feat(slug): Prevent numeric sentry app slugs (#56052)

Prevent numeric sentry app slugs. Currently, there is no way to update the slug with a PUT request, so we will need to manually go in and update this eventually.

Skip updating `SentryAppInstallationsEndpoint` POST because this takes in the slugs of sentry apps. While numerical sentry app slugs still exist, we cannot change this or those apps would be uninstallable.

src/sentry/sentry_apps/apps.py

@@ -1,6 +1,8 @@
 from __future__ import annotations
 
 import dataclasses
+import random
+import string
 from itertools import chain
 from typing import Any, Iterable, List, Mapping, Set
 
@@ -12,7 +14,7 @@
 from rest_framework.exceptions import ValidationError
 from sentry_sdk.api import push_scope
 
-from sentry import analytics, audit_log
+from sentry import analytics, audit_log, options
 from sentry.constants import SentryAppStatus
 from sentry.coreapi import APIError
 from sentry.db.postgres.transactions import in_test_hide_transaction_boundary
@@ -295,6 +297,11 @@ def run(self, *, user: User | RpcUser, request: HttpRequest | None = None) -> Se
     def _generate_and_validate_slug(self) -> str:
         slug = generate_slug(self.name, is_internal=self.is_internal)
 
+        # If option is set, add random 3 lowercase letter suffix to prevent numeric slug
+        # eg: 123 -> 123-abc
+        if options.get("api.prevent-numeric-slugs") and slug.isnumeric():
+            slug = f"{slug}-{''.join(random.choice(string.ascii_lowercase) for _ in range(3))}"
+
         # validate globally unique slug
         queryset = SentryApp.with_deleted.filter(slug=slug)
 

tests/sentry/api/endpoints/test_sentry_apps.py

@@ -21,6 +21,7 @@
 from sentry.silo.base import SiloMode
 from sentry.testutils.cases import APITestCase
 from sentry.testutils.helpers import Feature, with_feature
+from sentry.testutils.helpers.options import override_options
 from sentry.testutils.silo import assume_test_silo_mode, control_silo_test
 from sentry.utils import json
 
@@ -511,6 +512,14 @@ def test_cannot_create_with_error_created_hook_without_flag(self):
     def test_allows_empty_schema(self):
         self.get_success_response(**self.get_data(shema={}))
 
+    @override_options({"api.prevent-numeric-slugs": True})
+    def test_generated_slug_not_entirely_numeric(self):
+        response = self.get_success_response(**self.get_data(name="1234"), status_code=201)
+        slug = response.data["slug"]
+        assert len(slug) == 8
+        assert slug.startswith("1234-")
+        assert not slug.isnumeric()
+
     def test_missing_name(self):
         response = self.get_error_response(**self.get_data(name=None), status_code=400)
         assert "name" in response.data