ref(api): Narrow request.user in API plumbing and org endpoints

`api/base.py`, `api/bases/organization.py`, `api/decorators.py`, the group-index helpers and 22 org/project endpoints read the caller through `sentry.auth.principal`: who-did-this columns, analytics and Seer context use `acting_user_id()`; "mine" lookups (recent searches, prompts, monitoring identities) use `owned_by_acting_user()`; personal writes, user-only attributes and NOT NULL actors use `require_user()`.

Per-request paths: the 2FA check and the release cache key call `require_user()` only after checks a service account never passes (it has no member row; service-account auth is excluded), and `primary_email_verification_required` now answers a service account with 403 instead of an `AttributeError`.

- A service account gets empty prompts and recent searches, and can save transaction thresholds; recent-search POST, weekly-report exclusions, agentic onboarding and service hooks are 403 `user-required`. New tests cover five of these.
- Token callers get 401 instead of a 500 on recent-search POST and weekly-report exclusions.
- Users and agents see no change.

Left: three `features.batch_has(actor=request.user)` calls (widening it reaches getsentry's handlers), `_get_member`, `organization_releases` serialize, `prompts_activity` PUT and `organization_auth_tokens`.

Author: gricha

src/sentry/api/base.py

@@ -782,9 +782,7 @@ def track_set_commits_local(self, request: Request, organization_id=None, projec
         try:
             analytics.record(
                 ReleaseSetCommitsLocalEvent(
-                    user_id=acting_user_id(request.user)
-                    if request.user and request.user.id
-                    else None,
+                    user_id=acting_user_id(request.user),
                     organization_id=organization_id,
                     project_ids=project_ids,
                     user_agent=request.META.get("HTTP_USER_AGENT", ""),

src/sentry/api/bases/organization.py

@@ -31,7 +31,7 @@
 )
 from sentry.api.permissions import DemoSafePermission, StaffPermissionMixin
 from sentry.api.utils import get_date_range_from_params, is_member_disabled_from_limit
-from sentry.auth.principal import acting_user_id
+from sentry.auth.principal import acting_user_id, require_user
 from sentry.auth.services.auth import AuthenticatedToken
 from sentry.auth.superuser import is_active_superuser
 from sentry.constants import ALL_ACCESS_PROJECT_ID, ALL_ACCESS_PROJECTS_SLUG, ObjectStatus
@@ -99,7 +99,7 @@ def is_not_2fa_compliant(
         if not organization.flags.require_2fa:
             return False
 
-        if request.user.is_authenticated and request.user.has_2fa():
+        if request.user.is_authenticated and require_user(request).has_2fa():
             return False
 
         if request.user.is_authenticated and request.user.is_sentry_app:
@@ -932,7 +932,7 @@ def has_release_permission(
         key = None
         if not is_agent_auth(request.auth) and not is_service_account_auth(request.auth):
             if request.user.is_authenticated:
-                actor_id = "user:%s" % request.user.id
+                actor_id = "user:%s" % require_user(request).id
             elif request.auth is not None:
                 actor_id = "apikey:%s" % request.auth.entity_id
         if actor_id is not None:

src/sentry/api/bases/organization_events.py

@@ -56,6 +56,7 @@
 from sentry.search.events.constants import DURATION_UNITS, SIZE_UNITS
 from sentry.search.events.fields import get_function_alias, is_function
 from sentry.search.events.types import SAMPLING_MODES, SnubaParams
+from sentry.service_accounts.principal import ServiceAccountPrincipal
 from sentry.snuba import discover, metrics_enhanced_performance, metrics_performance
 from sentry.snuba.dataset import Dataset
 from sentry.snuba.metrics.extraction import MetricSpecType
@@ -290,7 +291,7 @@ def save_split_decision(
         has_errors: bool,
         has_transactions_data: bool,
         organization: Organization,
-        user: User | AnonymousUser,
+        user: User | AnonymousUser | ServiceAccountPrincipal,
     ) -> int | None:
         """This can be removed once the discover dataset has been fully split"""
         source = DashboardDatasetSourcesTypes.INFERRED.value

