[sentry-junior]

Fixes three places where one organization's data could be read or modified through another organization's request. Same change in both the Python and TypeScript backends.

Refs IE-93.

Changes

GET /api/items/ and GET /api/users/

Before: if ?organization= was missing, or didn't match an organization, the endpoint returned rows from every organization.

After:

• missing organization → 400
• unknown organization → 404
• otherwise only that organization's rows are returned

The frontend (KanbanPage.tsx) is the only caller, and it always passes ?organization=<slug>.

Python only: on /api/items/, the user filter used to be skipped when the request went through the Sentry-enrichment path. It's now applied in both paths.

POST /api/sentry/issue-link/link/

Before: the selected item was looked up by itemId alone, so an installation could link a Sentry issue to another organization's item.

After: the lookup also matches the installation's organization, and returns 404 if the item isn't found. Previously a missing item crashed with a 500.

Files:

• backend-py/src/api/endpoints/items.py, users.py, sentry/issue_link.py
• backend-ts/src/api/items.ts, users.ts, sentry/issueLink.ts

Tests

Removed the two tests per backend that asserted the unscoped behavior (GET with no organization returns everything). Added:

• GET items / users with no organization → 400
• GET items / users with an unknown organization → 404
• linking an item from another organization → 404, and the item is left unchanged
• Python: user filter combined with organization, including a user from another organization → empty list

All the new tests fail against main (7 Python, 5 TypeScript) and pass on this branch.

Verification

• backend-py: pytest 60 passed (Python 3.13); black 22.6.0 and flake8 4.0.1 clean on changed files
• backend-ts: jest 44 passed; tsc --noEmit clean; eslint clean on changed files except a Prettier error in src/api/items.ts line 18, which is also on main
• Both containers against the seeded DB: no organization → 400, unknown → 404, acme → 200 for /api/users/ (both) and /api/items/ (TS)

/api/items/?organization=acme on the Python container returns 500 on both main and this branch. It's unrelated to this change: Item.sentry_id is not None in items.py always evaluates to True, so every request goes down the Sentry-enrichment path and fails when the org has no Sentry installation.

via matt.duncan.

--

View Junior Session [Sentry]

[linear-code]

IE-93