fix(upload): detect SSO interstitials titled with the org display name (#55)

* fix(upload): detect SSO interstitials titled with the org display name

When an org's display name differs from its slug, the SAML SSO
interstitial's title shows the display name ("Sign in to Acme
Holdings, Inc" for slug acme-inc) and the page carries no
/orgs/<slug>/sso link, so neither isSignInInterstitial nor the
slug-based isSAMLProtected recognized it and users with full repo
access were told they may lack upload permission.

Add isAuthInterstitial as a fallback after both specific checks: any
"Sign in to ..." title combined with a missing "currentUser" marker
is an auth interstitial (a real repo page always embeds currentUser
and its title starts "GitHub - owner/repo"). Since a stale session
and an unauthorized SSO org are indistinguishable here, the error
names both causes with their fixes.

Fixes #52

* docs(skill): reword uploadToken-not-found troubleshooting row

Sign-in and SSO interstitials now surface their own error messages
before the generic one, so this symptom usually indicates a genuine
access problem rather than an expired session.

Author: drogers0

internal/upload/token.go

@@ -14,6 +14,8 @@ var uploadTokenRe = regexp.MustCompile(`"uploadToken":"([^"]+)"`)
 
 var signInTitleRe = regexp.MustCompile(`(?i)<title>\s*Sign in to GitHub\b`)
 
+var authTitleRe = regexp.MustCompile(`(?i)<title>\s*Sign in to [^\s<]`)
+
 // isSignInInterstitial reports whether the page is GitHub's generic "Sign in to
 // GitHub" interstitial rather than the real repo page. When the user_session
 // cookie is present but invalid or expired, GitHub neither redirects nor errors:
@@ -31,6 +33,23 @@ func isSignInInterstitial(body []byte) bool {
 	return signInTitleRe.Match(body) && !bytes.Contains(body, []byte(`"currentUser"`))
 }
 
+// isAuthInterstitial reports whether the page is ANY "Sign in to …" auth
+// interstitial — GitHub's own sign-in page or an org SSO page. It is the
+// fallback for SSO pages that isSAMLProtected cannot recognize: when an org's
+// display name differs from its slug, the interstitial's title shows the
+// display name ("Sign in to Acme Holdings, Inc" for slug acme-inc) and the
+// page carries no /orgs/<slug>/sso link, so no slug-derived pattern can match
+// (issue #52). The caller only ever knows the slug.
+//
+// The generic title alone would be unsafe — a repo named "sign-in-to-x" is
+// fine because a real repo page's title starts "GitHub - <owner>/<repo>", but
+// we still require "currentUser" to be absent: the repo page embeds it in its
+// JS payload whether or not the request is authenticated, while auth
+// interstitials have no such payload.
+func isAuthInterstitial(body []byte) bool {
+	return authTitleRe.Match(body) && !bytes.Contains(body, []byte(`"currentUser"`))
+}
+
 // isSAMLProtected reports whether the repo page is a SAML SSO "Sign in to
 // <owner>" interstitial rather than the real repo page. When an organization
 // enforces SAML SSO and the browser session is authenticated but not
@@ -98,6 +117,16 @@ func (c *Client) getUploadToken(owner, repo string) (string, error) {
 				"authorize in a browser at https://github.com/orgs/%s/sso (lasts ~24h), then retry. "+
 				"Repository access alone is not enough", owner, owner)
 		}
+		// An org SSO interstitial whose title shows the org's display name rather
+		// than its slug matches neither check above (issue #52); we cannot tell it
+		// apart from a stale session here, so name both causes.
+		if isAuthInterstitial(body) {
+			return "", fmt.Errorf("GitHub served a sign-in page instead of %s/%s — either your session token is "+
+				"invalid or expired (re-run `gh image extract-token`, or refresh GH_SESSION_TOKEN in CI), "+
+				"or %s enforces SAML SSO and your session is not authorized for it "+
+				"(authorize in a browser at https://github.com/orgs/%s/sso, lasts ~24h). "+
+				"Repository access alone is not enough", owner, repo, owner, owner)
+		}
 		return "", fmt.Errorf("uploadToken not found on repo page — you may not have upload access to %s/%s "+
 			"(or, if %s enforces SAML SSO, authorize at https://github.com/orgs/%s/sso)",
 			owner, repo, owner, owner)

