feat(gitlab): support non-admin tokens with CSV permissions

[icecrasher321]

Summary

• Add Administrator token and Non-admin token tabs to GitLab setup and settings, with CSV templates, inline validation, saved-file replacement, and PAT rotation.
• Store private permission snapshots and effective grants in generic connector-owned tables. Apply replacements atomically with revision checks and immediate read-time revocation; block reads while a changed source's ACLs are rebuilt.
• Exclude confidential issues and internal comments from the CSV path, preserve administrator permission mirroring, and document both setup flows with browser screenshots.
• Roll out the additive migration first, then compatible Trigger workers, then the application. No new feature flag.

Type of Change

• New feature
• Documentation

Testing

• 779 relevant unit and organization UI tests passed.
• Live GitLab CE regression: 9/9 passed, including administrator parity, regular KB and organization Search CSV setup, encrypted credentials, ingestion, every protected read surface, replacements, concurrent saves, and interrupted ACL changes.
• Licensed GitLab 19.2.5 Auditor CSV flows: 2/2 passed with a read_api token and a custom admin role containing only read_admin_users.
• Browser-tested organization setup, keyboard navigation, templates, malformed uploads, saved-file replacement, and denied/newly granted Search users. Membership replacement made no embedding calls. Regular KB setup and replacement were also exercised in the browser.
• Real PostgreSQL permission-store tests passed, including rollback, owner isolation, concurrent replacements, and a 100,000-grant indexed lookup. CSV size/row limits and the request ceiling are covered.
• TypeScript, lint, all 46 repository audits, API validation, generated artifacts, and migration safety passed.

Embedding/model outputs and embedding-capacity checks were substituted with deterministic local responses. GitLab requests, PostgreSQL, storage, authentication, ingestion, and authorization were real.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
docs	Skipped		Sep 11, 2026 1:13am UTC

[greptile-apps]

Confidence Score: 5/5

The PR appears safe to merge, with no outstanding correctness, security, or repository-rule violations identified.

Summary

• Adds token-mode setup and settings interfaces, CSV validation, replacement workflows, and PAT rotation.
• Introduces generic connector-owned permission snapshots and effective grants with revision checks and transactional replacement.
• Applies immediate read-time permission changes and blocks access while project or ACL changes are rebuilt.
• Excludes confidential GitLab issues and internal comments from the CSV-backed path.
• Adds database migration artifacts, API contracts, documentation, and extensive unit and integration coverage.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  Admin[Sim administrator] --> Setup{GitLab token path}
  Setup -->|Administrator token| Mirror[Mirror GitLab permissions]
  Setup -->|Non-admin token| CSV[Validate user mapping and project CSVs]
  CSV --> Snapshot[(Connector permission snapshot)]
  Snapshot --> Grants[(Effective connector grants)]
  GitLab[GitLab project content] --> Sync[Connector sync]
  Mirror --> Sync
  Snapshot --> Sync
  Sync --> Docs[(Indexed documents)]
  Reader[Verified organization or workspace member] --> Check[Read-time access check]
  Grants --> Check
  Docs --> Check
  Check --> Results[Authorized results]

Loading

_{Reviews (2) · Last reviewed commit: "fix(gitlab): address setup review and te..."}

[icecrasher321]

The permission-only save finding was a false positive: changedFields and updatedFields referenced the same array, so adding permissionConfig already satisfied the non-empty guard. I removed the alias to make that behavior explicit and added regression cases proving permission-only and token-only updates commit and record the change without dispatching a content sync. The failing CI assertions expected the removed connection-method controls; they now check the token tabs and managed-access submission. I also removed the runner-speed-dependent parsing assertion while retaining the 100,000-row acceptance and overflow checks.

[icecrasher321]

@greptile

[icecrasher321]

@cubic-dev-ai review this PR

[cubic-dev-ai]

@cubic-dev-ai review this PR

@icecrasher321 I have started the AI code review. It will take a few minutes to complete.