fix(gitlab): review round 1 — dedicated no-default access level for update member, expiration clearing via explicit empty string

Author: waleedlatif1

apps/docs/content/docs/en/integrations/gitlab.mdx

@@ -859,7 +859,7 @@ Update a member's access level in a GitLab project or group
 | `resourceId` | string | Yes | Project or group ID or path \(e.g. mygroup/myproject\) |
 | `userId` | number | Yes | The ID of the member to update |
 | `accessLevel` | number | Yes | New access level: 0 \(No access\), 5 \(Minimal\), 10 \(Guest\), 15 \(Planner\), 20 \(Reporter\), 25 \(Security Manager\), 30 \(Developer\), 40 \(Maintainer\), 50 \(Owner\) |
-| `expiresAt` | string | No | Access expiration date in YYYY-MM-DD format |
+| `expiresAt` | string | No | Access expiration date in YYYY-MM-DD format. Pass an empty string to clear an existing expiration. |
 | `memberRoleId` | number | No | Custom member role ID \(GitLab Ultimate only\). Warning: when omitted, GitLab removes any custom role the member currently holds. |
 
 #### Output

apps/sim/blocks/blocks/gitlab.ts

@@ -42,10 +42,13 @@ const USER_ID_OPS = [
   'gitlab_delete_user_identity',
 ]
 
-/** Operations that take a named access-level dropdown (required unless noted). */
+/**
+ * Operations that take the shared access-level dropdown (required unless
+ * noted). Update Member deliberately has its own dropdown without a default so
+ * an expiry-only edit cannot silently reset a Maintainer/Owner to Developer.
+ */
 const ACCESS_LEVEL_OPS = [
   'gitlab_add_member',
-  'gitlab_update_member',
   'gitlab_invite_member',
   'gitlab_approve_access_request',
   'gitlab_add_saml_group_link',
@@ -54,7 +57,6 @@ const ACCESS_LEVEL_OPS = [
 /** Operations where the access level is required (approve/invitation update are optional). */
 const ACCESS_LEVEL_REQUIRED_OPS = [
   'gitlab_add_member',
-  'gitlab_update_member',
   'gitlab_invite_member',
   'gitlab_add_saml_group_link',
 ]
@@ -1033,6 +1035,30 @@ Return ONLY the commit message - no explanations, no extra text.`,
         value: ACCESS_LEVEL_OPS,
       },
     },
+    // Access level for Update Member. Required by GitLab's edit-member API, but
+    // deliberately has NO default: the user must explicitly pick the level so an
+    // expiry-only edit can't silently downgrade a Maintainer/Owner to Developer.
+    {
+      id: 'memberAccessLevel',
+      title: 'Access Level',
+      type: 'dropdown',
+      options: [
+        { label: 'No access', id: '0' },
+        { label: 'Minimal Access', id: '5' },
+        { label: 'Guest', id: '10' },
+        { label: 'Planner', id: '15' },
+        { label: 'Reporter', id: '20' },
+        { label: 'Security Manager', id: '25' },
+        { label: 'Developer', id: '30' },
+        { label: 'Maintainer', id: '40' },
+        { label: 'Owner', id: '50' },
+      ],
+      required: true,
+      condition: {
+        field: 'operation',
+        value: ['gitlab_update_member'],
+      },
+    },
     // Optional access level for Update Invitation. Defaults to "Leave unchanged"
     // so updating only the expiration does not silently reset the access level.
     {
@@ -1818,15 +1844,15 @@ Return ONLY the commit message - no explanations, no extra text.`,
             }
 
           case 'gitlab_update_member':
-            if (!params.resourceId?.trim() || !params.userId || !params.accessLevel) {
+            if (!params.resourceId?.trim() || !params.userId || !params.memberAccessLevel) {
               throw new Error('Project / Group ID, User ID, and Access Level are required.')
             }
             return {
               ...baseParams,
               resourceType: params.resourceType || 'project',
               resourceId: params.resourceId.trim(),
               userId: Number(params.userId),
-              accessLevel: Number(params.accessLevel),
+              accessLevel: Number(params.memberAccessLevel),
               expiresAt: params.expiresAt?.trim() || undefined,
               memberRoleId: params.memberRoleId ? Number(params.memberRoleId) : undefined,
             }
@@ -2130,6 +2156,10 @@ Return ONLY the commit message - no explanations, no extra text.`,
     groupId: { type: 'string', description: 'Group ID or URL-encoded path' },
     userId: { type: 'number', description: 'Target user ID' },
     accessLevel: { type: 'number', description: 'GitLab access level (10-50)' },
+    memberAccessLevel: {
+      type: 'string',
+      description: 'Access level for member updates (explicit choice, no default)',
+    },
     invitationAccessLevel: {
       type: 'string',
       description: 'Optional new access level for an invitation ("" leaves it unchanged)',

apps/sim/tools/gitlab/update_invitation.ts

@@ -76,7 +76,8 @@ export const gitlabUpdateInvitationTool: ToolConfig<
       const body: Record<string, unknown> = {}
 
       if (params.accessLevel !== undefined) body.access_level = params.accessLevel
-      if (params.expiresAt) body.expires_at = params.expiresAt
+      // Send explicit empty string too, which clears an existing expiration.
+      if (params.expiresAt !== undefined) body.expires_at = params.expiresAt
 
       return body
     },

apps/sim/tools/gitlab/update_member.ts

@@ -53,7 +53,8 @@ export const gitlabUpdateMemberTool: ToolConfig<
       type: 'string',
       required: false,
       visibility: 'user-or-llm',
-      description: 'Access expiration date in YYYY-MM-DD format',
+      description:
+        'Access expiration date in YYYY-MM-DD format. Pass an empty string to clear an existing expiration.',
     },
     memberRoleId: {
       type: 'number',
@@ -79,7 +80,8 @@ export const gitlabUpdateMemberTool: ToolConfig<
         access_level: params.accessLevel,
       }
 
-      if (params.expiresAt) body.expires_at = params.expiresAt
+      // Send explicit empty string too, which clears an existing expiration.
+      if (params.expiresAt !== undefined) body.expires_at = params.expiresAt
       if (params.memberRoleId !== undefined) body.member_role_id = params.memberRoleId
 
       return body