test(integrations): Add permission, IDOR, and edge case tests for bulk code mappings by romtsn · Pull Request #109786 · getsentry/sentry

romtsn · 2026-03-03T16:03:55Z

Summary

Add tests for org:ci token authentication (sentry-cli CI use case)
Add IDOR prevention tests (cross-org project and repo access)
Add permission tests (project access check, org member access)
Add edge case tests (duplicate stackRoots in request, multiple repos with same name)

Depends on #109785
Closes getsentry/sentry-android-gradle-plugin#1075

Test plan

7 additional tests (27 total), all passing
Pre-commit passes

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

tests/sentry/integrations/api/endpoints/test_organization_code_mappings_bulk.py

armenzg · 2026-03-16T16:34:50Z

tests/sentry/integrations/api/endpoints/test_organization_code_mappings_bulk.py

        instance = mock_prc.call_args[0][0]
        assert instance._skip_post_save is False

+    def test_skip_post_save_does_not_leak_to_fetched_instances(self) -> None:


Can you please explain what does this test actually test? I'm not following it.

Added a docstring explaining the test: the endpoint sets _skip_post_save on in-memory instances to batch side-effects, and this test verifies that freshly fetched instances from the DB don't carry the suppressed flag.

— Claude Code

To ensure the transient skip_post_save flag does not leak. added a docstring in 5401221

tests/sentry/integrations/api/endpoints/test_organization_code_mappings_bulk.py

- Switch Repository.objects.create to self.create_repo() factory - Assert automatically_generated=False in happy path test

Suppress the per-save post_save signal during the mapping loop to avoid 300 redundant cache clears and celery task dispatches. Side effects (update_code_owners_schema + clear commit context cache) now fire once after the entire batch completes. Adds dispatch_uid to the RepositoryProjectPathConfig post_save signal connection to enable clean disconnect/reconnect.

…k code mappings Add tests for org:ci token auth, project access checks, cross-org IDOR prevention, duplicate stackRoot handling, and multiple repos with the same name.

The setUp login_as establishes a session that takes precedence over the Bearer token, so the test was passing via session auth, not the org:ci token. Adding logout ensures only token auth is exercised.

_#skip-changelog_ Add the `sentry-cli code-mappings upload` subcommand group and the `upload` subcommand with file parsing and validation. This is the first in a stack of 4 PRs to support bulk uploading code mappings from a JSON file — useful for Java/Android multi-module projects that need dozens of mappings. This PR adds: - Command scaffold following the `repos`/`deploys` pattern - JSON file reading and validation (empty arrays, empty stackRoot/sourceRoot) - CLI args: positional `PATH`, `--repo`, `--default-branch` - Help and no-subcommand trycmd integration tests Stack: **#3207** → #3208 → #3209 → #3210 Backend PRs: getsentry/sentry#109783, getsentry/sentry#109785, getsentry/sentry#109786 Closes getsentry/sentry-android-gradle-plugin#1076 Closes getsentry/sentry-android-gradle-plugin#1077 --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

…3208) *#skip-changelog* When `--repo` or `--default-branch` are not provided, infer them from the<br>local git repository. Uses the configured VCS remote (SENTRY_VCS_REMOTE / ini)<br>first, then falls back to best-effort remote detection (upstream > origin > first). Also extracts `find_best_remote()` as a shared utility in `src/utils/vcs.rs`,<br>replacing the inline logic that was duplicated in `git_repo_base_repo_name_preserve_case`. Stack: #3207 → [#3208](<#3208>) → [#3209](<#3209>) → [#3210](<#3210>) Backend PRs: [getsentry/sentry#109783](<getsentry/sentry#109783>), [getsentry/sentry#109785](<getsentry/sentry#109785>), [getsentry/sentry#109786](<getsentry/sentry#109786>) Closes [GRADLE-79](https://linear.app/getsentry/issue/GRADLE-79/add-git-inference-for-repo-name-and-default-branch) --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

…#3209) _#skip-changelog_ Connect the `code-mappings upload` command to the bulk code mappings API endpoint (`POST /api/0/organizations/{org}/code-mappings/bulk/`). Adds: - `bulk_upload_code_mappings()` method on `AuthenticatedApi` - Request/response data types in `src/api/data_types/code_mappings.rs` - Summary table and error reporting in the command output - Happy-path integration test with mock endpoint Stack: #3207 → #3208 → **#3209** → #3210 Backend PRs: getsentry/sentry#109783, getsentry/sentry#109785, getsentry/sentry#109786 Closes getsentry/sentry-android-gradle-plugin#1079 --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

