feat(preprod): Add organization-level endpoints for artifact details (EME-725)

[runningcode]

Summary

Add new organization-level API endpoints that don't require project ID in the path for preprod artifact operations.

Changes

New Endpoints

• ---

  • Returns build details for an artifact without requiring project ID
  • Looks up project from artifact ID internally
  • Validates artifact belongs to organization

• ---

  • Returns size analysis for an artifact without requiring project ID
  • Same pattern as build-details endpoint

Implementation Details

Both endpoints:

• Inherit from OrganizationEndpoint for organization-level access control
• Use select_related("project") to efficiently fetch the associated project
• Filter by project__organization_id=organization.id to prevent IDOR vulnerabilities
• Return 404 if artifact not found or belongs to different organization
• Require organizations:preprod-frontend-routes feature flag

Tests

Added comprehensive test coverage:

• 7 tests for build-details endpoint
• 9 tests for size-analysis endpoint

Test coverage includes:

• Success cases with correct data
• Not found scenarios (invalid ID, wrong organization)
• Feature flag disabled
• Invalid artifact ID format (non-numeric)
• Failed artifact states
• All size analysis states (pending, processing, failed, completed)

All tests pass ✅

Why

This enables simplified URL structures in the frontend where the project parameter can be optional. The artifact ID is globally unique within an organization, so we can look up the associated project internally.

The frontend makes two separate API calls that both need org-level variants:

1. build-details: Lightweight metadata (app info, version, VCS info, state)
2. size-analysis: Heavy data payload (treemap data, file sizes, breakdowns)

Security

Both endpoints validate that the artifact belongs to a project in the organization before returning data, preventing IDOR vulnerabilities:

preprod_artifact = PreprodArtifact.objects.get(
    id=artifact_id_int,
    project__organization_id=organization.id,  # ← Prevents IDOR
)

Related

Part of EME-725 URL restructuring work.

• Frontend PR: feat(preprod): Add new URL routes while maintaining backwards compatibility (EME-725) #106354

[linear]

EME-725 Adjust URL routes for size and distribution

[github-actions]

🚨 Warning: This pull request contains Frontend and Backend changes!

It's discouraged to make changes to Sentry's Frontend and Backend in a single pull request. The Frontend and Backend are not atomically deployed. If the changes are interdependent of each other, they must be separated into two pull requests and be made forward or backwards compatible, such that the Backend or Frontend can be safely deployed independently.

Have questions? Please ask in the #discuss-dev-infra channel.

[cursor]

Unrelated endpoint definitions accidentally removed from generated file

Medium Severity

The generated TypeScript file removes two detector-workflow endpoint definitions that still exist in the backend (src/sentry/workflow_engine/endpoints/urls.py lines 87-94). These deletions are unrelated to the preprod artifact endpoints being added and appear to be accidental—possibly from regenerating the file incorrectly or a merge conflict. Frontend code referencing these endpoints may lose type safety or fail TypeScript compilation.