Skip to content

ref(issue-ownership): switch issue assignment off OwnerActorField#113707

Merged
cvxluo merged 1 commit intomasterfrom
cvxluo/switch-issue-assignment-off-owneractorfield
Apr 22, 2026
Merged

ref(issue-ownership): switch issue assignment off OwnerActorField#113707
cvxluo merged 1 commit intomasterfrom
cvxluo/switch-issue-assignment-off-owneractorfield

Conversation

@cvxluo
Copy link
Copy Markdown
Contributor

@cvxluo cvxluo commented Apr 22, 2026

Be more permissive when assigning issue owners. Two forms of this:

  • stop using OwnerActorField
  • for open membership, allow issue assignment to any user or team, as long as the assigner has project level access

We want to stop using OwnerActorField since issue assignment doesn't convey any permissions increase or access to the issue, it's primarily a label for searching. Since issue ownership has its own validation in validate_assignedTo, this won't have any increase in permissions. Note that alerts, etc. still use OwnerActorField.

We also want to allow basically all issue assignment with open membership on. There were some previous edge cases, like where you couldn't assign a team to a issue if the team didn't have access to the project, even with open membership on. These will now be allowed.

Small docs update that clarifies this: getsentry/sentry-docs#17441

More context: https://www.notion.so/sentry/permissive-ownership-assignments-3348b10e4b5d806e91b4cbf12af6a26c?source=copy_link

@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Apr 22, 2026
@cvxluo cvxluo force-pushed the cvxluo/switch-issue-assignment-off-owneractorfield branch from 0b1ab42 to c473217 Compare April 22, 2026 17:57
Comment thread src/sentry/api/helpers/group_index/validators/group.py
@github-actions
Copy link
Copy Markdown
Contributor

github-actions Bot commented Apr 22, 2026

Backend Test Failures

Failures on 441eef5 in this run:

tests/sentry/integrations/slack/webhooks/actions/test_status.py::StatusActionTest::test_assign_issue_where_team_not_in_project_through_unfurllog
[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/integrations/slack/webhooks/actions/test_status.py:622: in test_assign_issue_where_team_not_in_project_through_unfurl
    assert resp.data["text"].endswith("Cannot assign to a team without access to the project")
E   AssertionError: assert False
E    +  where False = <built-in method endswith of str object at 0x7f880cdfe730>('Cannot assign to a team without access to the project')
E    +    where <built-in method endswith of str object at 0x7f880cdfe730> = '[caring-egret] IntegrationError: Identity not found.'.endswith
tests/sentry/issues/endpoints/test_group_details.py::GroupUpdateTest::test_assign_unavailable_teamlog
[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/issues/endpoints/test_group_details.py:619: in test_assign_unavailable_team
    assert response.status_code == 400, response.content
E   AssertionError: b'{"id":"36","shareId":null,"shortId":"BAR-1","title":"Hello world","culprit":null,"permalink":"http://testserver/orga...d":false,"count":"1","userCount":0,"firstSeen":"2026-04-22T18:04:22.201370Z","lastSeen":"2026-04-22T18:04:22.201366Z"}'
E   assert 200 == 400
E    +  where 200 = <Response status_code=200, "application/json">.status_code
tests/sentry/integrations/slack/webhooks/actions/test_status.py::StatusActionTest::test_assign_issue_where_team_not_in_projectlog
[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/integrations/slack/webhooks/actions/test_status.py:608: in test_assign_issue_where_team_not_in_project
    assert resp.data["text"].endswith("Cannot assign to a team without access to the project")
E   AssertionError: assert False
E    +  where False = <built-in method endswith of str object at 0x7fe26d889170>('Cannot assign to a team without access to the project')
E    +    where <built-in method endswith of str object at 0x7fe26d889170> = '[suitable-sponge] IntegrationError: Identity not found.'.endswith

@cvxluo cvxluo force-pushed the cvxluo/switch-issue-assignment-off-owneractorfield branch from c473217 to c8c40a7 Compare April 22, 2026 18:48
@cvxluo cvxluo marked this pull request as ready for review April 22, 2026 19:00
@cvxluo cvxluo requested review from a team as code owners April 22, 2026 19:00
Comment thread src/sentry/api/helpers/group_index/validators/group.py
| ----------------- | -------------------- | --------------------------------- |
| `ActorField` | No | Read-only display, filtering |
| `OwnerActorField` | Yes | Owner assignment, assignee fields |
Default to `OwnerActorField` for any write-op field accepting a team or user reference (assignment, ownership, delegation). Originally PR #106074.
Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

these are docs-only edits to clarify this new exception

@cvxluo cvxluo requested a review from a team April 22, 2026 19:03
Copy link
Copy Markdown
Contributor

@cursor cursor Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Cursor Bugbot has reviewed your changes and found 1 potential issue.

Fix All in Cursor

❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.

Reviewed by Cursor Bugbot for commit c8c40a7. Configure here.

Comment thread src/sentry/api/helpers/group_index/validators/group.py
Comment thread src/sentry/api/helpers/group_index/validators/group.py
Issue assignment has a project-access layer that other OwnerActorField
consumers lack: GroupValidator.validate_assignedTo already verifies the
assignee has access to the project. That project-access check is the
real permission gate for issues.

Switch GroupValidator.assignedTo to ActorField so assignment no longer
requires the assigner to be a member of the target team, and add an
open-membership bypass so all assignment is allowed when allow_joinleave
is set. OwnerActorField is unchanged — the 10 other consumers (alert
rules, monitors, workflows, detectors, etc.) keep their existing team
membership check.

Co-authored-by: Claude <noreply@anthropic.com>
@cvxluo cvxluo force-pushed the cvxluo/switch-issue-assignment-off-owneractorfield branch from c8c40a7 to c8f75f6 Compare April 22, 2026 19:23
Copy link
Copy Markdown
Member

@shashjar shashjar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice

Copy link
Copy Markdown
Contributor

@geoffg-sentry geoffg-sentry left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking solid Charlie, thanks!

@cvxluo cvxluo merged commit 2f0f10a into master Apr 22, 2026
57 checks passed
@cvxluo cvxluo deleted the cvxluo/switch-issue-assignment-off-owneractorfield branch April 22, 2026 21:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants