fix(autofix): Sign the update call with rpc secret (#76687)

src/sentry/api/endpoints/group_autofix_update.py

@@ -13,6 +13,7 @@ from sentry.api.api_publish_status import ApiPublishStatus
 from sentry.api.base import region_silo_endpoint
 from sentry.api.bases.group import GroupEndpoint
 from sentry.models.group import Group
+from sentry.seer.signed_seer_api import sign_with_seer_secret
 
 logger = logging.getLogger(__name__)
 
@@ -42,20 +43,29 @@ class GroupAutofixUpdateEndpoint(GroupEndpoint):
             )
 
         path = "/v1/automation/autofix/update"
+
+        body = orjson.dumps(
+            {
+                **request.data,
+                "invoking_user": (
+                    {
+                        "id": user.id,
+                        "display_name": user.get_display_name(),
+                    }
+                ),
+            }
+        )
+
         response = requests.post(
             f"{settings.SEER_AUTOFIX_URL}{path}",
-            data=orjson.dumps(
-                {
-                    **request.data,
-                    "invoking_user": (
-                        {
-                            "id": user.id,
-                            "display_name": user.get_display_name(),
-                        }
-                    ),
-                }
-            ),
-            headers={"content-type": "application/json;charset=utf-8"},
+            data=body,
+            headers={
+                "content-type": "application/json;charset=utf-8",
+                **sign_with_seer_secret(
+                    url=f"{settings.SEER_AUTOFIX_URL}{path}",
+                    body=body,
+                ),
+            },
         )
 
         response.raise_for_status()

tests/sentry/api/endpoints/test_group_autofix_update.py

@@ -4,6 +4,7 @@ import orjson
 from django.conf import settings
 from rest_framework import status
 
+from sentry.seer.signed_seer_api import sign_with_seer_secret
 from sentry.testutils.cases import APITestCase
 
 
@@ -32,22 +33,28 @@ class TestGroupAutofixUpdate(APITestCase):
         )
 
         assert response.status_code == status.HTTP_202_ACCEPTED
+        expected_body = orjson.dumps(
+            {
+                "run_id": 123,
+                "payload": {
+                    "type": "select_root_cause",
+                    "cause_id": 456,
+                },
+                "invoking_user": {
+                    "id": self.user.id,
+                    "display_name": self.user.get_display_name(),
+                },
+            }
+        )
+        expected_url = f"{settings.SEER_AUTOFIX_URL}/v1/automation/autofix/update"
+        expected_headers = {
+            "content-type": "application/json;charset=utf-8",
+            **sign_with_seer_secret(url=expected_url, body=expected_body),
+        }
         mock_post.assert_called_once_with(
-            f"{settings.SEER_AUTOFIX_URL}/v1/automation/autofix/update",
-            data=orjson.dumps(
-                {
-                    "run_id": 123,
-                    "payload": {
-                        "type": "select_root_cause",
-                        "cause_id": 456,
-                    },
-                    "invoking_user": {
-                        "id": self.user.id,
-                        "display_name": self.user.get_display_name(),
-                    },
-                }
-            ),
-            headers={"content-type": "application/json;charset=utf-8"},
+            expected_url,
+            data=expected_body,
+            headers=expected_headers,
         )
 
     @patch("sentry.api.endpoints.group_autofix_update.requests.post")
@@ -56,19 +63,13 @@ class TestGroupAutofixUpdate(APITestCase):
 
         response = self.client.post(
             self.url,
-            data=orjson.dumps(
-                {
-                    "run_id": 123,
-                    "payload": {
-                        "type": "select_root_cause",
-                        "cause_id": 456,
-                    },
-                    "invoking_user": {
-                        "id": self.user.id,
-                        "display_name": self.user.get_display_name(),
-                    },
-                }
-            ),
+            data={
+                "run_id": 123,
+                "payload": {
+                    "type": "select_root_cause",
+                    "cause_id": 456,
+                },
+            },
             format="json",
         )