{"record":{"id":"fcaf2b53b3c7c4ae","repo":"mastra-ai/mastra","slug":"repository-access-did-not-include-a-bearer-token","errorCode":null,"errorMessage":"Repository access did not include a bearer token.","messagePattern":"Repository access did not include a bearer token\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"mastracode/factory/src/integrations/github/routes.ts","lineNumber":1551,"sourceCode":"          return c.json({ error: 'Invalid JSON body' }, 400);\n        }\n        if (!isValidGitRefSandbox(body.branch)) {\n          return c.json({ error: 'Invalid branch' }, 400);\n        }\n        const branch = body.branch;\n        const sessionWorkspace = await resolveSessionWorkspace(github, project.id, userId, body.sessionId);\n        if (!sessionWorkspace) {\n          return c.json({ error: 'Invalid sessionId' }, 400);\n        }\n        const { workdir, sandbox: sessionSandbox } = sessionWorkspace;\n\n        try {\n          return await withSessionOperationLock(sessionWorkspace.session.sessionId, async () => {\n            const access = await github.versionControl.getRepositoryAccess({\n              orgId,\n              repositoryId: project.repository.id,\n            });\n            if (!access.authorization) throw new Error('Repository access did not include a bearer token.');\n            await pushBranch(sessionSandbox, workdir, branch, access.authorization.token, project.repository.slug);\n            await emitAudit?.({\n              context: loose(c),\n              input: {\n                action: 'factory.git.push',\n                factoryProjectId: project.factoryProjectId,\n                projectRepositoryId: project.id,\n                targets: [{ type: 'branch', id: branch }],\n                metadata: { branch, sessionId: sessionWorkspace.session.sessionId },\n              },\n            });\n            return c.json({ pushed: true, branch });\n          });\n        } catch (err) {\n          return gitErrorResponse(loose(c), err);\n        }\n      },\n    }),","sourceCodeStart":1533,"sourceCodeEnd":1569,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/mastracode/factory/src/integrations/github/routes.ts#L1533-L1569","documentation":"When pushing a session branch, the route fetches repository access (which should carry an installation bearer token) and immediately asserts access.authorization exists before using its token for git push. This error means the version-control service returned access metadata without credentials — the push cannot authenticate, so it aborts rather than attempting an unauthenticated push.","triggerScenarios":"Calling the factory git push route when `github.versionControl.getRepositoryAccess({ orgId, repositoryId })` resolves with `authorization: undefined` — e.g. the GitHub App installation is missing or deauthorized for that repo/org, or the access service is misconfigured to omit tokens.","commonSituations":"GitHub App installation uninstalled or its permissions revoked; repository not added to the installation's allowed repos; an internal service returning a partial response after a version/contract change.","solutions":["Re-install or repair the GitHub App installation for the org and confirm the repository is in its scope.","Check the versionControl access service config so it returns an authorization (token) for installation-scoped repos.","Verify the orgId/repositoryId passed to getRepositoryAccess actually map to an installation with content write permission.","Wrap the push flow to surface a user-facing 'repository not authorized' state instead of this internal error."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"const access = await github.versionControl.getRepositoryAccess({ orgId, repositoryId });\nif (!access?.authorization?.token) throw new Error('repository not authorized: no installation token');","typeGuard":"function hasAuthorization(a: { authorization?: { token: string } | null }): a is { authorization: { token: string } } {\n  return typeof a.authorization?.token === 'string' && a.authorization.token.length > 0;\n}","tryCatchPattern":"try {\n  await pushBranch(sessionSandbox, workdir, branch, access.authorization.token, slug);\n} catch (err) {\n  if (err instanceof Error && err.message.includes('bearer token')) {\n    throw new UnauthorizedError('GitHub installation is missing or lacks access to this repository');\n  }\n  throw err;\n}","preventionTips":["Before pushing, verify the GitHub App installation covers the org and repository.","Re-check installation status after org admins change app permissions.","Surface installation/authorization state in the UI before starting sessions.","Monitor getRepositoryAccess responses for missing authorization as an alerting signal."],"tags":["github","authentication","git-push"],"backgroundTag":"missing-auth-token","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}