ref(typing): Let security emails take a service account

capture_security_activity() and generate_security_email() take a
RequestPrincipal as the actor. The log line records acting_user_id(actor),
so a service account logs no actor id instead of a ServiceAccountId; the
email template already renders a blank address for callers with no user.
Drops organization_auth_tokens.py and user_authenticator_details.py from
the request.user allowlist.

Author: gricha

src/sentry/security/emails.py

@@ -4,9 +4,9 @@
 from datetime import datetime
 from typing import TYPE_CHECKING, Any, Protocol
 
-from django.contrib.auth.models import AnonymousUser
 from django.utils import timezone
 
+from sentry.auth.principal import RequestPrincipal
 from sentry.users.services.user.model import RpcUser
 from sentry.utils.email import MessageBuilder
 
@@ -32,7 +32,7 @@ def email(self) -> str: ...
 def generate_security_email(
     account: User | RpcUser | SecurityEmailAccount,
     type: str,
-    actor: AnonymousUser | User | RpcUser,
+    actor: RequestPrincipal,
     ip_address: str,
     context: Mapping[str, Any] | None = None,
     current_datetime: datetime | None = None,

src/sentry/security/utils.py

@@ -8,6 +8,7 @@
 from django.contrib.auth.models import AnonymousUser
 from django.utils import timezone
 
+from sentry.auth.principal import RequestPrincipal, acting_user_id
 from sentry.organizations.services.organization.model import RpcOrganization
 from sentry.sentry_apps.services.app.model import RpcSentryApp
 from sentry.users.services.user.model import RpcUser
@@ -26,7 +27,7 @@
 def capture_security_activity(
     account: User | RpcUser | AnonymousUser | SecurityEmailAccount,
     type: str,  # FIXME: "type" is a built-in function, so this isn't a great name
-    actor: User | RpcUser | AnonymousUser,
+    actor: RequestPrincipal,
     ip_address: str,
     context: Mapping[str, Any] | None = None,
     send_email: bool = True,
@@ -37,7 +38,11 @@ def capture_security_activity(
 
     assert not isinstance(account, AnonymousUser)
 
-    logger_context = {"ip_address": ip_address, "user_id": account.id, "actor_id": actor.id}
+    logger_context = {
+        "ip_address": ip_address,
+        "user_id": account.id,
+        "actor_id": acting_user_id(actor),
+    }
 
     if type == "mfa-removed" or type == "mfa-added":
         assert context is not None

tests/sentry/auth/test_principal.py

@@ -277,7 +277,7 @@ def _is_request_user_type_check(node: ast.AST) -> bool:
 # Lower these as callers move off. Exact, so the baseline can't drift back up.
 REQUEST_USER_ID_BASELINE = 133
 REQUEST_USER_TYPE_CHECK_BASELINE = 29
-REQUEST_USER_ALLOWLIST_BASELINE = 17
+REQUEST_USER_ALLOWLIST_BASELINE = 15
 
 
 def test_request_user_id_uses_only_go_down() -> None:

tools/mypy_helpers/request_user_allowlist.txt

@@ -1,5 +1,4 @@
 src/sentry/api/bases/organizationmember.py
-src/sentry/api/endpoints/organization_auth_tokens.py
 src/sentry/api/endpoints/organization_events.py
 src/sentry/api/endpoints/organization_events_stats.py
 src/sentry/api/endpoints/organization_releases.py
@@ -13,5 +12,4 @@ src/sentry/data_export/endpoints/data_export.py
 src/sentry/issues/endpoints/group_integration_details.py
 src/sentry/notebooks/endpoints/base.py
 src/sentry/seer/endpoints/organization_agent_token.py
-src/sentry/users/api/endpoints/user_authenticator_details.py
 src/sentry/web/client_config.py