fix(auth): Carry approved superuser access in ViewerContext (#126126)

After Sentry's normal organization access checks approve superuser
access to an organization the user does not belong to, Sentry adds an
org-bound `superuser: {expires_at}` object to ViewerContext. Propagated
elevation is always read-only, even when the browser session permits
writes: callback authorization caps scopes at `SENTRY_READONLY_SCOPES`.
Org members keep their existing membership-based callback permissions
and ViewerContext lifetime.

Sentry bounds elevation by five minutes and the remaining browser
session limits. Elevated ViewerContext JWTs expire by that deadline, and
re-encoding never extends it. Callbacks recheck organization binding,
the deadline, current user eligibility, and customer access policy;
their request-scoped user copy masks global staff/superuser flags. This
uses the existing Sentry-Seer shared signing key, so Seer is trusted to
preserve the claim. Browser logout or withdrawal of session org
authorization does not immediately revoke an issued claim.

This PR covers ViewerContext issuance and callback authorization.
getsentry/seer#8606 propagates the claim through
Seer; #126377 consumes it when
minting and authenticating agent tokens.

---------

Co-authored-by: Codex <noreply@openai.com>

Author: gricha

src/sentry/api/authentication.py

@@ -27,6 +27,7 @@
 
 from sentry import features, options
 from sentry.auth.services.auth import AuthenticatedToken
+from sentry.auth.superuser import resolve_superuser_access
 from sentry.auth.system import SystemToken, is_internal_ip
 from sentry.hybridcloud.models import ApiKeyReplica, ApiTokenReplica, OrgAuthTokenReplica
 from sentry.hybridcloud.rpc.service import RpcAuthenticationSetupException, compare_signature
@@ -920,9 +921,9 @@ class ViewerContextAuthentication(BaseAuthentication):
     Used by trusted services (e.g., Seer) that echo back the viewer context
     originally signed by Sentry.
 
-    The user is resolved via user_service.get_user() (RPC-backed, cached).
-    Sets request.auth = None so that determine_access derives permissions
-    from the user's OrganizationMember role — identical to session auth.
+    Identity-only contexts derive access from organization membership. An optional
+    Sentry-signed superuser context instead produces an org-bound credential;
+    shared access checks validate it again and cap it to read-only scopes.
     """
 
     def authenticate(self, request: Request) -> tuple[Any, Any] | None:
@@ -979,6 +980,38 @@ def authenticate(self, request: Request) -> tuple[Any, Any] | None:
         # avoid requiring browser-session SSO state on service callbacks.
         setattr(request, "user_from_viewer_context", True)
 
+        if vc.superuser is not None:
+            org_context = (
+                organization_service.get_organization_by_id(
+                    id=vc.organization_id,
+                    user_id=user.id,
+                    include_projects=False,
+                    include_teams=False,
+                )
+                if vc.organization_id is not None
+                else None
+            )
+            delegated = (
+                resolve_superuser_access(vc.superuser, user, org_context)
+                if org_context is not None
+                else None
+            )
+            if delegated is None:
+                raise AuthenticationFailed("Invalid superuser access")
+            scopes, _ = delegated
+            credential = AuthenticatedToken(
+                kind="viewer_context",
+                user_id=user.id,
+                organization_id=vc.organization_id,
+                scopes=sorted(scopes),
+                superuser=vc.superuser,
+            )
+            # Org-bound access must not enable global staff/superuser bypasses.
+            user = user.copy(
+                update={"is_staff": False, "is_superuser": False, "permissions": frozenset()}
+            )
+            return (user, credential)
+
         # Return None for auth to match session behavior —
         # determine_access will derive scopes from org membership role.
         return (user, None)

src/sentry/auth/access.py

@@ -18,7 +18,13 @@
 from sentry.auth.services.access.service import access_service
 from sentry.auth.services.auth import AuthenticatedToken, RpcAuthState, RpcMemberSsoState
 from sentry.auth.staff import is_active_staff
-from sentry.auth.superuser import get_superuser_scopes, is_active_superuser
+from sentry.auth.superuser import (
+    Superuser,
+    get_superuser_access_expiry,
+    get_superuser_scopes,
+    is_active_superuser,
+    resolve_superuser_access,
+)
 from sentry.auth.system import is_system_auth
 from sentry.constants import ObjectStatus
 from sentry.data_secrecy.logic import should_allow_superuser_access
@@ -28,15 +34,23 @@
 from sentry.models.organizationmemberteam import OrganizationMemberTeam
 from sentry.models.project import Project
 from sentry.models.team import Team, TeamStatus
-from sentry.organizations.services.organization import RpcTeamMember, RpcUserOrganizationContext
+from sentry.organizations.services.organization import (
+    RpcTeamMember,
+    RpcUserOrganizationContext,
+    organization_service,
+)
 from sentry.organizations.services.organization.serial import summarize_member
 from sentry.roles import organization_roles
 from sentry.roles.manager import OrganizationRole, TeamRole
 from sentry.seer.agent_token import is_agent_auth
 from sentry.sentry_apps.models.sentry_app import SentryApp
+from sentry.types.request import _HttpRequestWithUser
+from sentry.types.superuser import SuperuserAccess
 from sentry.users.models.user import User
 from sentry.users.services.user import RpcUser
+from sentry.users.services.user.service import user_service
 from sentry.utils import metrics
+from sentry.viewer_context import set_viewer_context_superuser
 
 __all__ = (
     "from_user",
@@ -992,6 +1006,28 @@ def __init__(self) -> None:
         )
 
 
+def _propagate_superuser_access(
+    request: _HttpRequestWithUser,
+    org_context: RpcUserOrganizationContext,
+    su: Superuser | None,
+) -> None:
+    # Members use their normal callback permissions and user flags; adding this
+    # claim would instead force read-only access and a five-minute VC lifetime.
+    if org_context.member is not None:
+        return
+    if request.auth is not None or su is None or not su.is_active:
+        return
+    if su.requires_org_auth(org_context.organization):
+        return
+    expires_at = get_superuser_access_expiry(su, org_context.organization.id)
+    if expires_at is not None:
+        set_viewer_context_superuser(
+            user_id=request.user.id,
+            organization_id=org_context.organization.id,
+            superuser=SuperuserAccess(expires_at=expires_at),
+        )
+
+
 def from_request_org_and_scopes(
     *,
     request: HttpRequest,
@@ -1002,6 +1038,10 @@ def from_request_org_and_scopes(
     Note that `scopes` is usually None because request.auth is not set at `get_authorization_header`
     when the request is made from the frontend using cookies
     """
+    if isinstance(request.auth, AuthenticatedToken) and request.auth.superuser is not None:
+        if rpc_user_org_context is None:
+            return DEFAULT
+        return from_superuser_access(request.auth, rpc_user_org_context)
     if is_agent_auth(request.auth):
         if rpc_user_org_context is None:
             return DEFAULT
@@ -1027,11 +1067,12 @@ def from_request_org_and_scopes(
 
     if is_active_superuser(request):
         su = getattr(request, "superuser", None)
-        if (
-            su
-            and su.requires_org_auth(rpc_user_org_context.organization)
-            and rpc_user_org_context.member is None
-        ):
+        if su is None and request.auth is None:
+            su = Superuser(request)
+        requires_org_auth = su is not None and su.requires_org_auth(
+            rpc_user_org_context.organization
+        )
+        if requires_org_auth and rpc_user_org_context.member is None:
             setattr(request, "_superuser_needs_org_auth", rpc_user_org_context.organization.slug)
 
         member = rpc_user_org_context.member
@@ -1043,12 +1084,14 @@ def from_request_org_and_scopes(
             org_member=member,
         )
 
-        superuser_scopes = get_superuser_scopes(auth_state, request.user, rpc_user_org_context)
+        superuser_scopes = get_superuser_scopes(auth_state, rpc_user_org_context)
         if scopes:
             superuser_scopes = superuser_scopes.union(set(scopes))
         if member and member.scopes:
             superuser_scopes = superuser_scopes.union(set(member.scopes))
 
+        _propagate_superuser_access(request, rpc_user_org_context, su)
+
         return ApiBackedOrganizationGlobalAccess(
             rpc_user_organization_context=rpc_user_org_context,
             auth_state=auth_state,
@@ -1114,7 +1157,9 @@ def from_user_and_rpc_user_org_context(
 def from_request(
     request: Request, organization: Organization | None = None, scopes: Iterable[str] | None = None
 ) -> Access:
-    if is_agent_auth(request.auth):
+    if isinstance(request.auth, AuthenticatedToken) and (
+        is_agent_auth(request.auth) or request.auth.superuser is not None
+    ):
         if organization is None:
             return DEFAULT
         return from_auth(request.auth, organization)
@@ -1154,7 +1199,7 @@ def from_request(
         )
         sso_state = auth_state.sso_state
 
