feat(search): Add team: filter for issues by project ownership

[mishamo]

Summary

Adds a new team: search filter that allows filtering issues by the team that owns the project. This addresses #45367.

Usage:

• team:data-engineering - Issues from projects owned by data-engineering
• team:#data-engineering - Same (# prefix supported for consistency with other team references)
• !team:data-engineering - Issues NOT from data-engineering's projects
• team:[team1,team2] - Issues from projects owned by either team

Changes

• src/sentry/issues/issue_search.py:
  • Add team key mapping
  • Add convert_team_value() converter that validates teams through projectteam relationship (prevents IDOR by ensuring users can only filter by teams associated with their searched projects)
• src/sentry/search/snuba/backend.py:
  • Add team_filter() function
  • Add team condition to queryset builder
• tests/snuba/search/test_backend.py:
  • test_team_filter - Basic filtering with/without # prefix
  • test_team_filter_negation - !team: exclusion
  • test_team_filter_invalid_team - Error handling for non-existent teams
  • test_team_filter_multiple_teams - team:[t1,t2] syntax
  • test_team_filter_team_not_in_searched_projects - Security test for IDOR prevention

Test plan

• Filter by team slug returns only issues from that team's projects
• # prefix works for consistency with other team references
• Negation (!team:) excludes issues from team's projects
• Invalid team raises InvalidSearchQuery
• Multiple teams syntax works
• Teams not associated with searched projects raise error (IDOR prevention)

🤖 Generated with Claude Code

[mishamo]

bugbot review

[mishamo]

@sentry review

[mishamo]

Is there anything else I have to do in the PR process here? (I can't find any docs). Or is this just waiting for a maintainer to take a look?

[cvxluo]

Is there anything else I have to do in the PR process here? (I can't find any docs). Or is this just waiting for a maintainer to take a look?

you're all good, i'll take a look.

[scttcper]

this likely would need to take into account the org open membership settings

[mishamo]

Thanks for the feedback. I noticed the existing parse_team_value used by assigned_to also only filters by project association, not org membership settings.

A few questions:

1. Should this be consistent with assigned_to behavior?
2. Is this a broader issue to fix across all team-related filters?
3. Would you prefer we use has_team_access checks here, or is project-based filtering sufficient given users already need project access?

[scttcper]

we can probably bulk query and i think that IDOR warning isn't really fixed with project[0].organization_id any more than using in=projects so lets keep it just filtering by projects.

Suggested change

	def convert_team_value(
	value: Iterable[str],
	projects: Sequence[Project],
	user: User,
	environments: Sequence[Environment] | None,
	) -> list[RpcUser | Team | None]:
	"""Convert team slug(s) to Team objects for filtering issues by project ownership.
	Only returns teams that are associated with at least one of the searched projects,
	ensuring users can only filter by teams they have visibility to.
	"""
	if not projects:
	return []
	teams: list[RpcUser | Team | None] = []
	for team_identifier in value:
	team_slug = team_identifier.lstrip("#")
	team = Team.objects.filter(
	slug__iexact=team_slug,
	organization_id=projects[0].organization_id,
	projectteam__project__in=projects,
	).first()
	if not team:
	raise InvalidSearchQuery(f"Invalid team '{team_identifier}'")
	teams.append(team)
	return teams
	def convert_team_value(
	value: Iterable[str],
	projects: Sequence[Project],
	user: User,
	environments: Sequence[Environment] | None,
	) -> list[RpcUser | Team | None]:
	if not projects:
	return []
	slugs = [v[1:] if v.startswith("#") else v for v in value]
	if not slugs:
	return []
	teams = Team.objects.filter(
	slug__in=slugs,
	projectteam__project__in=projects,
	).distinct()
	teams_by_slug = {team.slug: team for team in teams}
	result: list[RpcUser | Team | None] = []
	for slug in slugs:
	team = teams_by_slug.get(slug)
	if not team:
	raise InvalidSearchQuery(f"Invalid team '{slug}'")
	result.append(team)
	return result

[scttcper]

@mishamo never mind on the open membership we should already be filtering down projects to the ones available to user user similar to assigned to.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[mishamo]

@cvxluo @scttcper Any more thoughts on this?