feat(gitlab): access, membership, and user-admin operations (#5710)

* feat(gitlab): add access, membership, and user-admin tools

Adds member, invitation, access-request, SAML group link, and user
administration tools to the GitLab integration. Resource-scoped ops work
against projects or groups; user-admin ops require an admin token. All tools
reuse the existing host/SSRF guard via getGitLabApiBase and add a shared
getGitLabResourcePath helper.

* feat(gitlab): wire access operations into the GitLab block

Adds the new operations to the block dropdown and tools access list, with a
named access-level dropdown (enum in, integer out), first-class expires_at,
a /members/all default (direct-only opt-in), resource-type selector, and
member_role_id passthrough.

* test(gitlab): cover access operations

Covers the access_level enum-to-integer coercion, the /members/all default vs
direct-only, the 409-duplicate-add soft success, invitation per-email error
handling, user-status-action response parsing, and getGitLabResourcePath.

* docs(gitlab): document access and membership operations

* Update apps/sim/blocks/blocks/gitlab.ts

Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

* fix(gitlab): address review findings

- update_user now sends admin:false so the Administrator switch can demote
  (an untouched switch stays undefined and leaves the flag unchanged)
- expose the access-level dropdown for Update Invitation
- normalize comma-separated invite emails so spaced multi-email input works

* fix(gitlab): make update-invitation access level optional

Update Invitation now uses a dedicated dropdown that defaults to 'Leave
unchanged', so updating only the expiration no longer silently resets the
invitation's access level to Developer. The level is sent only when explicitly
chosen.

* fix(gitlab): validation pass — SAML provider param, member/invitation query filter, moderation user guard, registry order

* fix(gitlab): apply 10-agent validation findings across all 62 tools

- MR draft flag now applied via Draft: title prefix (GitLab has no draft body param)
- update_user only sends admin when a real boolean (untouched switch serialized null and could demote admins)
- add_member 409 soft-success now verified against the conflict body
- auto_merge sent alongside deprecated merge_when_pipeline_succeeds
- job log capped at 200k chars, file content at 1M chars, with truncated outputs
- MR diffs signal hasMore beyond 100 files
- wire dropped params: update_issue milestoneId, MR milestone/squash/removeSourceBranch, pipelines ref, tree ref, branches search, commits since/until/path/author, update_file lastCommitId, jobs includeRetried, create_user forceRandomPassword
- complete pipeline/job status enums, access-level enums, widen stale type unions
- guards: update_invitation requires a change; create_user requires a password strategy
- fix double-encoding trap in path descriptions; doc-accuracy touch-ups

* fix(gitlab): review round 1 — dedicated no-default access level for update member, expiration clearing via explicit empty string

* fix(gitlab): explicit Clear Expiration toggle for update member/invitation

* feat(gitlab): expose full documented API surface across tools and block

- membership: add-by-username, remove-member cleanup flags, list-member filters (user_ids/state/seat info), invite_source
- listings: search/visibility/owned/membership, assignee/milestone filters, source/target branch filters, per-domain order-by + sort direction
- CI: pipeline variables + spec:inputs, manual-job variables
- repo: commit authoring (start branch, author, execute flag), release tag message + asset links, cross-fork compare + unidiff, internal notes
- catalog: access-governance template + member-provisioning and access-request-audit skills
- hardening from 3-agent validation: declared release params, tolerate single-object asset links, NaN guard on assignee filter, null/scalar JSON rejection

* fix(gitlab): tri-state controls for update-op booleans (executable flag, MR squash/remove-source-branch)

---------

Co-authored-by: Marcus Chandra <mzxchandra@gmail.com>
Co-authored-by: mzxchandra <129460234+mzxchandra@users.noreply.github.com>
Co-authored-by: greptile-apps[bot] <165735046+greptile-apps[bot]@users.noreply.github.com>

