sentry
sentry copied to clipboard
fix(dashboards): stricter permission check when dashboards cover all/my projects
When Open Membership is disabled, it is expected to have more granular access to certain objects that are associated with projects. First version of project-level access on dashboards was implemented in https://github.com/getsentry/sentry/pull/70228
However, dashboards that cover "All Projects" or "My Projects" do not have explicit project ids, therefore we need to do a different check. After this PR, we will allow access to such dashboards only in these cases:
- if Open Membership is enabled;
- if actor is a Manager/Owner (having
org:writescope); - if actor is the original creator of a dashboard.
Codecov Report
Attention: Patch coverage is 77.77778% with 2 lines in your changes missing coverage. Please review.
:white_check_mark: All tests successful. No failed tests found.
| Files with missing lines | Patch % | Lines |
|---|---|---|
| ...rc/sentry/api/endpoints/organization_dashboards.py | 77.77% | 1 Missing and 1 partial :warning: |
Additional details and impacted files
@@ Coverage Diff @@
## master #78615 +/- ##
==========================================
- Coverage 78.14% 78.14% -0.01%
==========================================
Files 7099 7100 +1
Lines 312836 312695 -141
Branches 51085 51072 -13
==========================================
- Hits 244481 244364 -117
+ Misses 61975 61963 -12
+ Partials 6380 6368 -12