ref(typing): Narrow request.user in agent tokens, releases, notebooks and client config

- resolve_minting_principal() rejects any caller with no user. A service
  account used to resolve to a user principal carrying its
  ServiceAccountId and fail later; it now gets the same "Minting requires
  a user principal" 403 as an anonymous caller.
- Release serialization takes a RequestPrincipal; it only forwards the
  caller to serialize() and serialize_generic_user(), which already take
  one.
- Notebook endpoints read the caller through acting_user_id().
- The client config is built only from Django views, so its request is
  typed as an HttpRequest.

Drops four files from the request.user allowlist; member management and
group_integration_details.py remain.

Author: gricha

src/sentry/api/serializers/models/release.py

@@ -16,6 +16,7 @@
     GroupEventReleaseSerializerResponse,
     ReleaseSerializerResponse,
 )
+from sentry.auth.principal import RequestPrincipal
 from sentry.integrations.models.external_actor import ExternalActor
 from sentry.models.commit import Commit
 from sentry.models.commitauthor import CommitAuthor
@@ -332,7 +333,7 @@ def get_cached_results(
 def get_users_for_authors(
     organization_id: int,
     authors: list[CommitAuthor],
-    user: User | AnonymousUser | RpcUser | None = None,
+    user: RequestPrincipal | None = None,
 ) -> Mapping[str, Author]:
     """
     Returns a dictionary of commit_author_id => user, if a Sentry

src/sentry/notebooks/endpoints/base.py

@@ -10,6 +10,7 @@
 from sentry.api.api_owners import ApiOwner
 from sentry.api.bases.organization import OrganizationEndpoint, OrganizationPermission
 from sentry.api.exceptions import ResourceDoesNotExist
+from sentry.auth.principal import acting_user_id
 from sentry.constants import ObjectStatus
 from sentry.models.organization import Organization
 from sentry.models.project import Project
@@ -47,7 +48,7 @@ def organization_project_ids(organization: Organization) -> set[int]:
 
 
 def user_id(request: Request) -> int:
-    resolved = request.user.id
+    resolved = acting_user_id(request.user)
     if resolved is None:
         raise PermissionDenied
     return resolved

src/sentry/releases/use_cases/release.py

@@ -3,7 +3,6 @@
 from datetime import datetime, timezone
 from typing import Any, cast
 
-from django.contrib.auth.models import AnonymousUser
 from django.db.models import Sum
 from sentry_sdk import traces
 
@@ -13,6 +12,7 @@
 from sentry.api.serializers.release_details_types import Author, BaseProject, LastDeploy
 from sentry.api.serializers.release_details_types import Project as SerializedProject
 from sentry.api.serializers.types import ReleaseSerializerResponse
+from sentry.auth.principal import RequestPrincipal
 from sentry.models.commit import Commit
 from sentry.models.commitauthor import CommitAuthor
 from sentry.models.deploy import Deploy
@@ -27,16 +27,14 @@
 )
 from sentry.models.releases.release_project import ReleaseProject
 from sentry.releases.serializers import release
-from sentry.users.models.user import User
-from sentry.users.services.user import RpcUser
 from sentry.users.services.user.serial import serialize_generic_user
 from sentry.users.services.user.service import user_service
 
 
 @traces.trace
 def serialize(
     releases: list[Release],
-    user: AnonymousUser | User | RpcUser,
+    user: RequestPrincipal,
     organization_id: int,
     environment_ids: list[int],
     projects: list[Project],
@@ -343,15 +341,15 @@ def fetch_releases_adoption_stages(
 
 @traces.trace
 def fetch_authors(
-    user: AnonymousUser | User | RpcUser, organization_id: int, author_ids: Iterable[str]
+    user: RequestPrincipal, organization_id: int, author_ids: Iterable[str]
 ) -> Mapping[str, Any]:
     authors = list(CommitAuthor.objects.filter(id__in=author_ids, organization_id=organization_id))
     return get_users_for_authors(organization_id=organization_id, authors=authors, user=user)
 
 
 @traces.trace
 def fetch_commits(
-    user: AnonymousUser | User | RpcUser, organization_id: int, commit_ids: Iterable[int]
+    user: RequestPrincipal, organization_id: int, commit_ids: Iterable[int]
 ) -> dict[int, dict[str, Any]]:
     commit_list = list(
         Commit.objects.filter(id__in=commit_ids, organization_id=organization_id)
@@ -364,17 +362,15 @@ def fetch_commits(
 
 @traces.trace
 def fetch_deploys(
-    user: AnonymousUser | User | RpcUser, organization_id: int, deploy_ids: Iterable[int]
+    user: RequestPrincipal, organization_id: int, deploy_ids: Iterable[int]
 ) -> dict[int, LastDeploy]:
     deploy_list = list(Deploy.objects.filter(id__in=deploy_ids, organization_id=organization_id))
     # XXX: This serializer queries environments.
     return {d.id: c for d, c in zip(deploy_list, model_serializer(deploy_list, user))}
 