Author: 3 people

apps/docs/content/docs/en/integrations/gitlab.mdx

@@ -0,0 +1,160 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { GitLabBlock } from './gitlab'
+
+const block = GitLabBlock
+
+describe('GitLabBlock access operations', () => {
+  it('routes every access operation to its matching tool id without serialization-time coercion', () => {
+    const accessOps = [
+      'gitlab_list_members',
+      'gitlab_add_member',
+      'gitlab_update_member',
+      'gitlab_remove_member',
+      'gitlab_invite_member',
+      'gitlab_approve_access_request',
+      'gitlab_search_users',
+      'gitlab_block_user',
+      'gitlab_add_saml_group_link',
+    ]
+    for (const toolId of accessOps) {
+      expect(block.tools.access).toContain(toolId)
+      expect(block.tools.config.tool?.({ operation: toolId })).toBe(toolId)
+    }
+  })
+
+  it('exposes the named access-level dropdown with GitLab integer ids', () => {
+    const accessLevel = block.subBlocks.find((s) => s.id === 'accessLevel')
+    expect(accessLevel?.type).toBe('dropdown')
+    const options = typeof accessLevel?.options === 'function' ? undefined : accessLevel?.options
+    expect(options?.map((o) => o.id)).toEqual(['0', '5', '10', '15', '20', '25', '30', '40', '50'])
+    expect(accessLevel?.value?.()).toBe('30')
+  })
+
+  it('coerces the selected access level from the dropdown string to an integer at execution time', () => {
+    const addParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_add_member',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: '40',
+      expiresAt: '2026-12-31',
+      memberRoleId: '5',
+    })
+    expect(addParams).toMatchObject({
+      resourceType: 'group',
+      resourceId: '42',
+      userId: 7,
+      accessLevel: 40,
+      expiresAt: '2026-12-31',
+      memberRoleId: 5,
+    })
+    expect(typeof addParams?.accessLevel).toBe('number')
+  })
+
+  it('defaults list members to inherited members (directOnly falsy)', () => {
+    const listParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_list_members',
+      resourceType: 'project',
+      resourceId: 'grp/proj',
+    })
+    expect(listParams).toMatchObject({ resourceType: 'project', resourceId: 'grp/proj' })
+    expect(listParams?.directOnly).toBeUndefined()
+
+    const directParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_list_members',
+      resourceType: 'project',
+      resourceId: 'grp/proj',
+      directMembersOnly: true,
+    })
+    expect(directParams?.directOnly).toBe(true)
+  })
+
+  it('coerces the target user id for admin user actions', () => {
+    const blockParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_block_user',
+      userId: '99',
+    })
+    expect(blockParams).toMatchObject({ userId: 99 })
+    expect(typeof blockParams?.userId).toBe('number')
+  })
+
+  it('optionally coerces the granted access level for approve access request', () => {
+    const approveParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_approve_access_request',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: '30',
+    })
+    expect(approveParams).toMatchObject({ userId: 7, accessLevel: 30 })
+  })
+
+  it('sends admin:false so update user can demote an administrator', () => {
+    const demote = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_user',
+      userId: '9',
+      userAdminIsAdmin: false,
+    })
+    expect(demote?.admin).toBe(false)
+
+    // An untouched switch is undefined and must leave the admin flag unchanged.
+    const untouched = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_user',
+      userId: '9',
+    })
+    expect(untouched?.admin).toBeUndefined()
+  })
+
+  it('exposes an optional access-level dropdown for update invitation that defaults to unchanged', () => {
+    const invAccess = block.subBlocks.find((s) => s.id === 'invitationAccessLevel')
+    expect(invAccess?.type).toBe('dropdown')
+    expect(invAccess?.value?.()).toBe('')
+    const options = typeof invAccess?.options === 'function' ? undefined : invAccess?.options
+    expect(options?.[0]).toEqual({ label: 'Leave unchanged', id: '' })
+
+    // Updating only the expiration must NOT send an access level (no silent reset).
+    const expiryOnly = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_invitation',
+      resourceType: 'group',
+      resourceId: '42',
+      email: 'a@b.com',
+      expiresAt: '2027-01-01',
+      invitationAccessLevel: '',
+    })
+    expect(expiryOnly).toMatchObject({ email: 'a@b.com', expiresAt: '2027-01-01' })
+    expect(expiryOnly?.accessLevel).toBeUndefined()
+
+    // Choosing a level sends the coerced integer.
+    const withLevel = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_invitation',
+      resourceType: 'group',
+      resourceId: '42',
+      email: 'a@b.com',
+      invitationAccessLevel: '40',
+    })
+    expect(withLevel).toMatchObject({ email: 'a@b.com', accessLevel: 40 })
+  })
+
+  it('throws when required access fields are missing', () => {
+    expect(() =>
+      block.tools.config.params?.({
+        accessToken: 'pat',
+        operation: 'gitlab_add_member',
+        resourceType: 'group',
+        resourceId: '42',
+      })
+    ).toThrow()
+  })
+})