feat(replay): add model to allow per-user access control for replays

shellmayr · shellmayr · commit 9f6c21a4550b · 2025-12-05T13:38:32.000+01:00
diff --git a/src/sentry/api/serializers/models/organization.py b/src/sentry/api/serializers/models/organization.py
@@ -73,6 +73,7 @@
 from sentry.models.options.project_option import ProjectOption
 from sentry.models.organization import Organization, OrganizationStatus
 from sentry.models.organizationaccessrequest import OrganizationAccessRequest
+from sentry.models.organizationmemberreplayaccess import OrganizationMemberReplayAccess
 from sentry.models.organizationonboardingtask import OrganizationOnboardingTask
 from sentry.models.project import Project
 from sentry.models.team import Team, TeamStatus
@@ -557,6 +558,7 @@ class DetailedOrganizationSerializerResponse(_DetailedOrganizationSerializerResp
     enableSeerEnhancedAlerts: bool
     enableSeerCoding: bool
     autoOpenPrs: bool
+    replayAccessMembers: list[int]
 
 
 class DetailedOrganizationSerializer(OrganizationSerializer):
@@ -726,6 +728,26 @@ def serialize(  # type: ignore[override]
             "isDynamicallySampled": is_dynamically_sampled,
         }
 
+        if features.has("organizations:granular-replay-permissions", obj):
+            # The organization option can be missing, False, or null.
+            # Only set hasGranularReplayPermissions to True if the option exists and is truthy.
+            permissions_enabled = (
+                OrganizationOption.objects.filter(
+                    organization=obj, key="sentry:granular-replay-permissions"
+                )
+                .values_list("value", flat=True)
+                .first()
+            )
+            context["hasGranularReplayPermissions"] = bool(permissions_enabled)
+            context["replayAccessMembers"] = list(
+                OrganizationMemberReplayAccess.objects.filter(organization=obj).values_list(
+                    "organizationmember_id", flat=True
+                )
+            )
+        else:
+            context["hasGranularReplayPermissions"] = False
+            context["replayAccessMembers"] = []
+
         if has_custom_dynamic_sampling(obj, actor=user):
             context["targetSampleRate"] = float(
                 obj.get_option("sentry:target_sample_rate", TARGET_SAMPLE_RATE_DEFAULT)
diff --git a/src/sentry/core/endpoints/organization_details.py b/src/sentry/core/endpoints/organization_details.py
@@ -91,6 +91,7 @@
 from sentry.models.options.organization_option import OrganizationOption
 from sentry.models.options.project_option import ProjectOption
 from sentry.models.organization import Organization, OrganizationStatus
+from sentry.models.organizationmemberreplayaccess import OrganizationMemberReplayAccess
 from sentry.models.project import Project
 from sentry.organizations.services.organization import organization_service
 from sentry.organizations.services.organization.model import (
@@ -338,6 +339,12 @@ class OrganizationSerializer(BaseOrganizationSerializer):
     ingestThroughTrustedRelaysOnly = serializers.ChoiceField(
         choices=[("enabled", "enabled"), ("disabled", "disabled")], required=False
     )
+    replayAccessMembers = serializers.ListField(
+        child=serializers.IntegerField(),
+        required=False,
+        allow_null=True,
+        help_text="List of organization member IDs that have access to replay data. Only modifiable by owners and managers.",
+    )
 
     def _has_sso_enabled(self):
         org = self.context["organization"]
@@ -558,6 +565,73 @@ def save(self, **kwargs):
         if trusted_relay_info is not None:
             self.save_trusted_relays(trusted_relay_info, changed_data, org)
 