src/sentry/api/decorators.py

@@ -7,7 +7,7 @@
 from rest_framework.request import Request
 
 from sentry.api.exceptions import PrimaryEmailVerificationRequired, SudoRequired, UserRequired
-from sentry.auth.principal import has_user
+from sentry.auth.principal import has_user, require_user
 from sentry.models.apikey import is_api_key_auth
 from sentry.models.apitoken import is_api_token_auth
 from sentry.models.orgauthtoken import is_org_auth_token_auth
@@ -58,7 +58,10 @@ def wrapped(self: T, request: Request, *args: P.args, **kwargs: P.kwargs) -> Htt
 def primary_email_verification_required[T, **P](func: _RFMethod[T, P]) -> _RFMethod[T, P]:
     @wraps(func)
     def wrapped(self: T, request: Request, *args: P.args, **kwargs: P.kwargs) -> HttpResponseBase:
-        if isinstance(request.user, AnonymousUser) or not request.user.has_verified_primary_email():
+        if (
+            isinstance(request.user, AnonymousUser)
+            or not require_user(request).has_verified_primary_email()
+        ):
             raise PrimaryEmailVerificationRequired(request.user)
         return func(self, request, *args, **kwargs)
 

src/sentry/api/endpoints/organization_agentic_onboarding.py

@@ -22,6 +22,7 @@
     AgenticOnboardingRunSerializer,
 )
 from sentry.api.serializers.rest_framework import CamelSnakeSerializer
+from sentry.auth.principal import require_user
 from sentry.models.organization import Organization
 from sentry.onboarding.agentic_progress.model import (
     MAX_EVENT_NOTE_LENGTH,
@@ -168,8 +169,7 @@ class OrganizationAgenticOnboardingRunIndexEndpoint(OrganizationEndpoint):
     def post(self, request: Request, organization: Organization) -> Response:
         serializer = AgenticOnboardingRunRequestSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
-        user_id = request.user.id
-        assert user_id is not None
+        user_id = require_user(request).id
         try:
             run, onboarding_code = get_onboarding_progress_service().create_or_resume(
                 user_id=user_id,
@@ -207,8 +207,7 @@ def post(self, request: Request, organization: Organization) -> Response:
         serializer = AgenticOnboardingStatusRequestSerializer(data=request.data)
         serializer.is_valid(raise_exception=True)
         values = serializer.validated_data
-        user_id = request.user.id
-        assert user_id is not None
+        user_id = require_user(request).id
 
         try:
             run, changed, stage_status_changed = get_onboarding_progress_service().update(

src/sentry/api/endpoints/organization_agentic_onboarding_run_details.py

@@ -11,6 +11,7 @@
 from sentry.api.serializers.models.agentic_onboarding import (
     AgenticOnboardingRunSerializer,
 )
+from sentry.auth.principal import require_user
 from sentry.models.organization import Organization
 from sentry.onboarding.agentic_progress.model import OnboardingRunTerminal
 from sentry.onboarding.agentic_progress.service import (
@@ -27,8 +28,7 @@ class OrganizationAgenticOnboardingRunDetailsEndpoint(OrganizationEndpoint):
 
     @extend_schema(responses={200: AgenticOnboardingRunSerializer})
     def get(self, request: Request, organization: Organization, run_id: str) -> Response:
-        user_id = request.user.id
-        assert user_id is not None
+        user_id = require_user(request).id
         run = get_onboarding_progress_service().get(
             run_id=run_id, user_id=user_id, organization_id=organization.id
         )
@@ -39,8 +39,7 @@ def get(self, request: Request, organization: Organization, run_id: str) -> Resp
 
     @extend_schema(responses={200: AgenticOnboardingRunSerializer})
     def delete(self, request: Request, organization: Organization, run_id: str) -> Response:
-        user_id = request.user.id
-        assert user_id is not None
+        user_id = require_user(request).id
         try:
             run = get_onboarding_progress_service().cancel(
                 run_id=run_id, user_id=user_id, organization_id=organization.id

src/sentry/api/endpoints/organization_auth_tokens.py

@@ -161,7 +161,7 @@ def post(
             name=name,
             organization_id=organization.id,
             scope_list=sorted(set(scopes)),
-            created_by_id=request.user.id,
+            created_by_id=acting_user_id(request.user),
             token_last_characters=token_str[-4:],
             token_hashed=token_hashed,
         )

src/sentry/api/endpoints/organization_fork.py

@@ -14,6 +14,7 @@
 from sentry.api.base import Endpoint, cell_silo_endpoint
 from sentry.api.permissions import SuperuserOrStaffFeatureFlaggedPermission
 from sentry.api.serializers import serialize
+from sentry.auth.principal import acting_user_id, require_user
 from sentry.hybridcloud.services.organization_mapping import organization_mapping_service
 from sentry.models.organization import OrganizationStatus
 from sentry.relocation.api.endpoints.index import (
@@ -69,10 +70,11 @@ def post(self, request: Request, organization_id_or_slug) -> Response:
         :auth: required
         """
 
