ref(explore): Ask has_user() for the acting user on saved queries and events

src/sentry/api/bases/organization_events.py

@@ -30,6 +30,7 @@
 from sentry.api.helpers.teams import get_teams
 from sentry.api.serializers.snuba import SnubaTSResultSerializer
 from sentry.api.utils import handle_query_errors
+from sentry.auth.principal import has_user
 from sentry.discover.arithmetic import is_equation, parse_arithmetic, strip_equation
 from sentry.discover.models import (
     DatasetSourcesTypes,
@@ -207,9 +208,7 @@ def get_snuba_params(
                 end=filter_params["end"],
                 environments=filter_params.get("environment_objects", []),
                 projects=filter_params["project_objects"],
-                user=serialize_generic_user(
-                    request.user if request.user.is_authenticated else None
-                ),
+                user=serialize_generic_user(request.user if has_user(request.user) else None),
                 teams=self.get_teams(request, organization),
                 organization=organization,
                 query_string=query,

src/sentry/api/endpoints/organization_explore_formulas.py

@@ -31,6 +31,7 @@
 from sentry.api.serializers import Serializer, serialize
 from sentry.api.utils import SortBy, parse_sort_by, to_valid_int_id
 from sentry.apidocs.response_types import ValidationErrorResponse, as_validation_errors
+from sentry.auth.principal import acting_user_id, has_user
 from sentry.discover.arithmetic import (
     ArithmeticParseError,
     ArithmeticValidationError,
@@ -233,7 +234,7 @@ def get_attrs(
         if user_ids:
             service_serialized = user_service.serialize_many(
                 filter={"user_ids": list(user_ids)},
-                as_user=user if user.id else None,
+                as_user=user if has_user(user) else None,
             )
             serialized_users = {user["id"]: user for user in service_serialized}
         else:
@@ -687,7 +688,7 @@ def post(
         with write_formula_to_db():
             formula = ExploreSavedFormula.objects.create(
                 organization=organization,
-                created_by_id=request.user.id,
+                created_by_id=acting_user_id(request.user),
                 formula=data["formula"],
                 description=data["description"],
                 name=data["name"],
@@ -802,7 +803,7 @@ def put(
                 description=data["description"],
                 unit=data["unit"],
                 dataset=data["dataset"],
-                updated_by_id=request.user.id,
+                updated_by_id=acting_user_id(request.user),
             )
             ExploreSavedVariable.objects.filter(explore_saved_formula=formula).delete()
             for param in data["params"]:

src/sentry/discover/endpoints/discover_saved_queries.py

@@ -38,6 +38,7 @@
 )
 from sentry.apidocs.response_types import ValidationErrorResponse, as_validation_errors
 from sentry.apidocs.utils import inline_sentry_response_serializer
+from sentry.auth.principal import acting_user_id, has_user
 from sentry.discover.endpoints.bases import (
     DiscoverSavedQueryPermission,
     filter_to_accessible_discover_queries,
@@ -125,7 +126,7 @@ def get(
                     queryset = queryset.none()
 
         last_visited_query: Subquery | Value = Value(None, output_field=DateTimeField(null=True))
-        if request.user.is_authenticated:
+        if has_user(request.user):
             last_visited_query = Subquery(
                 DiscoverSavedQueryLastVisited.objects.filter(
                     organization=organization,
@@ -255,7 +256,7 @@ def post(
                 if user_selected_dataset
                 else DatasetSourcesTypes.UNKNOWN.value
             ),
-            created_by_id=request.user.id if request.user.is_authenticated else None,
+            created_by_id=acting_user_id(request.user),
         )
 
         model.set_projects(data["project_ids"])

src/sentry/explore/endpoints/explore_saved_queries.py

@@ -29,6 +29,7 @@
 )
 from sentry.apidocs.response_types import ValidationErrorResponse, as_validation_errors
 from sentry.apidocs.utils import inline_sentry_response_serializer
+from sentry.auth.principal import acting_user_id
 from sentry.explore.endpoints.bases import (
     ExploreSavedQueryPermission,
     filter_to_accessible_explore_queries,
@@ -564,7 +565,7 @@ def post(
             name=data["name"],
             query=data["query"],
             dataset=data["dataset"],
-            created_by_id=request.user.id if request.user.is_authenticated else None,
+            created_by_id=acting_user_id(request.user),
         )
 
