feat(private-link): Add private links UI

[0ski]

No description provided.

[changeset-bot]

🦋 Changeset detected

Latest commit: d8d5c89

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 29 packages

Name	Type
@trigger.dev/core	Patch
@trigger.dev/build	Patch
trigger.dev	Patch
@trigger.dev/python	Patch
@trigger.dev/redis-worker	Patch
@trigger.dev/schema-to-json	Patch
@trigger.dev/sdk	Patch
@internal/cache	Patch
@internal/clickhouse	Patch
@internal/llm-model-catalog	Patch
@internal/redis	Patch
@internal/replication	Patch
@internal/run-engine	Patch
@internal/schedule-engine	Patch
@internal/testcontainers	Patch
@internal/tracing	Patch
@internal/tsql	Patch
@internal/zod-worker	Patch
d3-chat	Patch
references-d3-openai-agents	Patch
references-nextjs-realtime	Patch
references-realtime-hooks-test	Patch
references-realtime-streams	Patch
references-telemetry	Patch
@internal/sdk-compat-tests	Patch
@trigger.dev/react-hooks	Patch
@trigger.dev/rsc	Patch
@trigger.dev/database	Patch
@trigger.dev/otlp-importer	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Introduces optional private networking support end-to-end. Billing and run-engine types now include hasPrivateLink, dequeue messages and schemas carry it, supervisor workload creation and Kubernetes labels may include privatelink. Webapp adds feature flag hasPrivateConnections, environment variables, two new Remix routes for listing/creating private connections, platform service functions (CRUD + regions), UI navigation items, path helpers, and a Changeset for @trigger.dev/core.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~60 minutes

🚥 Pre-merge checks | ✅ 1 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Description check	⚠️ Warning	The pull request description is completely empty, providing no information about the change, testing, or changelog as required by the template.	Add a complete description following the template: include issue closure, checklist confirmation, testing details, changelog summary, and any relevant screenshots.
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (1 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title 'feat(private-link): Add private links UI' is concise and directly summarizes the main change—adding a private links user interface to the webapp.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch oskar/feat-private-link

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[0ski]

Code review

Found 1 issue:

1. Direct process.env usage in webapp code (apps/webapp/CLAUDE.md says "Access via env export from app/env.server.ts. Never use process.env directly.")

Both PRIVATE_CONNECTIONS_ENABLED and PRIVATE_CONNECTIONS_AWS_ACCOUNT_IDS are accessed via process.env directly instead of through the env export from app/env.server.ts. These env vars should be declared in env.server.ts and accessed through the typed env singleton.

trigger.dev/apps/webapp/app/features.server.ts

Lines 17 to 21 in a9d6231

	function hasPrivateConnections(host: string): boolean {
	if (process.env.PRIVATE_CONNECTIONS_ENABLED === "1") {
	return isManagedCloud(host);
	}
	return false;

trigger.dev/apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.private-connections.new/route.tsx

Lines 71 to 73 in a9d6231

	const awsAccountIds = process.env.PRIVATE_CONNECTIONS_AWS_ACCOUNT_IDS?.split(",").filter(Boolean) ?? [];

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[devin-ai-integration]

Devin Review found 2 new potential issues.

View 6 additional findings in Devin Review.

[devin-ai-integration]

🟡 Hardcoded hasPrivateNetworking = true makes plan-based UI gating dead code

On line 176, hasPrivateNetworking is hardcoded to true, which means the !hasPrivateNetworking branch on line 204 is unreachable dead code. The "Private Connections require upgrading to Pro or an Enterprise plan" message will never be shown to any user. This variable was clearly intended to be derived from the user's billing plan (similar to how limit on line 177 reads from plan?.v3Subscription?.plan?.limits), but was left as a hardcoded true — likely a placeholder that was never replaced with the actual plan check.

Prompt for agents

In apps/webapp/app/routes/_app.orgs.$organizationSlug.settings.private-connections._index/route.tsx at line 176, replace the hardcoded `const hasPrivateNetworking = true;` with an actual check against the billing plan. The plan object is already available via `useCurrentPlan()` on line 157. The check should look something like:

const hasPrivateNetworking = plan?.v3Subscription?.plan?.limits?.hasPrivateNetworking ?? false;

This will make the UI correctly show the upgrade message for users whose plan does not include private networking, and hide the Add Connection button.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[devin-ai-integration]

🚩 Billing cache fallback omits hasPrivateLink — pods lose private networking label during billing outage

When the billing cache fails or returns no value (dequeueSystem.ts:499), the hasPrivateLink variable remains undefined (declared on line 498). This means during a billing cache outage, pods for orgs with private networking won't get the privatelink Kubernetes label, potentially breaking their CiliumNetworkPolicy-based network access. This is a deliberate conservative degradation (don't grant network access you can't verify), but it could cause unexpected connectivity failures for paying customers during transient billing issues. The billing cache has 5-minute fresh / 10-minute stale TTLs (billingCache.ts:17-18) so the window is typically small.

(Refers to lines 498-518)

---

Was this helpful? React with 👍 or 👎 to provide feedback.