[gricha]

Explore and Discover saved queries, the homepage query, stars and dashboards read the caller through sentry.auth.principal, following the issue-views pattern from #129401: shared rows for everyone, personal state (stars, last visited, "created by me") only for a user.

• A service account can list saved queries and Discover's myqueries (shared rows, nothing starred), the homepage GET returns 204, visits count without a last-visited row, and a query created with starred is created unstarred. Stars, favorites and homepage PUT are 403 user-required. Lists and creates skip personal state up front instead of reporting a caught UserRequired to Sentry on every call. New tests cover each; they fail on the old code.
• Token callers: Discover sortBy=myqueries no longer sorts creator-less queries first, and Explore's visit endpoint returns 204 instead of a 500 (NOT NULL write): the visit counts, with no last-visited row, as Discover and dashboard visits already did.
• Users and agents see no change.

Left: organization_dashboards.py calls has_edit_permissions(request.user.id), which needs to take the caller; and DashboardListSerializer still reads user.id, so a service account listing a non-empty set of dashboards still gets 403. Both are in the serializer follow-up.

[github-actions]

decision-model-linter

api

src/sentry/explore/endpoints/explore_saved_queries.py

• warn readsRequestBodyOutsideSerializer = TRUE (0.93): Request body values should be read from a serializer's validated_data. This file reads a value directly from request.data or request.POST.

_{decision-model-linter: 36 calls on 12 files, 79,785 input tokens, $0.0034, model typesafe/jev-1.13-20260917}