ref(flags): Remove organizations:ingest-through-trusted-relays-only

[wedamija]

Dev-only flag registered Jun 2025, never rolled out to customers. Remove the flag registration and the unreleased gated code paths.

[github-actions]

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

[github-actions]

📊 Type Coverage Diff

✅ No new type safety issues introduced. Coverage: 93.53%

[wedamija]

I'm not totally sure if this is fine to remove, would appreciate if someone from @getsentry/ingest could take a look. If we want to keep it, I can move it to be a permanent flag instead

[cursor]

Relay config removed but tests still expect enforcement

High Severity

The trustedRelaySettings config (including verifySignature) was completely removed from the relay config generation, but setup_for_trusted_relay_signature and test_not_trusted_relay still set the org option sentry:ingest-through-trusted-relays-only to "enabled" and expect Relay to enforce signature verification. Since the relay config no longer includes trustedRelaySettings, Relay won't enforce signature verification, and tests like test_not_trusted_relay, test_expired_signature, test_invalid_signature, and test_missing_signature will fail — they expect 403 rejections that can no longer occur.

Additional Locations (2)

• tests/relay_integration/test_integration.py#L330-L333
• src/sentry/relay/config/__init__.py#L854-L856

 

^{Reviewed by Cursor Bugbot for commit 3b7413f. Configure here.}

[cursor]

Existing tests reference removed feature flag and serializer

Medium Severity

Tests not updated by this PR still reference the removed feature flag and code. tests/sentry/relay/test_config.py::test_project_config_trusted_relay_settings enables the removed organizations:ingest-through-trusted-relays-only flag and asserts trustedRelaySettings is present in the config — this will fail since that config generation was deleted. Similarly, tests/sentry/core/endpoints/test_organization_details.py has several tests referencing the removed serializer field ingestThroughTrustedRelaysOnly and its validation, which will also fail.

Additional Locations (1)

• src/sentry/features/temporary.py#L414-L415

 

^{Reviewed by Cursor Bugbot for commit a496b65. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

There are 3 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2ff833c. Configure here.}

[cursor]

Tests referencing removed feature and serializer fields not cleaned up

Medium Severity

The removal of the ingestThroughTrustedRelaysOnly serializer field, its validation method, and the feature flag registration leaves several test files unmodified that will now fail. tests/sentry/core/endpoints/test_organization_details.py has tests at lines 1275–1302 that still send ingestThroughTrustedRelaysOnly data via the API and assert on the removed serializer field. tests/sentry/relay/test_config.py has test_project_config_trusted_relay_settings at lines 1480–1504 that asserts trustedRelaySettings is present when the feature flag is enabled, but both the flag and the config code are now removed. These tests will fail.

Additional Locations (1)

• src/sentry/features/temporary.py#L414-L415

 

^{Reviewed by Cursor Bugbot for commit 2ff833c. Configure here.}

[github-actions]

Backend Test Failures

Failures on 9802452 in this run:

tests/sentry/core/endpoints/test_organization_details.py::OrganizationUpdateTest::test_ingest_through_trusted_relays_only_option — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/core/endpoints/test_organization_details.py:1282: in test_ingest_through_trusted_relays_only_option
    assert (
E   AssertionError: assert None == 'enabled'
E    +  where None = get_option('sentry:ingest-through-trusted-relays-only')
E    +    where get_option = <Organization at 0x7f928714b4d0: id=4558144291536912, owner_id=None, name='baz', slug='baz'>.get_option
E    +      where <Organization at 0x7f928714b4d0: id=4558144291536912, owner_id=None, name='baz', slug='baz'> = <sentry.testutils.silo.OrganizationUpdateTest testMethod=test_ingest_through_trusted_relays_only_option>.organization

tests/relay_integration/test_integration.py::SentryRemoteTest::test_signature_header_is_none — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/relay_integration/test_integration.py:490: in test_signature_header_is_none
    assert event is None
E   assert <sentry.services.eventstore.models.Event at 0x7f10be5bf490: event_id=58b9c8ebd1df47c0a150a08c4c4ba9fd> is None

tests/sentry/core/endpoints/test_organization_details.py::OrganizationUpdateTest::test_get_ingest_through_trusted_relays_only_option — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/core/endpoints/test_organization_details.py:1298: in test_get_ingest_through_trusted_relays_only_option
    assert response.data["ingestThroughTrustedRelaysOnly"] == "disabled"
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
E   KeyError: 'ingestThroughTrustedRelaysOnly'

tests/relay_integration/test_integration.py::SentryRemoteTest::test_invalid_signature — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/relay_integration/test_integration.py:423: in test_invalid_signature
    assert event is None
E   assert <sentry.services.eventstore.models.Event at 0x7f7d9ebc7330: event_id=82a820b3d1954a1a96babecb69f70eaf> is None

tests/relay_integration/test_integration.py::SentryRemoteTest::test_missing_signature — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/relay_integration/test_integration.py:456: in test_missing_signature
    assert event is None
E   assert <sentry.services.eventstore.models.Event at 0x7fe57428c370: event_id=3f6d13e3d1564c789f5651c2255bcfc0> is None

tests/relay_integration/test_integration.py::SentryRemoteTest::test_not_trusted_relay — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/relay_integration/test_integration.py:355: in test_not_trusted_relay
    assert event is None
E   assert <sentry.services.eventstore.models.Event at 0x7f0d9e25b120: event_id=b50634271e9645d5b3c9a059090b0d68> is None

tests/sentry/relay/test_config.py::test_project_config_trusted_relay_settings[disabled-True-REGION] — log

[gw0] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/sentry/relay/test_config.py:1500: in test_project_config_trusted_relay_settings
    assert trusted_relay_settings is not None
E   assert None is not None

tests/relay_integration/test_integration.py::SentryRemoteTest::test_expired_signature — log

[gw1] linux -- Python 3.13.1 /home/runner/work/sentry/sentry/.venv/bin/python3
tests/relay_integration/test_integration.py:389: in test_expired_signature
    assert event is None
E   assert <sentry.services.eventstore.models.Event at 0x7f5314181f40: event_id=58c5d74fdbee48dbae32b122c147b516> is None