fix(gitlab): address review findings

- update_user now sends admin:false so the Administrator switch can demote
  (an untouched switch stays undefined and leaves the flag unchanged)
- expose the access-level dropdown for Update Invitation
- normalize comma-separated invite emails so spaced multi-email input works

Author: mzxchandra

apps/sim/blocks/blocks/gitlab.test.ts

@@ -97,6 +97,41 @@ describe('GitLabBlock access operations', () => {
     expect(approveParams).toMatchObject({ userId: 7, accessLevel: 30 })
   })
 
+  it('sends admin:false so update user can demote an administrator', () => {
+    const demote = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_user',
+      userId: '9',
+      userAdminIsAdmin: false,
+    })
+    expect(demote?.admin).toBe(false)
+
+    // An untouched switch is undefined and must leave the admin flag unchanged.
+    const untouched = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_user',
+      userId: '9',
+    })
+    expect(untouched?.admin).toBeUndefined()
+  })
+
+  it('exposes the access-level dropdown for update invitation and coerces it', () => {
+    const accessLevel = block.subBlocks.find((s) => s.id === 'accessLevel')
+    const condition = accessLevel?.condition
+    const ops = condition && 'value' in condition ? condition.value : undefined
+    expect(ops).toContain('gitlab_update_invitation')
+
+    const params = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_invitation',
+      resourceType: 'group',
+      resourceId: '42',
+      email: 'a@b.com',
+      accessLevel: '40',
+    })
+    expect(params).toMatchObject({ email: 'a@b.com', accessLevel: 40 })
+  })
+
   it('throws when required access fields are missing', () => {
     expect(() =>
       block.tools.config.params?.({

apps/sim/blocks/blocks/gitlab.ts

@@ -1820,7 +1820,10 @@ Return ONLY the commit message - no explanations, no extra text.`,
               email: params.userAdminEmail?.trim() || undefined,
               username: params.userAdminUsername?.trim() || undefined,
               name: params.userAdminName?.trim() || undefined,
-              admin: params.userAdminIsAdmin || undefined,
+              // Pass the boolean through (not `|| undefined`) so an explicit `false`
+              // demotes the user. An untouched switch is `undefined` and is skipped
+              // by the tool body, leaving the admin flag unchanged.
+              admin: params.userAdminIsAdmin,
             }
 
           case 'gitlab_delete_user':

apps/sim/tools/gitlab/access.test.ts

@@ -159,6 +159,26 @@ describe('gitlab_invite_member', () => {
   })
 })
 
+describe('gitlab_invite_member email normalization', () => {
+  it('normalizes a comma-separated list with spaces into GitLab-accepted form', () => {
+    const body = gitlabInviteMemberTool.request.body?.({
+      ...baseArgs,
+      email: 'alice@example.com, bob@example.com',
+      accessLevel: 30,
+    }) as Record<string, unknown>
+    expect(body.email).toBe('alice@example.com,bob@example.com')
+  })
+
+  it('passes a single email through unchanged', () => {
+    const body = gitlabInviteMemberTool.request.body?.({
+      ...baseArgs,
+      email: 'alice@example.com',
+      accessLevel: 30,
+    }) as Record<string, unknown>
+    expect(body.email).toBe('alice@example.com')
+  })
+})
+
 describe('gitlab user status actions', () => {
   it('returns success with no user object when GitLab responds with a bare true', async () => {
     const result = await gitlabBlockUserTool.transformResponse!(

apps/sim/tools/gitlab/invite_member.ts

@@ -74,8 +74,17 @@ export const gitlabInviteMemberTool: ToolConfig<
       'PRIVATE-TOKEN': params.accessToken,
     }),
     body: (params) => {
+      // GitLab accepts a comma-separated list of emails in a single `email`
+      // field. Normalize surrounding whitespace so "a@b.com, c@d.com" invites
+      // both addresses rather than sending a malformed second entry.
+      const email = String(params.email)
+        .split(',')
+        .map((address) => address.trim())
+        .filter(Boolean)
+        .join(',')
+
       const body: Record<string, unknown> = {
-        email: params.email,
+        email,
         access_level: params.accessLevel,
       }