Hi, I wanted to report a painful issue we’re having trying to move to use a GitHub App for common operations. This seems to be an unexpected or invalid set of logic related to the ‘member repository permissions’ set for organizations on GitHub. This is impacting all of our GitHub organizations, including our Enterprise Cloud orgs.   Summary Given a GitHub App with tons of permission (including read/write repository administration, organization administration, etc.)… The server-to-server GitHub App call to PATCH an existing repository with the body {private:false}, taking a repo public, returns HTTP 422: “Visibility can’t be changed by this user” This only happens to the GitHub App when the organization’s member privileges are set to not allow repository creation, even if the separate and independent privilege “allow members to change repository visibilities for this organization” is enabled   Expected A PATCH to a repository that is private, to change private to false, succeeds when called by a GitHub App that has repository admin permissions in an organization that has selected the privilege “allow members to change repository visibilities for this organization”   Actual The PATCH fails with HTTP 422, stating “Visibility can’t be changed by this user”, and pointing to a documentation page about GitHub pricing (although this is a GitHub Enterprise Cloud organization). The repository remains private.   Confirmed API workaround Change the ‘repository creation’ member privilege restriction to ‘allow private and public’. This does not work with our organization’s security and compliance policy that repos not be created directly on GitHub.   Diagnostic information (have reproduced with many apps and installs beyond this) GitHub App ID: 41899 GitHub API request ID: 2825:67D5:16B4F9:1B2455:5D93A51C REST API endpoint: PATCH https://api.github.com/repos/Azure-Samples/iot-edge-hmi-module Body: {“private”:”false”} Response: HTTP 422 Response body: "{"message":"Visibility can't be changed by this user.","documentation_url":"https://github.com/pricing"}"   Customer impact Cannot use GitHub Apps to replace older workflow. Documented behavior of member privileges is not accurate and causes pain, blocking scenarios.   Painful mitigation – do not use GitHub Apps: At this time we are forced to abandon using GitHub Apps for some scenarios and will have to continue using org owner personal access tokens or OAuth tokens for authorized users who are org owners.   Confusion around whether GitHub Apps are people/users or not… this is a server-to-server call, but the error message implies it’s a “user”   Set of independent member privileges set for the Azure-Samples org   Member Privileges:                 Repository creation:                                       Disabled   Admin repository permissions:                 Repository visibility change:                                 [ x ] Allow members to change repository visibilities for this organization                                                   If enabled, members with admin permissions for the repository will be able                                                 to change repository visibility from public to private. If disabled, only                                                 organization owners can change repository visibilities.   Thanks, Jeff ... View more

Hi, I've finally gotten around to trying to port a major GitHub OAuth application I've been using to the more modern GitHub App model, since so many things are improved.   However, I'm having issues with a particular user-to-server API that is descibed as being available: the REST v3 API "Edit your organization membership", as documentd here https :// developer.github.com/v3/orgs/members/ #edit-your-organization-membership, indicates that a user can essentially accept their organization invitation, as themselves, with a PATCH to this endpoint marking their state as 'active', if they have a pending invite to the org.   We successfully use this API from our OAuth application. For that to work, we must: - have the OAuth app authorized by that org - have the 'org:write' scope via OAuth for the user (OAuth app model) - have invited the user   The GitHub Apps docs on 'identifying and authorizing users', as documented here  , clearly lists this API - "Edit your organization membership" - as OK for the GitHub App user-to-server flow https://developer.github.com/apps/building-github-apps/identifying-and-authorizing-users-for-github-apps/   The docs also indicate that for GitHub Apps using the OAuth flow, that there is no longer a 'scope' concept, since the user is basically consenting as part of the approval. So, I feel like there may be a bug here.   So, when I issue the PATCH from my GitHub App as a user-to-server, using the user's token received from OAuth via this GitHub app that I allowed, I get a 403 with this error message while posting the state:active paramters:   "You do not have access to this organization membership."   Is this a bug, or are there other issues here? It almost feels like the behavior is slightly different, perhaps related to the scopes issue?   Thanks, and thank you for your help, it would be awesome to finally deprecate this old OAuth app model app for the GitHub App world!   If it helps pull telemetry... here are the headers associated with a sample of this error. I use the official octokit rest.js library that works for our OAuth app in this same call otherwise...   x-github-request-id:  A955:02AD:B0A1EB:D240E0:5D800EE2 date:  Mon, 16 Sep 2019 22:38:26 GMT x-oauth-client-id:  Iv1.a03c550179fc7393   This functionality is important, since it lets us offer a more smooth onboarding experience to our users joining our GitHub organizations: we are able to:   - ask the user to authenticate with our GitHub App via the OAuth client ID and secret and standard flow (no scope since that is not a GitHub App thing) - use the GitHub API to invite a user to our organization using our GitHub App installation token - use the user's OAuth token to PATCH to the API discussed here to edit a user's membership by accepting their invitation to the org (this does not work right now with our GitHub App)   The identical code in our OAuth app and the same everything else is:   - ask the user to auth with our OAuth app via a GitHub OAuth app ID and secret and scope of "org:write" - use one of our org owner's tokens to invite the user to the organization - use the user's OAuth token, with the org:write scope, to call the API to accept their invitation   This is way more simple than asking the user to check their e-mail for the invite, etc.   Jeff   Note - sorry the forum seems to have bugs around showing HTML links right now, I had to remove all links to post this...  ... View more