Skip to content

Commit

Permalink
fix(oauth): Add investigative logging (#81334)
Browse files Browse the repository at this point in the history
Ideally organization index endpoint should only return data limited to
the organization that is on the token. But today it does not if the user
is authenticated. I want to limit this usecase to return only the
organization on the token but before making the change adding logging to
see what I'll break.
  • Loading branch information
sentaur-athena authored Nov 26, 2024
1 parent df77c62 commit 5f8d008
Showing 1 changed file with 18 additions and 0 deletions.
18 changes: 18 additions & 0 deletions src/sentry/api/endpoints/organization_index.py
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
import logging

from django.conf import settings
from django.db import IntegrityError
from django.db.models import Count, Q, Sum
Expand Down Expand Up @@ -35,6 +37,8 @@
from sentry.signals import org_setup_complete, terms_accepted
from sentry.users.services.user.service import user_service

logger = logging.getLogger(__name__)


class OrganizationPostSerializer(BaseOrganizationSerializer):
defaultTeam = serializers.BooleanField(required=False)
Expand Down Expand Up @@ -120,6 +124,20 @@ def get(self, request: Request) -> Response:
"organization"
)
)
if request.auth and request.auth.organization_id is not None and queryset.count() > 1:
# TODO: @athena Remove the temporary logging
# If a token is limitted to one organization, this case should not happen
# So ideally here we should limit the query set to that one org
# Adding some logging to verify if this is going to be a breaking change
logger.info(
"organization_index.unexpected_results",
extra={
"token_org": request.auth.organization_id,
"org_count": queryset.count(),
"user_id": request.auth.user_id,
"app_id": request.auth.application_id,
},
)

query = request.GET.get("query")
if query:
Expand Down

0 comments on commit 5f8d008

Please sign in to comment.