[gricha]

Explore and Discover saved queries, the homepage query, stars and dashboards read the caller through sentry.auth.principal, following the issue-views pattern from #129401: shared rows for everyone, personal state (stars, last visited, "created by me") only for a user.

• A service account can list saved queries and Discover's myqueries (shared rows, nothing starred), the homepage GET returns 204, visits count without a last-visited row, and a query created with starred is created unstarred. Stars, favorites and homepage PUT are 403 user-required. Lists and creates skip personal state up front instead of reporting a caught UserRequired to Sentry on every call. New tests cover each; they fail on the old code.
• Token callers: Discover sortBy=myqueries no longer sorts creator-less queries first, and Explore's visit endpoint returns 204 instead of a 500 (NOT NULL write): the visit counts, with no last-visited row, as Discover and dashboard visits already did.
• Users and agents see no change.

Left: organization_dashboards.py calls has_edit_permissions(request.user.id), which needs to take the caller; and DashboardListSerializer still reads user.id, so a service account listing a non-empty set of dashboards still gets 403. Both are in the serializer follow-up.

[github-actions]

decision-model-linter

api

src/sentry/discover/endpoints/discover_saved_queries.py

• warn readsRequestBodyOutsideSerializer = TRUE (0.90): Request body values should be read from a serializer's validated_data. This file reads a value directly from request.data or request.POST.

src/sentry/explore/endpoints/explore_saved_queries.py

• warn readsRequestBodyOutsideSerializer = TRUE (0.94): Request body values should be read from a serializer's validated_data. This file reads a value directly from request.data or request.POST.

_{decision-model-linter: 36 calls on 12 files, 80,211 input tokens, $0.0034, model typesafe/jev-1.13-20260917}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c2ba565. Configure here.}

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	780	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

[cvxluo]

i saw #129422 first and left this comment: #129422 (review)

otherwise everything seems fine to me