-        superuser_scopes = get_superuser_scopes(auth_state, request.user, organization)
+        superuser_scopes = get_superuser_scopes(auth_state, organization)
         if scopes:
             superuser_scopes = superuser_scopes.union(set(scopes))
         if member and (member_scopes := member.get_scopes()):
@@ -1285,6 +1330,11 @@ def from_rpc_member(
 
 
 def from_auth(auth: AuthenticatedToken, organization: Organization) -> Access:
+    if isinstance(auth, AuthenticatedToken) and auth.superuser is not None:
+        context = organization_service.get_organization_by_id(
+            id=organization.id, user_id=auth.user_id
+        )
+        return from_superuser_access(auth, context) if context is not None else DEFAULT
     if is_system_auth(auth):
         return SystemAccess()
     if is_agent_auth(auth):
@@ -1312,6 +1362,8 @@ def from_auth(auth: AuthenticatedToken, organization: Organization) -> Access:
 def from_rpc_auth(
     auth: AuthenticatedToken, rpc_user_org_context: RpcUserOrganizationContext
 ) -> Access:
+    if isinstance(auth, AuthenticatedToken) and auth.superuser is not None:
+        return from_superuser_access(auth, rpc_user_org_context)
     if is_system_auth(auth):
         return SystemAccess()
     if is_agent_auth(auth):
@@ -1356,4 +1408,30 @@ def from_agent_auth(
     return from_rpc_member(rpc_user_org_context, scopes=auth.get_scopes())
 
 
+def from_superuser_access(
+    auth: AuthenticatedToken, rpc_user_org_context: RpcUserOrganizationContext
+) -> Access:
+    if (
+        auth.superuser is None
+        or auth.organization_id != rpc_user_org_context.organization.id
+        or auth.user_id != rpc_user_org_context.user_id
+    ):
+        return DEFAULT
+    users = user_service.get_many(filter={"user_ids": [auth.user_id]})
+    user = users[0] if users else None
+    if user is None:
+        return DEFAULT
+    delegated = resolve_superuser_access(auth.superuser, user, rpc_user_org_context)
+    if delegated is None:
+        return DEFAULT
+    scopes, _ = delegated
+    return ApiBackedOrganizationGlobalAccess(
+        rpc_user_organization_context=rpc_user_org_context,
+        auth_state=RpcAuthState(
+            sso_state=RpcMemberSsoState(is_valid=True, is_required=False), permissions=[]
+        ),
+        scopes=scopes & set(auth.get_scopes()),
+    )
+
+
 DEFAULT = NoAccess()

src/sentry/auth/services/auth/model.py

@@ -13,6 +13,7 @@
 
 from sentry.auth.scope_declaration import check_scope_declaration
 from sentry.hybridcloud.rpc import RpcModel
+from sentry.types.superuser import SuperuserAccess
 from sentry.users.services.user import RpcUser
 
 if TYPE_CHECKING:
@@ -66,6 +67,7 @@ class AuthenticatedToken(RpcModel):
     organization_id: int | None = None
     application_id: int | None = None  # only relevant for ApiToken
     project_id: int | None = None  # only relevant for ProjectKey
+    superuser: SuperuserAccess | None = Field(default=None, repr=False)
 
     def token_has_org_access(self, organization_id: int) -> bool:
         return self.kind == "api_token" and self.organization_id == organization_id

