Repository navigation
feat(sentry): Read every org that installs the public integration - #2565
Draft
sentry-junior[bot] wants to merge 1 commit into
Draft
sentry-junior[bot] wants to merge 1 commit into
sentry-junior[bot] wants to merge 1 commit into
Conversation
Add installations of a Sentry public integration next to the internal integration. The installation webhook saves the org and exchanges the grant code. Org-scoped reads use the token of that org's installation, minted again with a client JWT when the cached token nears expiry. The internal integration token still covers reads that no installation covers, so prod can move from one to the other without a cutover. Refs #2559 Co-Authored-By: David Cramer <23610+dcramer@users.noreply.github.com> Co-Authored-By: Burak Yigit Kaya <burak.kaya@sentry.io>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Contributor
|
5 screenshot changes — 5 changed · 0 added · 0 removed Review screenshots in Frameshift
|
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proof of concept for #2559. Junior reads any Sentry org that installs its public integration, using that org's own installation token. The internal integration keeps working next to it, so prod can move over without a cutover.
Installations
junior_sentry_installations(installuuid, org slug), with the plugin's first migration. Core does not read it.installation.createdsaves the org and exchanges the grant code for the first token. A Sentry retry does not exchange the code again, and an uninstalled installation is never added back.installation.deletedkeeps the row with no org.Tokens
Reads (
grantForEgress)/organizations/{org}/,/projects/{org}/…or/teams/{org}/…selects the installation. The grant carriesleaseScope: installation:<uuid>. The grant is stillorg-read, so the host does not keep the headers./issues/{id}/) uses the only installation. With more than one installation, Junior denies it and asks for the org-scoped path.SENTRY_READ_TOKENis set, it covers every read that no installation covers. Without it, reads of an org with no installation are denied withEgressPolicyDenied. They never fall back to user OAuth (feat(sentry): Read other orgs with the user's OAuth token #2457).Webhooks
SENTRY_APP_CLIENT_SECRETand thenSENTRY_WEBHOOK_SECRET. A public-integration delivery must come from an active installation. Installation webhooks are only accepted from the public integration.New env vars:
SENTRY_APP_CLIENT_ID,SENTRY_APP_CLIENT_SECRET.Prod rollout (no big-bang migration)
sentry, with read-only permissions, the issue webhook and Alert Rule Action. Set the webhook URL to/api/webhooks/sentry, with no redirect URL. Set the two new env vars, redeploy, then install it insentry.sentrynow use the installation token.SENTRY_READ_TOKENstill covers anything else.junior-c01117to the new app. Both secrets verify webhooks while this happens. Issue events from both integrations have the sameeventKey. I expect them to dedupe, but I have not checked this in prod.SENTRY_READ_TOKENandSENTRY_WEBHOOK_SECRET.Must land before a second org is installed
orgevent filter, with org-wide events requiring it, plus a backfill oforg: sentryon existing org-wide Sentry automations. Today an automation without an identifier runs for every installed org.checkResourcetrigger check from Support every GitHub App installation #2404, so saving a trigger for an org with no installation fails.ORG/, and should list installed orgs instead of usingsentry org list.Not in this POC
junior-google's setup page).401comes back. A409from two mints at once fails that one request.Tests:
pnpm --filter @sentry/junior-sentry test/lint/typecheck, plusmigration-metadata:checkandtest-architecture:check. Not tested against a real Sentry public integration yet.via @dcramer.
--
View Session [Sentry]