fix(gitlab): validate list_groups min-access-level and similarity ordering at execution time

Greptile round 1 (both P1):
- min_access_level: coerce via the shared access-level enum (coerceGitLabMinAccessLevel) and throw on out-of-enum values (31, 999) or 0, so a direct tool call fails loudly instead of sending an invalid filter to GitLab
- order_by=similarity now requires a non-empty search term (GitLab ignores similarity ordering without one); throws a clear error otherwise
- tests for both validations

Author: waleedlatif1

apps/sim/tools/gitlab/groups.test.ts

@@ -94,6 +94,40 @@ describe('gitlab_list_groups', () => {
     )
   })
 
+  it('forwards the documented visibility, min-access-level, and all-available filters', () => {
+    const url = gitlabListGroupsTool.request.url({
+      accessToken: 'pat',
+      visibility: 'private',
+      minAccessLevel: 30,
+      allAvailable: true,
+    })
+    expect(url).toBe(
+      'https://gitlab.com/api/v4/groups?visibility=private&min_access_level=30&all_available=true'
+    )
+  })
+
+  it('rejects an out-of-enum minimum access level instead of sending it to GitLab', () => {
+    expect(() =>
+      gitlabListGroupsTool.request.url({ accessToken: 'pat', minAccessLevel: 31 })
+    ).toThrow(/Invalid GitLab access level/)
+    expect(() =>
+      gitlabListGroupsTool.request.url({ accessToken: 'pat', minAccessLevel: 0 })
+    ).toThrow(/Invalid GitLab access level/)
+  })
+
+  it('rejects similarity ordering without a search term, but allows it with one', () => {
+    expect(() =>
+      gitlabListGroupsTool.request.url({ accessToken: 'pat', orderBy: 'similarity' })
+    ).toThrow(/similarity/)
+    expect(
+      gitlabListGroupsTool.request.url({
+        accessToken: 'pat',
+        orderBy: 'similarity',
+        search: 'plat',
+      })
+    ).toBe('https://gitlab.com/api/v4/groups?search=plat&order_by=similarity')
+  })
+
   it('reads the total from the x-total header, falling back to length', async () => {
     const withHeader = await gitlabListGroupsTool.transformResponse?.(
       mockResponse({ json: [{ id: 1 }, { id: 2 }], headers: { 'x-total': '17' } }),

apps/sim/tools/gitlab/list_groups.ts

@@ -1,5 +1,5 @@
 import type { GitLabListGroupsParams, GitLabListGroupsResponse } from '@/tools/gitlab/types'
-import { getGitLabApiBase } from '@/tools/gitlab/utils'
+import { coerceGitLabMinAccessLevel, getGitLabApiBase } from '@/tools/gitlab/utils'
 import type { ToolConfig } from '@/tools/types'
 
 export const gitlabListGroupsTool: ToolConfig<GitLabListGroupsParams, GitLabListGroupsResponse> = {
@@ -89,15 +89,24 @@ export const gitlabListGroupsTool: ToolConfig<GitLabListGroupsParams, GitLabList
   request: {
     url: (params) => {
       const queryParams = new URLSearchParams()
+      const search = params.search?.trim()
       if (params.owned) queryParams.append('owned', 'true')
-      if (params.search) queryParams.append('search', params.search)
+      if (search) queryParams.append('search', search)
       if (params.topLevelOnly) queryParams.append('top_level_only', 'true')
       if (params.visibility) queryParams.append('visibility', params.visibility)
-      if (params.minAccessLevel && params.minAccessLevel > 0) {
-        queryParams.append('min_access_level', String(params.minAccessLevel))
+      const minAccessLevel = coerceGitLabMinAccessLevel(params.minAccessLevel)
+      if (minAccessLevel !== undefined) {
+        queryParams.append('min_access_level', String(minAccessLevel))
       }
       if (params.allAvailable) queryParams.append('all_available', 'true')
-      if (params.orderBy) queryParams.append('order_by', params.orderBy)
+      if (params.orderBy) {
+        if (params.orderBy === 'similarity' && !search) {
+          throw new Error(
+            'GitLab list groups: order_by "similarity" requires a non-empty search term.'
+          )
+        }
+        queryParams.append('order_by', params.orderBy)
+      }
       if (params.sort) queryParams.append('sort', params.sort)
       if (params.perPage) queryParams.append('per_page', String(params.perPage))
       if (params.page) queryParams.append('page', String(params.page))

