feat(preprod): Create artifact download endpoint + associated authentication code #93865

NicoHinderling · 2025-06-18T21:42:02Z

I implemented the authentication logic that will power the monolith <> launchpad specific endpoints. The code is exactly how seer currently has its auth HTTP calls implemented. I put it in a shared space so that once this lands, we could potentially have the seer team share this underlying logic too. That way we don't have two different implementations of the same thing

As for "why this auth approach", I explored the different ways we currently have it implemented:

Relay: Public key + signature validation + IP allowlists
Cross-region RPC: Shared secret HMAC (RpcSignatureAuthentication)
Seer: Custom shared secret HMAC (SeerRpcSignatureAuthentication)
Codecov: JWT with shared signing secret
Taskbroker: gRPC interceptor with shared secrets

I went with the #3 approach since our use case is pretty much identical to the Seer use case and the implementation seemed the most straightforward.

Security folks though, please weigh in here! You know best

I also created 1 of the 3 new endpoints that we need for the launchpad service. This one just allows our service to download the artifact file. I included it so that the full usage of this auth logic is apparent

…ication code

NicoHinderling · 2025-06-18T21:45:38Z

src/sentry/api/authentication.py

@@ -550,3 +551,120 @@ def authenticate_token(self, request: Request, token: str) -> tuple[Any, Any]:
        sentry_sdk.get_isolation_scope().set_tag("rpc_auth", True)

        return (AnonymousUser(), token)
+
+
+def compare_service_signature(


pretty much 1:1 rip of https://github.com/getsentry/sentry/blob/master/src/sentry/api/endpoints/seer_rpc.py#L60

I'm pretty sure the seer implementation was derived from the cross-region rpc auth. We should consolidate these implementations now that we have 3 of them, but that can happen after this merges.

sounds good, so long as @mdtro signs off on this PR, I can then put another one up after this to merge all three until one

NicoHinderling · 2025-06-18T22:09:22Z

src/sentry/api/authentication.py

+    return False
+
+
+class ServiceRpcSignatureAuthentication(StandardAuthentication):


rip of https://github.com/getsentry/sentry/blob/master/src/sentry/api/endpoints/seer_rpc.py#L101

NicoHinderling · 2025-06-18T22:16:06Z

src/sentry/preprod/authentication.py

+
+    shared_secret_setting_name = LAUNCHPAD_RPC_SHARED_SECRET_SETTING
+    service_name = "Launchpad"
+    sdk_tag_name = "launchpad_rpc_auth"


we could just create another version of this but for seer cc @jennmueng

codecov · 2025-06-18T22:28:28Z

Codecov Report

Attention: Patch coverage is 96.80511% with 10 lines in your changes missing coverage. Please review.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...api/endpoints/project_preprod_artifact_download.py	87.23%	6 Missing ⚠️
src/sentry/api/authentication.py	90.00%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #93865      +/-   ##
==========================================
+ Coverage   88.02%   88.06%   +0.03%     
==========================================
  Files       10339    10338       -1     
  Lines      596639   598538    +1899     
  Branches    23171    23171              
==========================================
+ Hits       525199   527098    +1899     
  Misses      70981    70981              
  Partials      459      459

jennmueng

Nice, looks like we can definitely share it with Seer once it's in. I'm definitely not the best person to review this though, @mdtro will be.

markstory · 2025-06-19T18:37:05Z

src/sentry/api/authentication.py

@@ -550,3 +551,120 @@ def authenticate_token(self, request: Request, token: str) -> tuple[Any, Any]:
        sentry_sdk.get_isolation_scope().set_tag("rpc_auth", True)

        return (AnonymousUser(), token)
+
+
+def compare_service_signature(


I'm pretty sure the seer implementation was derived from the cross-region rpc auth. We should consolidate these implementations now that we have 3 of them, but that can happen after this merges.

markstory · 2025-06-19T18:41:25Z

src/sentry/preprod/api/endpoints/project_preprod_artifact_download.py

+class ProjectPreprodArtifactDownloadEndpoint(ProjectEndpoint):
+    owner = ApiOwner.EMERGE_TOOLS
+    publish_status = {
+        "GET": ApiPublishStatus.EXPERIMENTAL,


We should avoid marking this public in the future, as public endpoints become part of the customer facing API docs.

markstory · 2025-06-19T18:43:41Z

src/sentry/preprod/authentication.py

+LAUNCHPAD_RPC_SHARED_SECRET_SETTING = "LAUNCHPAD_RPC_SHARED_SECRET"
+
+
+@AuthenticationSiloLimit(SiloMode.CONTROL, SiloMode.REGION)


Suggested change

@AuthenticationSiloLimit(SiloMode.CONTROL, SiloMode.REGION)

@AuthenticationSiloLimit(SiloMode.REGION)

I don't think you'll be sending requests to control silo.

markstory · 2025-06-19T18:44:54Z

tests/sentry/api/endpoints/test_project_preprod_artifact_download.py

+            state=PreprodArtifact.ArtifactState.UPLOADING,
+        )
+
+        url = f"/api/0/projects/{self.organization.slug}/{self.project.slug}/files/preprodartifacts/{unprocessed_artifact.id}/"


Given that this is an internal API. We could put the URLs under /internal that will prevent these URLs from being reached from the frontend loadbalancers.

markstory

Token handling logic and endpoint looks good to me.

mdtro · 2025-06-23T22:15:22Z

src/sentry/api/authentication.py

+    url: str,
+    body: bytes,
+    signature: str,
+    shared_secret_setting: list[str] | None,


Is there any reason to allow None here? It'd be safer to enforce a key explicitly being set.
We should also not allow shared_secret_setting = [""]. This will effectively sign with an empty HMAC key.