internal/upload/token_test.go

@@ -130,6 +130,57 @@ func TestIsSignInInterstitial(t *testing.T) {
 	}
 }
 
+func TestIsAuthInterstitial(t *testing.T) {
+	cases := []struct {
+		name string
+		body string
+		want bool
+	}{
+		{
+			// The issue #52 page: SSO interstitial titled with the org's display
+			// name, which shares nothing with the slug the caller knows.
+			name: "SSO interstitial titled with the org display name",
+			body: `<title>Sign in to Acme Holdings, Inc</title>`,
+			want: true,
+		},
+		{
+			name: "GitHub's own sign-in interstitial",
+			body: `<title>Sign in to GitHub · GitHub</title><form action="/session">`,
+			want: true,
+		},
+		{
+			name: "anonymous repo page must NOT match",
+			body: `<title>GitHub - octocat/hello: hi</title>{"currentUser":null}`,
+			want: false,
+		},
+		{
+			name: "signed-in repo page must NOT match",
+			body: `<title>GitHub - octocat/hello: hi</title>{"currentUser":{"login":"octocat"}}`,
+			want: false,
+		},
+		{
+			// The real title starts "GitHub - <owner>/<repo>", so the anchored
+			// match cannot fire on a repo that merely mentions signing in.
+			name: "repo about signing in must NOT match",
+			body: `<title>GitHub - acme/auth: Sign in to GitHub from the CLI</title>`,
+			want: false,
+		},
+		{
+			// A title that ends at "Sign in to " names nothing; require a name.
+			name: "bare 'Sign in to ' with no name must NOT match",
+			body: `<title>Sign in to </title>`,
+			want: false,
+		},
+	}
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			if got := isAuthInterstitial([]byte(tc.body)); got != tc.want {
+				t.Errorf("isAuthInterstitial(%q) = %v, want %v", tc.body, got, tc.want)
+			}
+		})
+	}
+}
+
 func TestGetUploadToken(t *testing.T) {
 	cases := []struct {
 		name        string
@@ -169,6 +220,17 @@ func TestGetUploadToken(t *testing.T) {
 			errContains: []string{"invalid or expired"},
 			errExcludes: []string{"SAML"},
 		},
+		{
+			// Issue #52: the SSO interstitial's title shows the org's display name,
+			// not the slug, and the page has no /orgs/<slug>/sso link. Neither the
+			// stale-session nor the slug-based SAML check can fire; the generic
+			// auth-interstitial branch must, naming both possible causes.
+			name:        "SSO interstitial with display-name title names both causes, not access",
+			owner:       "acme-inc",
+			body:        `<title>Sign in to Acme Holdings, Inc</title>`,
+			errContains: []string{"sign-in page", "gh image extract-token", "SAML SSO", "/orgs/acme-inc/sso"},
+			errExcludes: []string{"you may not have upload access"},
+		},
 		{
 			name:        "no token and no interstitial markers gives the generic message",
 			owner:       "octocat",

skills/github-image-upload/SKILL.md

@@ -155,7 +155,7 @@ To fetch an attachment rather than post one, `gh image download <user-attachment
 | Symptom | Fix |
 |---|---|
 | `<org> enforces SAML SSO …` | Authorize the session at `https://github.com/orgs/<org>/sso` (lasts ~24h), then retry. Not a permissions problem. |
-| `uploadToken not found …` | Usually an expired session, not permissions — read access is enough. Re-authenticate; authorize SSO if the org uses it. |
+| `uploadToken not found …` | Expired-session and SSO pages get their own messages, so this likely means no access to the repo — verify the `--repo` value and your access. If both look right, re-authenticate; authorize SSO if the org uses it. |
 | No `user_session` cookie found | Log into GitHub in a supported browser, or set `GH_SESSION_TOKEN`. |
 | Windows + Chrome 127+ | Cookie-library limitation — use another browser or `GH_SESSION_TOKEN`. |
 | CI / headless | Set `GH_SESSION_TOKEN` from a dedicated bot account. |