[gricha]

Data export POSTs from a caller with no user (a legacy API key or an org auth token) created an export nobody could get, then returned 500.

An export is emailed to and downloaded by its user. For a caller with no user the endpoint still ran get_or_create(user_id=None, ...), scheduled the export task, and then crashed serializing the response, because the serializer looks the user up. Each attempt left an export that no one could download (the details endpoint needs a user since #129442). The user_id=None lookup also matched other no-user callers' unfinished exports with the same query.

require_user() now refuses these callers before anything is created: 401 for API keys, 403 user-required for a service account. (Org auth tokens only carry org:ci, so the permission check already returned 403.) Users are unaffected. Production had no export POST without a user in the last 30 days (0 of 3,968 sampled transactions), so no working integration relies on this.

test_api_key_cannot_export fails without the fix:

E   AssertionError: b'{"detail":"Internal Error","errorId":null}'
E   assert 500 == 401
FAILED tests/sentry/data_export/endpoints/test_data_export.py::DataExportTest::test_api_key_cannot_export

With it, test_data_export.py passes: 49 passed. Also drops data_export.py from the request.user allowlist (6 → 5).