         model.set_projects(data["project_ids"])

tests/sentry/api/endpoints/test_organization_explore_formulas.py

@@ -1,5 +1,6 @@
 from typing import Any
 
+from django.test import override_settings
 from django.urls import reverse
 
 from sentry.api.endpoints.organization_explore_formulas import sync_prebuilt_formulas
@@ -11,6 +12,7 @@
 from sentry.models.organization import Organization
 from sentry.testutils.cases import APITestCase
 from sentry.testutils.factories import Factories
+from sentry.viewer_context import Actor, ActorType, ViewerContext, encode_viewer_context
 
 
 class BaseFormulaTest(APITestCase):
@@ -130,6 +132,31 @@ def test_update_explore_formula(self) -> None:
         assert response.data["description"] == "test description"
         assert response.data["dataset"] == "logs"
 
+    @override_settings(SEER_API_SHARED_SECRET="service-account-secret")
+    def test_update_explore_formula_as_service_account(self) -> None:
+        formula = self.create_formula()
+        formula.update(created_by_id=self.user.id, updated_by_id=self.user.id)
+        service_account = self.create_service_account(
+            organization=self.org, scope_list=["org:read", "org:write"]
+        )
+        viewer_context = encode_viewer_context(
+            ViewerContext(
+                actor=Actor(type=ActorType.SERVICE_ACCOUNT, actor_id=service_account.id),
+                organization_id=self.org.id,
+            ),
+            key="service-account-secret",
+        )
+        self.formula_object["name"] = "formula.by_service_account"
+        with self.feature({**self.feature_flags, "organizations:service-accounts": True}):
+            response = self.client.put(
+                reverse("sentry-api-0-explore-formulas-detail", args=[self.org.slug, formula.id]),
+                data=self.formula_object,
+                HTTP_X_VIEWER_CONTEXT=viewer_context,
+            )
+        assert response.status_code == 200, response.content
+        assert response.data["createdBy"]["email"] == self.user.email
+        assert response.data["updatedBy"] is None
+
     def test_too_many_input_parameters(self) -> None:
         formula = self.create_formula()
         self.formula_object["name"] = "formula.hello"

tests/sentry/auth/test_principal.py

@@ -212,7 +212,7 @@ def _is_request_user_type_check(node: ast.AST) -> bool:
 
 
 # Lower these as callers move off. Exact, so the baseline can't drift back up.
-REQUEST_USER_ID_BASELINE = 487
+REQUEST_USER_ID_BASELINE = 483
 REQUEST_USER_TYPE_CHECK_BASELINE = 31
 
 

tests/sentry/seer/endpoints/test_organization_agent_token.py

@@ -607,22 +607,7 @@ class ServiceAccountGap(StrEnum):
 
 # Rows that don't match the oracle yet. Strict, so a fixed row fails until removed here.
 SERVICE_ACCOUNT_KNOWN_GAPS: dict[str, ServiceAccountGap] = {
-    "DiscoverSavedQueries": ServiceAccountGap.USER_ID_FIX,
-    "DiscoverSavedQueries_post": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationAIConversationDetails": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationAIConversations": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationEvents": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationEventsDropped": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationEventsTimeseries": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationProfilingChunks": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationProfilingFlamegraph": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationReplayCount": ServiceAccountGap.USER_ID_FIX,
     "OrganizationReplayDetails": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationTrace": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationTraceItemAttributes": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationTraceItemMetrics": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationTraceItemStats": ServiceAccountGap.USER_ID_FIX,
-    "OrganizationTraceMeta": ServiceAccountGap.USER_ID_FIX,
     "CustomInboundFilterDetails_delete": ServiceAccountGap.AUDIT_ACTOR,
     "CustomInboundFilterDetails_put": ServiceAccountGap.AUDIT_ACTOR,
     "CustomInboundFilters_post": ServiceAccountGap.AUDIT_ACTOR,