API Delete Debug File endpoint requires different scope and cannot find existing files
- Dominant language
- Python
- Stars
- 44.8k
- Forks
- 4.9k
- Avg merge
- 22h 21m
- Merged PRs (30d)
- 586
Description
### Environment
SaaS (https://sentry.io/)
### Steps to Reproduce
1. Generate an API token with Project Read + Write access
2. Use this generated token (header of Authorization: Bearer ) to get debug files for a project in the org. `GET https://sentry.io/api/0/projects///files/dsyms/?&cursor=20:0:0`
3. See valid debug files that have been uploaded in the recent past. Choose one and record the `id` property. Call it 000000000.
4. Send this delete request with the same auth header used in the GET. `DELETE https://sentry.io/api/0/projects///files/dsyms/?id=000000000`
5. Instead of a valid 200 response, you get a 403 Forbidden.
6. Try elevating privileges. Create a new API Token with the highest access to all scopes. Retry the DELETE call for the same id, but replace the limited access token with this new elevated one.
7. Instead of a valid 200 response, observe a 404 Not Found response.
This was consulted for reference: https://docs.sentry.io/api/projects/delete-a-specific-projects-debug-information-file/
I realize this is potentially two-in-one, but both seem pertinent to the use case of trying to delete a file that hasn't lapsed on the lifetime timer but needs to be removed to save space.
Other things I tried:
I noticed that the returned information for a debug file included an `id`, a `uuid`, and a `debugId`. I tried using each of these as the `?id=` query parameter, but saw no change in behaviour. The API returned 404 every time.
### Expected Result
I expected to be able to use the `project:write` scope in a token to make use of the delete endpoint for the debug files.
I also expected to be able to delete the file that I was able to observe with the GET request immediately prior.
### Actual Result
With the documented scope, I received a 403 Unauthorized for the DELETE request, but a successful 200 response for the GET request.
With the elevated scoped token, I received a 404 Not Found for the DELETE request, but a successful 200 response for the GET request.
### Product Area
APIs
### Link
_No response_
### DSN
https://82d686712b2311765cdd86f35e588331@o1018989.ingest.us.sentry.io/4506867340607488
### Version
_No response_
Contributor guide
Research direction
Start with the documented delete endpoint for project debug information files and trace the GET and DELETE handlers for `/api/0/projects///files/dsyms/`. Compare their authorization scope and handling of the returned `id`, `uuid`, and `debugId`; done means the documented scope can delete a file returned by GET and regression coverage verifies both responses.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100