ref(shared-views): Refactor delete endpoint permissions and model deletions #88845
Conversation
| try: | ||
| view = GroupSearchView.objects.get( | ||
| id=view_id, organization=organization, user_id=request.user.id | ||
| ) | ||
| view = GroupSearchView.objects.get(id=view_id) |
There was a problem hiding this comment.
It's possible that the view being deleted does not belong to the user. We should not filter by user id here
| has_delete_access = ( | ||
| view.user_id == request.user.id | ||
| or request.access.has_scope("org:admin") | ||
| or request.access.has_scope("team:admin") | ||
| ) |
There was a problem hiding this comment.
To any reviewers: could you confirm if these are the correct permission scopes to check for org admins?
There was a problem hiding this comment.
useful docs: https://docs.sentry.io/organization/membership/
For Business and Enterprise plans, the Org Admin role has been replaced by Team Admins and can no longer be assigned to new users. Existing users with Org Admin roles will retain their admin privileges.
and where we define role -> scope mapping for org level roles:
And for team level roles:
sentry/src/sentry/conf/server.py
Line 2182 in 1a08c08
Codecov ReportAttention: Patch coverage is ✅ All tests successful. No failed tests found.
Additional details and impacted files@@ Coverage Diff @@
## master #88845 +/- ##
=======================================
Coverage 87.72% 87.73%
=======================================
Files 10066 10067 +1
Lines 569533 569597 +64
Branches 22359 22359
=======================================
+ Hits 499628 499726 +98
+ Misses 69506 69472 -34
Partials 399 399 |
…etions (#88845) This PR makes the following refactors to the `DELETE` `/group-search-view/:viewId` endpoint: 1. Now, in addition to the creator of the view, org admins can also delete the view 2. Upon deletion, any users that had that view starred before will see that view deleted. 3. Any "last viewed" entries for that view are also deleted.
This PR makes the following refactors to the
DELETE/group-search-view/:viewIdendpoint: