access control capture and test

posthog/api/team.py

@@ -14,7 +14,7 @@
 from posthog.api.utils import action
 from posthog.auth import PersonalAPIKeyAuthentication
 from posthog.constants import AvailableFeature
-from posthog.event_usage import report_user_action
+from posthog.event_usage import report_user_action, groups
 from posthog.geoip import get_geoip_properties
 from posthog.jwt import PosthogJwtAudience, encode_jwt
 from posthog.models import ProductIntent, Team, User
@@ -52,6 +52,7 @@
     get_ip_address,
     get_week_start_for_country_code,
 )
+import posthoganalytics
 
 
 class PremiumMultiProjectPermissions(BasePermission):  # TODO: Rename to include "Env" in name
@@ -373,6 +374,22 @@ def create(self, validated_data: dict[str, Any], **kwargs) -> Team:
     def update(self, instance: Team, validated_data: dict[str, Any]) -> Team:
         before_update = instance.__dict__.copy()
 
+        if "access_control" in validated_data and validated_data["access_control"] != instance.access_control:
+            user = cast(User, self.context["request"].user)
+            posthoganalytics.capture(
+                str(user.distinct_id),
+                "project access control toggled",
+                properties={
+                    "enabled": validated_data["access_control"],
+                    "project_id": str(instance.id),
+                    "project_name": instance.name,
+                    "organization_id": str(instance.organization_id),
+                    "organization_name": instance.organization.name,
+                    "user_role": user.organization_memberships.get(organization=instance.organization).level,
+                },
+                groups=groups(instance.organization),
+            )
+
         if "survey_config" in validated_data:
             if instance.survey_config is not None and validated_data.get("survey_config") is not None:
                 validated_data["survey_config"] = {

posthog/api/test/test_team.py

@@ -28,6 +28,7 @@
 from posthog.temporal.common.schedule import describe_schedule
 from posthog.test.base import APIBaseTest
 from posthog.utils import get_instance_realm
+from posthog.event_usage import groups
 
 
 def team_api_test_factory():
@@ -1223,6 +1224,49 @@ def _patch_linked_flag_config(
             assert response.status_code == expected_status, response.json()
             return response
 
+        @patch("posthoganalytics.capture")
+        def test_access_control_toggle_capture(self, mock_capture):
+            self.organization_membership.level = OrganizationMembership.Level.ADMIN
+            self.organization_membership.save()
+
+            mock_capture.reset_mock()
+
+            response = self.client.patch(f"/api/environments/@current/", {"access_control": True})
+            self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+            mock_capture.assert_called_with(
+                str(self.user.distinct_id),
+                "project access control toggled",
+                properties={
+                    "enabled": True,
+                    "project_id": str(self.team.id),
+                    "project_name": self.team.name,
+                    "organization_id": str(self.organization.id),
+                    "organization_name": self.organization.name,
+                    "user_role": OrganizationMembership.Level.ADMIN,
+                },
+                groups=groups(self.organization),
+            )
+
+            # Test toggling back to false
+            mock_capture.reset_mock()
+            response = self.client.patch(f"/api/environments/@current/", {"access_control": False})
+            self.assertEqual(response.status_code, status.HTTP_200_OK)
+
+            mock_capture.assert_called_with(
+                str(self.user.distinct_id),
+                "project access control toggled",
+                properties={
+                    "enabled": False,
+                    "project_id": str(self.team.id),
+                    "project_name": self.team.name,
+                    "organization_id": str(self.organization.id),
+                    "organization_name": self.organization.name,
+                    "user_role": OrganizationMembership.Level.ADMIN,
+                },
+                groups=groups(self.organization),
+            )
+
     return TestTeamAPI