[gricha]

A ServiceAccountPrincipal is authenticated but has no user, and its id is a ServiceAccountId that raises UserRequired when used as a user id. has_viewed and viewed-by on replay details read request.user.id. They now call acting_user_id(request.user), so a service account isn't recorded as a viewer instead of getting a 403 user-required.

Nothing changes for users and agents.

Split out so the owning team can review its slice.

Matrix: fixes 1 service-account row (known gaps 69 → 68). The row is OrganizationReplayDetails; locally it also fails for every credential on an objectstore error, so CI is the check.

Stack (each PR is based on the one above it):

1. ref(auth): Add a shared request.user interface #128982 Shared request.user interface
2. ref(auth): Set request.user and request.auth through one helper #129133 Set request.user / request.auth through one helper
3. feat(auth): Put service accounts on request.user as a principal #129146 Service accounts on request.user
4. ref(auth): Ask has_user() in access, org lookups and users/me #129136 has_user() in access, org lookups and users/me
5. feat(api): Let endpoints and code require a user #129143 requires_user / require_user()
6. ref(auth): Lint request.user patterns that break for callers with no user #129144 Lints for patterns that break for a service account
7. feat(auth): Treat service accounts as sudo, like org auth tokens #129147 Service accounts pass sudo checks
8. ref(orgs): Ask has_user() for the acting user in org and team endpoints #129154 Orgs, teams, projects
9. ref(issues): Ask has_user() for the acting user on issue actions #129155 Issues
10. ref(explore): Ask has_user() for the acting user on saved queries and events #129149 Discover, Explore
11. ref(dashboards): Use acting_user_id() for the dashboard creator #129156 Dashboards
12. ref(workflow_engine): Ask has_user() for the detector and workflow creator #129150 Workflow engine
13. ref(replays): Use acting_user_id() for the viewer #129151 Replays
14. ref(preprod): Use acting_user_id() for the uploader #129152 Preprod
15. ref(auth): Ask has_user() for the acting user in the remaining endpoints #129153 Remaining endpoints
16. ref(audit): Attribute audit entries only to a user #129253 Audit entries
17. ref(api): Skip per-user serializer lookups when no user is calling #129254 Per-user serializer lookups
18. ref(users): Serialize no user when no user is behind the caller #129255 serialize_generic_user
19. ref(features): Give flagpole no user context without a user #129256 Flagpole user context

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	780	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings