org base permission is none, not read

[kans]

Fixes CXH-2100

This will drop 10s of millions of grants from some syncs.

Summary

• Fix false-positive repository pull grants under direct-collaborators-only: when GET /orgs/{org} omits default_repository_permission (common without org-owner / admin:org / Organization Administration visibility), stop inventing "read" and treat it as "none" instead.
• That fallback was expanding every org member onto every repo's pull entitlement via GrantExpandable, even when GitHub effective permission is "none".
• Warn when the field is missing so we can see that member→repo base-permission expansion was skipped.
• Org-admin → repo expansion is unchanged (owners still get admin on all repos).

Context

Reported on DoorDash (github_v2): C1 showed repo pull inherited from org membership for ~all members (~7.6k), while GET /repos/.../collaborators/{user}/permission returned "none". Root cause is the empty→"read" default in getOrgBasePermission.

[linear-code]

CXH-2100

[github-actions]

Connector PR Review: org base permission is none, not read

Blocking Issues: 0 | Suggestions: 0 | Threads Resolved: 0
Criteria: Criteria status: loaded .claude/skills/ci-review.md from trusted base 93f61808e090.
Review mode: full
View review run

Review Summary
Scanned the full PR diff for security and correctness. This changes getOrgBasePermission to fail closed: an empty or absent default_repository_permission now maps to none instead of read, preventing false GrantExpandable pull grants for every org member on every repo under direct-collaborators-only. The fix is correct and well-covered: orgBasePermissionToRepoPermissions returns nil for both none and empty string, and the new tests exercise the empty (fail-closed) and explicit read (still-expands) paths end-to-end. zap and ctxzap are already imported, the Debug log level suits a missing-but-expected value cached per-org, and org-admin expansion is untouched. No new issues found.

Security Issues
None found.

Correctness Issues
None found.

Suggestions
None.

[github-actions]

No blocking issues found.

[mateoHernandez123]

nit (non-blocking): I'd drop this to Debug. An empty default_repository_permission here isn't an error or a connector bug — it just means the credential lacks org-owner visibility, which is a normal, expected setup for a lot of tokens. We handle it gracefully (fail closed to none) and move on, and since it's cached per org it only fires once per sync. Logging that at Warn puts an expected, non-actionable condition into warning dashboards / retained OTEL spans as if something were wrong; Debug keeps the signal without the noise. Fine to keep if you want the higher visibility, just flagging it.

[github-actions]

No blocking issues found.