fix: explain default GitHub app org visibility on login rejection - #27374
Merged
Conversation
…tion When a fresh deployment falls back to the default Coder GitHub app and CODER_OAUTH2_GITHUB_ALLOWED_ORGS is set, the app can only see memberships in organizations that have installed it. Logins from allowed organizations were rejected with a bare "You aren't a member" error, bricking first login with no hint about the missing app installation. Add a remediation hint to the login rejection when the default provider is configured, warn at server startup when the default provider is combined with allowed orgs, and document the installation requirement. Fixes #17752
Docs preview📖 View docs preview for |
nickvigilante
approved these changes
Jul 21, 2026
nickvigilante
left a comment
nickvigilante
left a comment
Contributor
There was a problem hiding this comment.
Approved with changes. Thanks for this! 
🚀
Extract the install URL and remediation sentence into shared constants so the login rejection, server startup warning, and docs stay in sync. Add the same remediation hint to the team-membership rejection, which has the same root cause when the default GitHub app isn't installed in an organization. Cover the device-flow rejection branch with a test asserting the hint is returned in the response Detail.
matifali
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
On a fresh deployment with no custom GitHub OAuth app, Coder falls back to the default Coder-managed GitHub app. That app can only see organization memberships in organizations where it has been installed. If
CODER_OAUTH2_GITHUB_ALLOWED_ORGSis set but the app isn't installed in the allowed organizations, the membership list comes back empty and every login, including the first admin login, is rejected with a bare "You aren't a member of the authorized Github organizations!" with no hint about the actual cause. This leaves fresh deployments in an apparently broken state.Fix
CODER_OAUTH2_GITHUB_ALLOWED_ORGS, listing the allowed orgs and the install URL.CODER_OAUTH2_GITHUB_ALLOWED_ORGSstep in the GitHub auth docs.Access-control behavior is unchanged; the org check still rejects logins as before, it just explains why and how to fix it.
Testing
TestUserOAuth2Github/NotInAllowedOrganizationDefaultProviderasserts the hint appears whenDefaultProviderConfiguredis set; the existingNotInAllowedOrganizationsubtest asserts it does not leak into the custom-app path.Fixes #17752