Add single datasource enforcement config (#103870)

<!-- Describe your PR here. -->
Introduces `enforce_single_datasource` on the base detector validator to
restrict specific detector types (Uptime and Crons) to a single data
source.

This prevents invalid configurations where these detectors might be set
up with multiple data sources, which is not supported for their intended
functionality.

<!--

  Sentry employees and contractors can delete or ignore the following.

-->

### Legal Boilerplate

Look, I get it. The entity doing business as "Sentry" was incorporated
in the State of Delaware in 2015 as Functional Software, Inc. and is
gonna need some rights from me in order to utilize my contributions in
this here PR. So here's the deal: I retain all rights, title and
interest in and to my contributions, and by keeping this boilerplate
intact I confirm that Sentry can use, modify, copy, and redistribute my
contributions, under Sentry's choice of terms.

---
[Slack
Thread](https://sentry.slack.com/archives/C04P3P6669X/p1763769018150559?thread_ts=1763769018.150559&cid=C04P3P6669X)

<a
href="https://cursor.com/background-agent?bcId=bc-6e226670-3a54-442a-8e34-be99f595b1ba"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/open-in-cursor-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/open-in-cursor-light.svg"><img alt="Open in
Cursor"
src="https://cursor.com/open-in-cursor.svg"></picture></a>&nbsp;<a
href="https://cursor.com/agents?id=bc-6e226670-3a54-442a-8e34-be99f595b1ba"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/open-in-web-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/open-in-web-light.svg"><img alt="Open in Web"
src="https://cursor.com/open-in-web.svg"></picture></a>

---------

Co-authored-by: Cursor Agent <[email protected]>
Co-authored-by: getsantry[bot] <66042841+getsantry[bot]@users.noreply.github.com>

Author: 3 people

src/sentry/monitors/validators.py

@@ -716,6 +716,7 @@ class MonitorIncidentDetectorValidator(BaseDetectorTypeValidator):
     data_source field (MonitorDataSourceValidator).
     """
 
+    enforce_single_datasource = True
     data_sources = MonitorDataSourceListField(child=MonitorDataSourceValidator(), required=False)
 
     def validate_enabled(self, value: bool) -> bool:

src/sentry/uptime/endpoints/validators.py

@@ -464,6 +464,7 @@ def create_source(self, validated_data: dict[str, Any]) -> UptimeSubscription:
 
 
 class UptimeDomainCheckFailureValidator(BaseDetectorTypeValidator):
+    enforce_single_datasource = True
     data_sources = serializers.ListField(child=UptimeMonitorDataSourceValidator(), required=False)
 
     def validate_config(self, config: dict[str, Any]) -> dict[str, Any]:

src/sentry/workflow_engine/endpoints/validators/base/detector.py

@@ -41,6 +41,12 @@ class DetectorQuota:
 
 
 class BaseDetectorTypeValidator(CamelSnakeSerializer):
+    enforce_single_datasource = False
+    """
+    Set to True in subclasses to enforce that only a single data source can be configured.
+    This prevents invalid configurations for detector types that don't support multiple data sources.
+    """
+
     name = serializers.CharField(
         required=True,
         max_length=200,
@@ -79,6 +85,16 @@ def data_sources(self) -> serializers.ListField:
     def data_conditions(self) -> BaseDataConditionValidator:
         raise NotImplementedError
 
+    def validate_data_sources(self, value: list[dict[str, Any]]) -> list[dict[str, Any]]:
+        """
+        Validate data sources, enforcing single data source if configured.
+        """
+        if self.enforce_single_datasource and len(value) > 1:
+            raise serializers.ValidationError(
+                "Only one data source is allowed for this detector type."
+            )
+        return value
+
     def get_quota(self) -> DetectorQuota:
         return DetectorQuota(has_exceeded=False, limit=-1, count=-1)
 

tests/sentry/monitors/test_validators.py

@@ -1195,6 +1195,27 @@ def test_detector_requires_data_source(self):
         assert not validator.is_valid()
         assert "dataSources" in validator.errors
 
+    def test_rejects_multiple_data_sources(self):
+        """Test that multiple data sources are rejected for cron monitors."""
+        data = self._get_valid_detector_data(
+            dataSources=[
+                {
+                    "name": "Test Monitor 1",
+                    "slug": "test-monitor-1",
+                    "config": self._get_base_config(),
+                },
+                {
+                    "name": "Test Monitor 2",
+                    "slug": "test-monitor-2",
+                    "config": self._get_base_config(),
+                },
+            ]
+        )
+        validator = self._create_validator(data)
+        assert not validator.is_valid()
+        assert "dataSources" in validator.errors
+        assert "Only one data source is allowed" in str(validator.errors["dataSources"])
+
     def test_create_detector_validates_data_source(self):
         condition_group = DataConditionGroup.objects.create(
             organization_id=self.organization.id,

tests/sentry/uptime/endpoints/test_validators.py

@@ -146,6 +146,27 @@ def get_valid_data(self, **kwargs):
             ),
         }
 
+    def test_rejects_multiple_data_sources(self):
+        """Test that multiple data sources are rejected for uptime monitors."""
+        data = self.get_valid_data(
+            data_sources=[
+                {
+                    "url": "https://sentry.io",
+                    "intervalSeconds": 60,
+                    "timeoutMs": 1000,
+                },
+                {
+                    "url": "https://example.com",
+                    "intervalSeconds": 60,
+                    "timeoutMs": 1000,
+                },
+            ]
+        )
+        validator = UptimeDomainCheckFailureValidator(data=data, context=self.context)
+        assert not validator.is_valid()
+        assert "dataSources" in validator.errors
+        assert "Only one data source is allowed" in str(validator.errors["dataSources"])
+
     @mock.patch(
         "sentry.quotas.backend.assign_seat",
         return_value=Outcome.ACCEPTED,