fix(api): Validate scope_list in ApiKey serializer#108475
Merged
Conversation
The ApiKeySerializer accepted arbitrary strings in scope_list without validation, inconsistent with OrgAuthToken which validates scopes against SENTRY_SCOPES. Add validate_scope_list to reject invalid scope strings with a 400 response. Co-Authored-By: Claude <[email protected]>
github-actions
bot
added
the
Scope: Backend
JoshFerge
approved these changes
Feb 18, 2026
JonasBa
pushed a commit
that referenced
this pull request
Feb 19, 2026
Add scope validation to `ApiKeySerializer` so that invalid scope strings are rejected with a 400 response instead of being silently persisted. The `OrgAuthToken` model validates `scope_list` against `SENTRY_SCOPES` via `validate_scope_list`, but the legacy `ApiKey` serializer accepted arbitrary strings. While invalid scopes are inert at enforcement time (they never match any endpoint's `allowed_scopes`), the inconsistency represents an oversight and violates defense-in-depth principles. The fix adds a `validate_scope_list` method to `ApiKeySerializer` that checks each scope against `SENTRY_SCOPES` and returns a descriptive error for any invalid entries. Existing tests that relied on saving invalid scopes have been updated to use valid scopes, and new tests cover both fully-invalid and mixed-valid/invalid scope lists. Co-authored-by: Claude <[email protected]>
1 task
mchen-sentry
pushed a commit
that referenced
this pull request
Feb 24, 2026
Add scope validation to `ApiKeySerializer` so that invalid scope strings are rejected with a 400 response instead of being silently persisted. The `OrgAuthToken` model validates `scope_list` against `SENTRY_SCOPES` via `validate_scope_list`, but the legacy `ApiKey` serializer accepted arbitrary strings. While invalid scopes are inert at enforcement time (they never match any endpoint's `allowed_scopes`), the inconsistency represents an oversight and violates defense-in-depth principles. The fix adds a `validate_scope_list` method to `ApiKeySerializer` that checks each scope against `SENTRY_SCOPES` and returns a descriptive error for any invalid entries. Existing tests that relied on saving invalid scopes have been updated to use valid scopes, and new tests cover both fully-invalid and mixed-valid/invalid scope lists. Co-authored-by: Claude <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add scope validation to
ApiKeySerializerso that invalid scope stringsare rejected with a 400 response instead of being silently persisted.
The
OrgAuthTokenmodel validatesscope_listagainstSENTRY_SCOPESvia
validate_scope_list, but the legacyApiKeyserializer acceptedarbitrary strings. While invalid scopes are inert at enforcement time
(they never match any endpoint's
allowed_scopes), the inconsistencyrepresents an oversight and violates defense-in-depth principles.
The fix adds a
validate_scope_listmethod toApiKeySerializerthatchecks each scope against
SENTRY_SCOPESand returns a descriptiveerror for any invalid entries. Existing tests that relied on saving
invalid scopes have been updated to use valid scopes, and new tests
cover both fully-invalid and mixed-valid/invalid scope lists.