-        logger.info("relocations.fork.post.start", extra={"caller": request.user.id})
+        logger.info("relocations.fork.post.start", extra={"caller": acting_user_id(request.user)})
 
         if not request.user.is_authenticated:
             return Response(status=status.HTTP_400_BAD_REQUEST)
+        user = require_user(request)
 
         org_mapping = (
             organization_mapping_service.get(organization_id=organization_id_or_slug)
@@ -151,7 +153,7 @@ def post(self, request: Request, organization_id_or_slug) -> Response:
         # Identify who will be the owner of the newly forked organization, and ensure that they
         # don't already have relocations in flight.
         owners = organization_mapping_service.get_owners(organization_id=org_mapping.id)
-        owner = owners[0] if len(owners) > 0 else request.user
+        owner = owners[0] if len(owners) > 0 else user
         err = validate_relocation_uniqueness(owner)
         if err is not None:
             return err
@@ -162,7 +164,7 @@ def post(self, request: Request, organization_id_or_slug) -> Response:
         provenance = Relocation.Provenance.SAAS_TO_SAAS
         with atomic_transaction(using=(router.db_for_write(Relocation))):
             new_relocation = Relocation.objects.create(
-                creator_id=request.user.id,
+                creator_id=user.id,
                 owner_id=owner.id,
                 step=Relocation.Step.UPLOADING.value,
                 scheduled_pause_at_step=get_autopause_value(provenance),
@@ -180,7 +182,7 @@ def post(self, request: Request, organization_id_or_slug) -> Response:
         try:
             analytics.record(
                 RelocationForkedEvent(
-                    creator_id=request.user.id,
+                    creator_id=user.id,
                     owner_id=owner.id,
                     uuid=str(new_relocation.uuid),
                     from_org_slug=org_mapping.slug,

src/sentry/api/endpoints/organization_intercom_jwt.py

@@ -11,6 +11,7 @@
 from sentry.api.api_publish_status import ApiPublishStatus
 from sentry.api.base import control_silo_endpoint
 from sentry.api.bases.organization import ControlSiloOrganizationEndpoint
+from sentry.auth.principal import require_user
 from sentry.organizations.services.organization.model import (
     RpcOrganization,
     RpcUserOrganizationContext,
@@ -60,7 +61,7 @@ def get(
                 status=status.HTTP_503_SERVICE_UNAVAILABLE,
             )
 
-        user = request.user
+        user = require_user(request)
         now = int(datetime.datetime.now(datetime.UTC).timestamp())
         exp = now + JWT_VALIDITY_WINDOW_SECONDS
 

src/sentry/api/endpoints/organization_monitoring_provider_details.py

@@ -19,6 +19,7 @@
     MonitoringProviderPermission,
 )
 from sentry.auth.exceptions import IdentityNotValid
+from sentry.auth.principal import owned_by_acting_user
 from sentry.identity import default_manager as identity_manager
 from sentry.identity.base import Provider
 from sentry.identity.oauth2 import OAuth2Provider
@@ -86,8 +87,8 @@ def put(
         # Reuse the stored site from the existing connection.
         org_identity = (
             OrganizationIdentity.objects.filter(
+                owned_by_acting_user(request.user, "identity__user_id"),
                 organization_id=organization.id,
-                identity__user_id=request.user.id,  # type: ignore[misc]
                 identity__idp__type=provider_key,
             )
             .select_related("identity")
@@ -186,8 +187,8 @@ def delete(
 
         org_identities: list[OrganizationIdentity] = list(
             OrganizationIdentity.objects.filter(
+                owned_by_acting_user(request.user, "identity__user_id"),
                 organization_id=organization.id,
-                identity__user_id=request.user.id,  # type: ignore[misc]
                 identity__idp__type=provider_key,
             ).select_related("identity")
         )