ref(typing): Check batched feature flags against the acting user

The events, events-stats and trace-item-attributes endpoints pass
acting_user(request.user) to features.batch_has() instead of the raw
principal. Feature handlers here and in getsentry only read the actor as
`actor is not None and actor.is_superuser` or through has_user(), so None
and AnonymousUser behave the same and nothing changes for users or token
callers. Drops the three endpoints from the request.user allowlist.

Author: gricha

src/sentry/api/endpoints/organization_events.py

@@ -37,6 +37,7 @@
 )
 from sentry.apidocs.response_types import DetailResponse
 from sentry.apidocs.utils import inline_sentry_response_serializer
+from sentry.auth.principal import acting_user
 from sentry.discover.models import DiscoverSavedQuery, DiscoverSavedQueryTypes
 from sentry.explore.models import ExploreSavedFormula, ExploreSavedQueryDataset
 from sentry.ingestion_delay.meta import IngestionMeta
@@ -159,7 +160,7 @@ def get_features(self, organization: Organization, request: Request) -> Mapping[
         batch_features = features.batch_has(
             feature_names,
             organization=organization,
-            actor=request.user,
+            actor=acting_user(request.user),
         )
 
         all_features: dict[str, bool] = {}

src/sentry/api/endpoints/organization_events_stats.py

@@ -20,6 +20,7 @@
 )
 from sentry.api.serializers.snuba import StatsTimeSeriesResult
 from sentry.apidocs.utils import inline_sentry_response_serializer
+from sentry.auth.principal import acting_user
 from sentry.constants import MAX_TOP_EVENTS
 from sentry.models.dashboard_widget import DashboardWidget, DashboardWidgetTypes
 from sentry.models.organization import Organization
@@ -79,7 +80,7 @@ def get_features(
         batch_features = features.batch_has(
             feature_names,
             organization=organization,
-            actor=request.user,
+            actor=acting_user(request.user),
         )
         return (
             batch_features.get(f"organization:{organization.id}", {})

src/sentry/api/endpoints/organization_trace_item_attributes.py

@@ -64,6 +64,7 @@
     as_validation_errors,
 )
 from sentry.apidocs.utils import inline_sentry_response_serializer
+from sentry.auth.principal import acting_user
 from sentry.auth.staff import is_active_staff
 from sentry.auth.superuser import is_active_superuser
 from sentry.exceptions import InvalidSearchQuery
@@ -256,7 +257,7 @@ class OrganizationTraceItemAttributesEndpointBase(OrganizationEventsEndpointBase
 
     def has_feature(self, organization: Organization, request: Request) -> bool:
         batch_features = features.batch_has(
-            self.feature_flags, organization=organization, actor=request.user
+            self.feature_flags, organization=organization, actor=acting_user(request.user)
         )
 
         if batch_features is None:

tests/sentry/auth/test_principal.py

@@ -277,7 +277,7 @@ def _is_request_user_type_check(node: ast.AST) -> bool:
 # Lower these as callers move off. Exact, so the baseline can't drift back up.
 REQUEST_USER_ID_BASELINE = 133
 REQUEST_USER_TYPE_CHECK_BASELINE = 29
-REQUEST_USER_ALLOWLIST_BASELINE = 15
+REQUEST_USER_ALLOWLIST_BASELINE = 12
 
 
 def test_request_user_id_uses_only_go_down() -> None:

tools/mypy_helpers/request_user_allowlist.txt

@@ -1,8 +1,5 @@
 src/sentry/api/bases/organizationmember.py
-src/sentry/api/endpoints/organization_events.py
-src/sentry/api/endpoints/organization_events_stats.py
 src/sentry/api/endpoints/organization_releases.py
-src/sentry/api/endpoints/organization_trace_item_attributes.py
 src/sentry/api/endpoints/prompts_activity.py
 src/sentry/core/endpoints/organization_member_details.py
 src/sentry/core/endpoints/organization_member_index.py