fix(members): Validate teamRoles entries have required keys

src/sentry/core/endpoints/organization_member_index.py

@@ -146,6 +146,11 @@ def validate_teams(self, teams: list[Team]) -> list[Team]:
         return valid_teams
 
     def validate_teamRoles(self, teamRoles: list[dict[str, Any]]) -> list[tuple[Team, str]]:
+        for item in teamRoles:
+            if not isinstance(item, dict) or "role" not in item or "teamSlug" not in item:
+                raise serializers.ValidationError(
+                    "Each team-role entry must be an object with 'teamSlug' and 'role' keys"
+                )
         roles = {item["role"] for item in teamRoles}
         valid_roles = [r.id for r in team_roles.get_all()] + [None]
         if roles.difference(valid_roles):

tests/sentry/core/endpoints/test_organization_member_index.py

@@ -154,6 +154,27 @@ def test_invalid_team_role(self) -> None:
         assert not serializer.is_valid()
         assert serializer.errors == {"teamRoles": ["Invalid team-role"]}
 
+    def test_team_role_missing_keys(self) -> None:
+        context = {"organization": self.organization, "allowed_roles": [roles.get("member")]}
+        for bad_item in (
+            {"teamSlug": self.team.slug},
+            {"role": "contributor"},
+            {},
+            "not-a-dict",
+        ):
+            data = {
+                "email": "user@example.com",
+                "orgRole": "member",
+                "teamRoles": [bad_item],
+            }
+            serializer = OrganizationMemberRequestSerializer(context=context, data=data)
+            assert not serializer.is_valid()
+            assert serializer.errors == {
+                "teamRoles": [
+                    "Each team-role entry must be an object with 'teamSlug' and 'role' keys"
+                ]
+            }
+
     @with_feature("organizations:invite-billing")
     def test_valid_invite_billing_member(self) -> None:
         context = {"organization": self.organization, "allowed_roles": [roles.get("member")]}