From 2e494ebe9e0478a72bcb6c413eef7db9c97139a3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 17 Jul 2026 19:30:06 +0000
Subject: [PATCH] fix: correctly change EMU repo visibility to internal in both
 create and settings-update paths

---
 src/pages/api/projects/[projectName]/index.ts | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/src/pages/api/projects/[projectName]/index.ts b/src/pages/api/projects/[projectName]/index.ts
index 81ddab3..07d0825 100644
--- a/src/pages/api/projects/[projectName]/index.ts
+++ b/src/pages/api/projects/[projectName]/index.ts
@@ -168,6 +168,9 @@ export const POST: APIRoute = async ({
 
     const repo: FullRepository = await resp.json();
 
+    // Two-step visibility change for GitHub EMU organizations: the template
+    // generation API does not support `visibility: 'internal'`, so the repo
+    // is first created as private (above) and then patched to internal here.
     if (repoVisibility === 'internal') {
       const visibilityResp = await changeRepoVisibility(
         token?.value as string,
@@ -464,11 +467,21 @@ export const PUT: APIRoute = async ({ cookies, params, request, redirect }) => {
 
   // Has repo visibility changed?
   if (projectConfig.project.is_private !== body.is_private) {
+    // For GitHub EMU organizations, repos can only be private or internal (not
+    // public).  Sending `private: false` to the API would attempt a public
+    // visibility change which would fail for EMU orgs.  Use `'internal'`
+    // instead so the PATCH sets visibility explicitly.
+    const isEnterprise =
+      isEnterpriseGitHubOrg(slugContents.org) ||
+      cookies.get('auth-provider')?.value === 'utexas';
+    const targetVisibility: boolean | 'internal' =
+      !body.is_private && isEnterprise ? 'internal' : body.is_private;
+
     const visResponse = await changeRepoVisibility(
       info?.token as string,
       slugContents.org,
       slugContents.repo,
-      body.is_private
+      targetVisibility
     );
 
     if (!visResponse.ok) {