+        if "hasGranularReplayPermissions" in data or "replayAccessMembers" in data:
+            if not features.has("organizations:granular-replay-permissions", org):
+                raise serializers.ValidationError(
+                    {
+                        "hasGranularReplayPermissions": "This feature is not enabled for your organization."
+                    }
+                )
+
+            if not self.context["request"].access.has_scope("org:admin"):
+                raise serializers.ValidationError(
+                    {
+                        "hasGranularReplayPermissions": "You do not have permission to modify granular replay permissions."
+                    }
+                )
+
+            if "hasGranularReplayPermissions" in data:
+                option_key = "sentry:granular-replay-permissions"
+                new_value = data["hasGranularReplayPermissions"]
+
+                option_inst, created = OrganizationOption.objects.update_or_create(
+                    organization=org, key=option_key, defaults={"value": new_value}
+                )
+
+                if new_value or created:
+                    changed_data["hasGranularReplayPermissions"] = f"to {new_value}"
+
+            if "replayAccessMembers" in data:
+                member_ids = data["replayAccessMembers"]
+
+                if member_ids is None:
+                    member_ids = []
+
+                current_member_ids = set(
+                    OrganizationMemberReplayAccess.objects.filter(organization=org).values_list(
+                        "organizationmember_id", flat=True
+                    )
+                )
+                new_member_ids = set(member_ids)
+
+                to_add = new_member_ids - current_member_ids
+                to_remove = current_member_ids - new_member_ids
+
+                if to_add:
+                    OrganizationMemberReplayAccess.objects.bulk_create(
+                        [
+                            OrganizationMemberReplayAccess(
+                                organization=org, organizationmember_id=member_id
+                            )
+                            for member_id in to_add
+                        ]
+                    )
+
+                if to_remove:
+                    OrganizationMemberReplayAccess.objects.filter(
+                        organization=org, organizationmember_id__in=to_remove
+                    ).delete()
+
+                if to_add or to_remove:
+                    changes = []
+                    if to_add:
+                        changes.append(f"added {len(to_add)} member(s)")
+                    if to_remove:
+                        changes.append(f"removed {len(to_remove)} member(s)")
+                    changed_data["replayAccessMembers"] = (
+                        f"{' and '.join(changes)} (total: {len(new_member_ids)} member(s) with access)"
+                    )
+
         if "openMembership" in data:
             org.flags.allow_joinleave = data["openMembership"]
         if "allowSharedIssues" in data:
@@ -775,6 +849,16 @@ class OrganizationDetailsPutSerializer(serializers.Serializer):
         help_text="The role required to download debug information files, ProGuard mappings and source maps.",
         required=False,
     )
+    hasGranularReplayPermissions = serializers.BooleanField(
+        help_text="Specify `true` to enable granular replay permissions, allowing per-member access control for replay data.",
+        required=False,
+    )
+    replayAccessMembers = serializers.ListField(
+        child=serializers.IntegerField(),
+        help_text="A list of organization member IDs who have permission to access replay data. When empty, all members have access. Requires the granular-replay-permissions feature flag.",
+        required=False,
+        allow_null=True,
+    )
 