apps/sim/tools/gitlab/utils.test.ts

@@ -4,6 +4,7 @@
 import { describe, expect, it } from 'vitest'
 import {
   coerceGitLabAccessLevel,
+  coerceGitLabMinAccessLevel,
   getGitLabApiBase,
   getGitLabResourcePath,
   hasGitLabAccessLevel,
@@ -139,6 +140,33 @@ describe('coerceGitLabAccessLevel', () => {
   })
 })
 
+describe('coerceGitLabMinAccessLevel', () => {
+  it('returns undefined for absent or blank values', () => {
+    expect(coerceGitLabMinAccessLevel(undefined)).toBeUndefined()
+    expect(coerceGitLabMinAccessLevel(null)).toBeUndefined()
+    expect(coerceGitLabMinAccessLevel('')).toBeUndefined()
+  })
+
+  it('coerces valid filter levels from integer, numeric string, or name', () => {
+    expect(coerceGitLabMinAccessLevel(30)).toBe(30)
+    expect(coerceGitLabMinAccessLevel('30')).toBe(30)
+    expect(coerceGitLabMinAccessLevel('Developer')).toBe(30)
+    expect(coerceGitLabMinAccessLevel(5)).toBe(5)
+  })
+
+  it('rejects zero ("No access") — GitLab\'s filter floor is 5', () => {
+    expect(() => coerceGitLabMinAccessLevel(0)).toThrow(InvalidGitLabAccessLevelError)
+    expect(() => coerceGitLabMinAccessLevel('No access')).toThrow(InvalidGitLabAccessLevelError)
+  })
+
+  it('rejects out-of-enum values so they never reach GitLab', () => {
+    expect(() => coerceGitLabMinAccessLevel(31)).toThrow(InvalidGitLabAccessLevelError)
+    expect(() => coerceGitLabMinAccessLevel(999)).toThrow(InvalidGitLabAccessLevelError)
+    expect(() => coerceGitLabMinAccessLevel('35')).toThrow(InvalidGitLabAccessLevelError)
+    expect(() => coerceGitLabMinAccessLevel('root')).toThrow(InvalidGitLabAccessLevelError)
+  })
+})
+
 describe('hasGitLabAccessLevel', () => {
   it('treats numeric zero ("No access") and its string form as provided', () => {
     expect(hasGitLabAccessLevel(0)).toBe(true)

apps/sim/tools/gitlab/utils.ts

@@ -149,6 +149,23 @@ export function coerceGitLabAccessLevel(value: unknown): number {
   throw new InvalidGitLabAccessLevelError(value)
 }
 
+/**
+ * Coerces an optional GitLab `min_access_level` filter value. Returns undefined
+ * when the field is absent or blank, otherwise coerces via the shared
+ * access-level rules and rejects "No access" (0) — GitLab's minimum-access
+ * filter floor is 5 (Minimal access). Runs at execution time so a direct tool
+ * call with an out-of-enum value (e.g. 31 or 999) fails loudly with a clear
+ * error instead of sending an invalid filter to GitLab.
+ *
+ * @throws {InvalidGitLabAccessLevelError} when the value is not a valid filter level.
+ */
+export function coerceGitLabMinAccessLevel(value: unknown): number | undefined {
+  if (value === undefined || value === null || value === '') return undefined
+  const level = coerceGitLabAccessLevel(value)
+  if (level === 0) throw new InvalidGitLabAccessLevelError(value)
+  return level
+}
+
 /**
  * A GitLab access/membership resource is scoped either to a project or a group.
  * The two share an identical endpoint surface (`/members`, `/invitations`,