[sentry-junior]

Granular replay permissions currently take only a list of individual users. Orgs that manage access through their identity provider want replay access to follow an IdP group: a member gets access when they are added to the group and loses it when they are removed. SCIM already syncs IdP groups into Sentry teams, so this PR lets replay access be granted to teams.

• Adds a TeamReplayAccess model with one row per granted team. The row is deleted along with its team.
• has_replay_permission now also allows active members of a granted team whose team is active. Membership is checked on every request, so removing someone from the team through SCIM revokes access on their next request. There is no copied list that could go stale. A SCIM test covers this end to end.
• The org details PUT accepts replayAccessTeams (team IDs). It uses the same org:write check and audit log entry as replayAccessMembers. The org serializer returns replayAccessTeams.
• Team grants and per-user grants combine: either one gives access. An org that wants the IdP to be the only source of truth can leave the per-user list empty. With combined grants, a user added to the per-user list by hand keeps access after leaving the IdP group.

Follow-up: a frontend PR, separate because frontend and backend deploy separately. useHasReplayAccess checks only replayAccessMembers today, so it needs to check the user's team membership as well. The settings form also needs a team picker. Until that lands, the backend enforces access correctly, but the UI can hide replays from members who only have access through a team.

via Michael Chai.

--

View Session [Sentry]

[github-actions]

decision-model-linter

api

src/sentry/api/serializers/models/organization.py

• warn addsNewOmittedFields = TRUE (0.98): This withholds a field from the public API schema and every generated SDK, though clients can still use it. Withhold a field only if it must never be public, and make its reason say why. To fix a missing description, add help_text to the field instead.

_{decision-model-linter: 21 calls on 6 files, 43,908 input tokens, $0.0018, model typesafe/jev-1.13-20260917}

[github-actions]

This PR has a migration; here is the generated SQL for src/sentry/replays/migrations/0008_team_replay_access.py

for 0008_team_replay_access in replays

--
-- Create model TeamReplayAccess
--
CREATE TABLE "sentry_teamreplayaccess" ("id" bigint NOT NULL PRIMARY KEY GENERATED BY DEFAULT AS IDENTITY, "date_updated" timestamp with time zone NOT NULL, "date_added" timestamp with time zone NOT NULL, "team_id" bigint NOT NULL UNIQUE);
ALTER TABLE "sentry_teamreplayaccess" ADD CONSTRAINT "sentry_teamreplayaccess_team_id_0fe0e5ce_fk_sentry_team_id" FOREIGN KEY ("team_id") REFERENCES "sentry_team" ("id") DEFERRABLE INITIALLY DEFERRED NOT VALID;
ALTER TABLE "sentry_teamreplayaccess" VALIDATE CONSTRAINT "sentry_teamreplayaccess_team_id_0fe0e5ce_fk_sentry_team_id";