ref(preprod): Register endpoints on organization as well as project

[chromy]

We would like the frontend to use paths like

• Individual pages: /preprod/{install/size}/:artifact_id:/?project={project_id}
• Compare pages: /preprod/size/compare/:head_id:/:base_id:/?project={project_id}

Rather than the current ones which look like:

• Install pages are /preprod/:project_id:/:artifact_id:/install
• Size pages are /preprod/:project_id:/:artifact_id

Making project a query param is more consistent with the existing frontend pages.

However this causes difficulties with the API paths.
This existing API paths look like this:

• /api/0/project/:org/:project/preprodartifacts/:head_artifact_id/build-details/

That is they require the :project id/slug even though the :head_artifact_id is region unique.

This double registers each API endpoints:

• once on /api/0/project/:org/:project/...
• once on /api/0/organization/:org/...

We do this by adjusting the endpoint to make :project optional.
If missing it will be filled in from the head_artifact_id.
If present it will be checked against the head_artifact_id.
This allows us to refactor the endpoints to remove the :project without:

• Doing each endpoint individually
• Having a lot of duplicated code in the intermediate state

See EME-725 for context.

[github-actions]

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

[runningcode]

LGTM aside from my comments!

[runningcode]

I'm wondering if there are any security implications here? like does sentry have project level access permissions that this might break?

Are there users that don't have the org permission where this would break?

[chromy]

Tweaked the permissions a bit:

• Now we use event:* as the scope which is more correct I think
• We check in the body of the function that we have permission to access the given project
  Also fixed a bug:
• This ProjectPreprodArtifactPermission is only for the compare triggering not here.

[runningcode]

Oh, cool that event scope works!

[getsantry]

This issue has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you remove the label Waiting for: Community, I will leave it alone ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}