@sentry/junior-sentry 0.236.0 → 0.237.0

package/README.md

@@ -1,6 +1,6 @@
 # @sentry/junior-sentry
 
-Sentry investigations (per-user OAuth) and signed issue webhooks (internal integration) for Junior.
+Sentry investigations (per-user OAuth plus optional org read access) and signed issue webhooks (internal integration) for Junior.
 
 ```bash
 pnpm add @sentry/junior @sentry/junior-sentry
@@ -32,6 +32,10 @@ Verified CLI surface (check live `sentry --help` before blocking):
 - `sentry alert metrics list|view|create|edit|delete`
 - `sentry api <endpoint>` fallback
 
+## Org read access
+
+Set `SENTRY_READ_TOKEN` to a read-only internal integration token. Junior then uses it for Sentry API reads (`GET`, `HEAD`, `OPTIONS`), including Explore queries, scheduled tasks, and event automations. Writes and `/api/0/users/` requests still use the requesting user's OAuth token.
+
 ## Issue webhooks
 
 Use a **Sentry internal integration** (not a public app install flow):

package/dist/index.d.ts

@@ -1,9 +1,9 @@
 /**
  * Sentry plugin runtime boundary.
  *
- * This package owns per-user Sentry OAuth, CLI setup, internal-integration
- * issue webhook normalization, and Sentry resource identities. Junior core owns
- * watches and event automations.
+ * This package owns per-user Sentry OAuth, org read access, CLI setup,
+ * internal-integration issue webhook normalization, and Sentry resource
+ * identities. Junior core owns watches and event automations.
  */
 import { type PluginRegistration } from "@sentry/junior-plugin-api";
 /** Register Sentry runtime metadata and signed event ingress. */

package/dist/index.js

@@ -9,6 +9,62 @@ import {
 import {
   defineJuniorPlugin
 } from "@sentry/junior-plugin-api";
+
+// src/org-read.ts
+var SENTRY_API_DOMAINS = ["sentry.io", "us.sentry.io", "de.sentry.io"];
+var ORG_READ_GRANT = "org-read";
+var LEASE_MS = 60 * 60 * 1e3;
+var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+function orgReadToken() {
+  return process.env.SENTRY_READ_TOKEN?.trim() || void 0;
+}
+function isOrgReadRequest(request) {
+  if (!READ_METHODS.has(request.method.toUpperCase())) {
+    return false;
+  }
+  const url = new URL(request.url);
+  if (!SENTRY_API_DOMAINS.includes(url.hostname)) {
+    return false;
+  }
+  const [api, version, resource] = url.pathname.split("/").filter(Boolean);
+  return api === "api" && version === "0" && !!resource && resource !== "users";
+}
+function sentryGrantForEgress(ctx) {
+  if (!orgReadToken() || !isOrgReadRequest(ctx.request)) {
+    return void 0;
+  }
+  return {
+    name: ORG_READ_GRANT,
+    access: "read",
+    reason: "sentry.org-read"
+  };
+}
+function issueSentryCredential(ctx) {
+  if (ctx.grant.name !== ORG_READ_GRANT) {
+    throw new Error(
+      `Sentry plugin cannot issue unknown grant "${ctx.grant.name}".`
+    );
+  }
+  const token = orgReadToken();
+  if (!token) {
+    return {
+      type: "unavailable",
+      message: "Sentry org read access requires SENTRY_READ_TOKEN."
+    };
+  }
+  return {
+    type: "lease",
+    lease: {
+      expiresAt: new Date(Date.now() + LEASE_MS).toISOString(),
+      headerTransforms: SENTRY_API_DOMAINS.map((domain) => ({
+        domain,
+        headers: { Authorization: `Bearer ${token}` }
+      }))
+    }
+  };
+}
+
+// src/index.ts
 function sentryPlugin() {
   return defineJuniorPlugin({
     packageName: "@sentry/junior-sentry",
@@ -36,7 +92,7 @@ function sentryPlugin() {
       credentials: {
         authTokenEnv: "SENTRY_AUTH_TOKEN",
         authTokenPlaceholder: "host_managed_credential",
-        domains: ["sentry.io", "us.sentry.io", "de.sentry.io"],
+        domains: SENTRY_API_DOMAINS,
         type: "oauth-bearer"
       },
       description: "Investigate Sentry telemetry, manage alerting, and receive issue webhooks",
@@ -44,6 +100,7 @@ function sentryPlugin() {
       envVars: {
         SENTRY_CLIENT_ID: {},
         SENTRY_CLIENT_SECRET: {},
+        SENTRY_READ_TOKEN: {},
         SENTRY_WEBHOOK_ORG: {},
         SENTRY_WEBHOOK_SECRET: {}
       },
@@ -64,6 +121,8 @@ function sentryPlugin() {
       ]
     },
     hooks: {
+      grantForEgress: sentryGrantForEgress,
+      issueCredential: issueSentryCredential,
       routes(ctx) {
         return [
           createSentryWebhookRoute({

package/dist/org-read.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Sentry org read access.
+ *
+ * An internal integration token can read the Sentry organization that
+ * installed the integration. Junior uses it for Sentry API reads. Writes use
+ * the requesting user's OAuth token.
+ */
+import type { EgressHookContext, IssueCredentialHookContext, PluginCredentialResult, PluginGrant } from "@sentry/junior-plugin-api";
+export declare const SENTRY_API_DOMAINS: string[];
+/**
+ * Select the org read grant for Sentry API reads.
+ *
+ * Return undefined for other requests so the host uses the user's OAuth token.
+ */
+export declare function sentryGrantForEgress(ctx: EgressHookContext): PluginGrant | undefined;
+/** Issue the org read token for the org read grant. */
+export declare function issueSentryCredential(ctx: IssueCredentialHookContext): PluginCredentialResult;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sentry/junior-sentry",
-  "version": "0.236.0",
+  "version": "0.237.0",
   "private": false,
   "publishConfig": {
     "access": "public"
@@ -27,7 +27,7 @@
   ],
   "dependencies": {
     "zod": "^4.5.4",
-    "@sentry/junior-plugin-api": "0.236.0"
+    "@sentry/junior-plugin-api": "0.237.0"
   },
   "devDependencies": {
     "@oxlint/plugins": "1.79.0",