src/sentry/auth/superuser.py

@@ -30,13 +30,15 @@
 from sentry import options
 from sentry.api.exceptions import DataSecrecyError, SentryAPIException
 from sentry.auth.elevated_mode import ElevatedMode, InactiveReason
-from sentry.auth.services.auth.model import RpcAuthState
+from sentry.auth.services.auth.model import RpcAuthState, RpcMemberSsoState
 from sentry.auth.system import is_system_auth
 from sentry.data_secrecy.logic import should_allow_superuser_access
 from sentry.models.organization import Organization
 from sentry.organizations.services.organization import RpcUserOrganizationContext
 from sentry.types.request import _HttpRequestWithUser, _RequestWithUser
+from sentry.types.superuser import SUPERUSER_ACCESS_TTL, SuperuserAccess
 from sentry.users.models.user import User
+from sentry.users.services.user import RpcUser
 from sentry.utils import metrics
 from sentry.utils.auth import has_completed_sso
 from sentry.utils.settings import is_self_hosted
@@ -89,7 +91,6 @@
 
 def get_superuser_scopes(
     auth_state: RpcAuthState,
-    user: User,
     organization_context: Organization | RpcUserOrganizationContext,
 ) -> set[str]:
     if not should_allow_superuser_access(organization_context):
@@ -315,7 +316,8 @@ def get_session_data(self, current_datetime: datetime | None = None) -> dict[str
             )
             return None
 
-        data = request.session.get(SESSION_KEY)
+        raw_data = request.session.get(SESSION_KEY)
+        data = dict(raw_data) if raw_data else None
         if not cookie_token:
             if data:
                 logger.warning(
@@ -576,3 +578,39 @@ def on_response(self, response: HttpResponse) -> None:
         # otherwise, if the session is invalid and there's a cookie set, clear it
         elif not self.is_valid and request.COOKIES.get(COOKIE_NAME):
             response.delete_cookie(COOKIE_NAME)
+
+
+def get_superuser_access_expiry(su: Superuser, organization_id: int) -> int | None:
+    """Bound an approved superuser session for ViewerContext propagation."""
+    data = su.get_session_data()
+    if data is None:
+        return None
+    now = django_timezone.now()
+    expires = min(data["exp"], data["idl"], now + SUPERUSER_ACCESS_TTL)
+    if organization_id != su.org_id:
+        expires = min(expires, data["exp"] - MAX_AGE + MAX_AGE_PRIVILEGED_ORG_ACCESS)
+    if expires <= now:
+        return None
+    return int(expires.timestamp())
+
+
+def resolve_superuser_access(
+    superuser: SuperuserAccess, user: RpcUser, org_context: RpcUserOrganizationContext
+) -> tuple[set[str], datetime] | None:
+    """Resolve read-only scopes after validating expiry and current user/customer policy."""
+    if not user.is_active or not user.is_superuser or user.is_suspended:
+        return None
+    try:
+        expires = datetime.fromtimestamp(superuser.expires_at, timezone.utc)
+        now = django_timezone.now()
+        if expires <= now or expires > now + SUPERUSER_ACCESS_TTL:
+            return None
+        scopes = (
+            get_superuser_scopes(
+                RpcAuthState(sso_state=RpcMemberSsoState(), permissions=[]), org_context
+            )
+            & settings.SENTRY_READONLY_SCOPES
+        )
+    except (TypeError, ValueError, OverflowError, DataSecrecyError):
+        return None
+    return scopes, expires

src/sentry/data_secrecy/logic.py

@@ -11,7 +11,7 @@
 
 
 def should_allow_superuser_access(
-    organization_context: Organization | RpcUserOrganizationContext,
+    organization_context: Organization | RpcOrganization | RpcUserOrganizationContext,
 ) -> bool:
     # If self hosted installation, allow superuser access
     if settings.SENTRY_SELF_HOSTED:

src/sentry/seer/signed_seer_api.py

@@ -133,7 +133,14 @@ def _resolve_viewer_context(
     )
 
     if has_mismatch:
-        return replace(vc, organization_id=org_id, user_id=user_id, project_id=None, token=None)
+        return replace(
+            vc,
+            organization_id=org_id,
+            user_id=user_id,
+            project_id=None,
+            token=None,
+            superuser=None,
+        )
     return replace(vc, organization_id=org_id, user_id=user_id)
 
 

src/sentry/types/superuser.py

@@ -0,0 +1,14 @@
+from datetime import timedelta
+
+from pydantic import BaseModel, StrictInt
+
+SUPERUSER_ACCESS_TTL = timedelta(minutes=5)
+
+
+class SuperuserAccess(BaseModel):
+    """Read-only elevation for the ViewerContext's user and organization."""
+
+    expires_at: StrictInt
+
+    class Config:
+        frozen = True