From 56897d717e9445eb7aacfceba3f17bfe782f4809 Mon Sep 17 00:00:00 2001
From: Lee Standen <lee.standen@ironcladhq.com>
Date: Wed, 10 Sep 2025 15:57:16 -0700
Subject: [PATCH] Fixes issue with organization name case sensitivity when
 using allowedInstallationOwners

Signed-off-by: Lee Standen <lee.standen@ironcladhq.com>
---
 .changeset/thin-phones-press.md               |  5 +++
 ...eInstanceGithubCredentialsProvider.test.ts | 36 +++++++++++++++++++
 ...SingleInstanceGithubCredentialsProvider.ts | 10 ++++--
 3 files changed, 49 insertions(+), 2 deletions(-)
 create mode 100644 .changeset/thin-phones-press.md

diff --git a/.changeset/thin-phones-press.md b/.changeset/thin-phones-press.md
new file mode 100644
index 0000000000..8b3f985772
--- /dev/null
+++ b/.changeset/thin-phones-press.md
@@ -0,0 +1,5 @@
+---
+'@backstage/integration': patch
+---
+
+Fixes issue with Github credentials provider which fails to match organization name if using allowedInstallationOwners
diff --git a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts
index ec07d1b465..0468e96e14 100644
--- a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts
+++ b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.test.ts
@@ -231,6 +231,42 @@ describe('SingleInstanceGithubCredentialsProvider tests', () => {
     expect(token).toEqual(undefined);
   });
 
+  it('should not fail to issue tokens for an organization when there is a case mismatch in the organization name', async () => {
+    octokit.apps.listInstallations.mockResolvedValue({
+      headers: {
+        etag: '123',
+      },
+      data: [
+        {
+          id: 1,
+          repository_selection: 'selected',
+          account: {
+            login: 'backstage',
+          },
+        },
+      ],
+    } as RestEndpointMethodTypes['apps']['listInstallations']['response']);
+
+    octokit.apps.createInstallationAccessToken.mockResolvedValueOnce({
+      data: {
+        expires_at: DateTime.local().plus({ hours: 1 }).toString(),
+        token: 'secret_token',
+        repository_selection: 'selected',
+      },
+    } as RestEndpointMethodTypes['apps']['createInstallationAccessToken']['response']);
+
+    octokit.apps.listReposAccessibleToInstallation.mockReturnValue({
+      data: [{ name: 'some-repo' }],
+    } as unknown as RestEndpointMethodTypes['apps']['listReposAccessibleToInstallation']['response']);
+
+    const { token, headers } = await github.getCredentials({
+      url: 'https://github.com/Backstage',
+    });
+    const expectedToken = 'secret_token';
+    expect(headers).toEqual({ Authorization: `Bearer ${expectedToken}` });
+    expect(token).toEqual('secret_token');
+  });
+
   it('should not fail to issue tokens for an organization when the app is installed for a single repo', async () => {
     octokit.apps.listInstallations.mockResolvedValue({
       headers: {
diff --git a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts
index fd3c02486f..eaaabe8b0f 100644
--- a/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts
+++ b/packages/integration/src/github/SingleInstanceGithubCredentialsProvider.ts
@@ -102,7 +102,9 @@ class GithubAppManager {
   private readonly allowedInstallationOwners: string[] | undefined; // undefined allows all installations
 
   constructor(config: GithubAppConfig, baseUrl?: string) {
-    this.allowedInstallationOwners = config.allowedInstallationOwners;
+    this.allowedInstallationOwners = config.allowedInstallationOwners?.map(
+      owner => owner.toLocaleLowerCase('en-US'),
+    );
     this.baseUrl = baseUrl;
     this.baseAuthConfig = {
       appId: config.appId,
@@ -121,7 +123,11 @@ class GithubAppManager {
     repo?: string,
   ): Promise<{ accessToken: string | undefined }> {
     if (this.allowedInstallationOwners) {
-      if (!this.allowedInstallationOwners?.includes(owner)) {
+      if (
+        !this.allowedInstallationOwners?.includes(
+          owner.toLocaleLowerCase('en-US'),
+        )
+      ) {
         return { accessToken: undefined }; // An empty token allows anonymous access to public repos
       }
     }