feat(gitlab): dynamic access levels + group & membership ops + full group filters (#5743)

* feat(gitlab): dynamic access levels + group and membership operations

Access levels can now be bound to runtime references (e.g. a policy-table
lookup), not just picked from a static list. The three access-level fields
(accessLevel, memberAccessLevel, invitationAccessLevel) switch from dropdown
to combobox so a reference expression is accepted at Copilot save-time instead
of being rejected as an invalid enum value. The resolved value is validated at
execution time by coerceGitLabAccessLevel, which accepts an integer, a numeric
string, or a level name ("Developer"), and throws a clear error otherwise -
preserving the real safety property (no bad integer reaches GitLab) while
dropping the false one (levels must be known at design time).

Also closes demand gaps from the AskIT data:
- get_group / list_groups: resolve and list groups (provisioning critical path)
- list_user_memberships: admin GET /users/:id/memberships, gated in its
  description; the non-admin path is composing list_members

The access-level enum is now a single source of truth in tools/gitlab/utils.ts
(GITLAB_ACCESS_LEVELS) that the block options and runtime coercion both derive
from, replacing three inline copies.

* fix(gitlab): treat access level 0 ("No access") as a provided value

A runtime reference can resolve to the integer 0, but the block still gated
access-level presence with truthiness: required ops rejected 0 as missing and
optional ops silently omitted it. Add hasGitLabAccessLevel(value) (0 and '0'
are provided; undefined/null/'' are not) and use it for all six presence
gates so "No access" can be granted or set via a reference.

* feat(gitlab): expand group listing filters and harden access-level enum

- list_groups: add visibility, min_access_level, and all_available filters (documented on GET /groups) plus order_by/sort, now surfaced in the block and forwarded in params
- order_by widened to include GitLab's documented 'similarity' value
- access-level enum label 'Minimal Access' -> 'Minimal access' to match GitLab verbatim; coercion already case-insensitive
- min_access_level guard rejects 0 (GitLab floor is 5); reuse the access-level enum for the block dropdown (drops 'No access')
- tests: out-of-enum numeric-string coercion case + full list_groups filter mapping

* fix(gitlab): validate list_groups min-access-level and similarity ordering at execution time

Greptile round 1 (both P1):
- min_access_level: coerce via the shared access-level enum (coerceGitLabMinAccessLevel) and throw on out-of-enum values (31, 999) or 0, so a direct tool call fails loudly instead of sending an invalid filter to GitLab
- order_by=similarity now requires a non-empty search term (GitLab ignores similarity ordering without one); throws a clear error otherwise
- tests for both validations

---------

Co-authored-by: Marcus Chandra <mzxchandra@gmail.com>

Author: waleedlatif1

apps/sim/blocks/blocks/gitlab.test.ts

@@ -25,15 +25,16 @@ describe('GitLabBlock access operations', () => {
     }
   })
 
-  it('exposes the named access-level dropdown with GitLab integer ids', () => {
+  it('exposes the named access-level combobox with GitLab integer ids', () => {
     const accessLevel = block.subBlocks.find((s) => s.id === 'accessLevel')
-    expect(accessLevel?.type).toBe('dropdown')
+    // A combobox (not a dropdown) so the level can be bound to a runtime reference.
+    expect(accessLevel?.type).toBe('combobox')
     const options = typeof accessLevel?.options === 'function' ? undefined : accessLevel?.options
     expect(options?.map((o) => o.id)).toEqual(['0', '5', '10', '15', '20', '25', '30', '40', '50'])
     expect(accessLevel?.value?.()).toBe('30')
   })
 
-  it('coerces the selected access level from the dropdown string to an integer at execution time', () => {
+  it('coerces the selected access level from the combobox string to an integer at execution time', () => {
     const addParams = block.tools.config.params?.({
       accessToken: 'pat',
       operation: 'gitlab_add_member',
@@ -55,6 +56,69 @@ describe('GitLabBlock access operations', () => {
     expect(typeof addParams?.accessLevel).toBe('number')
   })
 
