fix(api): Allow Bearer token auth for GET /api/0/auth/

src/sentry/api/endpoints/auth_index.py

@@ -14,7 +14,7 @@
 from sentry.analytics.events.auth_v2 import AuthV2DeleteLogin
 from sentry.api.api_owners import ApiOwner
 from sentry.api.api_publish_status import ApiPublishStatus
-from sentry.api.authentication import QuietBasicAuthentication
+from sentry.api.authentication import QuietBasicAuthentication, UserAuthTokenAuthentication
 from sentry.api.base import Endpoint, control_silo_endpoint
 from sentry.api.exceptions import SsoRequired
 from sentry.api.serializers import serialize
@@ -134,6 +134,17 @@ class AuthIndexEndpoint(BaseAuthIndexEndpoint):
     authentication methods from JS endpoints by relying on internal sessions
     and simple HTTP authentication.
     """
+
+    def initialize_request(self, request, *args, **kwargs):
+        rv = super().initialize_request(request, *args, **kwargs)
+        # Allow Bearer token authentication for GET (whoami) only.
+        # POST/PUT/DELETE are session-management operations where Bearer auth
+        # is inappropriate — the original restriction to QuietBasicAuthentication
+        # and SessionAuthentication is intentional for those methods.
+        if request.method == "GET":
+            rv.authenticators = [UserAuthTokenAuthentication(), *(rv.authenticators or [])]
+        return rv
+
     enforce_rate_limit = True
     rate_limits = RateLimitConfig(
         limit_overrides={

tests/sentry/api/endpoints/test_auth.py

@@ -1,7 +1,29 @@
 from django.urls import reverse
 
+from sentry.models.apitoken import ApiToken
 from sentry.testutils.cases import APITestCase
 from sentry.testutils.silo import control_silo_test
+from sentry.types.token import AuthTokenType
+
+
+@control_silo_test
+class AuthGetTest(APITestCase):
+    def test_get_with_bearer_token(self) -> None:
+        user = self.create_user(email="a@example.com")
+        api_token = ApiToken.objects.create(token_type=AuthTokenType.USER, user=user)
+        url = reverse("sentry-api-0-auth")
+        response = self.client.get(
+            url,
+            format="json",
+            HTTP_AUTHORIZATION=f"Bearer {api_token.plaintext_token}",
+        )
+        assert response.status_code == 200
+        assert response.data["id"] == str(user.id)
+
+    def test_get_unauthenticated(self) -> None:
+        url = reverse("sentry-api-0-auth")
+        response = self.client.get(url, format="json")
+        assert response.status_code == 400
 
 
 @control_silo_test