From 310674f8d41a9f3fe006e51e9769a097c68eacb1 Mon Sep 17 00:00:00 2001
From: AmirSa12 <amirhosseinpr184@gmail.com>
Date: Mon, 21 Sep 2026 19:17:20 +0330
Subject: [PATCH 1/2] fix: require gh app repo access

---
 packages/app/server/routes/check.post.ts | 9 +--------
 1 file changed, 1 insertion(+), 8 deletions(-)

diff --git a/packages/app/server/routes/check.post.ts b/packages/app/server/routes/check.post.ts
index dbbe8146..ae3dfdf8 100644
--- a/packages/app/server/routes/check.post.ts
+++ b/packages/app/server/routes/check.post.ts
@@ -17,18 +17,11 @@ export default eventHandler(async (event) => {
       authenticated = true;
     } catch {}
 
-    try {
-      await app.octokit.request("GET /orgs/{org}/installation", {
-        org: owner,
-      });
-      authenticated = true;
-    } catch {}
-
     if (!authenticated) {
       throw createError({
         statusCode: 404,
         fatal: true,
-        message: `The app https://github.com/apps/pkg-pr-new is not installed on ${owner}/${repo}.`,
+        message: `The app https://github.com/apps/pkg-pr-new is not installed on or does not have access to ${owner}/${repo}.`,
       });
     }
 

From 510288662fbba1f829e1546f6f93deaa46cbc3fa Mon Sep 17 00:00:00 2001
From: AmirSa12 <amirhosseinpr184@gmail.com>
Date: Wed, 23 Sep 2026 19:51:35 +0330
Subject: [PATCH 2/2] update

---
 packages/app/server/routes/check.post.ts | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/packages/app/server/routes/check.post.ts b/packages/app/server/routes/check.post.ts
index ae3dfdf8..8a900b05 100644
--- a/packages/app/server/routes/check.post.ts
+++ b/packages/app/server/routes/check.post.ts
@@ -17,6 +17,23 @@ export default eventHandler(async (event) => {
       authenticated = true;
     } catch {}
 
+    if (!authenticated) {
+      try {
+        const { data: installation } = await app.octokit.request(
+          "GET /orgs/{org}/installation",
+          { org: owner },
+        );
+        const installationOctokit = await app.getInstallationOctokit(
+          installation.id,
+        );
+        await installationOctokit.request("GET /repos/{owner}/{repo}", {
+          owner,
+          repo,
+        });
+        authenticated = true;
+      } catch {}
+    }
+
     if (!authenticated) {
       throw createError({
         statusCode: 404,