Commit 7019b60
authored
fix(init): allow org admins to create projects when member creation is disabled (#1284)
## Problem
`sentry init` on org `test101-n4` fails with:
```
✖ Setup failed.
Project creation is disabled for members in "test101-n4".
```
...even though the user is an **org admin**, not a member.
## Root Cause
The preflight check in `assertOrgScopedCreationCanProceed`
(`src/lib/init/preflight.ts:376-381`) used
`hasOrgWriteAccess(organization.access)` which only checked for
`org:write` in the access scopes.
In Sentry's role hierarchy (verified against `SENTRY_ROLES` in
`sentry/conf/server.py`):
| Role | `org:write` | `project:write` | `project:admin` |
|------|-------------|-----------------|-----------------|
| member | - | - | - |
| **admin** | **-** | **✓** | **✓** |
| manager | ✓ | ✓ | ✓ |
| owner | ✓ | ✓ | ✓ |
The `admin` role has `project:write` and `project:admin` but **NOT**
`org:write`. The check was more restrictive than the actual Sentry API,
which allows admins to create projects.
## Fix
Replace the narrow `hasOrgWriteAccess` (checked only `org:write`) with
`canBypassMemberCreationRestriction` which recognizes `org:write`,
`project:admin`, and `project:write` — matching the actual server-side
permission model.
## Tests
Added 3 new test cases:
- Admin with `project:admin` scope can proceed
- User with `project:write` scope can proceed
- Admin with `project:admin` scope can proceed even when `listTeams`
returns 403
All 30 tests pass.1 parent d904166 commit 7019b60
3 files changed
Lines changed: 266 additions & 16 deletions
0 commit comments