feat(data-secrecy): Migration to Add prevent_superuser_access Bit Flag
#74700
Conversation
github-actions
bot
added
the
Scope: Backend
| with self.options( | ||
| {"system.url-prefix": "http://example.com"} | ||
| ), self.tasks(), outbox_runner(): | ||
| with ( |
There was a problem hiding this comment.
A lot of these diffs are auto-formatting from IDE
| ).values_list("organization_id", "user_id") | ||
|
|
||
| for (org_id, user_id) in queried_owner_ids: | ||
| for org_id, user_id in queried_owner_ids: |
There was a problem hiding this comment.
Auto formatting from IDE
src/sentry/models/organization.py
Outdated
| disable_member_project_creation: bool | ||
|
|
||
| # Disable superuser access to an organization | ||
| disable_superuser_access: bool |
There was a problem hiding this comment.
This is a negative since the default is False and we do not want to have data secrecy enabled by default.
|
This PR has a migration; here is the generated SQL for --
-- Alter field flags on organization
--
-- (no-op) |
cathteng
left a comment
cathteng
left a comment
There was a problem hiding this comment.
the wording for this project is difficult for sure
| "require_2fa": org.flags.require_2fa.is_set, | ||
| "codecov_access": org.flags.codecov_access.is_set, | ||
| "disable_member_project_creation": org.flags.disable_member_project_creation.is_set, | ||
| "disable_superuser_access": org.flags.disable_superuser_access.is_set, |
There was a problem hiding this comment.
i've had trouble with options using the negative before... i would suggest calling this allow_superuser_access
There was a problem hiding this comment.
This is a negative since the default is False and we do not want to have data secrecy enabled by default.
If i make this allow, I will need to write a script to make everyone's allow_data_secrecy True by default and we would have to do this for every new org creation.
There was a problem hiding this comment.
What about prevent_superuser_access? That would avoid needing to use negation 🤷
| ), | ||
| "avatar": avatar, | ||
| "allowMemberProjectCreation": not obj.flags.disable_member_project_creation, | ||
| "allowSuperuserAccess": not obj.flags.disable_superuser_access, |
There was a problem hiding this comment.
would customers understand what this means? can we specify that this means sentry employees?
There was a problem hiding this comment.
we can add a description in the frontend for this
iamrajjoshi
changed the title
disable_superuser_access Bit Flagdisable_superuser_access Bit Flag
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## master #74700 +/- ##
=======================================
Coverage 78.14% 78.15%
=======================================
Files 6730 6731 +1
Lines 300110 300162 +52
Branches 51623 51627 +4
=======================================
+ Hits 234529 234582 +53
+ Misses 59256 59254 -2
- Partials 6325 6326 +1
|
iamrajjoshi
force-pushed
the
raj/ds/bitflag-mig-1
branch
from
c23631e to
924557b
Compare
|
This PR has a migration; here is the generated SQL for --
-- Alter field flags on organization
--
-- (no-op) |
iamrajjoshi
changed the title
disable_superuser_access Bit Flagprevent_superuser_access Bit Flag
wedamija
left a comment
wedamija
left a comment
There was a problem hiding this comment.
migration lgtm, bitflag changes are a no-op
…es (#74891) I recently merged a [migration](#74700) to add `prevent_superuser_access` to the Organization bitflag and now need to add it to Hybrid Cloud services to sync since I need it to exist on `RpcOrganization`. In this PR, I also add the `disable_member_project_creation` flag since it existed above the new flag I created. My flag is still not used in our logic, but the `disable_member_project_creation` is currently being used, so we need to make sure this pr doesn't mess around with its value.
…es (#74891) I recently merged a [migration](#74700) to add `prevent_superuser_access` to the Organization bitflag and now need to add it to Hybrid Cloud services to sync since I need it to exist on `RpcOrganization`. In this PR, I also add the `disable_member_project_creation` flag since it existed above the new flag I created. My flag is still not used in our logic, but the `disable_member_project_creation` is currently being used, so we need to make sure this pr doesn't mess around with its value.
Created migration to add bit flag to Organization. Will need to follow this up with a migration to add the flag so Hybrid Cloud services can handle syncing.
Glossary
Data secrecy mode: Disallows any kind of superuser access into an organization
Enable/Disable Data secrecy mode: Persistently enable/disable data secrecy for an organization
Waive Data secrecy mode: Temporarily disable data secrecy for an organizations
Reinstate Data secrecy mode: Re-enable data secrecy after a temporary waiver
This flag handles the enable/disable function.
spec