fix(api): separate user preferences and search mutations from org read#113121
Draft
dcramer wants to merge 1 commit intodcramer/fix/api-project-leaf-scopesfrom
Draft
fix(api): separate user preferences and search mutations from org read#113121dcramer wants to merge 1 commit intodcramer/fix/api-project-leaf-scopesfrom
dcramer wants to merge 1 commit intodcramer/fix/api-project-leaf-scopesfrom
Conversation
Move user-owned state and saved-search mutation flows onto dedicated scopes. Previously, endpoints for bookmarks, starred state, onboarding progress, recent searches, and saved-search mutations could be reached with readonly org or member scopes, and those scopes were also requestable by third-party apps. Add user:preferences, org:searches, and flags:write, move the affected endpoints onto those scopes, and block the personal-only scopes from OAuth and Sentry App grant flows. Co-Authored-By: OpenAI Codex <noreply@openai.com>
github-actions
bot
added
the
Scope: Backend
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 7cc0772. Configure here.
| "event:write", | ||
| "event:admin", | ||
| "org:searches", | ||
| "user:preferences", |
Contributor
There was a problem hiding this comment.
Member role has flags:write but admin role does not
Medium Severity
The member role includes flags:write directly, but the (retired) admin role does not, and the admin role lacks any scope (like org:write) that would grant flags:write through the hierarchy. This creates a privilege inversion where a lower-privileged member can manage flag webhook signing secrets but a higher-privileged admin cannot. The admin role's scopes need flags:write added for consistency.
Additional Locations (1)
Reviewed by Cursor Bugbot for commit 7cc0772. Configure here.
Contributor
Backend Test FailuresFailures on
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Split first-party user-owned state and saved-search mutation flows out of readonly organization and member scopes.
Previously, endpoints for personal state such as project bookmarking, dashboard starring, onboarding task state, recent searches, starred saved queries, starred search views, search-view order / visit state, and similar flows were reachable through readonly scopes like
org:readormember:read. Saved search and custom view mutation also acceptedorg:readon write methods. That meant readonly API tokens could mutate personal or search state.After this change, user-owned state moves to
user:preferences, saved search and custom view mutation moves toorg:searches, and feature flag webhook secret management moves toflags:write.org:writeandorg:admincontinue to implyorg:searches, butuser:preferencesandflags:writeare treated as first-party / direct-token capabilities rather than general third-party app scopes.This PR also updates app grant flows so
user:preferencesandflags:writeare not requestable by OAuth apps or Sentry Apps. The intent is to keep those capabilities available for session-driven and direct token flows without presenting them as normal external app permissions.ProjectDetailsEndpointis split along the same line: bookmark updates are treated asuser:preferences, while project-wide behavior changes requireproject:write.Refs getsentry/getsentry#19897