feat(ee): GitLab permission syncing - #585

Merged
brendan-kellam merged 6 commits into
mainfrom
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged

feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom
bkellam/gitlab_permission_syncing

Conversation

@brendan-kellam

@brendan-kellambrendan-kellam commented Oct 30, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

This PR adds support for GitLab permission syncing.

Summary by CodeRabbit

  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled

@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai

coderabbitaiBot commented Oct 30, 2025•
edited
Loading

Copy link
Copy Markdown
Contributor

Walkthrough

This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.

Changes

Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration

Sequence Diagram(s)

sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end
Loading

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~45 minutes

  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management

Possibly related PRs

Suggested labels

sourcebot-team

Pre-merge checks and finishing touches

❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment
  • Commit unit tests in branch bkellam/gitlab_permission_syncing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@brendan-kellam

brendan-kellam commented Oct 30, 2025

Copy link
Copy Markdown
ContributorAuthor

@coderabbitai review

@coderabbitai

coderabbitaiBot commented Oct 30, 2025

Copy link
Copy Markdown
Contributor
✅ Actions performed

Review triggered.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

coderabbitai[bot]
coderabbitaiBot reviewed Oct 30, 2025
View reviewed changes

@coderabbitaicoderabbitaiBot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.

📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*

📄 CodeRabbit inference engine (.cursor/rules/style.mdc)

Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.

Files:

  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build

Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari reviewed Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari previously approved these changes Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam merged commit 4899c9f into mainOct 30, 2025
8 checks passed
@brendan-kellam
brendan-kellam deleted the bkellam/gitlab_permission_syncing branch October 30, 2025 18:08
@github-actionsgithub-actionsBot mentioned this pull request Oct 30, 2025
Open
@brendan-kellambrendan-kellam mentioned this pull request Oct 31, 2025
Closed
@coderabbitaicoderabbitaiBot mentioned this pull request Nov 5, 2025
Merged
This was referenced Jan 13, 2026
Merged
Merged
This was referenced Feb 2, 2026
Merged
Merged
Merged
Merged
This was referenced Feb 24, 2026
Merged
Merged
This was referenced Mar 10, 2026
Merged
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Jun 10, 2026
Merged
@coderabbitaicoderabbitaiBot mentioned this pull request Jun 18, 2026
Closed
@coderabbitaicoderabbitaiBot mentioned this pull request Jul 15, 2026
Merged
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
feat(ee): GitLab permission syncing - #585
Merged
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Oct 30, 2025
Merged
feat(ee): GitLab permission syncing#585
brendan-kellam merged 6 commits into
mainfrom 
bkellam/gitlab_permission_syncing
Conversation
@brendan-kellam
@brendan-kellambrendan-kellam
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
This PR adds support for GitLab permission syncing.
Summary by CodeRabbit
  • New Features
    • Added GitLab support for repository and user permission synchronization
    • Introduced GitLab environment configuration settings
    • Enhanced permission sync job logging for improved traceability
    • Conditional OAuth scopes for GitLab SSO when permission syncing is enabled
@github-actions

This comment has been minimized.

Sign in to view
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025•

edited

Loading

Copy link


Copy Markdown

Contributor
Walkthrough
This PR extends permission syncing to support GitLab alongside GitHub. It adds GitLab client factory functions, integrates GitLab API calls into repo and user permission syncers with per-job logging, adds a GitLab base URL environment variable, updates OAuth scope handling for GitLab SSO to conditionally include read_api, and refactors job scheduling from transactional to non-transactional creation.
Changes
Cohort / File(s)Summary
Configuration & constants
packages/backend/src/constants.ts, packages/backend/src/env.ts		Added 'gitlab' to PERMISSION_SYNC_SUPPORTED_CODE_HOST_TYPES constant; added AUTH_EE_GITLAB_BASE_URL environment variable with default "https://gitlab.com"
GitLab integration utilities
packages/backend/src/gitlab.ts		Added createGitLabFromPersonalAccessToken and createGitLabFromOAuthToken factory functions; added getProjectMembers and getProjectsForAuthenticatedUser utility functions with retry and error handling; refactored getGitLabReposFromConfig to use the new factory
Permission syncers
packages/backend/src/ee/repoPermissionSyncer.ts, packages/backend/src/ee/userPermissionSyncer.ts		Added GitLab branch logic to fetch project members/projects and map to user IDs; introduced per-job logger factory for improved traceability; changed job scheduling from transactional to non-transactional creation followed by enqueueing; enhanced error handling and logging in job completion/failure callbacks
SSO scope handling
packages/web/src/ee/features/sso/sso.ts		Updated GitLab OAuth scope to conditionally include "read_api" when permission-syncing experiments are enabled and entitlement is present
Documentation cleanup
packages/backend/src/repoCompileUtils.ts		Removed todo comment about 'internal' visibility consideration
Sequence Diagram(s)
sequenceDiagram
participant Job
participant Syncer
participant GitLabAPI
participant DB
participant Logger
rect rgba(100, 150, 200, 0.2)
Note over Syncer: GitLab Permission Sync Flow
Job->>Syncer: runJob(repoId, userId)
Syncer->>Logger: createJobLogger(jobId)
Syncer->>GitLabAPI: createGitLabFromOAuthToken(token)
GitLabAPI-->>Syncer: Gitlab client
Syncer->>GitLabAPI: getProjectMembers(projectId)
GitLabAPI-->>Syncer: members array
Syncer->>DB: mapMembersToUserIds()
DB-->>Syncer: userId[]
Syncer-->>Job: return mapped IDs
end
rect rgba(150, 200, 100, 0.2)
Note over Syncer: GitHub Permission Sync Flow (existing)
Job->>Syncer: runJob(repoId, userId)
Syncer->>GitLabAPI: Fetch via GitHub API
GitLabAPI-->>Syncer: collaborators
Syncer-->>Job: return mapped IDs
end
rect rgba(200, 100, 100, 0.2)
Note over Syncer: Job Scheduling (changed)
Job->>DB: createJob() [non-transactional]
DB-->>Job: jobRecord
Job->>Syncer: enqueueJob(jobRecord)
Syncer-->>Job: success
end

