fix(cli): route to org-auth token host when no URL is configured - #1575
fix(cli): route to org-auth token host when no URL is configured#1575jared-outpost[bot] wants to merge 2 commits into
Conversation
getConfiguredSentryUrl() only reads SENTRY_HOST/SENTRY_URL and otherwise falls back to DEFAULT_SENTRY_URL (https://sentry.io), ignoring the sntrys_ org-auth token's embedded url claim. With only SENTRY_AUTH_TOKEN set, the request destination resolved to sentry.io while the host-scoping guard trusts the token claim host, tripping the confusing "Refusing to route requests" error. Fall back to the active token host before DEFAULT_SENTRY_URL so the request destination agrees with the trust anchor. Explicit SENTRY_HOST/SENTRY_URL/ --url still take precedence. Fixes #1568
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.
Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit e59cf08. Configure here.
![sentry[bot]](https://avatars.githubusercontent.com/in/12637?s=60&v=4){kind=small}
resolveOrgRegion() resolved its org-details base URL via getSentryBaseUrl(), a separate resolver from getApiBaseUrl() that still defaulted to sentry.io when only a bare sntrys_ token was set. Org-scoped commands (debug-files upload, releases, etc.) therefore still requested sentry.io and tripped the host-scoping guard, so the first commit only fixed part of #1568. Route the org-details request through getApiBaseUrl() (which already falls back to the active token host). Kept getSentryBaseUrl() as-is to avoid a sentry-urls -> token-host -> db/auth -> telemetry -> sentry-urls module-init cycle; its remaining callers build web links and telemetry tags, not requests. Adds a region test asserting a bare sntrys_ token routes org discovery to its claim host.
|
The one issue Bugbot flagged (org-scoped commands still routing to |
Problem
When only
SENTRY_AUTH_TOKENis set — ansntrys_org-auth token embedding a custom instance URL (e.g.http://localhost:8000) — and noSENTRY_URL/SENTRY_HOST/--urlis provided, commands such assentry debug-files uploadfail with:Root cause
getConfiguredSentryUrl()(used bygetApiBaseUrl()/getControlSiloUrl()) only readsSENTRY_HOST/SENTRY_URLand otherwise falls back toDEFAULT_SENTRY_URL(https://sentry.io). It never consults thesntrys_token's embeddedurlclaim.Meanwhile
getActiveTokenHost()does treat the org-auth token's embedded claim URL as authoritative for the host-scope trust check. With onlySENTRY_AUTH_TOKENset, the two resolutions disagree: the request destination defaults tohttps://sentry.iowhile the trust check computes the token host ashttp://localhost:8000. The mismatch trips the host-scoping guard, producing the confusing error even though no host override was intentionally requested.Fix
Route the base URL to the active token host before falling back to
DEFAULT_SENTRY_URL:This aligns the request destination with the trust anchor. Explicit
SENTRY_HOST/SENTRY_URL/--url(which the boot path also populates from.sentryclircand stored defaults) still take precedence, so no configured behavior changes. No new credential-leak path is introduced: requests are only routed to the host the credentials are already trusted for.Tests
Added
test/lib/sentry-client.base-url.test.ts:sntrys_token claim host when no URL is setSENTRY_URL/SENTRY_HOSToverride the token claim hostsntrys_env token without a URL still defaults to SaaSTest results (with
pipefail):sentry-client.base-url+env-token-host+token-host+token-claims: 60 passedsentry-client+sentry-client.invalidation: 13 passedFixes #1568