fix(integrations): Disallow modifying a repo's integration

[cmanallen]

No description provided.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Autofix Details

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Repository migration silently fails due to ignored integrationId
  • The repository details PUT endpoint now returns a 400 error when no valid updatable fields are provided, so integrationId-only migration requests no longer succeed silently.

Or push these changes by commenting:

@cursor push 4d3895d645

Preview (4d3895d645)

diff --git a/src/sentry/integrations/api/endpoints/organization_repository_details.py b/src/sentry/integrations/api/endpoints/organization_repository_details.py
--- a/src/sentry/integrations/api/endpoints/organization_repository_details.py
+++ b/src/sentry/integrations/api/endpoints/organization_repository_details.py
@@ -81,28 +81,27 @@
                 update_kwargs["status"] = ObjectStatus.HIDDEN
             else:
                 raise NotImplementedError
-        if update_kwargs:
-            old_status = repo.status
-            with transaction.atomic(router.db_for_write(Repository)):
-                repo.update(**update_kwargs)
-                if (
-                    old_status == ObjectStatus.PENDING_DELETION
-                    and repo.status == ObjectStatus.ACTIVE
-                ):
-                    repo.reset_pending_deletion_field_names()
-                    repo.delete_pending_deletion_option()
-                elif repo.status == ObjectStatus.HIDDEN and old_status != repo.status:
-                    repository_cascade_delete_on_hide.apply_async(kwargs={"repo_id": repo.id})
+        if not update_kwargs:
+            return Response({"detail": "No valid update fields were provided"}, status=400)
 
-                    if repo.external_id and repo.provider:
-                        cleanup_seer_repository_preferences.apply_async(
-                            kwargs={
-                                "organization_id": repo.organization_id,
-                                "repo_external_id": repo.external_id,
-                                "repo_provider": repo.provider,
-                            }
-                        )
+        old_status = repo.status
+        with transaction.atomic(router.db_for_write(Repository)):
+            repo.update(**update_kwargs)
+            if old_status == ObjectStatus.PENDING_DELETION and repo.status == ObjectStatus.ACTIVE:
+                repo.reset_pending_deletion_field_names()
+                repo.delete_pending_deletion_option()
+            elif repo.status == ObjectStatus.HIDDEN and old_status != repo.status:
+                repository_cascade_delete_on_hide.apply_async(kwargs={"repo_id": repo.id})
 
+                if repo.external_id and repo.provider:
+                    cleanup_seer_repository_preferences.apply_async(
+                        kwargs={
+                            "organization_id": repo.organization_id,
+                            "repo_external_id": repo.external_id,
+                            "repo_provider": repo.provider,
+                        }
+                    )
+
         return Response(serialize(repo, request.user))
 
     def delete(self, request: Request, organization, repo_id) -> Response:

diff --git a/tests/sentry/integrations/api/endpoints/test_organization_repository_details.py b/tests/sentry/integrations/api/endpoints/test_organization_repository_details.py
--- a/tests/sentry/integrations/api/endpoints/test_organization_repository_details.py
+++ b/tests/sentry/integrations/api/endpoints/test_organization_repository_details.py
@@ -323,7 +323,7 @@
             }
         )
 
-    def test_put_does_not_change_provider(self) -> None:
+    def test_put_rejects_integration_id(self) -> None:
         self.login_as(user=self.user)
 
         org = self.create_organization(owner=self.user, name="baz")
@@ -339,9 +339,10 @@
         )
 
         url = reverse("sentry-api-0-organization-repository-details", args=[org.slug, repo.id])
-        response = self.client.put(url, data={"status": "visible", "integrationId": integration.id})
+        response = self.client.put(url, data={"integrationId": integration.id})
 
-        assert response.status_code == 200
+        assert response.status_code == 400
+        assert response.data["detail"] == "No valid update fields were provided"
 
         repo = Repository.objects.get(id=repo.id)
         assert repo.provider == "integrations:github"

_{This Bugbot Autofix run was free. To enable autofix for future PRs, go to the Cursor dashboard.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}