_#skip-changelog_ Split large mapping files into batches of 300 (the backend limit) per request. Each batch is sent sequentially with progress reporting, and results are merged into a single summary. Also changes the output table to only show error rows — for large uploads (hundreds of mappings), printing every row would flood the terminal. Successful mappings are reflected in the summary counts instead. Stack: #3207 → #3208 → #3209 → **#3210** Backend PRs: getsentry/sentry#109783, getsentry/sentry#109785, getsentry/sentry#109786 --------- Co-authored-by: Claude Opus 4.6 <[email protected]>

vercel bot deployed to Preview March 3, 2026 16:03 View deployment

romtsn requested a review from a team as a code owner March 3, 2026 16:03

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from a7c3d3c to bba4e7d Compare March 3, 2026 23:06

vercel bot deployed to Preview March 3, 2026 23:09 View deployment

cursor bot reviewed Mar 3, 2026

View reviewed changes

tests/sentry/integrations/api/endpoints/test_organization_code_mappings_bulk.py Show resolved Hide resolved

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from bba4e7d to fb4125f Compare March 3, 2026 23:14

vercel bot deployed to Preview March 3, 2026 23:17 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-endpoint branch from 388490d to f859e09 Compare March 3, 2026 23:22

romtsn requested review from a team as code owners March 3, 2026 23:22

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from fb4125f to 7c50a5e Compare March 3, 2026 23:22

vercel bot deployed to Preview March 3, 2026 23:25 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 7c50a5e to 7a39daa Compare March 5, 2026 20:38

vercel bot deployed to Preview March 5, 2026 20:41 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 7a39daa to 63d0d0c Compare March 5, 2026 20:52

vercel bot deployed to Preview March 5, 2026 20:56 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 63d0d0c to 84754bc Compare March 5, 2026 20:59

vercel bot deployed to Preview March 5, 2026 21:02 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 84754bc to 7a5a034 Compare March 5, 2026 21:15

vercel bot deployed to Preview March 5, 2026 21:18 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 7a5a034 to 1627b8f Compare March 5, 2026 22:39

vercel bot deployed to Preview March 5, 2026 22:42 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-endpoint branch from 8a88ceb to e78bac9 Compare March 6, 2026 12:20

romtsn requested a review from a team as a code owner March 6, 2026 12:20

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 1627b8f to 2802318 Compare March 6, 2026 12:20

vercel bot deployed to Preview March 6, 2026 12:23 View deployment

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 2802318 to 2def8c1 Compare March 6, 2026 14:15

vercel bot deployed to Preview March 6, 2026 14:19 View deployment

vercel bot deployed to Preview March 6, 2026 14:33 View deployment

romtsn mentioned this pull request Mar 11, 2026

feat(integrations): Add bulk code mappings API endpoint #109785

Merged

3 tasks

armenzg self-requested a review March 12, 2026 14:45

scttcper approved these changes Mar 12, 2026

View reviewed changes

scttcper reviewed Mar 12, 2026

View reviewed changes

tests/sentry/integrations/api/endpoints/test_organization_code_mappings_bulk.py Outdated Show resolved Hide resolved

armenzg reviewed Mar 16, 2026

View reviewed changes

romtsn force-pushed the rz/feat/bulk-code-mappings-endpoint branch 3 times, most recently from d64c9f8 to a042869 Compare March 17, 2026 12:45

Base automatically changed from rz/feat/bulk-code-mappings-endpoint to master March 17, 2026 14:58

romtsn added 4 commits March 17, 2026 16:57

test: Use factory method and assert automatically_generated

5ff1485

- Switch Repository.objects.create to self.create_repo() factory - Assert automatically_generated=False in happy path test

test(integrations): Add permission, IDOR, and edge case tests for bul…

af4fa41

…k code mappings Add tests for org:ci token auth, project access checks, cross-org IDOR prevention, duplicate stackRoot handling, and multiple repos with the same name.

fix: logout session before token auth test to actually validate org:ci

3b10358

The setUp login_as establishes a session that takes precedence over the Bearer token, so the test was passing via session auth, not the org:ci token. Adding logout ensures only token auth is exercised.

romtsn force-pushed the rz/feat/bulk-code-mappings-edge-cases branch from 990bed3 to 3b10358 Compare March 17, 2026 16:00

github-actions bot added the Scope: Backend Automatically applied to PRs that change backend components label Mar 17, 2026

vercel bot deployed to Preview March 17, 2026 16:03 View deployment

ref: Address PR feedback — add docstrings, remove section headers

5401221

vercel bot deployed to Preview March 17, 2026 16:46 View deployment

romtsn merged commit 944f2e3 into master Mar 17, 2026
59 checks passed

romtsn deleted the rz/feat/bulk-code-mappings-edge-cases branch March 17, 2026 17:13

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

test(integrations): Add permission, IDOR, and edge case tests for bulk code mappings#109786

test(integrations): Add permission, IDOR, and edge case tests for bulk code mappings#109786
romtsn merged 5 commits intomasterfrom
rz/feat/bulk-code-mappings-edge-cases

romtsn commented Mar 3, 2026 •

edited

Loading

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

Uh oh!

armenzg Mar 16, 2026

Uh oh!

romtsn Mar 17, 2026

Uh oh!

romtsn Mar 17, 2026

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

romtsn commented Mar 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

armenzg Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

romtsn Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

romtsn Mar 17, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

romtsn commented Mar 3, 2026 •

edited

Loading