fix(deploys): Fix permissions for deploy endpoint projects

[szokeasaurusrex]

Currently, in order to link specific projects to a deploy, e.g. via the sentry-cli deploys new command, users must provide a token with the project:read scope. This is inconsistent with the sentry-cli releases new command, which allows users to create a new release associated with only some projects by using the org:read and project:release scopes.

This PR proposes allowing specifying projects for a deploy using a token with project:releases scope.

Fixes #78025

[oioki]

Will this break a corresponding endpoint calls for tokens that have project:read scope?

[szokeasaurusrex]

@oioki, a token that only has project:read (and org:read) will not be able to access the endpoint at all, but a token with project:write can and such a token will break with this change.

I think it would be possible to make this change in a way which would be backwards compatible. Should I do that?

[szokeasaurusrex]

@oioki, I changed the code so it should now remain backwards-compatible with tokens that have project:read but not project:releases

[codecov]

Codecov Report

Attention: Patch coverage is 75.00000% with 1 line in your changes missing coverage. Please review.

✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
...c/sentry/api/serializers/rest_framework/project.py	75.00%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master   #78026      +/-   ##
==========================================
- Coverage   78.40%   78.29%   -0.12%     
==========================================
  Files        7154     7077      -77     
  Lines      316431   314216    -2215     
  Branches    43612    43300     -312     
==========================================
- Hits       248112   246002    -2110     
+ Misses      61982    56530    -5452     
- Partials     6337    11684    +5347     

[szokeasaurusrex]

@getsentry/security Can I get a review here?

[oioki]

Mind creating a test that covers this case?

[szokeasaurusrex]

Mind creating a test that covers this case?

I am not really sure how to test this @oioki. I have already spent more than an hour trying to figure it out without making much progress, so it is probably more productive if someone more familiar with this code adds the test

@iamrajjoshi or @snigdhas, would either of you know how to test this change? Looks like you all edited the code most recently. If you need time to investigate, we can merge this change and open an issue to add tests.

[snigdhas]

@szokeasaurusrex this test looks like it might mimic similar behavior of setting a specific scope and using the API token to test behavior

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀

[getsantry]

This pull request has gone three weeks without activity. In another week, I will close it.

But! If you comment or otherwise update it, I will reset the clock, and if you add the label WIP, I will leave it alone unless WIP is removed ... forever!

---

"A weed is but an unloved flower." ― Ella Wheeler Wilcox 🥀