     # avatar
     avatarType = serializers.ChoiceField(
diff --git a/src/sentry/migrations/1012_organizationmember_replay_access.py b/src/sentry/migrations/1012_organizationmember_replay_access.py
@@ -0,0 +1,64 @@
+# Generated by Django 5.2.8 on 2025-12-02 12:31
+
+import django.db.models.deletion
+import django.utils.timezone
+from django.db import migrations, models
+
+import sentry.db.models.fields.bounded
+import sentry.db.models.fields.foreignkey
+from sentry.new_migrations.migrations import CheckedMigration
+
+
+class Migration(CheckedMigration):
+    # This flag is used to mark that a migration shouldn't be automatically run in production.
+    # This should only be used for operations where it's safe to run the migration after your
+    # code has deployed. So this should not be used for most operations that alter the schema
+    # of a table.
+    # Here are some things that make sense to mark as post deployment:
+    # - Large data migrations. Typically we want these to be run manually so that they can be
+    #   monitored and not block the deploy for a long period of time while they run.
+    # - Adding indexes to large tables. Since this can take a long time, we'd generally prefer to
+    #   run this outside deployments so that we don't block them. Note that while adding an index
+    #   is a schema change, it's completely safe to run the operation after the code has deployed.
+    # Once deployed, run these manually via: https://develop.sentry.dev/database-migrations/#migration-deployment
+
+    is_post_deployment = False
+
+    dependencies = [
+        ("sentry", "1011_update_oc_integration_cascade_to_null"),
+    ]
+
+    operations = [
+        migrations.CreateModel(
+            name="OrganizationMemberReplayAccess",
+            fields=[
+                (
+                    "id",
+                    sentry.db.models.fields.bounded.BoundedBigAutoField(
+                        primary_key=True, serialize=False
+                    ),
+                ),
+                ("date_added", models.DateTimeField(default=django.utils.timezone.now)),
+                (
+                    "organization",
+                    sentry.db.models.fields.foreignkey.FlexibleForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="replay_access_set",
+                        to="sentry.organization",
+                    ),
+                ),
+                (
+                    "organizationmember",
+                    sentry.db.models.fields.foreignkey.FlexibleForeignKey(
+                        on_delete=django.db.models.deletion.CASCADE,
+                        related_name="replay_access",
+                        to="sentry.organizationmember",
+                    ),
+                ),
+            ],
+            options={
+                "db_table": "sentry_organizationmemberreplayaccess",
+                "unique_together": {("organization", "organizationmember")},
+            },
+        ),
+    ]
diff --git a/src/sentry/models/__init__.py b/src/sentry/models/__init__.py
@@ -74,6 +74,7 @@
 from .organizationmember import *  # NOQA
 from .organizationmemberinvite import *  # NOQA
 from .organizationmembermapping import *  # NOQA
+from .organizationmemberreplayaccess import *  # NOQA
 from .organizationmemberteam import *  # NOQA
 from .organizationmemberteamreplica import *  # NOQA
 from .organizationonboardingtask import *  # NOQA
diff --git a/src/sentry/models/organizationmemberreplayaccess.py b/src/sentry/models/organizationmemberreplayaccess.py
@@ -0,0 +1,34 @@
+from __future__ import annotations
+
+from django.db import models
+from django.utils import timezone
+
+from sentry.backup.scopes import RelocationScope
+from sentry.db.models import FlexibleForeignKey, Model, region_silo_model, sane_repr
+
+
+@region_silo_model
+class OrganizationMemberReplayAccess(Model):
+    """
+    Tracks which organization members have permission to access replay data.
+
+    When no records exist for an organization, all members have access (default).
+    When records exist, only members with a record can access replays.
+    """
+
+    __relocation_scope__ = RelocationScope.Organization
+
+    organization = FlexibleForeignKey("sentry.Organization", related_name="replay_access_set")
+    organizationmember = FlexibleForeignKey(
+        "sentry.OrganizationMember",
+        on_delete=models.CASCADE,
+        related_name="replay_access",
+    )
+    date_added = models.DateTimeField(default=timezone.now)
+
+    class Meta:
+        app_label = "sentry"
+        db_table = "sentry_organizationmemberreplayaccess"
+        unique_together = (("organization", "organizationmember"),)
+
+    __repr__ = sane_repr("organization_id", "organizationmember_id")
diff --git a/src/sentry/testutils/helpers/backups.py b/src/sentry/testutils/helpers/backups.py
@@ -472,6 +472,14 @@ def create_exhaustive_organization(
             organization=org, key="sentry:scrape_javascript", value=True
         )
 
+        # OrganizationMemberReplayAccess - add for the owner member
+        from sentry.models.organizationmemberreplayaccess import OrganizationMemberReplayAccess
+
+        owner_member = OrganizationMember.objects.get(organization=org, user_id=owner_id)
+        OrganizationMemberReplayAccess.objects.create(
+            organization=org, organizationmember=owner_member
+        )
+
         # Team
         team = self.create_team(name=f"test_team_in_{slug}", organization=org)
         self.create_team_membership(user=owner, team=team)
