fix(similarity): allow single_org sentry users to not be superuser to call backfill (#70917)

still enforces org / project permissions

Author: JoshFerge

src/sentry/api/endpoints/project_backfill_similar_issues_embeddings_records.py

@@ -1,3 +1,4 @@
+from django.conf import settings
 from rest_framework.request import Request
 from rest_framework.response import Response
 
@@ -18,11 +19,16 @@ class ProjectBackfillSimilarIssuesEmbeddingsRecords(ProjectEndpoint):
     }
 
     def post(self, request: Request, project) -> Response:
-        if not features.has(
-            "projects:similarity-embeddings-backfill", project
-        ) or not is_active_superuser(request):
+        if not features.has("projects:similarity-embeddings-backfill", project):
             return Response(status=404)
 
+        # needs to have the flag to run
+
+        if not (is_active_superuser(request) or settings.SENTRY_SINGLE_ORGANIZATION):
+            return Response(status=404)
+
+        # needs to either be a superuser or be in single org mode
+
         last_processed_id = None
         dry_run = False
         if request.data.get("last_processed_id"):

tests/sentry/api/endpoints/test_project_backfill_similar_issues_embeddings_records.py

@@ -1,5 +1,6 @@
 from unittest.mock import patch
 
+from django.test import override_settings
 from django.urls import reverse
 
 from sentry.testutils.cases import APITestCase
@@ -47,6 +48,18 @@ def test_post_success_no_last_processed_id(
         assert response.status_code == 204, response.content
         mock_backfill_seer_grouping_records.assert_called_with(self.project.id, None, False)
 
+    @patch(
+        "sentry.api.endpoints.project_backfill_similar_issues_embeddings_records.backfill_seer_grouping_records.delay"
+    )
+    @with_feature("projects:similarity-embeddings-backfill")
+    @override_settings(SENTRY_SINGLE_ORGANIZATION=True)
+    def test_post_success_no_last_processed_id_single_org(
+        self, mock_backfill_seer_grouping_records
+    ):
+        response = self.client.post(self.url, data={})
+        assert response.status_code == 204, response.content
+        mock_backfill_seer_grouping_records.assert_called_with(self.project.id, None, False)
+
     @patch(
         "sentry.api.endpoints.project_backfill_similar_issues_embeddings_records.is_active_superuser",
         return_value=True,