fix(seer explorer): Restrict to orgs with open membership #101178
Conversation
github-actions
bot
added
the
Scope: Backend
![seer-by-sentry[bot]](https://avatars.githubusercontent.com/in/801464?s=60&v=4){kind=small}
| if not organization.flags.allow_joinleave: | ||
| return Response( | ||
| { | ||
| "detail": "Organization does not have open team membership enabled. Seer requires this to aggregate context across all projects and allow members to ask questions freely." | ||
| }, | ||
| status=403, | ||
| ) |
There was a problem hiding this comment.
Potential bug: Insufficient access control logic denies access to users with global roles.
-
Description: The access control logic incorrectly denies access to users with high-level permissions (e.g.,
org:admin,org:write). The code checks only theorganization.flags.allow_joinleaveflag, but it should use therequest.access.has_global_accessproperty, which correctly grants access to users with global roles regardless of theallow_joinleavesetting. This results in a functional bug where legitimate users are blocked from the feature. -
Suggested fix: Replace the check
if not organization.flags.allow_joinleave:withif not request.access.has_global_access:to correctly account for users who have global project access through their organizational role.
severity: 3.0, confidence: 5.0
Did we get this right? 👍 / 👎 to inform future reviews.
2 participants
Only allows orgs with
organization.flags.allow_joinleaveset to true to use Seer Explorer. This is because Explorer requires aggregating context across all projects, which violates permissions if some members aren't allowed to access some projects.