feat(ecosystem): Open permissions for code mappings to members by scttcper · Pull Request #39176 · getsentry/sentry

scttcper · 2022-09-22T23:56:11Z

Loosens permissions to anyone with org:read for code owners, code mappings.

fixes https://getsentry.atlassian.net/browse/WOR-2186

armenzg · 2022-09-23T17:22:59Z

src/sentry/api/bases/organization.py

+        "POST": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "PUT": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "DELETE": ["org:read", "org:write", "org:admin", "org:integrations"],
+    }


For posterity, the current change of permissions would look like this:

"GET": ["org:read", "org:write", "org:admin", "org:integrations"], - "POST": [ "org:write", "org:admin", "org:integrations"], + "POST": ["org:read", "org:write", "org:admin", "org:integrations"], - "PUT": [ "org:write", "org:admin", "org:integrations"], + "PUT": ["org:read", "org:write", "org:admin", "org:integrations"], - "DELETE": [ "org:admin", "org:integrations"], + "DELETE": ["org:read", "org:write", "org:admin", "org:integrations"],

sentry/src/sentry/api/bases/organization.py

Lines 97 to 103 in c605f45

class OrganizationIntegrationsPermission(OrganizationPermission):

scope_map = {

"GET": ["org:read", "org:write", "org:admin", "org:integrations"],

"POST": ["org:write", "org:admin", "org:integrations"],

"PUT": ["org:write", "org:admin", "org:integrations"],

"DELETE": ["org:admin", "org:integrations"],

}

As per @NisanthanNanthakumar the member role doesn't have org:write here

sentry/src/sentry/conf/server.py

Lines 1652 to 1666 in f617782

"id": "member",

"name": "Member",

"desc": "Members can view and act on events, as well as view most other data within the organization.",

"scopes": {

"event:read",

"event:write",

"event:admin",

"project:releases",

"project:read",

"org:read",

"member:read",

"team:read",

"alerts:read",

"alerts:write",

},

armenzg · 2022-09-23T17:26:50Z

src/sentry/api/endpoints/organization_code_mapping_details.py

 from rest_framework.response import Response

 from sentry.api.base import region_silo_endpoint
-from sentry.api.bases.organization import OrganizationEndpoint, OrganizationIntegrationsPermission


This grants any organization member to read, write, update and delete the details of code mappings. Is this correct?

that's the goal i believe

src/sentry/api/endpoints/organization_codeowners_associations.py

armenzg · 2022-09-23T18:27:24Z

tests/sentry/api/endpoints/test_organization_code_mapping_details.py

+    def test_basic_edit_from_member_permissions(self):
+        self.login_as(user=self.user2)
+        resp = self.make_put({"sourceRoot": "newRoot"})
+        assert resp.status_code == 200


This is updating an existing code mapping:
source_root: "/source/root" -> "newRoot"

This is the code mapping:

sentry/tests/sentry/api/endpoints/test_organization_code_mapping_details.py

Lines 38 to 45 in c605f45

self.config = RepositoryProjectPathConfig.objects.create(

repository_id=str(self.repo.id),

project_id=str(self.project.id),

organization_integration_id=str(self.org_integration.id),

stack_root="/stack/root",

source_root="/source/root",

default_branch="master",

)

armenzg · 2022-09-23T18:36:38Z

tests/sentry/api/endpoints/test_organization_code_mappings.py

+    def test_basic_post_from_member_permissions(self):
+        self.login_as(user=self.user2)
+        response = self.make_post()
+        assert response.status_code == 201, response.content


This creates a new code mapping by a non-superuser user:

sentry/tests/sentry/api/endpoints/test_organization_code_mappings.py

Line 15 in c605f45

self.user2 = self.create_user("nisanthan@sentry.io", is_superuser=False)

armenzg · 2022-09-23T18:38:11Z

tests/sentry/api/endpoints/test_organization_codeowners_associations.py

+    def test_member_can_access(self):
        """
-        Tests that users without the 'org:integrations' scope (i.e. Members) cannot access this endpoint.
+        Tests that users without the 'org:read' scope (i.e. Members) can access this endpoint.


I would like to know the difference between org:read vs org:write to feel comfortable about giving org:read access to the endpoints.

armenzg · 2022-09-23T18:41:21Z

tests/sentry/api/endpoints/test_organization_codeowners_associations.py

+        Tests that users without the 'org:read' scope (i.e. Members) can access this endpoint.
        """
        member = self.create_user("hernando@life.com")
        self.create_member(user=member, organization=self.organization, role="member")


The creation of users and members in here are slightly different than the other setUp methods I have looked at:

sentry/tests/sentry/api/endpoints/test_organization_code_mappings.py

Line 15 in c605f45

self.user2 = self.create_user("nisanthan@sentry.io", is_superuser=False)

sentry/tests/sentry/api/endpoints/test_organization_code_mappings.py

Lines 23 to 28 in c605f45

self.create_member(

organization=self.organization,

user=self.user2,

has_global_access=False,

teams=[self.team2],

)

This is just an observation. It probably does not matter.

NisanthanNanthakumar

needs a small change

NisanthanNanthakumar · 2022-09-23T18:55:28Z

src/sentry/api/bases/organization.py

+        "GET": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "POST": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "PUT": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "DELETE": ["org:read", "org:write", "org:admin", "org:integrations"],


@scttcper DELETE should not have org:read or org:write. The permissions to delete does not need to be loosened

armenzg · 2022-09-23T18:58:53Z

src/sentry/api/bases/organization.py

+        "POST": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "PUT": ["org:read", "org:write", "org:admin", "org:integrations"],
+        "DELETE": ["org:read", "org:write", "org:admin", "org:integrations"],
+    }


As per @NisanthanNanthakumar the member role doesn't have org:write here

sentry/src/sentry/conf/server.py

Lines 1652 to 1666 in f617782

"id": "member",

"name": "Member",

"desc": "Members can view and act on events, as well as view most other data within the organization.",

"scopes": {

"event:read",

"event:write",

"event:admin",

"project:releases",

"project:read",

"org:read",

"member:read",

"team:read",

"alerts:read",

"alerts:write",

},

Allow members to add repos. See related PR #39176

feat(ecosystem): Open permissions for code mappings and repos to members

565fad0

scttcper requested a review from a team as a code owner September 22, 2022 23:56

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Sep 22, 2022

vercel bot deployed to Preview – sentry September 22, 2022 23:57 View deployment

vercel bot deployed to Preview – storybook September 22, 2022 23:58 View deployment

remove status

338194d

scttcper requested a review from a team September 23, 2022 00:09

vercel bot deployed to Preview – storybook September 23, 2022 00:12 View deployment

vercel bot deployed to Preview – sentry September 23, 2022 00:12 View deployment

revert change to repositories

38a5b7e

vercel bot deployed to Preview – sentry September 23, 2022 00:30 View deployment

vercel bot deployed to Preview – storybook September 23, 2022 00:31 View deployment

add org:write to delete

c605f45

vercel bot deployed to Preview – storybook September 23, 2022 16:58 View deployment

vercel bot deployed to Preview – sentry September 23, 2022 16:58 View deployment

armenzg reviewed Sep 23, 2022

View reviewed changes

reuse permissions object from other loose endpoints

f6fd870

scttcper mentioned this pull request Sep 23, 2022

feat(ecosystem): Allow org members to add code mappings #39172

Merged

vercel bot deployed to Preview – storybook September 23, 2022 18:41 View deployment

vercel bot deployed to Preview – sentry September 23, 2022 18:41 View deployment

armenzg reviewed Sep 23, 2022

View reviewed changes

NisanthanNanthakumar suggested changes Sep 23, 2022

View reviewed changes

armenzg approved these changes Sep 23, 2022

View reviewed changes

do not allow delete

f434be9

vercel bot deployed to Preview – storybook September 23, 2022 20:43 View deployment

vercel bot deployed to Preview – sentry September 23, 2022 20:44 View deployment

Merge branch 'master' into scttcper/be-open-permissions

cd004e2

vercel bot deployed to Preview – storybook September 23, 2022 21:02 View deployment

vercel bot deployed to Preview – sentry September 23, 2022 21:02 View deployment

scttcper requested a review from NisanthanNanthakumar September 23, 2022 21:26

NisanthanNanthakumar approved these changes Sep 23, 2022

View reviewed changes

scttcper changed the title ~~feat(ecosystem): Open permissions for code mappings and repos to members~~ feat(ecosystem): Open permissions for code mappings to members Sep 23, 2022

scttcper merged commit 6d128d9 into master Sep 23, 2022

scttcper deleted the scttcper/be-open-permissions branch September 23, 2022 21:52

scttcper added a commit that referenced this pull request Sep 24, 2022

feat(ecosystem): Allow members to add repos

87f66e6

Allow members to add repos. See related PR #39176

scttcper mentioned this pull request Sep 24, 2022

feat(ecosystem): Open permissions - Allow members to add repos #39276

Merged

github-actions bot locked and limited conversation to collaborators Oct 9, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(ecosystem): Open permissions for code mappings to members#39176

feat(ecosystem): Open permissions for code mappings to members#39176
scttcper merged 7 commits intomasterfrom
scttcper/be-open-permissions

scttcper commented Sep 22, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

scttcper Sep 23, 2022

Uh oh!

Uh oh!

armenzg Sep 23, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

NisanthanNanthakumar left a comment

Uh oh!

NisanthanNanthakumar Sep 23, 2022

Uh oh!

armenzg Sep 23, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

	class OrganizationIntegrationsPermission(OrganizationPermission):
	scope_map = {
	"GET": ["org:read", "org:write", "org:admin", "org:integrations"],
	"POST": ["org:write", "org:admin", "org:integrations"],
	"PUT": ["org:write", "org:admin", "org:integrations"],
	"DELETE": ["org:admin", "org:integrations"],
	}

	"id": "member",
	"name": "Member",
	"desc": "Members can view and act on events, as well as view most other data within the organization.",
	"scopes": {
	"event:read",
	"event:write",
	"event:admin",
	"project:releases",
	"project:read",
	"org:read",
	"member:read",
	"team:read",
	"alerts:read",
	"alerts:write",
	},

	self.config = RepositoryProjectPathConfig.objects.create(
	repository_id=str(self.repo.id),
	project_id=str(self.project.id),
	organization_integration_id=str(self.org_integration.id),
	stack_root="/stack/root",
	source_root="/source/root",
	default_branch="master",
	)

	self.create_member(
	organization=self.organization,
	user=self.user2,
	has_global_access=False,
	teams=[self.team2],
	)

Uh oh!

Conversation

scttcper commented Sep 22, 2022

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NisanthanNanthakumar left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants