feat(auth): Gate OAuth React entry points behind an option (#128288)

OAuth authorization needs a controlled cutover to the React flows after
the frontend and API changes are deployed.

Register `auth.oauth-react-enabled`, defaulting to false. When enabled,
browser authorization and device verification GET requests serve the
React application, including unauthenticated device requests so the flow
can handle login. Existing POST handling remains available.

Keep both OAuth entry points on the primary domain in multi-region
deployments, matching login. Customer-domain requests redirect to the
primary host with their query strings preserved, and an active
organization does not move primary-domain requests to an organization
host.

Author: evanpurkhiser

src/sentry/options/defaults.py

@@ -283,6 +283,11 @@
     default=False,
     flags=FLAG_ALLOW_EMPTY | FLAG_PRIORITIZE_DISK | FLAG_REQUIRED,
 )
+register(
+    "auth.oauth-react-enabled",
+    default=False,
+    flags=FLAG_AUTOMATOR_MODIFIABLE,
+)
 register(
     "auth.email-verification-at-signup.rollout-rate",
     type=Float,

src/sentry/web/frontend/oauth_authorize.py

@@ -12,7 +12,7 @@
 from django.utils.safestring import mark_safe
 from django.views.decorators.cache import never_cache
 
-from sentry import analytics
+from sentry import analytics, options
 from sentry.analytics.events.oauth_consent import OAuthConsentEvent
 from sentry.api.helpers.oauth_authorize.approval import approve_authorization
 from sentry.api.helpers.oauth_authorize.request import build_authorization_request
@@ -37,13 +37,14 @@
 from sentry.utils import auth
 from sentry.web.client_config import get_client_config
 from sentry.web.frontend.base import BaseView, control_silo_view
+from sentry.web.frontend.react_page import ReactMixin
 
 logger = logging.getLogger("sentry.oauth")
 
 
 @control_silo_view
 @method_decorator(never_cache, name="dispatch")
-class OAuthAuthorizeView(BaseView):
+class OAuthAuthorizeView(BaseView, ReactMixin):
     enforce_rate_limit = True
     rate_limits = RateLimitConfig(
         limit_overrides={"GET": {RateLimitCategory.IP: RateLimit(limit=20, window=1)}}
@@ -114,6 +115,9 @@ def error(
         return self.redirect_response(response_type, redirect_uri, {"error": name, "state": state})
 
     def get(self, request: HttpRequest, **kwargs) -> HttpResponseBase:
+        if options.get("auth.oauth-react-enabled"):
+            return self.handle_react(request)
+
         try:
             serializer = OAuthAuthorizeQuerySerializer(data=request.GET)
             if not serializer.is_valid():

src/sentry/web/frontend/oauth_device.py

@@ -1,12 +1,15 @@
 from __future__ import annotations
 
+from typing import Any
+
 from django.contrib.auth.views import redirect_to_login
 from django.http import HttpRequest, HttpResponse
 from django.http.response import HttpResponseBase
 from django.urls import reverse
 from django.utils.decorators import method_decorator
 from django.views.decorators.cache import never_cache
 
+from sentry import options
 from sentry.api.helpers.oauth_consent import (
     InvalidOrganizationSelection,
     get_organization_options,
@@ -28,6 +31,7 @@
 from sentry.utils import auth
 from sentry.web.client_config import get_client_config
 from sentry.web.frontend.base import BaseView, control_silo_view
+from sentry.web.frontend.react_page import ReactMixin
 
 # Standardized error messages
 ERR_NO_ORG_ACCESS = (
@@ -40,7 +44,7 @@
 
 @control_silo_view
 @method_decorator(never_cache, name="dispatch")
-class OAuthDeviceView(BaseView):
+class OAuthDeviceView(BaseView, ReactMixin):
     """
     Device verification page for OAuth 2.0 Device Flow (RFC 8628 §3.3).
 
@@ -72,6 +76,12 @@ class OAuthDeviceView(BaseView):
         limit_overrides={"GET": {RateLimitCategory.IP: RateLimit(limit=20, window=1)}}
     )
 
+    def is_auth_required(self, request: HttpRequest, *args: Any, **kwargs: Any) -> bool:
+        if request.method == "GET" and options.get("auth.oauth-react-enabled"):
+            return False
+
+        return super().is_auth_required(request, *args, **kwargs)
+
     def handle_auth_required(self, request: HttpRequest, **kwargs) -> HttpResponse:
         auth.initiate_login(request, next_url=request.get_full_path())
         return redirect_to_login(request.get_full_path(), reverse("sentry-login"))
@@ -91,6 +101,9 @@ def _error_response(self, request: HttpRequest, error: str) -> HttpResponseBase:
         return self.respond("sentry/oauth-device.html", context)
 
     def get(self, request: HttpRequest, **kwargs) -> HttpResponseBase:
+        if options.get("auth.oauth-react-enabled"):
+            return self.handle_react(request)
+
         # RFC 8628 §3.3.1 allows `verification_uri_complete` to carry the user code.
         # We validate it here and advance to the approval step, but the user must
         # still explicitly approve or deny the request per §3.3 and the

src/sentry/web/frontend/react_page.py

@@ -38,6 +38,8 @@
 MULTI_REGION_NON_CUSTOMER_DOMAIN_URL_NAMES = [
     "sentry-login",
     "sentry-auth-organization",
+    "sentry-oauth-authorize",
+    "sentry-oauth-device",
 ]
 
 

tests/sentry/web/frontend/test_oauth_authorize.py

@@ -7,6 +7,7 @@
 
 from sentry.analytics.events.oauth_consent import OAuthConsentEvent
 from sentry.api.helpers.oauth_authorize.transactions import OAUTH_AUTHORIZE_SESSION_TTL
+from sentry.api.helpers.oauth_consent import persist_authorization
 from sentry.models.apiapplication import ApiApplication, ApiApplicationStatus
 from sentry.models.apiauthorization import ApiAuthorization
 from sentry.models.apigrant import ApiGrant
@@ -29,6 +30,58 @@ def setUp(self) -> None:
             owner=self.user, redirect_uris="https://example.com"
         )
 
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_stays_on_primary_domain_with_active_organization(self) -> None:
+        organization = self.create_organization(owner=self.user)
+        self.login_as(self.user)
+        session = self.client.session
+        session["activeorg"] = organization.slug
+        session.save()
+        path = f"{self.path}?client_id=example-client&state=example-state"
+
+        with self.feature({"system:multi-region": True}):
+            response = self.client.get(path, HTTP_HOST="testserver", follow=True)
+
+        assert response.status_code == 200
+        assert response.redirect_chain == []
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_customer_domain_redirects_to_primary_domain(self) -> None:
+        organization = self.create_organization(owner=self.user)
+        self.login_as(self.user)
+        session = self.client.session
+        session["activeorg"] = organization.slug
+        session.save()
+        path = f"{self.path}?client_id=example-client&state=example-state"
+
+        with self.feature({"system:multi-region": True}):
+            response = self.client.get(
+                path, HTTP_HOST=f"{organization.slug}.testserver", follow=True
+            )
+
+        assert response.status_code == 200
+        assert response.redirect_chain == [(f"http://testserver{path}", 302)]
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_authorization_is_public(self) -> None:
+        response = self.client.get(self.path, {"client_id": self.application.client_id})
+        assert response.status_code == 200
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_authorization_does_not_issue_existing_consent_grant(self) -> None:
+        self.login_as(self.user)
+        persist_authorization(self.application, self.user.id, [], None)
+        response = self.client.get(
+            self.path,
+            {"client_id": self.application.client_id, "response_type": "code"},
+        )
+        assert response.status_code == 200
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+        assert not ApiGrant.objects.filter(application=self.application).exists()
+
     def test_blank_pkce_challenge_returns_oauth_error(self) -> None:
         response = self.client.get(
             self.path,

tests/sentry/web/frontend/test_oauth_device.py

@@ -10,6 +10,7 @@
 from sentry.models.apiauthorization import ApiAuthorization
 from sentry.models.apidevicecode import ApiDeviceCode, DeviceCodeStatus
 from sentry.testutils.cases import TestCase
+from sentry.testutils.helpers import override_options
 from sentry.testutils.silo import control_silo_test
 
 
@@ -39,6 +40,54 @@ def test_get_unauthenticated_redirects_to_login(self) -> None:
             fetch_redirect_response=False,
         )
 
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_stays_on_primary_domain_with_active_organization(self) -> None:
+        organization = self.create_organization(owner=self.user)
+        self.login_as(self.user)
+        session = self.client.session
+        session["activeorg"] = organization.slug
+        session.save()
+        path = f"{self.path}?user_code=ABCD-EFGH"
+
+        with self.feature({"system:multi-region": True}):
+            response = self.client.get(path, HTTP_HOST="testserver", follow=True)
+
+        assert response.status_code == 200
+        assert response.redirect_chain == []
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_customer_domain_redirects_to_primary_domain(self) -> None:
+        organization = self.create_organization(owner=self.user)
+        self.login_as(self.user)
+        session = self.client.session
+        session["activeorg"] = organization.slug
+        session.save()
+        path = f"{self.path}?user_code=ABCD-EFGH"
+
+        with self.feature({"system:multi-region": True}):
+            response = self.client.get(
+                path, HTTP_HOST=f"{organization.slug}.testserver", follow=True
+            )
+
+        assert response.status_code == 200
+        assert response.redirect_chain == [(f"http://testserver{path}", 302)]
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_code_entry_is_public(self) -> None:
+        response = self.client.get(self.path)
+        assert response.status_code == 200
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+
+    @override_options({"auth.oauth-react-enabled": True})
+    def test_react_verification_is_public(self) -> None:
+        response = self.client.get(self.path, {"user_code": self.device_code.user_code})
+        assert response.status_code == 200
+        self.assertTemplateUsed(response, "sentry/base-react.html")
+        self.device_code.refresh_from_db()
+        assert self.device_code.status == DeviceCodeStatus.PENDING
+
     def test_get_preserves_user_code_in_login_destination(self) -> None:
         full_path = f"{self.path}?user_code={self.device_code.user_code}"
         resp = self.client.get(full_path)