12,6 +13,9 @@ locals {
     REDIS_CLUSTER_URL                       = var.redis_cluster_url
     REDIS_TLS_CA_BASE64                     = var.redis_tls_ca_base64
     ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER = tostring(var.enable_auth_user_sync_background_worker)
+    ENABLE_BILLING_HTTP_TEAM_PROVISION_SINK = tostring(var.enable_billing_http_team_provision_sink)
+    BILLING_SERVER_URL                      = var.billing_server_url
+    BILLING_SERVER_API_TOKEN                = var.billing_server_api_token
     OTEL_COLLECTOR_GRPC_ENDPOINT            = "localhost:${var.otel_collector_grpc_port}"
     LOGS_COLLECTOR_ADDRESS                  = "http://localhost:${var.logs_proxy_port.port}"
   }

iac/modules/job-dashboard-api/variables.tf

@@ -23,6 +23,11 @@ variable "postgres_connection_string" {
   sensitive = true
 }
 
+variable "admin_token" {
+  type      = string
+  sensitive = true
+}
+
 variable "auth_db_connection_string" {
   type      = string
   sensitive = true
@@ -55,6 +60,10 @@ variable "enable_auth_user_sync_background_worker" {
   default = false
 }
 
+variable "enable_billing_http_team_provision_sink" {
+  type    = bool
+  default = false
+}
 variable "otel_collector_grpc_port" {
   type    = number
   default = 4317
@@ -76,6 +85,17 @@ variable "redis_tls_ca_base64" {
   default   = ""
 }
 
+variable "billing_server_url" {
+  type    = string
+  default = ""
+}
+
+variable "billing_server_api_token" {
+  type      = string
+  sensitive = true
+  default   = ""
+}
+
 variable "logs_proxy_port" {
   type = object({
     name = string

iac/provider-gcp/Makefile

@@ -78,6 +78,7 @@ tf_vars := \
 	$(call tfvar, DASHBOARD_API_COUNT) \
 	$(call tfvar, SUPABASE_DB_CONNECTION_STRING) \
 	$(call tfvar, ENABLE_AUTH_USER_SYNC_BACKGROUND_WORKER) \
+	$(call tfvar, ENABLE_BILLING_HTTP_TEAM_PROVISION_SINK) \
 	$(call tfvar, DEFAULT_PERSISTENT_VOLUME_TYPE) \
 	$(call tfvar, PERSISTENT_VOLUME_TYPES) \
 	$(call tfvar, DB_MAX_OPEN_CONNECTIONS) \

iac/provider-gcp/api.tf

@@ -64,6 +64,24 @@ resource "google_secret_manager_secret_version" "api_admin_token_value" {
   secret_data = random_password.api_admin_secret.result
 }
 
+resource "random_password" "dashboard_api_admin_secret" {
+  length  = 32
+  special = false
+}
+
+resource "google_secret_manager_secret" "dashboard_api_admin_token" {
+  secret_id = "${var.prefix}dashboard-api-admin-token"
+
+  replication {
+    auto {}
+  }
+}
+
+resource "google_secret_manager_secret_version" "dashboard_api_admin_token_value" {
+  secret      = google_secret_manager_secret.dashboard_api_admin_token.id
+  secret_data = random_password.dashboard_api_admin_secret.result
+}
+
 resource "random_password" "sandbox_access_token_hash_seed" {
   length  = 32
   special = false
@@ -80,4 +98,4 @@ resource "google_secret_manager_secret" "sandbox_access_token_hash_seed" {
 resource "google_secret_manager_secret_version" "sandbox_access_token_hash_seed" {
   secret      = google_secret_manager_secret.sandbox_access_token_hash_seed.id
   secret_data = random_password.sandbox_access_token_hash_seed.result
-}
+}

iac/provider-gcp/main.tf

@@ -276,8 +276,10 @@ module "nomad" {
 
   # Dashboard API
   dashboard_api_count                     = var.dashboard_api_count
+  dashboard_api_admin_token               = random_password.dashboard_api_admin_secret.result
   supabase_db_connection_string           = var.supabase_db_connection_string
   enable_auth_user_sync_background_worker = var.enable_auth_user_sync_background_worker
+  enable_billing_http_team_provision_sink = var.enable_billing_http_team_provision_sink
 
   # Docker reverse proxy
   docker_reverse_proxy_port                = var.docker_reverse_proxy_port

iac/provider-gcp/nomad/main.tf

@@ -1,8 +1,11 @@
 locals {
-  clickhouse_connection_string = var.clickhouse_server_count > 0 ? "clickhouse://${var.clickhouse_username}:${random_password.clickhouse_password.result}@clickhouse.service.consul:${var.clickhouse_server_port.port}/${var.clickhouse_database}" : ""
-  redis_url                    = trimspace(data.google_secret_manager_secret_version.redis_cluster_url.secret_data) == "" ? "redis.service.consul:${var.redis_port.port}" : ""
-  redis_cluster_url            = trimspace(data.google_secret_manager_secret_version.redis_cluster_url.secret_data)
-  loki_url                     = "http://loki.service.consul:${var.loki_service_port.port}"
+  clickhouse_connection_string            = var.clickhouse_server_count > 0 ? "clickhouse://${var.clickhouse_username}:${random_password.clickhouse_password.result}@clickhouse.service.consul:${var.clickhouse_server_port.port}/${var.clickhouse_database}" : ""
+  redis_url                               = trimspace(data.google_secret_manager_secret_version.redis_cluster_url.secret_data) == "" ? "redis.service.consul:${var.redis_port.port}" : ""
+  redis_cluster_url                       = trimspace(data.google_secret_manager_secret_version.redis_cluster_url.secret_data)
+  loki_url                                = "http://loki.service.consul:${var.loki_service_port.port}"
+  enable_billing_http_team_provision_sink = var.enable_billing_http_team_provision_sink
+  dashboard_api_billing_server_url        = local.enable_billing_http_team_provision_sink ? data.google_cloud_run_v2_service.billing_server[0].uri : ""
+  dashboard_api_billing_server_api_token  = local.enable_billing_http_team_provision_sink ? data.google_secret_manager_secret_version.billing_server_api_token[0].secret_data : ""
 }
 
 # API
@@ -35,6 +38,21 @@ data "google_secret_manager_secret_version" "launch_darkly_api_key" {
   secret = var.launch_darkly_api_key_secret_name
 }
 
+data "google_secret_manager_secret_version" "billing_server_api_token" {
+  count = local.enable_billing_http_team_provision_sink ? 1 : 0
+
+  project = var.gcp_project_id
+  secret  = "${var.prefix}billing-server-api-token"
+}
+
+data "google_cloud_run_v2_service" "billing_server" {
+  count = local.enable_billing_http_team_provision_sink ? 1 : 0
+
+  project  = var.gcp_project_id
+  location = var.gcp_region
+  name     = "${var.prefix}billing-server"
+}
+
 provider "nomad" {
   address      = "https://nomad.${var.domain_name}"
   secret_id    = var.nomad_acl_token_secret
@@ -130,6 +148,7 @@ module "dashboard_api" {
 
   image = data.google_artifact_registry_docker_image.dashboard_api_image[0].self_link
 
+  admin_token                             = var.dashboard_api_admin_token
   postgres_connection_string              = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
   auth_db_connection_string               = data.google_secret_manager_secret_version.postgres_connection_string.secret_data
   auth_db_read_replica_connection_string  = trimspace(data.google_secret_manager_secret_version.postgres_read_replica_connection_string.secret_data)
@@ -140,6 +159,9 @@ module "dashboard_api" {
   redis_cluster_url                       = local.redis_cluster_url
   redis_tls_ca_base64                     = trimspace(data.google_secret_manager_secret_version.redis_tls_ca_base64.secret_data)
   enable_auth_user_sync_background_worker = var.enable_auth_user_sync_background_worker
+  enable_billing_http_team_provision_sink = var.enable_billing_http_team_provision_sink
+  billing_server_url                      = local.dashboard_api_billing_server_url
+  billing_server_api_token                = local.dashboard_api_billing_server_api_token
 
   otel_collector_grpc_port = var.otel_collector_grpc_port
   logs_proxy_port          = var.logs_proxy_port

iac/provider-gcp/nomad/variables.tf

@@ -98,6 +98,10 @@ variable "api_admin_token" {
   type = string
 }
 
+variable "dashboard_api_admin_token" {
+  type = string
+}
+
 variable "sandbox_access_token_hash_seed" {
   type = string
 }
@@ -465,6 +469,10 @@ variable "enable_auth_user_sync_background_worker" {
   default = false
 }
 
+variable "enable_billing_http_team_provision_sink" {
+  type    = bool
+  default = false
+}
 variable "volume_token_issuer" {
   type = string
 }

iac/provider-gcp/variables.tf

@@ -241,6 +241,10 @@ variable "enable_auth_user_sync_background_worker" {
   default = false
 }
 
