feat(symbols): Add platform-restricted builtin symbol sources with org access control

[vaind]

Summary

Adds support for platform-restricted builtin symbol sources with organization-level access control.

This enables symbol sources to be restricted to specific platforms (e.g., console platforms like Nintendo Switch) and only accessible to organizations with the appropriate console platform access enabled.

Companion PR: getsentry/getsentry#18867 - Defines the Nintendo symbol source configuration (credentials, bucket settings, etc.)

Changes

Platform Filtering for Builtin Sources API

• builtin_symbol_sources.py: Add platform-based filtering
  • Filter sources by platform query parameter
  • Check organization's enabledConsolePlatforms access for restricted sources
  • Backward compatible (works without platform parameter)

Default Symbol Sources Enhancement

• default_symbol_sources.py: Enhanced helper for platform-specific defaults
  • Added nintendo-switch platform mapping to nintendo source
  • Check platform restrictions and org access before adding sources
  • Organization auto-fetched from project if not provided

Shared Utility

• console_platforms.py: New utility module
  • organization_has_console_platform_access() - checks if org has access to a console platform
  • Used by both builtin sources endpoint and tempest utils

Schema Update

• sources.py: Add platforms field to source schema

Refactoring

• tempest/utils.py: Refactored to use shared organization_has_console_platform_access utility
• team_projects.py: Pass organization to set_default_symbol_sources()

How It Works

Platform Restrictions

Sources can include a platforms key to restrict visibility:

"nintendo": {
    "type": "s3",
    "platforms": ["nintendo-switch"],  # Only visible to nintendo-switch projects
    # ... other config (defined in getsentry)
}

Two-layer filtering:

1. Platform match: Request's platform must match source's platforms list
2. Org access: Organization must have platform in enabledConsolePlatforms

Default Symbol Sources

DEFAULT_SYMBOL_SOURCES = {
    "electron": ["ios", "microsoft", "electron"],
    "unity": ["ios", "microsoft", "android", "nuget", "unity", "nvidia", "ubuntu"],
    "unreal": ["ios", "microsoft", "android", "nvidia", "ubuntu"],
    "godot": ["ios", "microsoft", "android", "nuget", "nvidia", "ubuntu"],
    "nintendo-switch": ["nintendo"],
}

Test Plan

• Unit tests pass
• Pre-commit hooks pass
• Mypy type checking passes
• Verify Nintendo Switch project in enabled org sees the source
• Verify Nintendo Switch project in non-enabled org does NOT see the source
• Verify non-Nintendo projects never see the source
• Verify public sources still visible to all platforms
• Verify API works without platform parameter (backward compatibility)

[github-actions]

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

[priscilawebdev]

Hmm, so as I understand it, we’re introducing a new private symbol source default nintendo-private that should be applied conditionally based on the platform.

Instead of adding the nintendo-private source to the defaults and then filtering it out later in the endpoint, shouldn't we only add it in the first place if the organization has nintendo-switch in their enabled consoles? This would probably live in the set_default_symbol_sources function.

The reason I’m thinking that way is: if we process a symbol source marked as a private default, we probably shouldn’t omit it later.

Also, just a quick note - I noticed this PR includes both frontend and backend changes. We usually try to keep those separate in different PRs 😉

[vaind]

Also, just a quick note - I noticed this PR includes both frontend and backend changes. We usually try to keep those separate in different PRs 😉

This now only has backend changes but it looks like CI doesn't remove labels previously assigned.

[vaind]

@sentry review

[loewenheim]

If you remove the definition of the Nintendo source (and change all references to nintendo-private to nintendo, in accordance with the getsentry PR, this is ready to merge.

[priscilawebdev]

is this an extra check we want to add? will there be more platforms in the future?

[vaind]

• yes, this check is necessary to only show this server for nintendo-switch projects.
• there's likely to be another console symbol server in the futer

[priscilawebdev]

instead of defining this object, can't we just import the SENTRY_BUILTIN_SOURCES?

[vaind]

We need it because

• The "nintendo" source is not defined in this repo - it's in getsentry
• The real SENTRY_BUILTIN_SOURCES contains public sources (ios, microsoft, etc.) that don't have platform restrictions
• We need a controlled test fixture with both public sources AND a platform-restricted source to properly test the filtering logic

[priscilawebdev]

are we adding an additional security check here? Users should only be able to create a Nintendo Switch project if they have access. Or is the idea that access could later be revoked, in which case they would already have an existing Nintendo Switch project?

[vaind]

yes we are. the platform is an API input so if we didn't check for access, anyone could add it just by overriding the request.

[priscilawebdev]

should we test if the epoch changes, if a known platform is provided?

[vaind]

This is already covered by the existing tests:
test_electron_platform (line 51) - verifies electron gets ios, microsoft, electron
test_unity_platform (line 62) - verifies unity gets ios, microsoft, android, nuget, unity, nvidia, ubuntu
These tests implicitly verify epoch defaults are overridden because they assert platform-specific sources are present.

[priscilawebdev]

LGTM! 👏

[priscilawebdev]

thank you 💜

[mujacica]

LGTM

[vaind]

The API diff is for added "platforms" string array:

{
  paths: {
    /api/0/projects/{organization_id_or_slug}/{project_id_or_slug}/symbol-sources/: {
      get: {
        responses: {
          200: {
            content: {
              application/json: {
                schema: {
                  items: {
                    oneOf: [
                      {
                        properties: {
+                          platforms: {
+                            type: "array"
+                            items: {
+                              type: "string"
+                            }
+                          }
                        }
                      }
                      {
                        properties: {
+                          platforms: {
+                            type: "array"
+                            items: {
+                              type: "string"
+                            }
+                          }
                        }
                      }
                      {
                        properties: {
+                          platforms: {
+                            type: "array"
+                            items: {
+                              type: "string"
+                            }
+                          }
                        }
                      }
                      ...
                    ]
                  }
                }
              }
            }
          }
        }
      }
      post: {
        responses: {
          201: {
            content: {
              application/json: {
                schema: {
                  oneOf: [
                    {
                      properties: {
+                        platforms: {
+                          type: "array"
+                          items: {
+                            type: "string"
+                          }
+                        }
                      }
                    }
                    {
                      properties: {
+                        platforms: {
+                          type: "array"
+                          items: {
+                            type: "string"
+                          }
+                        }
                      }
                    }
                    {
                      properties: {
+                        platforms: {
+                          type: "array"
+                          items: {
+                            type: "string"
+                          }
+                        }
                      }
                    }
                    ...
                  ]
                }
              }
            }
          }
        }
      }
      put: {
        responses: {
          200: {
            content: {
              application/json: {
                schema: {
                  oneOf: [
                    {
                      properties: {
+                        platforms: {
+                          type: "array"
+                          items: {
+                            type: "string"
+                          }
+                        }
                      }
                    }
                    {
                      properties: {
+                        platforms: {
+                          type: "array"
+                          items: {
+                            type: "string"
+                          }
+                        }
                      }
                    }
                    {
                      properties: {
+                        platforms: {
+                          type: "array"
+                          items: {
+                            type: "string"
+                          }
+                        }
                      }
                    }
                    ...
                  ]
                }
              }
            }
          }
        }
      }
    }
  }
}