Loading
Estimated code review effort
🎯 4 (Complex) | ⏱️ ~45 minutes
  • repoPermissionSyncer.ts and userPermissionSyncer.ts: Heterogeneous changes including new GitLab integration logic, per-job logger refactoring, transaction removal from scheduling, and error handling updates across multiple code paths—each requires separate reasoning
  • gitlab.ts: New factory functions and utility methods with retry patterns and error handling need verification for consistency and correctness
  • Transactional scheduling change: The removal of transactional job creation requires careful review of race condition handling and consistency guarantees
  • Per-job logging pattern: Verify consistent implementation across both syncers and proper logger lifecycle management
Possibly related PRs
Suggested labels
sourcebot-team
Pre-merge checks and finishing touches
❌ Failed checks (1 warning)
Check nameStatusExplanationResolution
Docstring Coverage⚠️ WarningDocstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.You can run @coderabbitai generate docstrings to improve docstring coverage.
✅ Passed checks (2 passed)
Check nameStatusExplanation
Title Check✅ PassedThe PR title "feat(ee): GitLab permission syncing" directly aligns with the primary objective of the changeset, which is to add GitLab permission syncing support to the system. The changes across multiple files—including updates to permission syncers, new GitLab utilities, environment variables, and SSO scopes—all serve this central feature. The title is concise, uses conventional commit formatting, and clearly communicates the main change in a way that would be readily understood by someone scanning the git history. The title is neither vague nor misleading.
Description Check✅ PassedCheck skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  •  📝 Generate docstrings
🧪 Generate unit tests (beta)
  •  Create PR with unit tests
  •  Post copyable unit tests in a comment
  •  Commit unit tests in branch bkellam/gitlab_permission_syncing
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
❤️ Share
Comment @coderabbitai help to get the list of available commands and usage tips.
@brendan-kellam
brendan-kellam
commented
Oct 30, 2025

Copy link


Copy Markdown

ContributorAuthor
@coderabbitai review
@coderabbitai
coderabbitaiBot
commented
Oct 30, 2025

Copy link


Copy Markdown

Contributor
✅ Actions performed
Review triggered.
Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.
coderabbitai[bot]
coderabbitaiBot
reviewed
Oct 30, 2025
View reviewed changes
@coderabbitaicoderabbitaiBot
left a comment


Copy link


Copy Markdown

Contributor
Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 3
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📥 Commits
Reviewing files that changed from the base of the PR and between 384aa9e and 05c3d13.
📒 Files selected for processing (7)
  • packages/backend/src/constants.ts (1 hunks)
  • packages/backend/src/ee/repoPermissionSyncer.ts (6 hunks)
  • packages/backend/src/ee/userPermissionSyncer.ts (6 hunks)
  • packages/backend/src/env.ts (1 hunks)
  • packages/backend/src/gitlab.ts (3 hunks)
  • packages/backend/src/repoCompileUtils.ts (0 hunks)
  • packages/web/src/ee/features/sso/sso.ts (1 hunks)
💤 Files with no reviewable changes (1)
  • packages/backend/src/repoCompileUtils.ts
🧰 Additional context used
📓 Path-based instructions (1)
**/*
📄 CodeRabbit inference engine (.cursor/rules/style.mdc)
Filenames should always be camelCase. Exception: if there are filenames in the same directory with a format other than camelCase, use that format to keep things consistent.
Files:
  • packages/backend/src/env.ts
  • packages/backend/src/ee/repoPermissionSyncer.ts
  • packages/web/src/ee/features/sso/sso.ts
  • packages/backend/src/constants.ts
  • packages/backend/src/ee/userPermissionSyncer.ts
  • packages/backend/src/gitlab.ts
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (1)
  • GitHub Check: build
Comment threadpackages/backend/src/ee/repoPermissionSyncer.ts
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
Comment threadpackages/backend/src/gitlab.ts
msukkari
msukkari
reviewed
Oct 30, 2025
View reviewed changes
Comment threadpackages/backend/src/ee/userPermissionSyncer.ts
msukkari
msukkari
previously approved these changes
Oct 30, 2025
View reviewed changes
@brendan-kellam
brendan-kellam
merged commit 4899c9f
into
mainOct 30, 2025

8 checks passed

@brendan-kellam
brendan-kellam
deleted the

bkellam/gitlab_permission_syncing

branch
October 30, 2025 18:08
@github-actionsgithub-actionsBot
mentioned this pull request
Oct 30, 2025

Open

@brendan-kellambrendan-kellam
mentioned this pull request
Oct 31, 2025

Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Nov 5, 2025
 Merged


This was referenced Jan 13, 2026
 Merged

 Merged


This was referenced Feb 2, 2026
 Merged

 Merged

 Merged

 Merged


This was referenced Feb 24, 2026
 Merged

 Merged


This was referenced Mar 10, 2026
 Merged

 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 10, 2026
 Merged

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jun 18, 2026
 Closed

@coderabbitaicoderabbitaiBot
mentioned this pull request
Jul 15, 2026
 Merged

Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment

Reviewers

@coderabbitaicoderabbitai[bot]coderabbitai[bot] left review comments
@msukkarimsukkarimsukkari left review comments

Assignees


No one assigned


Labels


None yet


Projects


None yet


Milestone


No milestone


Development

Successfully merging this pull request may close these issues.

2 participants

@brendan-kellam@msukkari