+variable "enable_billing_http_team_provision_sink" {
+  type    = bool
+  default = false
+}
 variable "docker_reverse_proxy_port" {
   type = object({
     name        = string

packages/auth/pkg/auth/middleware.go

@@ -2,6 +2,7 @@ package auth
 
 import (
 	"context"
+	"crypto/subtle"
 	"errors"
 	"fmt"
 	"net/http"
@@ -127,7 +128,7 @@ func (a *CommonAuthenticator[T]) SecuritySchemeName() string {
 
 func adminValidationFunction(adminToken string) func(ctx context.Context, ginCtx *gin.Context, token string) (struct{}, *APIError) {
 	return func(_ context.Context, _ *gin.Context, token string) (struct{}, *APIError) {
-		if token != adminToken {
+		if subtle.ConstantTimeCompare([]byte(token), []byte(adminToken)) != 1 {
 			return struct{}{}, &APIError{
 				Code:      http.StatusUnauthorized,
 				Err:       errors.New("invalid access token"),

packages/auth/pkg/auth/middleware_test.go

@@ -0,0 +1,28 @@
+package auth
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestAdminValidationFunction(t *testing.T) {
+	t.Parallel()
+
+	validate := adminValidationFunction("super-secret-token")
+
+	t.Run("accepts matching token", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := validate(t.Context(), nil, "super-secret-token")
+		require.Nil(t, err)
+	})
+
+	t.Run("rejects non-matching token", func(t *testing.T) {
+		t.Parallel()
+
+		_, err := validate(t.Context(), nil, "super-secret-tokem")
+		require.NotNil(t, err)
+		require.Equal(t, 401, err.Code)
+	})
+}

packages/dashboard-api/Makefile

@@ -13,6 +13,10 @@ endif
 HOSTNAME := $(shell hostname 2> /dev/null || hostnamectl hostname 2> /dev/null)
 $(if $(HOSTNAME),,$(error Failed to determine hostname: both 'hostname' and 'hostnamectl' failed))
 
+define export_extra_env
+export $$(printf '%s' "$$DASHBOARD_API_ENV_VARS" | jq -r '(if .=="" then empty elif type=="string" then (fromjson? // empty) else . end) | to_entries? // [] | map("\(.key)=\(.value|tostring)") | .[]' 2>/dev/null) 2>/dev/null;
+endef
+
 .PHONY: generate
 generate:
 	go generate ./...
@@ -32,12 +36,12 @@ build-and-upload:
 .PHONY: run
 run:
 	make build
-	./bin/dashboard-api
+	@$(export_extra_env) ./bin/dashboard-api
 
 .PHONY: run-local
 run-local:
 	make build
-	NODE_ID=$(HOSTNAME) ./bin/dashboard-api
+	@$(export_extra_env) NODE_ID=$(HOSTNAME) ./bin/dashboard-api
 
 .PHONY: test
 test:

packages/dashboard-api/go.mod

@@ -20,13 +20,15 @@ require (
 	github.com/gin-contrib/cors v1.7.6
 	github.com/gin-gonic/gin v1.12.0
 	github.com/google/uuid v1.6.0
+	github.com/hashicorp/go-retryablehttp v0.7.7
 	github.com/jackc/pgx/v5 v5.9.1
 	github.com/oapi-codegen/gin-middleware v1.0.2
 	github.com/oapi-codegen/runtime v1.1.1
 	github.com/riverqueue/river v0.33.0
 	github.com/riverqueue/river/riverdriver/riverpgxv5 v0.33.0
 	github.com/riverqueue/river/rivertype v0.33.0
 	github.com/stretchr/testify v1.11.1
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0
 	go.opentelemetry.io/otel v1.43.0
 	go.opentelemetry.io/otel/metric v1.43.0
 	go.opentelemetry.io/otel/trace v1.43.0
@@ -82,6 +84,7 @@ require (
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.3.2 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.3 // indirect
+	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/jackc/pgerrcode v0.0.0-20250907135507-afb5586c32a6 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
@@ -149,7 +152,6 @@ require (
 	go.opentelemetry.io/auto/sdk v1.2.1 // indirect
 	go.opentelemetry.io/contrib/bridges/otelzap v0.14.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/github.com/gin-gonic/gin/otelgin v0.68.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.64.0 // indirect
 	go.opentelemetry.io/contrib/instrumentation/runtime v0.66.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc v0.15.0 // indirect
 	go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.39.0 // indirect