fix type issue and make sure we dont have audit log if unchanged+

Author: shellmayr

src/sentry/api/serializers/models/organization.py

@@ -764,11 +764,13 @@ def serialize(  # type: ignore[override]
                 .first()
             )
             context["hasGranularReplayPermissions"] = bool(permissions_enabled)
-            context["replayAccessMembers"] = list(
-                OrganizationMemberReplayAccess.objects.filter(
+            context["replayAccessMembers"] = [
+                user_id
+                for user_id in OrganizationMemberReplayAccess.objects.filter(
                     organizationmember__organization=obj
                 ).values_list("organizationmember__user_id", flat=True)
-            )
+                if user_id is not None
+            ]
 
         if has_custom_dynamic_sampling(obj, actor=user):
             context["targetSampleRate"] = float(

src/sentry/core/endpoints/organization_details.py

@@ -622,10 +622,16 @@ def save(self, **kwargs):
         if "hasGranularReplayPermissions" in data:
             option_key = "sentry:granular-replay-permissions"
             new_value = data["hasGranularReplayPermissions"]
-            option_inst, created = OrganizationOption.objects.update_or_create(
+            option_inst, created = OrganizationOption.objects.get_or_create(
                 organization=org, key=option_key, defaults={"value": new_value}
             )
-            changed_data["hasGranularReplayPermissions"] = f"to {new_value}"
+            if not created and option_inst.value != new_value:
+                old_val = option_inst.value
+                option_inst.value = new_value
+                option_inst.save()
+                changed_data["hasGranularReplayPermissions"] = f"from {old_val} to {new_value}"
+            elif created:
+                changed_data["hasGranularReplayPermissions"] = f"to {new_value}"
 
         if "replayAccessMembers" in data:
             user_ids = data["replayAccessMembers"]

tests/sentry/core/endpoints/test_organization_details.py

@@ -1515,6 +1515,39 @@ def test_granular_replay_permissions_flag_unset(self) -> None:
 
         assert "to False" in log.data["hasGranularReplayPermissions"]
 
+    @with_feature("organizations:granular-replay-permissions")
+    def test_granular_replay_permissions_no_spurious_audit_log(self) -> None:
+        self.organization.update_option("sentry:granular-replay-permissions", True)
+        with assume_test_silo_mode_of(AuditLogEntry):
+            AuditLogEntry.objects.filter(organization_id=self.organization.id).delete()
+
+        data = {"hasGranularReplayPermissions": True}
+        with outbox_runner():
+            self.get_success_response(self.organization.slug, **data)
+
+        with assume_test_silo_mode_of(AuditLogEntry):
+            audit_logs = AuditLogEntry.objects.filter(organization_id=self.organization.id)
+            assert audit_logs.count() == 0
+
+    @with_feature("organizations:granular-replay-permissions")
+    def test_granular_replay_permissions_change_logs_old_value(self) -> None:
+        self.organization.update_option("sentry:granular-replay-permissions", False)
+        with assume_test_silo_mode_of(AuditLogEntry):
+            AuditLogEntry.objects.filter(organization_id=self.organization.id).delete()
+
+        data = {"hasGranularReplayPermissions": True}
+        with outbox_runner():
+            self.get_success_response(self.organization.slug, **data)
+
+        option_value = OrganizationOption.objects.get(
+            organization=self.organization, key="sentry:granular-replay-permissions"
+        )
+        assert option_value.value is True
+
+        with assume_test_silo_mode_of(AuditLogEntry):
+            log = AuditLogEntry.objects.get(organization_id=self.organization.id)
+        assert log.data["hasGranularReplayPermissions"] == "from False to True"
+
     def test_granular_replay_permissions_flag_requires_feature(self) -> None:
         data = {"hasGranularReplayPermissions": True}
         self.get_error_response(self.organization.slug, **data, status_code=404)