You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Connector PR Review: hard failure on getOrgBasePermission failure
Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0 Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 7b8e75696a7d. Review mode: full View review run
Review Summary
Scanned the full PR diff for security and correctness. This change converts the previous silent fail-closed behavior (treating an absent default_repository_permission as none) into a hard PermissionDenied failure whenever direct-collaborators-only is enabled, plus an up-front Validate() probe (validateBasePermissionVisibility) on one confirmed-admin org in both the PAT and GitHub App credential paths. The behavior change is intentional, gated behind the opt-in direct-collaborators-only flag, and well covered by new and updated tests (connector_test.go, repository_test.go) that assert both the missing-field PermissionDenied error (with empty grants) and the base-permission none no-expansion path. The adminFound bool to firstAdminOrg refactor is correct, and the installation-token client (gh.client) is the right one to probe in App mode. No new issues found.
The prior suggestion about documenting the new credential requirement is partly addressed: the optimizeForLargeOrgs config description now states admin:org / Organization Administration read is required, but docs/connector.mdx:455-462 still does not mention it (D3), so that earlier finding stands and is not re-posted here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
luisina-santos
changed the title
now, with more faulting.