feat(scopes): Add project:distribution permission scope #102006

runningcode · 2025-10-23T15:09:18Z

Summary

Adds a new permission scope project:distribution for Sentry Build Distribution functionality. This scope allows checking for updates of a given mobile app distribution.

Changes

Added project:distribution to ApiScopes.project tuple in src/sentry/models/apiscopes.py
Added project:distribution to ScopesDict TypedDict
Added project:distribution to SENTRY_SCOPES in src/sentry/conf/server.py
Added project:distribution to SENTRY_SCOPE_HIERARCHY_MAPPING in src/sentry/conf/server.py
Generated database migrations to update BitField scopes for API token models

Scope Availability

✅ Available for:

ApiToken
ApiKey
ApiAuthorization
SentryApp
OrgAuthToken

codecov · 2025-10-23T15:27:43Z

❌ 2 Tests Failed:

Tests completed	Failed	Passed	Skipped
41363	2	41361	249

View the top 2 failed test(s) by shortest run time

tests.sentry.api.serializers.test_organization.DetailedOrganizationSerializerTest::test_detailed

Stack Traces | 1.41s run time

#x1B[1m#x1B[.../api/serializers/test_organization.py#x1B[0m:159: in test_detailed
    assert result["access"] == default_owner_scopes
#x1B[1m#x1B[31mE   AssertionError: assert frozenset({'a...:admin', ...}) == frozenset({'a...:admin', ...})#x1B[0m
#x1B[1m#x1B[31mE     #x1B[0m
#x1B[1m#x1B[31mE     Extra items in the right set:#x1B[0m
#x1B[1m#x1B[31mE     'project:distribution'#x1B[0m
#x1B[1m#x1B[31mE     #x1B[0m
#x1B[1m#x1B[31mE     Full diff:#x1B[0m
#x1B[1m#x1B[31mE       frozenset({#x1B[0m
#x1B[1m#x1B[31mE           'alerts:read',#x1B[0m
#x1B[1m#x1B[31mE           'alerts:write',#x1B[0m
#x1B[1m#x1B[31mE           'event:admin',#x1B[0m
#x1B[1m#x1B[31mE           'event:read',#x1B[0m
#x1B[1m#x1B[31mE           'event:write',#x1B[0m
#x1B[1m#x1B[31mE           'member:admin',#x1B[0m
#x1B[1m#x1B[31mE           'member:invite',#x1B[0m
#x1B[1m#x1B[31mE           'member:read',#x1B[0m
#x1B[1m#x1B[31mE           'member:write',#x1B[0m
#x1B[1m#x1B[31mE           'org:admin',#x1B[0m
#x1B[1m#x1B[31mE           'org:integrations',#x1B[0m
#x1B[1m#x1B[31mE           'org:read',#x1B[0m
#x1B[1m#x1B[31mE           'org:write',#x1B[0m
#x1B[1m#x1B[31mE           'project:admin',#x1B[0m
#x1B[1m#x1B[31mE     -     'project:distribution',#x1B[0m
#x1B[1m#x1B[31mE           'project:read',#x1B[0m
#x1B[1m#x1B[31mE           'project:releases',#x1B[0m
#x1B[1m#x1B[31mE           'project:write',#x1B[0m
#x1B[1m#x1B[31mE           'team:admin',#x1B[0m
#x1B[1m#x1B[31mE           'team:read',#x1B[0m
#x1B[1m#x1B[31mE           'team:write',#x1B[0m
#x1B[1m#x1B[31mE       })#x1B[0m

tests.sentry.api.serializers.test_organization.DetailedOrganizationSerializerWithProjectsAndTeamsTest::test_detailed_org_projs_teams

