feat(auth): Put service accounts on request.user as a principal by gricha · Pull Request #128983 · getsentry/sentry

gricha · 2026-10-28T07:04:47Z

Behind auth.service-account-principal (default off), a service account's request.user is a ServiceAccountPrincipal instead of AnonymousUser. With the option off it stays anonymous, as #128779 has it. set_request_principal applies the option, so there is one place to turn it off.

The principal's user_id is None and its actor is SERVICE_ACCOUNT. Its id is a ServiceAccountId that never equals an int and raises UserRequired (403 user-required) when converted to one, so no existing request.user.id call site can reach the user with the same number. Those 403s show up in api.user_required, tagged by endpoint.

The Django-level request.user stays anonymous, so session auth and web views never see the account. SentryIsAuthenticated rejects callers with no user_id. Service accounts count as sudo, like org auth tokens, and get their own rate-limit bucket.

What's covered where

Shared defaults (ref(auth): Give callers with no human the org auth token defaults #129101) cover serializers.
Fixed here, per site: team and org lookups, update_groups, ScheduledDeletion, Activity and creator attribution, saved queries, dashboards, replay has_viewed and onboarding. Creating a project calls require_user.
Auth matrix results: 14 of the 36 known service-account gaps now match the oracle, and 5 human-only routes assert user-required. The other 17 remain as strict xfails: 12 because service-account auth is cell-only, and 5 because they check the caller's own membership.
Matrix setting: it runs with the option on.

Merges #128779 (still open) to build on its ViewerContextAuthentication and ServiceAccountAccess.

Stack (each PR is based on the one above it):

ref(auth): Add a shared request.user interface #128982 Shared request.user interface and get_current_actor
ref(auth): Set request.user and request.auth through one helper #129133 Set request.user / request.auth through one helper
ref(auth): Give callers with no human the org auth token defaults #129101 Callers with no human view as anonymous by default
ref(auth): Ask has_user() in access, org lookups and users/me #129136 Read request.user.user_id in access, permissions and org lookups
feat(api): Let endpoints and code require a user #129143 requires_user / require_user()
ref(auth): Lint request.user patterns that break for callers with no user #129144 Lints for patterns that break for callers with no human
feat(auth): Put service accounts on request.user as a principal #128983 Service accounts on request.user, behind auth.service-account-principal

…oint The viewer-context endpoint now signs a SERVICE_ACCOUNT actor for the account instead of Seer's org-only context. Requests carrying that context authenticate as a userless credential bound to the account's org, with scopes read from the cell replica on every request, and get a new ServiceAccountAccess: every active project with open membership, otherwise only the account's linked active projects. A service-account context can't mint another account's context, and service accounts skip the release permission cache so their IDs don't share keys with API keys. Refs ENG-8829 Co-Authored-By: Shaun Kaasten <shaun.kaasten@sentry.io>

…t-actor Co-Authored-By: Shaun Kaasten <shaun.kaasten@sentry.io>

OrganizationReleasesBaseEndpoint.get_projects only admitted API keys, org tokens, agents and users, so a service account got no projects and has_release_permission never passed. Admit service accounts bound to the organization. Endpoints that default to "my projects" filter by membership, which a service account never has. Treat its linked projects as its membership. Refs ENG-8829

SeerRpcViewerContextAuthentication accepted a service-account ViewerContext like Seer's own org-only one. seer-rpc methods trust their org_id argument and skip access checks, so the account's scopes, project links and active status were not enforced there. Reject service-account actors; HMAC callers are unaffected. This also covers the viewer-context endpoint, so its separate service-account check is no longer needed. Refs ENG-8829 Co-Authored-By: Shaun Kaasten <shaun.kaasten@sentry.io>

Show that the release endpoints' project lookup stays limited to a service account's linked projects, including for $all, and clarify why service accounts skip the release permission cache. Refs ENG-8829

Refs ENG-8829

…st-principal

Behind auth.service-account-principal (default off), a service account's request.user is a ServiceAccountPrincipal instead of AnonymousUser. Off, it is anonymous, as #128779 has it. set_request_principal applies the option, so there is one place to turn it off. The principal's user_id is None and its actor is SERVICE_ACCOUNT. Its id is a ServiceAccountId that never equals an int and raises UserRequired (403, user-required) when converted to one, so no existing request.user.id call site can reach the user with the same number. The Django-level request.user stays anonymous, so session auth and web views never see the account. SentryIsAuthenticated rejects callers with no user_id; service accounts count as sudo, like org auth tokens, and get their own rate-limit bucket. The stack's shared defaults cover serializers. What's left here is per-site: team and org lookups, update_groups, ScheduledDeletion, Activity and creator attribution, saved queries, dashboards, replay has_viewed and onboarding. Creating a project calls require_user. 14 of the 36 known service-account gaps in the auth matrix now match the oracle, and 5 human-only routes assert user-required instead.

github-actions · 2026-10-29T06:47:14Z

Backend Test Failures

Failures on 861407c in this run:

tests/sentry/web/frontend/test_js_sdk_loader.py::JavaScriptSdkLoaderTest::test_headers — log

[gw0] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/web/frontend/test_js_sdk_loader.py:501: in test_headers
    assert "Vary" not in resp, f"Found Vary header: {resp['Vary']}"
E   AssertionError: Found Vary header: Cookie
E   assert 'Vary' not in <HttpResponse status_code=200, "text/javascript">

tests/sentry/web/frontend/test_team_avatar.py::TeamAvatarPhotoTest::test_headers — log

[gw1] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/web/frontend/test_team_avatar.py:26: in test_headers
    assert response.get("Vary") is None
E   assert 'Cookie' is None
E    +  where 'Cookie' = get('Vary')
E    +    where get = <HttpResponse status_code=200, "image/png">.get

tests/sentry/web/frontend/test_team_avatar.py::TeamAvatarPhotoTest::test_origin_header — log

[gw1] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/web/frontend/test_team_avatar.py:43: in test_origin_header
    assert response.get("Vary") == "Origin"
E   AssertionError: assert 'Origin, Cookie' == 'Origin'
E     
E     �[0m�[91m- Origin�[39;49;00m�[90m�[39;49;00m
E     �[92m+ Origin, Cookie�[39;49;00m�[90m�[39;49;00m

tests/sentry/users/web/test_user_avatar.py::UserAvatarTest::test_headers_control_file — log

[gw0] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/users/web/test_user_avatar.py:24: in test_headers_control_file
    assert response.get("Vary") is None
E   assert 'Cookie' is None
E    +  where 'Cookie' = get('Vary')
E    +    where get = <HttpResponse status_code=200, "image/png">.get

tests/sentry/web/frontend/test_organization_avatar.py::OrganizationAvatarTest::test_headers — log

[gw0] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/web/frontend/test_organization_avatar.py:34: in test_headers
    assert response.get("Vary") is None
E   assert 'Cookie' is None
E    +  where 'Cookie' = get('Vary')
E    +    where get = <HttpResponse status_code=200, "image/png">.get

tests/sentry/web/frontend/test_organization_avatar.py::OrganizationAvatarTest::test_origin_header — log

[gw0] linux -- Python 3.13.17 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/web/frontend/test_organization_avatar.py:50: in test_origin_header
    assert response.get("Vary") == "Origin"
E   AssertionError: assert 'Origin, Cookie' == 'Origin'
E     
E     �[0m�[91m- Origin�[39;49;00m�[90m�[39;49;00m
E     �[92m+ Origin, Cookie�[39;49;00m�[90m�[39;49;00m

The dashboard creator on the model and the serializer read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

Scheduled deletion actor, onboarding, Tempest credentials, Seer agentic triage and integration direct-enable read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

update_groups' acting user, group integration and external-issue activity, and per-user issue defaults read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

Discover and Explore saved queries, saved formulas, and the events base read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

Org details, org index, teams, project index, Team lookups, org deletion actor and auth_organization_config read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

The detector and workflow creator in the validators read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

The snapshot uploader on preprod snapshot endpoints read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).

has_viewed and viewed-by on replay details read the caller's human from request.user.user_id instead of request.user.id if request.user.is_authenticated else None, or is_authenticated used to mean "is a person". No behavior change: today only AnonymousUser has no user_id, and every authenticated caller's user_id is its id. Once service accounts can sit on request.user (behind auth.service-account-principal), their user_id is None, so these places record no user instead of reading an id that raises UserRequired. Split out of #128983 so owning teams can review their slice; the core change is #129146. Needs #128982 (user_id on request.user).