fix(issues): inherit ShortIdLookupEndpoint from GroupEndpoint

src/sentry/api/urls.py

@@ -1286,7 +1286,7 @@ def create_group_urls(name_prefix: str) -> list[URLPattern | URLResolver]:
         name="sentry-api-0-organization-dashboard-favorite",
     ),
     re_path(
-        r"^(?P<organization_id_or_slug>[^\/]+)/shortids/(?P<short_id>[^\/]+)/$",
+        r"^(?P<organization_id_or_slug>[^\/]+)/shortids/(?P<issue_id>[^\/]+)/$",
         ShortIdLookupEndpoint.as_view(),
         name="sentry-api-0-short-id-lookup",
     ),

src/sentry/issues/endpoints/organization_shortid.py

@@ -4,21 +4,19 @@
 from sentry.api.api_owners import ApiOwner
 from sentry.api.api_publish_status import ApiPublishStatus
 from sentry.api.base import region_silo_endpoint
-from sentry.api.bases.organization import OrganizationEndpoint
-from sentry.api.exceptions import ResourceDoesNotExist
+from sentry.api.bases import GroupEndpoint
 from sentry.api.serializers import serialize
 from sentry.models.group import Group
-from sentry.models.organization import Organization
 
 
 @region_silo_endpoint
-class ShortIdLookupEndpoint(OrganizationEndpoint):
+class ShortIdLookupEndpoint(GroupEndpoint):
     owner = ApiOwner.ISSUES
     publish_status = {
         "GET": ApiPublishStatus.UNKNOWN,
     }
 
-    def get(self, request: Request, organization: Organization, short_id: str) -> Response:
+    def get(self, request: Request, group: Group) -> Response:
         """
         Resolve a Short ID
         ``````````````````
@@ -30,14 +28,9 @@ def get(self, request: Request, organization: Organization, short_id: str) -> Re
         :pparam string short_id: the short ID to look up.
         :auth: required
         """
-        try:
-            group = Group.objects.by_qualified_short_id(organization.id, short_id)
-        except Group.DoesNotExist:
-            raise ResourceDoesNotExist()
-
         return Response(
             {
-                "organizationSlug": organization.slug,
+                "organizationSlug": group.project.organization.slug,
                 "projectSlug": group.project.slug,
                 "groupId": str(group.id),
                 "group": serialize(group, request.user),

tests/sentry/issues/endpoints/test_organization_shortid.py

@@ -7,20 +7,38 @@
 
 
 class ShortIdLookupEndpointTest(APITestCase):
-    def test_simple(self) -> None:
-        org = self.create_organization(owner=self.user)
-        project = self.create_project(organization=org)
-        group = self.create_group(project=project, short_id=project.next_short_id())
-
-        self.login_as(user=self.user)
-        url = reverse(
+    def setUp(self):
+        self.group = self.create_group(project=self.project, short_id=self.project.next_short_id())
+        self.url = reverse(
             "sentry-api-0-short-id-lookup",
-            kwargs={"organization_id_or_slug": org.slug, "short_id": group.qualified_short_id},
+            kwargs={
+                "organization_id_or_slug": self.organization.slug,
+                "issue_id": self.group.qualified_short_id,
+            },
         )
-        response = self.client.get(url, format="json")
+
+    def test_simple(self) -> None:
+        self.login_as(user=self.user)
+        response = self.client.get(self.url, format="json")
 
         assert response.status_code == 200, response.content
-        assert response.data["organizationSlug"] == org.slug
-        assert response.data["projectSlug"] == project.slug
-        assert response.data["groupId"] == str(group.id)
-        assert response.data["group"]["id"] == str(group.id)
+        assert response.data["organizationSlug"] == self.organization.slug
+        assert response.data["projectSlug"] == self.project.slug
+        assert response.data["groupId"] == str(self.group.id)
+        assert response.data["group"]["id"] == str(self.group.id)
+
+    def test_access_non_member_project(self):
+        # disable Open Membership
+        self.organization.flags.allow_joinleave = False
+        self.organization.save()
+
+        # user has no access to the first project
+        user_no_team = self.create_user(is_superuser=False)
+        self.create_member(
+            user=user_no_team, organization=self.organization, role="member", teams=[]
+        )
+        self.login_as(user_no_team)
+
+        response = self.client.get(self.url, format="json")
+        assert response.status_code == 403, response.content
+        assert response.data["detail"] == "You do not have permission to perform this action."