 
 @traces.trace
-def fetch_owners(
-    user: AnonymousUser | User | RpcUser, owner_ids: Iterable[int]
-) -> dict[int, dict[str, Any]]:
+def fetch_owners(user: RequestPrincipal, owner_ids: Iterable[int]) -> dict[int, dict[str, Any]]:
     users = user_service.serialize_many(
         filter={"user_ids": owner_ids}, as_user=serialize_generic_user(user)
     )

src/sentry/seer/agent_token.py

@@ -13,21 +13,19 @@
 from typing import NotRequired, TypedDict, TypeGuard
 
 from django.conf import settings
-from django.contrib.auth.models import AnonymousUser
 from django.db import router, transaction
 from django.utils import timezone
 from jwt import PyJWTError
 from pydantic import ValidationError
 
+from sentry.auth.principal import RequestPrincipal, has_user
 from sentry.auth.services.auth import AuthenticatedToken
 from sentry.seer.models.agent_write_grant import (
     AGENT_SESSION_ID_MAX_LENGTH,
     DEFAULT_EXPIRATION,
     SeerAgentWriteGrant,
 )
 from sentry.types.superuser import SuperuserAccess
-from sentry.users.models.user import User
-from sentry.users.services.user import RpcUser
 from sentry.utils import jwt
 
 FEATURE_FLAG = "organizations:seer-agent-token-flow"
@@ -66,7 +64,6 @@ class AgentPrincipal:
 
 
 type MintingPrincipal = AgentPrincipal | MintingPrincipalRejection
-type MintingUser = User | RpcUser | AnonymousUser
 
 
 class AgentTokenClaims(TypedDict):
@@ -97,11 +94,11 @@ def readonly_scopes() -> frozenset[str]:
 
 
 def resolve_minting_principal(
-    user: MintingUser, auth: AuthenticatedToken | None
+    user: RequestPrincipal, auth: AuthenticatedToken | None
 ) -> MintingPrincipal:
     if is_agent_auth(auth):
         return MintingPrincipalRejection.AGENT
-    if isinstance(user, AnonymousUser):
+    if not has_user(user):
         return MintingPrincipalRejection.UNSUPPORTED
     if user.is_sentry_app:
         return MintingPrincipalRejection.INTEGRATION

src/sentry/web/client_config.py

@@ -12,7 +12,6 @@
 from django.core.cache import cache
 from django.http import HttpRequest
 from packaging.version import parse as parse_version
-from rest_framework.request import Request
 
 import sentry
 from sentry import features, options
@@ -183,7 +182,7 @@ def _resolve_last_org(
 class _ClientConfig:
     def __init__(
         self,
-        request: Request | None = None,
+        request: HttpRequest | None = None,
         org_context: RpcUserOrganizationContext | None = None,
     ) -> None:
         self.request = request

tests/sentry/auth/test_principal.py

@@ -275,9 +275,9 @@ def _is_request_user_type_check(node: ast.AST) -> bool:
 
 
 # Lower these as callers move off. Exact, so the baseline can't drift back up.
-REQUEST_USER_ID_BASELINE = 131
+REQUEST_USER_ID_BASELINE = 130
 REQUEST_USER_TYPE_CHECK_BASELINE = 29
-REQUEST_USER_ALLOWLIST_BASELINE = 10
+REQUEST_USER_ALLOWLIST_BASELINE = 6
 
 
 def test_request_user_id_uses_only_go_down() -> None:

tests/sentry/seer/test_agent_token.py

@@ -24,6 +24,7 @@
 from sentry.organizations.services.organization import organization_service
 from sentry.seer import agent_token
 from sentry.seer.models.agent_write_grant import SeerAgentWriteGrant
+from sentry.service_accounts.principal import ServiceAccountPrincipal
 from sentry.testutils.cases import TestCase
 from sentry.testutils.requests import drf_request_from_request
 from sentry.users.models.user import User
@@ -105,6 +106,12 @@ def test_minting_principal_resolves_only_users(self) -> None:
         assert unsupported is agent_token.MintingPrincipalRejection.UNSUPPORTED
         assert not agent_token.is_mintable_agent_principal(unsupported)
 
+        service_account = ServiceAccountPrincipal(
+            service_account_id=1, organization_id=self.org.id, name="seer-autofix"
+        )
+        rejected = agent_token.resolve_minting_principal(service_account, None)
+        assert rejected is agent_token.MintingPrincipalRejection.UNSUPPORTED
+
     def test_minting_principal_rejects_integrations_and_agents(self) -> None:
         integration_user = self.create_user(is_sentry_app=True)
         integration = agent_token.resolve_minting_principal(integration_user, None)

tools/mypy_helpers/request_user_allowlist.txt

@@ -1,10 +1,6 @@
 src/sentry/api/bases/organizationmember.py
-src/sentry/api/endpoints/organization_releases.py
 src/sentry/core/endpoints/organization_member_details.py
 src/sentry/core/endpoints/organization_member_index.py
 src/sentry/core/endpoints/organization_member_requests_invite_index.py
 src/sentry/data_export/endpoints/data_export.py
 src/sentry/issues/endpoints/group_integration_details.py
-src/sentry/notebooks/endpoints/base.py
-src/sentry/seer/endpoints/organization_agent_token.py
-src/sentry/web/client_config.py