[gricha]

User, auth, auth_v2 and relocation code reads the caller through sentry.auth.principal: person-only paths (passwords, 2FA, account merge, relocation creator) use require_user(), self checks in user permissions use is_acting_user(), "mine" lookups (relocation list, id:me) use owned_by_acting_user(), and logs use acting_user_id(). access.from_user(), normalize_valid_user() and SessionSerializer.serialize() take a service account (type-only).

• A service account gets an empty relocation list instead of 403 (new test); creating or retrying one is 403 user-required. User and auth_v2 endpoints are control-silo.
• An API key deleting a user's last primary authenticator with backup codes gets 401 instead of a 500.
• Users and agents see no change.

Left: user_authenticator_details.py passes the caller to capture_security_activity on a path API keys reach, so it stays on #129402's mypy allowlist.

[sentry]

Sentry Snapshot Testing

Name	Added	Removed	Changed	Renamed	Unchanged	Skipped	Status
sentry-frontend sentry-frontend	0	0	0	0	780	0	✅ Unchanged

⚙️ sentry-frontend Snapshot Settings

[sentry-warden]

Backup MFA removal records the caller as the account owner

When an admin removes another user's last primary authenticator, this call passes the admin from require_user(request) as account, so capture_security_activity records the backup removal under the admin's user_id rather than the authenticator owner's. Pass account=user and actor=request.user, matching the other removal calls; the helper accepts AnonymousUser as an actor, so this also avoids rejecting an API-key caller at this point.

Evidence

• In the last-primary branch of UserAuthenticatorDetailsEndpoint.delete(), the backup authenticators belong to user, but the call passes require_user(request) as account.
• capture_security_activity logs account.id as user_id, so when an admin removes another user's authenticator, the audit event is attributed to the admin rather than the target.
• UserEndpoint.requires_user rejects authenticated principals without a user, but an API key's AnonymousUser is unauthenticated; this endpoint's organization permission path can allow the request to reach the branch.
• For that API-key request, require_user(request) raises NotAuthenticated inside the atomic block, rolling back the deletions. The helper accepts AnonymousUser as actor, and sibling removal calls pass account=user and actor=request.user.

_{Identified by Warden · sentry-backend-bugs · T5J-3YH}