perf(auth): Skip full organization hydration during access checks

Fetch project and team IDs lazily for RPC-backed global access, allowing permission contexts to omit full resource collections. Preserve active-resource filtering and request-local caching.

Refs ISWF-3361

Author: shashjar

src/sentry/api/permissions.py

@@ -227,7 +227,10 @@ def determine_access(
             org_context = organization
         else:
             org_context = organization_service.get_organization_by_id(
-                id=extract_id_from(organization), user_id=user_id
+                id=extract_id_from(organization),
+                user_id=user_id,
+                include_projects=False,
+                include_teams=False,
             )
 
         if org_context is None:
@@ -393,6 +396,8 @@ def determine_access(
             org_context = organization_service.get_organization_by_id(
                 id=extract_id_from(organization),
                 user_id=request.user.id if request.user else None,
+                include_projects=False,
+                include_teams=False,
             )
 
         assert org_context is not None, "Failed to fetch organization in determine_access"

src/sentry/auth/access.py

@@ -827,17 +827,17 @@ def has_project_access(self, project: Project) -> bool:
     @cached_property
     def accessible_team_ids(self) -> frozenset[int]:
         return frozenset(
-            t.id
-            for t in self.rpc_user_organization_context.organization.teams
-            if t.status == TeamStatus.ACTIVE
+            organization_service.get_active_team_ids(
+                organization_id=self.rpc_user_organization_context.organization.id
+            )
         )
 
     @cached_property
     def accessible_project_ids(self) -> frozenset[int]:
         return frozenset(
-            p.id
-            for p in self.rpc_user_organization_context.organization.projects
-            if p.status == ObjectStatus.ACTIVE
+            organization_service.get_active_project_ids(
+                organization_id=self.rpc_user_organization_context.organization.id
+            )
         )
 
 
@@ -1332,7 +1332,10 @@ def from_rpc_member(
 def from_auth(auth: AuthenticatedToken, organization: Organization) -> Access:
     if isinstance(auth, AuthenticatedToken) and auth.superuser is not None:
         context = organization_service.get_organization_by_id(
-            id=organization.id, user_id=auth.user_id
+            id=organization.id,
+            user_id=auth.user_id,
+            include_projects=False,
+            include_teams=False,
         )
         return from_superuser_access(auth, context) if context is not None else DEFAULT
     if is_system_auth(auth):

tests/sentry/api/bases/test_organization.py

@@ -38,11 +38,12 @@
 from sentry.models.organization import Organization
 from sentry.models.organizationmember import OrganizationMember
 from sentry.organizations.services.organization import organization_service
+from sentry.organizations.services.organization.impl import DatabaseBackedOrganizationService
 from sentry.silo.base import SiloMode
 from sentry.testutils.cases import TestCase
 from sentry.testutils.helpers.datetime import freeze_time
 from sentry.testutils.requests import drf_request_from_request
-from sentry.testutils.silo import assume_test_silo_mode
+from sentry.testutils.silo import all_silo_test, assume_test_silo_mode
 from sentry.users.services.user.serial import serialize_rpc_user
 from sentry.users.services.user.service import user_service
 from sentry.utils.security.orgauthtoken_token import hash_token
@@ -501,6 +502,62 @@ def build_request(self, user=None, active_superuser=False, **params):
         return request
 
 
+@all_silo_test
+class DetermineAccessHydrationTest(TestCase):
+    def test_member_access_omits_full_organization_resources(self) -> None:
+        user = self.create_user()
+        org = self.create_organization(flags=0)
+        team = self.create_team(organization=org)
+        project = self.create_project(organization=org, teams=[team])
+        self.create_member(user=user, organization=org, role="member", teams=[team])
+        other_team = self.create_team(organization=org)
+        other_project = self.create_project(organization=org, teams=[other_team])
+        request = drf_request_from_request(self.make_request(user=user))
+
+        with (
+            mock.patch.object(
+                DatabaseBackedOrganizationService,
+                "get_organization_by_id",
+                autospec=True,
+                side_effect=DatabaseBackedOrganizationService.get_organization_by_id,
+            ) as get_org,
+            mock.patch(
+                "sentry.organizations.services.organization.serial.serialize_project"
+            ) as serialize_project,
+            mock.patch(
+                "sentry.organizations.services.organization.serial.serialize_rpc_team"
+            ) as serialize_team,
+        ):
+            OrganizationPermission().determine_access(request, org)
+
+        get_org.assert_called_once()
+        assert get_org.call_args.kwargs["id"] == org.id
+        assert get_org.call_args.kwargs["user_id"] == user.id
+        assert get_org.call_args.kwargs["include_projects"] is False
+        assert get_org.call_args.kwargs["include_teams"] is False
+        serialize_project.assert_not_called()
+        serialize_team.assert_not_called()
+        assert request.access.accessible_team_ids == frozenset({team.id})
+        assert request.access.accessible_project_ids == frozenset({project.id})
+        assert not request.access.has_team_access(other_team)
+        assert not request.access.has_project_access(other_project)
+
+    def test_existing_context_is_reused(self) -> None:
+        user = self.create_user()
+        org = self.create_organization(owner=user)
+        context = organization_service.get_organization_by_id(
+            id=org.id, user_id=user.id, include_projects=False, include_teams=False
+        )
+        assert context is not None
+        request = drf_request_from_request(self.make_request(user=user))
+
+        with mock.patch.object(organization_service, "get_organization_by_id") as get_org:
+            OrganizationPermission().determine_access(request, context)
+
+        get_org.assert_not_called()
+        assert request.access.has_scope("org:read")
+
+
 class ControlSiloOrganizationEndpointTest(TestCase):
     def setUp(self) -> None:
         super().setUp()

tests/sentry/api/test_permissions.py

@@ -1,3 +1,5 @@
+from unittest.mock import patch
+
 from rest_framework.views import APIView
 
 from sentry.api.bases.organization import OrganizationPermission
@@ -296,6 +298,28 @@ def test_determine_access_no_demo_users(self) -> None:
 
             assert readonly_rpc_context.member.scopes == list(self.org_member_scopes)
 
+    def test_determine_access_omits_full_organization_resources(self) -> None:
+        team = self.create_team(organization=self.organization)
+        self.create_project(organization=self.organization, teams=[team])
+        request = self.make_request(self.readonly_user)
+
+        with (
+            override_options(
+                {"demo-mode.enabled": True, "demo-mode.users": [self.readonly_user.id]}
+            ),
+            patch(
+                "sentry.organizations.services.organization.serial.serialize_project"
+            ) as serialize_project,
+            patch(
+                "sentry.organizations.services.organization.serial.serialize_rpc_team"
+            ) as serialize_team,
+        ):
+            self.user_permission.determine_access(request=request, organization=self.organization)
+
+        serialize_project.assert_not_called()
+        serialize_team.assert_not_called()
+        assert request.access.scopes == frozenset(READONLY_SCOPES)
+
 
 class InsufficientScopeResponseTest(APITestCase):
     """End-to-end: a token-scope denial reaches the client as a 403 carrying the RFC 6750