Stack Traces | 2.43s run time

#x1B[1m#x1B[.../api/serializers/test_organization.py#x1B[0m:177: in test_detailed_org_projs_teams
    assert result["access"] == default_owner_scopes
#x1B[1m#x1B[31mE   AssertionError: assert frozenset({'a...:admin', ...}) == frozenset({'a...:admin', ...})#x1B[0m
#x1B[1m#x1B[31mE     #x1B[0m
#x1B[1m#x1B[31mE     Extra items in the right set:#x1B[0m
#x1B[1m#x1B[31mE     'project:distribution'#x1B[0m
#x1B[1m#x1B[31mE     #x1B[0m
#x1B[1m#x1B[31mE     Full diff:#x1B[0m
#x1B[1m#x1B[31mE       frozenset({#x1B[0m
#x1B[1m#x1B[31mE           'alerts:read',#x1B[0m
#x1B[1m#x1B[31mE           'alerts:write',#x1B[0m
#x1B[1m#x1B[31mE           'event:admin',#x1B[0m
#x1B[1m#x1B[31mE           'event:read',#x1B[0m
#x1B[1m#x1B[31mE           'event:write',#x1B[0m
#x1B[1m#x1B[31mE           'member:admin',#x1B[0m
#x1B[1m#x1B[31mE           'member:invite',#x1B[0m
#x1B[1m#x1B[31mE           'member:read',#x1B[0m
#x1B[1m#x1B[31mE           'member:write',#x1B[0m
#x1B[1m#x1B[31mE           'org:admin',#x1B[0m
#x1B[1m#x1B[31mE           'org:integrations',#x1B[0m
#x1B[1m#x1B[31mE           'org:read',#x1B[0m
#x1B[1m#x1B[31mE           'org:write',#x1B[0m
#x1B[1m#x1B[31mE           'project:admin',#x1B[0m
#x1B[1m#x1B[31mE     -     'project:distribution',#x1B[0m
#x1B[1m#x1B[31mE           'project:read',#x1B[0m
#x1B[1m#x1B[31mE           'project:releases',#x1B[0m
#x1B[1m#x1B[31mE           'project:write',#x1B[0m
#x1B[1m#x1B[31mE           'team:admin',#x1B[0m
#x1B[1m#x1B[31mE           'team:read',#x1B[0m
#x1B[1m#x1B[31mE           'team:write',#x1B[0m
#x1B[1m#x1B[31mE       })#x1B[0m

To view more test analytics, go to the Test Analytics Dashboard
_{📋 Got 3 mins? Take this short survey to help us improve Test Analytics.}

github-actions · 2025-10-23T15:37:08Z

This PR has a migration; here is the generated SQL for src/sentry/hybridcloud/migrations/0024_add_distribution_scope.py src/sentry/migrations/0998_add_distribution_scope.py

for 0024_add_distribution_scope in hybridcloud

--
-- Alter field scopes on apikeyreplica
--
-- (no-op)
--
-- Alter field scopes on apitokenreplica
--
-- (no-op)

for 0998_add_distribution_scope in sentry

--
-- Alter field scopes on apiauthorization
--
-- (no-op)
--
-- Alter field scopes on apikey
--
-- (no-op)
--
-- Alter field scopes on apitoken
--
-- (no-op)
--
-- Alter field scopes on sentryapp
--
-- (no-op)

Adds a new permission scope for Sentry Distribution functionality. Changes: - Added project:distribution to ApiScopes.project tuple - Added project:distribution to ScopesDict TypedDict - Added project:distribution to SENTRY_SCOPES - Added project:distribution to SENTRY_SCOPE_HIERARCHY_MAPPING - Added project:distribution to SENTRY_SCOPE_SETS with description - Updated tests to verify the new scope works correctly

github-actions · 2025-10-23T16:56:54Z

This PR has a migration; here is the generated SQL for src/sentry/hybridcloud/migrations/0024_add_distribution_token.py src/sentry/migrations/0999_add_distribution_token.py

for 0024_add_distribution_token in hybridcloud

--
-- Alter field scopes on apikeyreplica
--
-- (no-op)
--
-- Alter field scopes on apitokenreplica
--
-- (no-op)

for 0999_add_distribution_token in sentry

--
-- Alter field scopes on apiauthorization
--
-- (no-op)
--
-- Alter field scopes on apikey
--
-- (no-op)
--
-- Alter field scopes on apitoken
--
-- (no-op)
--
-- Alter field scopes on sentryapp
--
-- (no-op)

src/sentry/conf/server.py

… mapping Registers the project:distribution scope in SENTRY_SCOPES and SENTRY_SCOPE_HIERARCHY_MAPPING to make it available for permission checks throughout the system.

cursor · 2025-10-24T14:17:53Z

src/sentry/conf/server.py

    "project:write": {"project:read", "project:write"},
    "project:admin": {"project:read", "project:write", "project:admin"},
    "project:releases": {"project:releases"},
+    "project:distribution": {"project:distribution"},


Bug: Scope Misalignment in Token Validation

The project:distribution scope was added to SENTRY_SCOPES and SENTRY_SCOPE_HIERARCHY_MAPPING. This goes against the design intent to restrict this scope to API tokens only, making it incorrectly available for OrgAuthToken validation.

michelletran-sentry · 2025-10-24T15:01:27Z

src/sentry/models/apiscopes.py

            "alerts:read": bool,
            "alerts:write": bool,
            "member:invite": bool,
+            "project:distribution": bool,


Since this scope will not be used with OAuth, I don't think it needs to be added here.

michelletran-sentry · 2025-10-24T15:02:53Z

src/sentry/migrations/0999_add_distribution_token.py

+        ),
+        migrations.AlterField(
+            model_name="apitoken",
+            name="scopes",


Is this field still being used? The last time this value was not 0 was in 2017... 🤔

michelletran-sentry · 2025-10-24T15:05:42Z

src/sentry/migrations/0999_add_distribution_token.py

+    operations = [
+        migrations.AlterField(
+            model_name="apiauthorization",
+            name="scopes",


This looks unused, as the value is always 0.

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 23, 2025

vercel bot deployed to Preview October 23, 2025 15:12 View deployment

runningcode force-pushed the no/add-project-distribution-scope branch from 4d6cc73 to 2bed6fa Compare October 23, 2025 15:29

vercel bot deployed to Preview October 23, 2025 15:32 View deployment

runningcode force-pushed the no/add-project-distribution-scope branch from 2bed6fa to 0734b4b Compare October 23, 2025 15:42

vercel bot deployed to Preview October 23, 2025 15:44 View deployment

runningcode force-pushed the no/add-project-distribution-scope branch from 0734b4b to aabe42b Compare October 23, 2025 16:27

vercel bot deployed to Preview October 23, 2025 16:30 View deployment

runningcode force-pushed the no/add-project-distribution-scope branch from aabe42b to 0154fdf Compare October 23, 2025 16:40

vercel bot deployed to Preview October 23, 2025 16:42 View deployment

runningcode force-pushed the no/add-project-distribution-scope branch 2 times, most recently from b25ca21 to 4db2460 Compare October 23, 2025 16:43

vercel bot deployed to Preview October 23, 2025 16:47 View deployment

runningcode force-pushed the no/add-project-distribution-scope branch from 4db2460 to 217b718 Compare October 23, 2025 16:49

vercel bot deployed to Preview October 23, 2025 16:51 View deployment

runningcode marked this pull request as ready for review October 23, 2025 17:41

runningcode requested a review from a team as a code owner October 23, 2025 17:41

seer-by-sentry bot reviewed Oct 23, 2025

View reviewed changes

src/sentry/conf/server.py Show resolved Hide resolved

refactor(scopes): Remove project:distribution from SENTRY_SCOPE_SETS

e6dd0cd

vercel bot deployed to Preview October 24, 2025 09:28 View deployment

This comment was marked as outdated.

Sign in to view

feat(scopes): Add project:distribution to SENTRY_SCOPES and hierarchy…

0edd2fc

… mapping Registers the project:distribution scope in SENTRY_SCOPES and SENTRY_SCOPE_HIERARCHY_MAPPING to make it available for permission checks throughout the system.

vercel bot deployed to Preview October 24, 2025 14:17 View deployment

cursor bot reviewed Oct 24, 2025

View reviewed changes

michelletran-sentry reviewed Oct 24, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(scopes): Add project:distribution permission scope #102006

feat(scopes): Add project:distribution permission scope #102006

runningcode commented Oct 23, 2025 •

edited

Loading

Uh oh!

codecov bot commented Oct 23, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor bot Oct 24, 2025

Uh oh!

michelletran-sentry Oct 24, 2025

Uh oh!

michelletran-sentry Oct 24, 2025

Uh oh!

michelletran-sentry Oct 24, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

feat(scopes): Add project:distribution permission scope #102006

Are you sure you want to change the base?

feat(scopes): Add project:distribution permission scope #102006

Conversation

runningcode commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Scope Availability

Uh oh!

codecov bot commented Oct 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ 2 Tests Failed:

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

github-actions bot commented Oct 23, 2025

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

cursor bot Oct 24, 2025

Choose a reason for hiding this comment

Bug: Scope Misalignment in Token Validation

Uh oh!

michelletran-sentry Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

michelletran-sentry Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

michelletran-sentry Oct 24, 2025

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

runningcode commented Oct 23, 2025 •

edited

Loading

codecov bot commented Oct 23, 2025 •

edited

Loading