feat(demo-mode): passwordless login

src/sentry/utils/auth.py

@@ -23,7 +23,7 @@
 from sentry.users.models.user import User
 from sentry.users.services.user import RpcUser
 from sentry.users.services.user.service import user_service
-from sentry.utils import metrics
+from sentry.utils import demo_mode, metrics
 from sentry.utils.http import absolute_uri
 
 logger = logging.getLogger("sentry.auth")
@@ -417,6 +417,8 @@ def authenticate(
         if users:
             for user in users:
                 try:
+                    if demo_mode.is_readonly_user(user):
+                        return user
                     if user.password:
                         # XXX(joshuarli): This is checked before (and therefore, regardless of outcome)
                         # password checking as a mechanism to drop old password hashers immediately and

src/sentry/utils/demo_mode.py

@@ -0,0 +1,36 @@
+from sentry import options
+from sentry.models.organization import Organization
+from sentry.users.models.user import User
+
+
+def is_readonly_user(user: User | None) -> bool:
+    if not options.get("demo-mode.enabled"):
+        return False
+
+    if not user:
+        return False
+
+    email = getattr(user, "email", None)
+
+    if email:
+        return True
+
+    return email in options.get("demo-mode.users")
+
+
+def is_demo_org(organization: Organization | None):
+    if not options.get("demo-mode.enabled"):
+        return False
+
+    if not organization:
+        return False
+
+    return organization.id in options.get("demo-mode.orgs")
+
+
+def get_readonly_user():
+    if not options.get("demo-mode.enabled"):
+        return None
+
+    email = options.get("demo-mode.users")[0]
+    return User.objects.get(email=email)

src/sentry/web/frontend/auth_login.py

@@ -37,6 +37,7 @@
     is_valid_redirect,
     login,
 )
+from sentry.utils.demo_mode import get_readonly_user, is_demo_org
 from sentry.utils.http import absolute_uri
 from sentry.utils.sdk import capture_exception
 from sentry.utils.urls import add_params_to_url
@@ -562,6 +563,11 @@ def handle_basic_auth(self, request: Request, **kwargs) -> HttpResponseBase:
         op = request.POST.get("op")
         organization = kwargs.pop("organization", None)
 
+        if is_demo_org(organization):
+            user = get_readonly_user()
+            self._handle_login(request, user, organization)
+            return self.redirect(get_login_redirect(request))
+
         if request.method == "GET" and request.subdomain and self.org_exists(request):
             urls = [
                 reverse("sentry-auth-organization", args=[request.subdomain]),