Skip to content

ref(typing): Type request.user with service accounts outside an allowlist - #129402

Draft
gricha wants to merge 1 commit into
ref/sa-narrow-widenfrom
ref/mypy-request-user-principal
Draft

gricha wants to merge 1 commit into
ref/sa-narrow-widenfrom
ref/mypy-request-user-principal

Conversation

@gricha

@gricha gricha commented Oct 30, 2026 •

Copy link
Copy Markdown
Member

mypy now types DRF request.user as User | AnonymousUser | ServiceAccountPrincipal, except in files on tools/mypy_helpers/request_user_allowlist.txt. Those keep today's type, so mypy stays green, while every other file must narrow before it reads user-only attributes.

  • Plugin: an attribute hook on rest_framework.request.Request.user returns the union outside the allowlist. report_config_data rechecks a cached module when it joins or leaves the list.
  • ServiceAccountPrincipal.id is hidden from mypy (if not TYPE_CHECKING) but kept at runtime, so ServiceAccountId still guards unconverted reads.
  • Allowlist: 23 files, exactly the ones with errors once the PRs below land (31 errors): member management (4), issue search (5, after fix(issues): Match no issues for my_teams when the caller has no teams #129424), features.batch_has (3) and 11 one-offs. A test fails if the list grows or names a deleted file, and another fails if the hook stops applying.
  • AGENTS.md: a two-line note that fixing a file means removing it from the list.

No runtime change. It lands after the fixes: the PRs below narrow the rest, and each later fix removes its files from the list.

@github-actions github-actions Bot added the Scope: Backend Automatically applied to PRs that change backend components label Oct 30, 2026
@gricha
gricha force-pushed the ref/mypy-request-user-principal branch from 54aacbe to a6954ca Compare October 31, 2026 01:29
@gricha
gricha changed the base branch from master to ref/principal-helper-examples October 31, 2026 01:29
@gricha
gricha added this pull request to stack #129364 October 31, 2026 01:30
@gricha
gricha removed this pull request from stack #129364 November 1, 2026 04:24
@gricha
gricha changed the base branch from ref/principal-helper-examples to ref/sa-narrow-widen November 1, 2026 04:24
@gricha
gricha force-pushed the ref/mypy-request-user-principal branch from a6954ca to 8d3da3d Compare November 1, 2026 04:24
@gricha
gricha added this pull request to stack #129440 November 1, 2026 04:24
@sentry

sentry Bot commented Nov 1, 2026 •

Copy link
Copy Markdown
Contributor

Sentry Snapshot Testing

Name Added Removed Changed Renamed Unchanged Skipped Status
sentry-frontend
sentry-frontend
0 0 0 0 780 0 ✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

…list

request.user on a DRF Request can be a ServiceAccountPrincipal, but mypy
didn't know, so nothing forced callers to narrow. The mypy plugin now types
it as User | AnonymousUser | ServiceAccountPrincipal, except in the 23 files
on tools/mypy_helpers/request_user_allowlist.txt, which keep today's type.
ServiceAccountPrincipal.id is hidden from mypy but still raises UserRequired
at runtime.

A test fails if the allowlist grows or lists a deleted file.
@gricha
gricha force-pushed the ref/mypy-request-user-principal branch from 8d3da3d to 9be4ce4 Compare November 1, 2026 04:57

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Scope: Backend Automatically applied to PRs that change backend components

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant