fix(flags): separate permission class (#82463)

Author: oioki

src/sentry/api/bases/organization.py

@@ -230,6 +230,14 @@ class OrganizationMetricsPermission(OrganizationPermission):
     }
 
 
+class OrganizationFlagWebHookSigningSecretPermission(OrganizationPermission):
+    scope_map = {
+        "GET": ["org:read", "org:write", "org:admin"],
+        "POST": ["org:read", "org:write", "org:admin"],
+        "DELETE": ["org:write", "org:admin"],
+    }
+
+
 class ControlSiloOrganizationEndpoint(Endpoint):
     """
     A base class for endpoints that use an organization scoping but lives in the control silo

src/sentry/flags/endpoints/secrets.py

@@ -11,7 +11,10 @@
 from sentry.api.api_owners import ApiOwner
 from sentry.api.api_publish_status import ApiPublishStatus
 from sentry.api.base import region_silo_endpoint
-from sentry.api.bases.organization import OrganizationEndpoint, OrgAuthTokenPermission
+from sentry.api.bases.organization import (
+    OrganizationEndpoint,
+    OrganizationFlagWebHookSigningSecretPermission,
+)
 from sentry.api.paginator import OffsetPaginator
 from sentry.api.serializers import Serializer, register, serialize
 from sentry.flags.models import FlagWebHookSigningSecretModel
@@ -46,7 +49,7 @@ class FlagWebhookSigningSecretValidator(serializers.Serializer):
 @region_silo_endpoint
 class OrganizationFlagsWebHookSigningSecretsEndpoint(OrganizationEndpoint):
     owner = ApiOwner.REPLAY
-    permission_classes = (OrgAuthTokenPermission,)
+    permission_classes = (OrganizationFlagWebHookSigningSecretPermission,)
     publish_status = {
         "GET": ApiPublishStatus.PRIVATE,
         "POST": ApiPublishStatus.PRIVATE,
@@ -95,7 +98,7 @@ def post(self, request: Request, organization: Organization) -> Response:
 @region_silo_endpoint
 class OrganizationFlagsWebHookSigningSecretEndpoint(OrganizationEndpoint):
     owner = ApiOwner.REPLAY
-    permission_classes = (OrgAuthTokenPermission,)
+    permission_classes = (OrganizationFlagWebHookSigningSecretPermission,)
     publish_status = {"DELETE": ApiPublishStatus.PRIVATE}
 
     def delete(