From b07b3132af43e1d45fc7e23a6b24a32cce53d387 Mon Sep 17 00:00:00 2001 From: Meredith Date: Mon, 22 Jul 2019 15:16:55 -0700 Subject: [PATCH 1/2] fix(app-platform): Allow GET requests for published apps --- src/sentry/api/bases/sentryapps.py | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/sentry/api/bases/sentryapps.py b/src/sentry/api/bases/sentryapps.py index c18f6015b22e..19feedeb6de4 100644 --- a/src/sentry/api/bases/sentryapps.py +++ b/src/sentry/api/bases/sentryapps.py @@ -160,6 +160,11 @@ def has_object_permission(self, request, view, sentry_app): if sentry_app.owner not in request.user.get_orgs(): raise Http404 + # we can't use ensure_scoped_permission now that the public + # endpoint isn't denoted by '()' + if sentry_app.is_published and request.method == 'GET': + return True + return ensure_scoped_permission( request, self._scopes_for_sentry_app(sentry_app).get(request.method), From a057303e5c4c5ad28ab17e2d3d7458334ff2b10a Mon Sep 17 00:00:00 2001 From: Meredith Date: Mon, 22 Jul 2019 15:59:02 -0700 Subject: [PATCH 2/2] TODO --- src/sentry/api/bases/sentryapps.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/sentry/api/bases/sentryapps.py b/src/sentry/api/bases/sentryapps.py index 19feedeb6de4..1c628d29fa5d 100644 --- a/src/sentry/api/bases/sentryapps.py +++ b/src/sentry/api/bases/sentryapps.py @@ -160,8 +160,9 @@ def has_object_permission(self, request, view, sentry_app): if sentry_app.owner not in request.user.get_orgs(): raise Http404 - # we can't use ensure_scoped_permission now that the public - # endpoint isn't denoted by '()' + # TODO(meredith): make a better way to allow for public + # endpoints. we can't use ensure_scoped_permission now + # that the public endpoint isn't denoted by '()' if sentry_app.is_published and request.method == 'GET': return True