Skip to content

ref(sentry_apps): Narrow request.user in Sentry app and integration endpoints - #129417

Draft
gricha wants to merge 1 commit into
ref/sa-narrow-corefrom
ref/sa-narrow-apps
Draft

gricha wants to merge 1 commit into
ref/sa-narrow-corefrom
ref/sa-narrow-apps

Conversation

@gricha

@gricha gricha commented Oct 31, 2026

Copy link
Copy Markdown
Member

Sentry app and integration endpoints read the caller through sentry.auth.principal: service lookups and analytics use acting_user_id() (analytics only record a user id when there is one), proxy-user and requester checks use is_acting_user(), and app create/delete/uninstall use require_user().

  • A service account can use the coding-agents endpoint (no identity lookup with a service-account id); new test fails on the old code. The rest are control-silo, which service accounts don't reach yet.
  • Legacy API keys creating a Sentry app get 401 instead of a 500 from an assert.
  • Users and agents see no change.

Left: organization_config_integrations.py (passes the caller to is_provider_enabled, widened higher in the stack).

mypy allowlist: 126 → 117 files.

…ndpoints

Sentry app and integration endpoints read the caller through `sentry.auth.principal`: service lookups and analytics use `acting_user_id()` (analytics only record a user id when there is one), proxy-user and requester checks use `is_acting_user()`, and app create/delete/uninstall use `require_user()`.

- A service account can use the coding-agents endpoint (no identity lookup with a service-account id); new test fails on the old code. The rest are control-silo, which service accounts don't reach yet.
- Legacy API keys creating a Sentry app get 401 instead of a 500 from an `assert`.
- Users and agents see no change.

Left: `organization_config_integrations.py` (passes the caller to `is_provider_enabled`, widened higher in the stack).
@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 31, 2026
@gricha
gricha added this pull request to stack #129364 October 31, 2026 02:27
@sentry

sentry Bot commented Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Sentry Snapshot Testing

Name Added Removed Changed Renamed Unchanged Skipped Status
sentry-frontend
sentry-frontend
0 0 0 0 780 0 ✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant