Skip to content

ref(sentry_apps): Narrow request.user in Sentry app and integration endpoints - #129417

Draft
gricha wants to merge 1 commit into
ref/sa-narrow-corefrom
ref/sa-narrow-apps
Draft

gricha wants to merge 1 commit into
ref/sa-narrow-corefrom
ref/sa-narrow-apps

Conversation

@gricha

@gricha gricha commented Oct 31, 2026 •

Copy link
Copy Markdown
Member

Sentry app and integration endpoints read the caller through sentry.auth.principal: service lookups and analytics use acting_user_id() (analytics only record a user id when there is one), proxy-user and requester checks use is_acting_user(), and app create/delete/uninstall use require_user().

  • A service account can use the coding-agents endpoint (no identity lookup with a service-account id); new test fails on the old code. The rest are control-silo, which service accounts don't reach yet.
  • Legacy API keys creating a Sentry app get 401 instead of a 500 from an assert.
  • Users and agents see no change.

Left: organization_config_integrations.py (passes the caller to is_provider_enabled, widened higher in the stack).

@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 31, 2026
@gricha
gricha added this pull request to stack #129364 October 31, 2026 02:27
@sentry

sentry Bot commented Oct 31, 2026 •

Copy link
Copy Markdown
Contributor

Sentry Snapshot Testing

Name Added Removed Changed Renamed Unchanged Skipped Status
sentry-frontend
sentry-frontend
0 0 0 0 780 0 ✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

@gricha
gricha removed this pull request from stack #129364 November 1, 2026 04:24
@gricha
gricha force-pushed the ref/sa-narrow-apps branch from f233351 to ad6a03c Compare November 1, 2026 04:24
@gricha
gricha added this pull request to stack #129440 November 1, 2026 04:24
…ndpoints

Sentry app and integration endpoints read the caller through `sentry.auth.principal`: service lookups and analytics use `acting_user_id()` (analytics only record a user id when there is one), proxy-user and requester checks use `is_acting_user()`, and app create/delete/uninstall use `require_user()`.

- A service account can use the coding-agents endpoint (no identity lookup with a service-account id); new test fails on the old code. The rest are control-silo, which service accounts don't reach yet.
- Legacy API keys creating a Sentry app get 401 instead of a 500 from an `assert`.
- Users and agents see no change.

Left: `organization_config_integrations.py` (passes the caller to `is_provider_enabled`, widened higher in the stack).
@gricha
gricha force-pushed the ref/sa-narrow-apps branch from ad6a03c to 1a941e3 Compare November 1, 2026 04:57

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant