test(gitlab): cover access operations

Covers the access_level enum-to-integer coercion, the /members/all default vs
direct-only, the 409-duplicate-add soft success, invitation per-email error
handling, user-status-action response parsing, and getGitLabResourcePath.

Author: mzxchandra

apps/sim/blocks/blocks/gitlab.test.ts

@@ -0,0 +1,110 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { GitLabBlock } from './gitlab'
+
+const block = GitLabBlock
+
+describe('GitLabBlock access operations', () => {
+  it('routes every access operation to its matching tool id without serialization-time coercion', () => {
+    const accessOps = [
+      'gitlab_list_members',
+      'gitlab_add_member',
+      'gitlab_update_member',
+      'gitlab_remove_member',
+      'gitlab_invite_member',
+      'gitlab_approve_access_request',
+      'gitlab_search_users',
+      'gitlab_block_user',
+      'gitlab_add_saml_group_link',
+    ]
+    for (const toolId of accessOps) {
+      expect(block.tools.access).toContain(toolId)
+      expect(block.tools.config.tool?.({ operation: toolId })).toBe(toolId)
+    }
+  })
+
+  it('exposes the named access-level dropdown with GitLab integer ids', () => {
+    const accessLevel = block.subBlocks.find((s) => s.id === 'accessLevel')
+    expect(accessLevel?.type).toBe('dropdown')
+    const options = typeof accessLevel?.options === 'function' ? undefined : accessLevel?.options
+    expect(options?.map((o) => o.id)).toEqual(['0', '5', '10', '15', '20', '25', '30', '40', '50'])
+    expect(accessLevel?.value?.()).toBe('30')
+  })
+
+  it('coerces the selected access level from the dropdown string to an integer at execution time', () => {
+    const addParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_add_member',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: '40',
+      expiresAt: '2026-12-31',
+      memberRoleId: '5',
+    })
+    expect(addParams).toMatchObject({
+      resourceType: 'group',
+      resourceId: '42',
+      userId: 7,
+      accessLevel: 40,
+      expiresAt: '2026-12-31',
+      memberRoleId: 5,
+    })
+    expect(typeof addParams?.accessLevel).toBe('number')
+  })
+
+  it('defaults list members to inherited members (directOnly falsy)', () => {
+    const listParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_list_members',
+      resourceType: 'project',
+      resourceId: 'grp/proj',
+    })
+    expect(listParams).toMatchObject({ resourceType: 'project', resourceId: 'grp/proj' })
+    expect(listParams?.directOnly).toBeUndefined()
+
+    const directParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_list_members',
+      resourceType: 'project',
+      resourceId: 'grp/proj',
+      directMembersOnly: true,
+    })
+    expect(directParams?.directOnly).toBe(true)
+  })
+
+  it('coerces the target user id for admin user actions', () => {
+    const blockParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_block_user',
+      userId: '99',
+    })
+    expect(blockParams).toMatchObject({ userId: 99 })
+    expect(typeof blockParams?.userId).toBe('number')
+  })
+
+  it('optionally coerces the granted access level for approve access request', () => {
+    const approveParams = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_approve_access_request',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: '30',
+    })
+    expect(approveParams).toMatchObject({ userId: 7, accessLevel: 30 })
+  })
+
+  it('throws when required access fields are missing', () => {
+    expect(() =>
+      block.tools.config.params?.({
+        accessToken: 'pat',
+        operation: 'gitlab_add_member',
+        resourceType: 'group',
+        resourceId: '42',
+      })
+    ).toThrow()
+  })
+})

apps/sim/tools/gitlab/access.test.ts

@@ -0,0 +1,181 @@
+/**
+ * @vitest-environment node
+ */
+import { describe, expect, it } from 'vitest'
+import { gitlabAddMemberTool } from '@/tools/gitlab/add_member'
+import { gitlabApproveAccessRequestTool } from '@/tools/gitlab/approve_access_request'
+import { gitlabInviteMemberTool } from '@/tools/gitlab/invite_member'
+import { gitlabListMembersTool } from '@/tools/gitlab/list_members'
+import { gitlabUpdateMemberTool } from '@/tools/gitlab/update_member'
+import { gitlabBlockUserTool } from '@/tools/gitlab/user_status_actions'
+
+interface MockResponseOptions {
+  ok?: boolean
+  status?: number
+  json?: unknown
+  text?: string
+  headers?: Record<string, string>
+}
+
+function mockResponse({
+  ok = true,
+  status = 200,
+  json,
+  text = '',
+  headers = {},
+}: MockResponseOptions): Response {
+  return {
+    ok,
+    status,
+    json: async () => json,
+    text: async () => text,
+    headers: {
+      get: (key: string) => headers[key.toLowerCase()] ?? null,
+    },
+  } as unknown as Response
+}
+
+const baseArgs = { accessToken: 'pat', resourceType: 'group' as const, resourceId: '42' }
+
+describe('gitlab_list_members', () => {
+  it('defaults to /members/all so inherited members are included', () => {
+    const url = gitlabListMembersTool.request.url({ ...baseArgs })
+    expect(url).toBe('https://gitlab.com/api/v4/groups/42/members/all')
+  })
+
+  it('uses /members when directOnly is set', () => {
+    const url = gitlabListMembersTool.request.url({ ...baseArgs, directOnly: true })
+    expect(url).toBe('https://gitlab.com/api/v4/groups/42/members')
+  })
+
+  it('builds a project path and forwards pagination', () => {
+    const url = gitlabListMembersTool.request.url({
+      ...baseArgs,
+      resourceType: 'project',
+      resourceId: 'grp/proj',
+      perPage: 50,
+      page: 2,
+    })
+    expect(url).toBe('https://gitlab.com/api/v4/projects/grp%2Fproj/members/all?per_page=50&page=2')
+  })
+})
+
+describe('gitlab_add_member', () => {
+  it('sends integer user_id and access_level in the body', () => {
+    const body = gitlabAddMemberTool.request.body?.({
+      ...baseArgs,
+      userId: 7,
+      accessLevel: 30,
+      expiresAt: '2026-12-31',
+      memberRoleId: 5,
+    })
+    expect(body).toEqual({
+      user_id: 7,
+      access_level: 30,
+      expires_at: '2026-12-31',
+      member_role_id: 5,
+    })
+  })
+
+  it('treats a 409 as a soft success so workflows are re-runnable', async () => {
+    const result = await gitlabAddMemberTool.transformResponse!(
+      mockResponse({ ok: false, status: 409, json: { message: 'Member already exists' } }),
+      {} as never
+    )
+    expect(result.success).toBe(true)
+    expect(result.output.alreadyMember).toBe(true)
+  })
+
+  it('returns the created member on success', async () => {
+    const result = await gitlabAddMemberTool.transformResponse!(
+      mockResponse({ ok: true, status: 201, json: { id: 7, access_level: 30 } }),
+      {} as never
+    )
+    expect(result.success).toBe(true)
+    expect(result.output.alreadyMember).toBe(false)
+    expect(result.output.member).toEqual({ id: 7, access_level: 30 })
+  })
+
+  it('surfaces other errors as hard failures', async () => {
+    const result = await gitlabAddMemberTool.transformResponse!(
+      mockResponse({ ok: false, status: 403, text: 'Forbidden' }),
+      {} as never
+    )
+    expect(result.success).toBe(false)
+  })
+})
+
+describe('gitlab_update_member', () => {
+  it('sends the new access_level integer and expires_at', () => {
+    const body = gitlabUpdateMemberTool.request.body?.({
+      ...baseArgs,
+      userId: 7,
+      accessLevel: 40,
+      expiresAt: '2027-01-01',
+    })
+    expect(body).toEqual({ access_level: 40, expires_at: '2027-01-01' })
+  })
+})
+
+describe('gitlab_approve_access_request', () => {
+  it('passes the granted access_level as an integer query param', () => {
+    const url = gitlabApproveAccessRequestTool.request.url({
+      ...baseArgs,
+      userId: 7,
+      accessLevel: 40,
+    })
+    expect(url).toBe(
+      'https://gitlab.com/api/v4/groups/42/access_requests/7/approve?access_level=40'
+    )
+  })
+
+  it('omits access_level when not provided (GitLab defaults to Developer)', () => {
+    const url = gitlabApproveAccessRequestTool.request.url({ ...baseArgs, userId: 7 })
+    expect(url).toBe('https://gitlab.com/api/v4/groups/42/access_requests/7/approve')
+  })
+})
+
+describe('gitlab_invite_member', () => {
+  it('reports a per-email failure even when GitLab returns 200 with status:error', async () => {
+    const result = await gitlabInviteMemberTool.transformResponse!(
+      mockResponse({
+        ok: true,
+        status: 201,
+        json: { status: 'error', message: { 'a@b.com': 'Already invited' } },
+      }),
+      {} as never
+    )
+    expect(result.success).toBe(false)
+    expect(result.output.status).toBe('error')
+  })
+
+  it('reports success when GitLab accepts the invite', async () => {
+    const result = await gitlabInviteMemberTool.transformResponse!(
+      mockResponse({ ok: true, status: 201, json: { status: 'success' } }),
+      {} as never
+    )
+    expect(result.success).toBe(true)
+    expect(result.output.status).toBe('success')
+  })
+})
+
+describe('gitlab user status actions', () => {
+  it('returns success with no user object when GitLab responds with a bare true', async () => {
+    const result = await gitlabBlockUserTool.transformResponse!(
+      mockResponse({ ok: true, status: 201, json: true }),
+      {} as never
+    )
+    expect(result.success).toBe(true)
+    expect(result.output.success).toBe(true)
+    expect(result.output.user).toBeUndefined()
+  })
+
+  it('surfaces the updated user object when GitLab returns one', async () => {
+    const result = await gitlabBlockUserTool.transformResponse!(
+      mockResponse({ ok: true, status: 201, json: { id: 9, state: 'blocked' } }),
+      {} as never
+    )
+    expect(result.success).toBe(true)
+    expect(result.output.user).toEqual({ id: 9, state: 'blocked' })
+  })
+})

apps/sim/tools/gitlab/utils.test.ts

@@ -2,7 +2,12 @@
  * @vitest-environment node
  */
 import { describe, expect, it } from 'vitest'
-import { getGitLabApiBase, normalizeGitLabHost, UnsafeGitLabHostError } from '@/tools/gitlab/utils'
+import {
+  getGitLabApiBase,
+  getGitLabResourcePath,
+  normalizeGitLabHost,
+  UnsafeGitLabHostError,
+} from '@/tools/gitlab/utils'
 
 describe('normalizeGitLabHost', () => {
   it('defaults to gitlab.com when the host is empty, blank, or not a string', () => {
@@ -69,3 +74,17 @@ describe('getGitLabApiBase', () => {
     expect(() => getGitLabApiBase('legit.com@evil.com')).toThrow(UnsafeGitLabHostError)
   })
 })
+
+describe('getGitLabResourcePath', () => {
+  it('builds project and group path segments', () => {
+    expect(getGitLabResourcePath('project', 42)).toBe('projects/42')
+    expect(getGitLabResourcePath('group', 7)).toBe('groups/7')
+  })
+
+  it('URL-encodes namespaced paths and trims whitespace', () => {
+    expect(getGitLabResourcePath('project', '  mygroup/myproject  ')).toBe(
+      'projects/mygroup%2Fmyproject'
+    )
+    expect(getGitLabResourcePath('group', 'parent/child')).toBe('groups/parent%2Fchild')
+  })
+})