feat(preprod): Add org-scoped build-details endpoint and auto-resolve project

[NicoHinderling]

Add a new organization-scoped build-details API endpoint at
/organizations/{org}/preprodartifacts/{artifactId}/build-details/
that returns build details including project_id and project_slug
without requiring the project slug in the URL path.

This enables preprod URLs like /preprod/size/12345/ to work without
requiring ?project= upfront, improving UX for shared links. When a
user opens a link without the project query param, the frontend fetches
build details from the org-scoped endpoint, extracts the project ID
from the response, and automatically adds it to the URL via a
useResolveProjectFromArtifact hook.

• New OrganizationPreprodBuildDetailsEndpoint with IDOR protection
  (scopes artifact lookup by project__organization_id)

[NicoHinderling]

• ref(preprod): Remove projectId from URL path utilities #109112 : 2 dependent PRs (#109154 , #109161 )
• feat(preprod): Add org-scoped build-details endpoint and auto-resolve project #109111 👈 (View in Graphite)
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.

[github-actions]

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Org build details bypasses project access

High Severity

OrganizationPreprodBuildDetailsEndpoint fetches PreprodArtifact by project__organization_id only and never scopes to projects the requester can access. An org member without access to a given project could retrieve build details for that project if they know/guess the artifact_id, leaking project_id, project_slug, and build metadata.

 

[NicoHinderling]

i think thats not a real concern