[sentry-junior]

#131067 had to add the 402 and 409 responses that the Seer Autofix start endpoint already returned but its @extend_schema(responses=...) never listed. Until then, @sentry/api typed those errors as unknown. This adds a flake8 rule, S034, that catches that kind of omission when the endpoint is written. Requested by @BYK after the review question on #131067.

What S034 checks: a class method with @extend_schema(responses={...}) that writes return Response(..., status=...) with a 4xx status, either a literal or a status.HTTP_4xx_* / HTTP_4xx_* name. If that status isn't a key in responses=, the rule fires. (status, media_type) tuple keys and digit-string keys count as documented. Run on the pre-#131067 version of group_ai_autofix.py, it flags all six of the 402/409 returns that PR documented.

What it doesn't check, as the rule's docstring says, so passing doesn't mean every 4xx is documented:

• a 4xx that comes back from a helper, e.g. return handle_ui_feedback(...);
• a response assigned to a variable before it's returned;
• raised exceptions, which DRF renders as 4xx;
• responses= values it can't read statically (a name, a ** spread, a non-literal key). The method is skipped rather than guessed at.

Two follow-ups would close the gaps the rule leaves: tightening the mypy plugin so error bodies are checked against their TypedDict (handled separately), and a test-time check of responses against the generated schema (#131073).

Existing violations: 95 inline returns in 43 methods across 30 files, all in src/. getsentry has no extend_schema endpoints. Every one returns a status its schema didn't list, so I documented each with the existing RESPONSE_* constant instead of baselining them: 400, 401, 403, 404, 409 and 429. This adds RESPONSE_GONE for the one 410. Like S021–S023, the rule then runs with no baseline, and tests/* is exempt the same way. These are schema-only additions, with no runtime behavior change. Where a status has a known body shape, a typed response like the ones in #131067 can replace the generic constant later.

The optional prod-vs-dev schema diff check fails by design here: the schema gains those response entries, and nothing is removed.

via @BYK.

--

View Session [Sentry]

[BYK]

Two follow-ups would close the gaps the rule leaves: tightening the mypy plugin so error bodies are checked against their TypedDict (handled separately), and a test-time check of responses against the generated schema (#131073).

Let's do these.