org base permission is none, not read

pkg/connector/repository.go

@@ -548,7 +548,14 @@ func orgBasePermissionSessionKey(orgID string) string {
 
 // getOrgBasePermission fetches the org's default_repository_permission, caching in the session.
 // Returns "read", "write", "admin", or "none".
+//
+// An empty/absent field is treated as "none" (fail closed). GitHub only returns
+// default_repository_permission to org owners / tokens with admin:org (or the
+// GitHub App Organization Administration permission). An omitted field means
+// "unknown", not GitHub's create-org default of "read" — assuming "read" would
+// invent pull grants for every org member on every repo.
 func (o *repositoryResourceType) getOrgBasePermission(ctx context.Context, ss sessions.SessionStore, orgName string, orgResourceID *v2.ResourceId) (string, error) {
+	l := ctxzap.Extract(ctx)
 	key := orgBasePermissionSessionKey(orgResourceID.Resource)
 	cached, found, err := session.GetJSON[string](ctx, ss, key)
 	if err != nil {
@@ -565,7 +572,13 @@ func (o *repositoryResourceType) getOrgBasePermission(ctx context.Context, ss se
 
 	perm := org.GetDefaultRepoPermission()
 	if perm == "" {
-		perm = readConst // GitHub default
+		l.Warn(
+			"baton-github: org default_repository_permission missing or empty; skipping org-member repo expansion (treating as none). "+
+				"Grant the credential org-owner visibility (admin:org / Organization Administration) to sync base-permission grants accurately.",
+			zap.String("org", orgName),
+			zap.String("org_id", orgResourceID.Resource),
+		)
+		perm = "none"
 	}
 
 	if err := session.SetJSON(ctx, ss, key, perm); err != nil {

pkg/connector/repository_test.go

@@ -80,3 +80,26 @@ func TestRepository(t *testing.T) {
 		require.Empty(t, revokeAnnotations)
 	})
 }
+
+func TestOrgBasePermissionToRepoPermissions(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name     string
+		basePerm string
+		want     []string
+	}{
+		{name: "none skips member expansion", basePerm: "none", want: nil},
+		{name: "empty skips member expansion", basePerm: "", want: nil},
+		{name: "read grants pull", basePerm: "read", want: []string{repoPermissionPull}},
+		{name: "write grants pull triage push", basePerm: "write", want: []string{repoPermissionPull, repoPermissionTriage, repoPermissionPush}},
+		{name: "admin grants all levels", basePerm: "admin", want: []string{repoPermissionPull, repoPermissionTriage, repoPermissionPush, repoPermissionMaintain, repoPermissionAdmin}},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			require.Equal(t, tc.want, orgBasePermissionToRepoPermissions(tc.basePerm))
+		})
+	}
+}