None isn't actually allow here. It's rejected

if not shared_secret_setting: raise RpcAuthenticationSetupException( f"Cannot validate {service_name} RPC request signatures without shared secret" )

None is just an option to make the usage of the ServiceRpcSignatureAuthentication class cleaner. I'll change it tho 👍 I also just updated the code to handle the empty HMAC key case

sentry-io · 2025-07-01T22:39:53Z

Suspect Issues

This pull request was deployed and Sentry observed the following issues:

‼️ RpcAuthenticationSetupException: Cannot validate L... in prod

_{Did you find this useful? React with a 👍 or 👎}

…ication code (#93865) I implemented the authentication logic that will power the monolith <> launchpad specific endpoints. The code is exactly how seer currently has its auth HTTP calls implemented. I put it in a shared space so that once this lands, we could potentially have the seer team share this underlying logic too. That way we don't have two different implementations of the same thing As for "why this auth approach", I explored the different ways we currently have it implemented: 1. Relay: Public key + signature validation + IP allowlists 2. Cross-region RPC: Shared secret HMAC (RpcSignatureAuthentication) 3. Seer: Custom shared secret HMAC (SeerRpcSignatureAuthentication) 4. Codecov: JWT with shared signing secret 5. Taskbroker: gRPC interceptor with shared secrets I went with the #3 approach since our use case is pretty much identical to the Seer use case and the implementation seemed the most straightforward. Security folks though, please weigh in here! You know best I also created 1 of the 3 new endpoints that we need for the launchpad service. This one just allows our service to download the artifact file. I included it so that the full usage of this auth logic is apparent

feat(preprod): Create artifact download endpoint + associated authent…

4442b32

…ication code

NicoHinderling requested review from a team as code owners June 18, 2025 21:42

github-actions bot added the Scope: Backend label Jun 18, 2025

NicoHinderling commented Jun 18, 2025

View reviewed changes

NicoHinderling marked this pull request as draft June 18, 2025 21:54

cleanup imports

d306f53

vercel bot deployed to Preview June 18, 2025 21:56 View deployment

cleanup

fb9d647

vercel bot deployed to Preview June 18, 2025 22:09 View deployment

NicoHinderling commented Jun 18, 2025

View reviewed changes

adjust naming logic in endpoint

f262a9b

vercel bot deployed to Preview June 18, 2025 22:13 View deployment

NicoHinderling marked this pull request as ready for review June 18, 2025 22:14

NicoHinderling commented Jun 18, 2025

View reviewed changes

vercel bot deployed to Preview June 18, 2025 23:31 View deployment

tests

3bd37f8

NicoHinderling force-pushed the new-launchpad-endpoints branch from 9ce5c17 to 3bd37f8 Compare June 18, 2025 23:48

vercel bot deployed to Preview June 18, 2025 23:49 View deployment

jennmueng reviewed Jun 19, 2025

View reviewed changes

markstory reviewed Jun 19, 2025

View reviewed changes

NicoHinderling mentioned this pull request Jun 20, 2025

[ignore][will not land] All new launchpad endpoints #93991

Closed

feedback

fd0d295

NicoHinderling requested a review from a team as a code owner June 23, 2025 14:24

vercel bot deployed to Preview June 23, 2025 14:25 View deployment

add internal prefix in test file

8d51cec

vercel bot deployed to Preview June 23, 2025 14:41 View deployment

NicoHinderling requested a review from mdtro June 23, 2025 14:49

fix path typo

c7e73bd

vercel bot deployed to Preview June 23, 2025 15:10 View deployment

markstory approved these changes Jun 23, 2025

View reviewed changes

mdtro reviewed Jun 23, 2025

View reviewed changes

add empty hmac strng handling

8d0fbfa

vercel bot deployed to Preview June 24, 2025 13:41 View deployment

ensure we have test coverage for the two hmac cases

85d4818

vercel bot deployed to Preview June 24, 2025 16:02 View deployment

method param

1a0a017

vercel bot deployed to Preview June 24, 2025 16:42 View deployment

type error warning

18f5477

vercel bot deployed to Preview June 24, 2025 16:55 View deployment

mdtro approved these changes Jun 24, 2025

View reviewed changes

NicoHinderling merged commit e1d511f into master Jun 24, 2025
64 checks passed

NicoHinderling deleted the new-launchpad-endpoints branch June 24, 2025 22:03

github-actions bot locked and limited conversation to collaborators Jul 17, 2025

		return False


		class ServiceRpcSignatureAuthentication(StandardAuthentication):

		LAUNCHPAD_RPC_SHARED_SECRET_SETTING = "LAUNCHPAD_RPC_SHARED_SECRET"


		@AuthenticationSiloLimit(SiloMode.CONTROL, SiloMode.REGION)

	@AuthenticationSiloLimit(SiloMode.CONTROL, SiloMode.REGION)
	@AuthenticationSiloLimit(SiloMode.REGION)

Uh oh!

feat(preprod): Create artifact download endpoint + associated authentication code #93865

feat(preprod): Create artifact download endpoint + associated authentication code #93865

Uh oh!

Conversation

NicoHinderling commented Jun 18, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Jun 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

jennmueng left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

markstory left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NicoHinderling Jun 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

sentry-io bot commented Jul 1, 2025

Suspect Issues

Uh oh!

Uh oh!

codecov bot commented Jun 18, 2025 •

edited

Loading

NicoHinderling Jun 24, 2025 •

edited

Loading