Skip to content
Closed
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 0 additions & 5 deletions src/sentry/api/urls.py
Original file line number Diff line number Diff line change
Expand Up @@ -3782,11 +3782,6 @@ def create_group_urls(name_prefix: str) -> list[URLPattern | URLResolver]:
DataExportNotificationsEndpoint.as_view(),
name="sentry-api-0-data-export-notifications",
),
re_path(
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Removed URL route still referenced in test helpers

High Severity

The deleted URL route named sentry-api-0-accept-organization-invite is still referenced in tests/sentry/api/endpoints/test_accept_organization_invite.py — in _get_paths() (line 39), _get_urls() (line 52), and a direct reverse() call (line 208). These helpers are used by nearly every test in AcceptInviteTest, so removing the route without updating the tests will cause NoReverseMatch failures across the entire test class.

Fix in Cursor Fix in Web

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Backend route removal breaks frontend invite fallback path

Medium Severity

The removed accept-invite/{member_id}/{token}/ API route is still called by the frontend component AcceptOrganizationInvite in static/app/views/acceptOrganizationInvite/index.tsx. When orgSlug is null (no orgId in URL params and no customer domain), both the useApiQuery GET (line 227) and the useMutation POST (line 246, constructed via string interpolation, not getApiUrl) will hit the now-removed endpoint, resulting in 404 errors. The web route sentry-accept-invite in web/urls.py still exists and renders this component, so this path is still reachable.

Fix in Cursor Fix in Web

r"^accept-invite/(?P<member_id>[^/]+)/(?P<token>[^/]+)/$",
AcceptOrganizationInvite.as_view(),
name="sentry-api-0-accept-organization-invite",
),
re_path(
r"^notification-defaults/$",
Comment on lines 3783 to 3786
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The removal of a legacy API invite endpoint is incomplete. Frontend code and backend tests still reference the deleted route, which will break user-facing functionality and CI tests.
Severity: HIGH

Suggested Fix

Update the frontend component in static/app/views/acceptOrganizationInvite/index.tsx to remove the conditional logic that calls the old endpoint, ensuring it always uses the new, organization-specific invite URL. Also, update the corresponding test file tests/sentry/api/endpoints/test_accept_organization_invite.py to remove references to the deleted route name sentry-api-0-accept-organization-invite.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: src/sentry/api/urls.py#L3792-L3795

Potential issue: The pull request removes the legacy API route
`/api/0/accept-invite/{memberId}/{token}/`, named
`sentry-api-0-accept-organization-invite`. However, the frontend code in
`static/app/views/acceptOrganizationInvite/index.tsx` was not updated and will still
attempt to call this removed endpoint for users on older invite links that lack an
organization slug. This will cause a 404 error, breaking the invitation acceptance flow
for those users. Additionally, backend tests in
`tests/sentry/api/endpoints/test_accept_organization_invite.py` still reference the
removed route name via `reverse()`, which will cause `NoReverseMatch` errors and break
the CI pipeline.

Did we get this right? 👍 / 👎 to inform future reviews.

Comment on lines 3783 to 3786
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Bug: The backend route for legacy organization invites (/accept-invite/.../) is removed, but the frontend still has fallback logic that calls this endpoint, leading to a 404 error.
Severity: MEDIUM

Suggested Fix

The frontend code in static/app/views/acceptOrganizationInvite/index.tsx should be updated to remove the fallback logic that calls the legacy /accept-invite/.../ endpoint. Alternatively, revert the removal of the backend route until the corresponding frontend changes are merged. The associated test in index.spec.tsx that validates this legacy behavior should also be removed or updated.

Prompt for AI Agent
Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: src/sentry/api/urls.py#L3783-L3786

Potential issue: This pull request removes the legacy backend API route
`sentry-api-0-accept-organization-invite` at
`/accept-invite/(?P<member_id>[^/]+)/(?P<token>[^/]+)/`. However, the frontend component
`acceptOrganizationInvite` still contains fallback logic that attempts to call this
removed endpoint. This occurs when a user accesses a legacy invite link without an
organization slug (e.g., `/accept/:memberId/:token/`). The frontend will render, but the
subsequent API call will fail with a 404 error, showing the user a generic "invalid
link" message instead of properly handling the invite. The frontend changes to remove
this dependency were not included in this PR.

NotificationDefaultsEndpoints.as_view(),
Expand Down
1 change: 0 additions & 1 deletion static/app/utils/api/knownSentryApiUrls.generated.ts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@

export type KnownSentryApiUrls =
| '/'
| '/accept-invite/$memberId/$token/'
| '/accept-invite/$organizationIdOrSlug/$memberId/$token/'
| '/accept-transfer/'
| '/api-applications/'
Expand Down
Loading