fix: Correct missing organization constraint in PromptsActivityEndpoint

src/sentry/api/endpoints/prompts_activity.py

@@ -92,8 +92,12 @@ def put(self, request: Request, **kwargs):
         # if project_id or organization_id in required fields make sure they exist
         # if NOT in required fields, insert dummy value so dups aren't recorded
         if "project_id" in required_fields:
-            if not Project.objects.filter(id=fields["project_id"]).exists():
-                return Response({"detail": "Project no longer exists"}, status=400)
+            if not Project.objects.filter(
+                id=fields["project_id"], organization_id=request.organization.id
+            ).exists():
+                return Response(
+                    {"detail": "Project does not belong to this organization"}, status=400
+                )
         else:
             fields["project_id"] = 0
 

tests/sentry/api/endpoints/test_prompts_activity.py

@@ -81,18 +81,20 @@ def test_invalid_project(self) -> None:
         }
         resp = self.client.get(self.path, data)
         assert resp.status_code == 200
+        project_id = self.project.id
         self.project.delete()
         # project doesn't exist
         resp = self.client.put(
             self.path,
             {
                 "organization_id": self.org.id,
-                "project_id": self.project.id,
+                "project_id": project_id,
                 "feature": "releases",
                 "status": "dismissed",
             },
         )
         assert resp.status_code == 400
+        assert resp.data["detail"] == "Project does not belong to this organization"
 
     def test_dismiss(self) -> None:
         data = {
@@ -271,3 +273,20 @@ def test_batched(self) -> None:
         assert resp.status_code == 200
         assert "dismissed_ts" in resp.data["features"]["releases"]
         assert "snoozed_ts" in resp.data["features"]["alert_stream"]
+
+    def test_project_from_different_organization(self) -> None:
+        other_org = self.create_organization()
+        other_project = self.create_project(organization=other_org)
+
+        resp = self.client.put(
+            self.path,
+            {
+                "organization_id": self.org.id,
+                "project_id": other_project.id,
+                "feature": "releases",
+                "status": "dismissed",
+            },
+        )
+
+        assert resp.status_code == 400
+        assert resp.data["detail"] == "Project does not belong to this organization"