fix(gitlab): treat access level 0 ("No access") as a provided value

A runtime reference can resolve to the integer 0, but the block still gated
access-level presence with truthiness: required ops rejected 0 as missing and
optional ops silently omitted it. Add hasGitLabAccessLevel(value) (0 and '0'
are provided; undefined/null/'' are not) and use it for all six presence
gates so "No access" can be granted or set via a reference.

Author: mzxchandra

apps/sim/blocks/blocks/gitlab.test.ts

@@ -69,6 +69,43 @@ describe('GitLabBlock access operations', () => {
     expect(typeof byName?.accessLevel).toBe('number')
   })
 
+  it('accepts a runtime-resolved numeric 0 ("No access") on a required op', () => {
+    // A reference can resolve to the number 0; a truthiness guard would wrongly
+    // reject it as missing. It must pass and coerce to 0.
+    const byZero = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_add_member',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: 0,
+    })
+    expect(byZero).toMatchObject({ userId: 7, accessLevel: 0 })
+    expect(byZero?.accessLevel).toBe(0)
+  })
+
+  it('sends a numeric 0 on optional ops instead of silently omitting it', () => {
+    const approve = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_approve_access_request',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: 0,
+    })
+    expect(approve?.accessLevel).toBe(0)
+
+    const invite = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_invitation',
+      resourceType: 'group',
+      resourceId: '42',
+      email: 'a@b.com',
+      invitationAccessLevel: 0,
+    })
+    expect(invite?.accessLevel).toBe(0)
+  })
+
   it('throws loudly when a resolved access level is not a valid GitLab level', () => {
     expect(() =>
       block.tools.config.params?.({

apps/sim/blocks/blocks/gitlab.ts

@@ -2,7 +2,11 @@ import { GitLabIcon } from '@/components/icons'
 import type { BlockConfig, BlockMeta } from '@/blocks/types'
 import { AuthMode, IntegrationType } from '@/blocks/types'
 import type { GitLabResponse } from '@/tools/gitlab/types'
-import { coerceGitLabAccessLevel, GITLAB_ACCESS_LEVEL_OPTIONS } from '@/tools/gitlab/utils'
+import {
+  coerceGitLabAccessLevel,
+  GITLAB_ACCESS_LEVEL_OPTIONS,
+  hasGitLabAccessLevel,
+} from '@/tools/gitlab/utils'
 import { getTrigger } from '@/triggers'
 
 /**
@@ -2498,7 +2502,7 @@ Return ONLY the JSON array - no explanations, no extra text.`,
             if (
               !params.resourceId?.trim() ||
               (!addMemberUserId && !params.username?.trim()) ||
-              !params.accessLevel
+              !hasGitLabAccessLevel(params.accessLevel)
             ) {
               throw new Error(
                 'Project / Group ID, User ID (or Username), and Access Level are required.'
@@ -2517,7 +2521,11 @@ Return ONLY the JSON array - no explanations, no extra text.`,
           }
 
           case 'gitlab_update_member':
-            if (!params.resourceId?.trim() || !params.userId || !params.memberAccessLevel) {
+            if (
+              !params.resourceId?.trim() ||
+              !params.userId ||
+              !hasGitLabAccessLevel(params.memberAccessLevel)
+            ) {
               throw new Error('Project / Group ID, User ID, and Access Level are required.')
             }
             return {
@@ -2544,7 +2552,11 @@ Return ONLY the JSON array - no explanations, no extra text.`,
             }
 
