feat(project-creation): Backend for disableMemberProjectCreation flag #62294
Conversation
github-actions
bot
added
Scope: Frontend
|
🚨 Warning: This pull request contains Frontend and Backend changes! It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently. Have questions? Please ask in the |
leedongwei
force-pushed
the
dlee/pc-flag
branch
from
1ccad42 to
42c647d
Compare
leedongwei
force-pushed
the
dlee/pc-changes
branch
from
1552c41 to
918adf8
Compare
leedongwei
changed the title
Codecov ReportAttention:
Additional details and impacted files@@ Coverage Diff @@
## master #62294 +/- ##
=======================================
Coverage 81.25% 81.26%
=======================================
Files 5198 5197 -1
Lines 230206 230225 +19
Branches 39759 39774 +15
=======================================
+ Hits 187059 187095 +36
+ Misses 37405 37385 -20
- Partials 5742 5745 +3
|
| and not request.access.has_scope("org:write") | ||
| ): | ||
| return Response( | ||
| {"detail": "Your organization has disabled this feature for members."}, status=403 |
There was a problem hiding this comment.
nit: add the const? DISABLED_FEATURE_ERROR_STRING
| return Response( | ||
| {"detail": "Your organization has disabled this feature for members."}, status=403 | ||
| ) |
There was a problem hiding this comment.
| return Response( | |
| {"detail": "Your organization has disabled this feature for members."}, status=403 | |
| ) | |
| raise PermissionDenied(detail=DISABLED_FEATURE_ERROR_STRING) |
tests/sentry/api/endpoints/test_organization_projects_experiment.py
Outdated
Show resolved
Hide resolved
| @@ -164,6 +164,13 @@ def post(self, request: Request, team) -> Response: | |||
|
|
|||
| if not serializer.is_valid(): | |||
| return Response(serializer.errors, status=status.HTTP_400_BAD_REQUEST) | |||
| if ( | |||
| team.organization.flags.disable_member_project_creation | |||
| and not request.access.has_scope("org:write") | |||
There was a problem hiding this comment.
This would disable creating new projects for even team admins that are normal org members, is this intended?
| if organization.flags.disable_member_project_creation and not request.access.has_scope( | ||
| "org:write" | ||
| ): |
There was a problem hiding this comment.
Still learning the models, so sorry for the basic questions:
- Will admins always have the
org:writescope attached to theiraccess? - Is the permission/scope limited to the project, or is it a global user permission?
- What about if this is invoked through an API token?
- Is seems like based on
OrgProjectPermission, theorg:writeis already required, and the endpoint will fail if that scope is not part of the request, so is this line still needed?
There was a problem hiding this comment.
Is seems like based on OrgProjectPermission, the org:write is already required, and the endpoint will fail if that scope is not part of the request, so is this line still needed?
Nevermind, we overwrite the POST permissions, and the source map is not additive, so this line is needed
There was a problem hiding this comment.
org admins have org:write, but regular org members can become team admins, in which case they don't have org:write. Org admins are automatically made into team admins when they join teams.
There was a problem hiding this comment.
Scopes are attached to each user depending on their role in the organization. For example, org owners are the only ones with org:admin.
Api tokens have scopes attached to them, which you can select when making a user token or integration token
There was a problem hiding this comment.
Would a regular member/user have access to tokens that have this elevated permission (scope)? Trying to understand if a user can side step this permission check even if it's not coming directly from them. So even if I'm blocked on the UI, I could get around this if I go through automation
There was a problem hiding this comment.
User tokens can have any scopes b/c it can be applied to multiple orgs the user is part of. We take the intersection between the user token's scopes and the user's role in the org.
Integration tokens are tied to orgs, but we don't allow regular members to create them
|
This issue has gone three weeks without activity. In another week, I will close it. But! If you comment or otherwise update it, I will reset the clock, and if you remove the label "A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀 |
Per Seiji's suggestion in code review. Co-authored-by: Seiji Chew <[email protected]>
Depends on #62277