From 67d66b3e7a3bdb356c9844736a30d9cdfb27b6e0 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Sun, 5 Apr 2026 18:07:47 +0000
Subject: [PATCH] fix: setup_ops_repo should create ops repo under
 disinto-admin, not the authenticated bot (#240)

- Replace POST /api/v1/users/{owner}/repos fallback with admin API
  POST /api/v1/admin/users/{org_name}/repos, which creates in the target
  namespace regardless of which user is authenticated
- Fix ops_slug derivation in disinto_init to always use disinto-admin
  as owner instead of deriving from forge_repo (which may be johba/...)
- Update projects/disinto.toml.example ops_repo default to disinto-admin/disinto-ops
---
 bin/disinto                   | 14 +++++++++-----
 projects/disinto.toml.example |  2 +-
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/bin/disinto b/bin/disinto
index 5bfff27..48b4526 100755
--- a/bin/disinto
+++ b/bin/disinto
@@ -1007,13 +1007,15 @@ setup_ops_repo() {
       -H "Content-Type: application/json" \
       "${forge_url}/api/v1/orgs/${org_name}/repos" \
       -d "{\"name\":\"${ops_name}\",\"auto_init\":true,\"default_branch\":\"${primary_branch}\",\"description\":\"Operational data for ${org_name}/${ops_name%-ops}\"}" >/dev/null 2>&1; then
-      # Fallback: create under the repo owner namespace (FORGE_REPO owner)
-      local repo_owner="${FORGE_REPO%%/*}"
+      # Fallback: use admin API to create repo under the target namespace.
+      # POST /api/v1/users/{username}/repos creates under the authenticated user,
+      # not under {username}. The admin API POST /api/v1/admin/users/{username}/repos
+      # explicitly creates in the target user's namespace regardless of who is authed.
       curl -sf -X POST \
         -H "Authorization: token ${admin_token:-${FORGE_TOKEN}}" \
         -H "Content-Type: application/json" \
-        "${forge_url}/api/v1/users/${repo_owner}/repos" \
-        -d "{\"name\":\"${ops_name}\",\"auto_init\":true,\"default_branch\":\"${primary_branch}\",\"description\":\"Operational data\"}" >/dev/null 2>&1 || true
+        "${forge_url}/api/v1/admin/users/${org_name}/repos" \
+        -d "{\"name\":\"${ops_name}\",\"auto_init\":true,\"default_branch\":\"${primary_branch}\",\"description\":\"Operational data for ${org_name}/${ops_name%-ops}\"}" >/dev/null 2>&1 || true
     fi
 
     # Add all bot users as collaborators with appropriate permissions
@@ -1980,7 +1982,9 @@ p.write_text(text)
   echo "Branch:  ${branch}"
 
   # Set up {project}-ops repo (#757)
-  local ops_slug="${forge_repo}-ops"
+  # Always use disinto-admin as the ops repo owner — forge_repo owner may be
+  # the calling user (e.g. johba) but the ops repo belongs to disinto-admin.
+  local ops_slug="disinto-admin/${project_name}-ops"
   local ops_root="/home/${USER}/${project_name}-ops"
   setup_ops_repo "$forge_url" "$ops_slug" "$ops_root" "$branch"
 
diff --git a/projects/disinto.toml.example b/projects/disinto.toml.example
index ea0b8c5..61781e5 100644
--- a/projects/disinto.toml.example
+++ b/projects/disinto.toml.example
@@ -5,7 +5,7 @@
 
 name            = "disinto"
 repo            = "johba/disinto"
-ops_repo        = "johba/disinto-ops"
+ops_repo        = "disinto-admin/disinto-ops"
 forge_url       = "http://localhost:3000"
 repo_root       = "/home/YOU/dark-factory"
 ops_repo_root   = "/home/YOU/disinto-ops"