           case 'gitlab_invite_member':
-            if (!params.resourceId?.trim() || !params.email?.trim() || !params.accessLevel) {
+            if (
+              !params.resourceId?.trim() ||
+              !params.email?.trim() ||
+              !hasGitLabAccessLevel(params.accessLevel)
+            ) {
               throw new Error('Project / Group ID, Email, and Access Level are required.')
             }
             return {
@@ -2576,7 +2588,7 @@ Return ONLY the JSON array - no explanations, no extra text.`,
               throw new Error('Project / Group ID and Email are required.')
             }
             if (
-              !params.invitationAccessLevel &&
+              !hasGitLabAccessLevel(params.invitationAccessLevel) &&
               !params.expiresAt?.trim() &&
               !params.clearExpiresAt
             ) {
@@ -2591,7 +2603,7 @@ Return ONLY the JSON array - no explanations, no extra text.`,
               email: params.email.trim(),
               // Only send access_level when a level is chosen; "Leave unchanged"
               // ('') keeps the invitation's current level instead of resetting it.
-              accessLevel: params.invitationAccessLevel
+              accessLevel: hasGitLabAccessLevel(params.invitationAccessLevel)
                 ? coerceGitLabAccessLevel(params.invitationAccessLevel)
                 : undefined,
               expiresAt: params.clearExpiresAt ? '' : params.expiresAt?.trim() || undefined,
@@ -2629,7 +2641,7 @@ Return ONLY the JSON array - no explanations, no extra text.`,
               resourceType: params.resourceType || 'project',
               resourceId: params.resourceId.trim(),
               userId: Number(params.userId),
-              accessLevel: params.accessLevel
+              accessLevel: hasGitLabAccessLevel(params.accessLevel)
                 ? coerceGitLabAccessLevel(params.accessLevel)
                 : undefined,
             }
@@ -2655,7 +2667,11 @@ Return ONLY the JSON array - no explanations, no extra text.`,
             }
 
           case 'gitlab_add_saml_group_link':
-            if (!params.groupId?.trim() || !params.samlGroupName?.trim() || !params.accessLevel) {
+            if (
+              !params.groupId?.trim() ||
+              !params.samlGroupName?.trim() ||
+              !hasGitLabAccessLevel(params.accessLevel)
+            ) {
               throw new Error('Group ID, SAML Group Name, and Access Level are required.')
             }
             return {

apps/sim/tools/gitlab/utils.test.ts

@@ -6,6 +6,7 @@ import {
   coerceGitLabAccessLevel,
   getGitLabApiBase,
   getGitLabResourcePath,
+  hasGitLabAccessLevel,
   InvalidGitLabAccessLevelError,
   normalizeGitLabHost,
   UnsafeGitLabHostError,
@@ -136,3 +137,18 @@ describe('coerceGitLabAccessLevel', () => {
     expect(() => coerceGitLabAccessLevel('boss')).toThrow(/Developer \(30\)/)
   })
 })
+
+describe('hasGitLabAccessLevel', () => {
+  it('treats numeric zero ("No access") and its string form as provided', () => {
+    expect(hasGitLabAccessLevel(0)).toBe(true)
+    expect(hasGitLabAccessLevel('0')).toBe(true)
+    expect(hasGitLabAccessLevel(30)).toBe(true)
+    expect(hasGitLabAccessLevel('Developer')).toBe(true)
+  })
+
+  it('treats undefined, null, and the empty-string sentinel as not provided', () => {
+    expect(hasGitLabAccessLevel(undefined)).toBe(false)
+    expect(hasGitLabAccessLevel(null)).toBe(false)
+    expect(hasGitLabAccessLevel('')).toBe(false)
+  })
+})

apps/sim/tools/gitlab/utils.ts

@@ -113,6 +113,17 @@ export class InvalidGitLabAccessLevelError extends Error {
   }
 }
 
+/**
+ * Whether an access-level field carries a value to send. Distinguishes a real
+ * level - including numeric `0` ("No access") - from "not provided" (undefined,
+ * null, or the empty-string "leave unchanged" sentinel). A bare truthiness check
+ * would wrongly treat a runtime-resolved `0` as absent, rejecting it on required
+ * operations and silently omitting it on optional ones.
+ */
+export function hasGitLabAccessLevel(value: unknown): boolean {
+  return value !== undefined && value !== null && value !== ''
+}
+
 /**
  * Coerces a runtime access-level value to the GitLab integer. Accepts an integer
  * (`30`), a numeric string (`'30'`), or a level name (`'Developer'`,