+  it('accepts an access level bound by name (from a resolved reference) and coerces it', () => {
+    const byName = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_add_member',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: 'Developer',
+    })
+    expect(byName).toMatchObject({ userId: 7, accessLevel: 30 })
+    expect(typeof byName?.accessLevel).toBe('number')
+  })
+
+  it('accepts a runtime-resolved numeric 0 ("No access") on a required op', () => {
+    // A reference can resolve to the number 0; a truthiness guard would wrongly
+    // reject it as missing. It must pass and coerce to 0.
+    const byZero = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_add_member',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: 0,
+    })
+    expect(byZero).toMatchObject({ userId: 7, accessLevel: 0 })
+    expect(byZero?.accessLevel).toBe(0)
+  })
+
+  it('sends a numeric 0 on optional ops instead of silently omitting it', () => {
+    const approve = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_approve_access_request',
+      resourceType: 'group',
+      resourceId: '42',
+      userId: '7',
+      accessLevel: 0,
+    })
+    expect(approve?.accessLevel).toBe(0)
+
+    const invite = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_update_invitation',
+      resourceType: 'group',
+      resourceId: '42',
+      email: 'a@b.com',
+      invitationAccessLevel: 0,
+    })
+    expect(invite?.accessLevel).toBe(0)
+  })
+
+  it('throws loudly when a resolved access level is not a valid GitLab level', () => {
+    expect(() =>
+      block.tools.config.params?.({
+        accessToken: 'pat',
+        operation: 'gitlab_add_member',
+        resourceType: 'group',
+        resourceId: '42',
+        userId: '7',
+        accessLevel: 'root',
+      })
+    ).toThrow(/access level/i)
+  })
+
   it('defaults list members to inherited members (directOnly falsy)', () => {
     const listParams = block.tools.config.params?.({
       accessToken: 'pat',
@@ -117,7 +181,7 @@ describe('GitLabBlock access operations', () => {
 
   it('exposes an optional access-level dropdown for update invitation that defaults to unchanged', () => {
     const invAccess = block.subBlocks.find((s) => s.id === 'invitationAccessLevel')
-    expect(invAccess?.type).toBe('dropdown')
+    expect(invAccess?.type).toBe('combobox')
     expect(invAccess?.value?.()).toBe('')
     const options = typeof invAccess?.options === 'function' ? undefined : invAccess?.options
     expect(options?.[0]).toEqual({ label: 'Leave unchanged', id: '' })
@@ -158,3 +222,76 @@ describe('GitLabBlock access operations', () => {
     ).toThrow()
   })
 })
+
+describe('GitLabBlock group operations', () => {
+  it('registers and routes the new group/membership operations', () => {
+    for (const toolId of [
+      'gitlab_list_groups',
+      'gitlab_get_group',
+      'gitlab_list_user_memberships',
+    ]) {
+      expect(block.tools.access).toContain(toolId)
+      expect(block.tools.config.tool?.({ operation: toolId })).toBe(toolId)
+    }
+  })
+
+  it('maps list-groups filters to tool params', () => {
+    const params = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_list_groups',
+      owned: true,
+      searchQuery: 'plat',
+      groupsTopLevelOnly: true,
+      visibility: 'private',
+      groupMinAccessLevel: '30',
+      groupAllAvailable: true,
+      groupOrderBy: 'similarity',
+      sortOrder: 'asc',
+      perPage: '50',
+      page: '2',
+    })
+    expect(params).toMatchObject({
+      owned: true,
+      search: 'plat',
+      topLevelOnly: true,
+      visibility: 'private',
+      minAccessLevel: 30,
+      allAvailable: true,
+      orderBy: 'similarity',
+      sort: 'asc',
+      perPage: 50,
+      page: 2,
+    })
+  })
+
+  it('requires a group id for get group', () => {
+    expect(() =>
+      block.tools.config.params?.({ accessToken: 'pat', operation: 'gitlab_get_group' })
+    ).toThrow(/group id/i)
+
+    const params = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_get_group',
+      groupId: '  parent/child  ',
+    })
+    expect(params).toMatchObject({ groupId: 'parent/child' })
+  })
+
+  it('requires a user id for list user memberships and forwards the type filter', () => {
+    expect(() =>
+      block.tools.config.params?.({
+        accessToken: 'pat',
+        operation: 'gitlab_list_user_memberships',
+      })
+    ).toThrow(/user id/i)
+
+    const params = block.tools.config.params?.({
+      accessToken: 'pat',
+      operation: 'gitlab_list_user_memberships',
+      userId: '7',
+      membershipType: 'Namespace',
+      perPage: '25',
+    })
+    expect(params).toMatchObject({ userId: '7', membershipType: 'Namespace', perPage: 25 })
+  })
+})