fix(search): align GitLab CSV updates with CLI and API policies

Author: waleedlatif1

apps/docs/content/docs/cli/organizations.mdx

@@ -265,6 +265,8 @@ API request and response schemas: [getGitLabSearchPermissions](/api-reference/or
 
 OAuth login or personal API key required.
 
+This replaces both GitLab permission files. Readers omitted from the new grants lose access.
+
 ```bash
 sim organizations gitlab-permissions replace <sourceId> [options]
 ```
@@ -289,6 +291,7 @@ sim organizations gitlab-permissions replace <sourceId> [options]
 | `--expected-revision <value>` | Yes | Current permission revision obtained before generating this snapshot. |
 | `--user-mapping <json\|@file>` | Yes | GitLab user IDs and their verified Sim email addresses. (JSON, or @path / @- to read a file or stdin). |
 | `--project-permissions <json\|@file>` | Yes | GitLab project paths and the IDs of users granted access. (JSON, or @path / @- to read a file or stdin). |
+| `-y, --yes` | Yes | Confirm this operation. |
 
 </CommandTable>
 

apps/docs/content/docs/cli/reference.mdx

@@ -4322,6 +4322,8 @@ API request and response schemas: [getGitLabSearchPermissions](/api-reference/or
 
 Replace GitLab search permission CSVs (OAuth login or personal API key required)
 
+This replaces both GitLab permission files. Readers omitted from the new grants lose access.
+
 ```bash
 sim organizations gitlab-permissions replace <sourceId> [options]
 ```
@@ -4346,6 +4348,7 @@ sim organizations gitlab-permissions replace <sourceId> [options]
 | `--expected-revision <value>` | Yes | Current permission revision obtained before generating this snapshot. |
 | `--user-mapping <json\|@file>` | Yes | GitLab user IDs and their verified Sim email addresses. (JSON, or @path / @- to read a file or stdin). |
 | `--project-permissions <json\|@file>` | Yes | GitLab project paths and the IDs of users granted access. (JSON, or @path / @- to read a file or stdin). |
+| `-y, --yes` | Yes | Confirm this operation. |
 
 </CommandTable>
 

apps/docs/scripts/fixtures/content-baseline.json

@@ -6746,6 +6746,20 @@
           "bytes": 51,
           "line": 201
         },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "f57b9272801ee426bbcac1ba0a76951bd50f0d66de23916fe7beffd36a8078d7",
+          "bytes": 61,
+          "line": 238
+        },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "d28646b150b37f8c75a2ae8ab0ca07b698279c3b044530810a2f9096079d5ff9",
+          "bytes": 65,
+          "line": 270
+        },
         {
           "lang": "bash",
           "meta": null,
@@ -12595,6 +12609,20 @@
           "bytes": 45,
           "line": 4259
         },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "f57b9272801ee426bbcac1ba0a76951bd50f0d66de23916fe7beffd36a8078d7",
+          "bytes": 61,
+          "line": 4295
+        },
+        {
+          "lang": "bash",
+          "meta": null,
+          "sha256": "d28646b150b37f8c75a2ae8ab0ca07b698279c3b044530810a2f9096079d5ff9",
+          "bytes": 65,
+          "line": 4327
+        },
         {
           "lang": "bash",
           "meta": null,
@@ -177603,6 +177631,13 @@
           "sha256": "5c2ebfcc044ebc01c17a4af2664a4fbc667ae4916ef21555d90cfd9f245394bd",
           "bytes": 70,
           "line": 56
+        },
+        {
+          "lang": "yaml",
+          "meta": "title=\".gitlab-ci.yml\"",
+          "sha256": "cbd29bdea80fc9e1c908abaa8e708dd21435267b66be0583a033686a199b8882",
+          "bytes": 1046,
+          "line": 98
         }
       ],
       "links": [

apps/sim/app/api/v2/organizations/[organizationId]/search/sources/[sourceId]/gitlab-permissions/route.ts

@@ -4,11 +4,11 @@ import {
 } from '@/lib/api/contracts/v2/organizations'
 import { defineV2JsonRoute, v2ApiKeyAuth, v2RateLimits } from '@/lib/api/server/routes'
 import { v2OrganizationErrorPolicy } from '@/lib/api/server/routes/organizations'
-import { gitLabSearchPermissionOperations } from '@/lib/knowledge/application/gitlab-search-permission-operations'
 import {
   readGitLabSearchPermissions,
   replaceGitLabSearchPermissions,
 } from '@/lib/knowledge/application/gitlab-search-permissions'
+import { gitLabSearchPermissionOperations } from '@/lib/knowledge/application/operations'
 
 export const GET = defineV2JsonRoute({
   contract: v2GetGitLabSearchPermissionsContract,

apps/sim/lib/api/contracts/v2/openapi/organizations.ts

@@ -23,7 +23,7 @@ import {
 } from '@/lib/api/contracts/v2/organizations'
 import { defineOpenApiRoute } from '@/lib/api/openapi/types'
 import { invitationOperations } from '@/lib/invitations/application/operations'
-import { gitLabSearchPermissionOperations } from '@/lib/knowledge/application/gitlab-search-permission-operations'
+import { gitLabSearchPermissionOperations } from '@/lib/knowledge/application/operations'
 import { organizationOperations } from '@/lib/organizations/application/operations'
 
 const TIMESTAMP = '2026-06-01T09:00:00.000Z'

apps/sim/lib/api/server/routes/copilot-refused-routes.json

@@ -174,6 +174,16 @@
     "path": "/api/v2/organizations/[organizationId]/permission-groups/[groupId]/members/bulk",
     "operation": "permission_groups.members.bulk_add"
   },
+  {
+    "method": "GET",
+    "path": "/api/v2/organizations/[organizationId]/search/sources/[sourceId]/gitlab-permissions",
+    "operation": "knowledge.search.gitlab_permissions.read"
+  },
+  {
+    "method": "PUT",
+    "path": "/api/v2/organizations/[organizationId]/search/sources/[sourceId]/gitlab-permissions",
+    "operation": "knowledge.search.gitlab_permissions.replace"
+  },
   {
     "method": "GET",
     "path": "/api/v2/organizations/[organizationId]/sso/policy",

apps/sim/lib/knowledge/application/gitlab-search-permission-operations.ts

@@ -14,7 +14,7 @@ import { authorizeOrganizationOperation } from '@/lib/core/application/organizat
 import { OrchestrationError } from '@/lib/core/orchestration/types'
 import { resourceScopeCondition } from '@/lib/core/resource-scope.server'
 import { isKnowledgeMemberAccessAvailable } from '@/lib/knowledge/access/availability'
-import { gitLabSearchPermissionOperations } from '@/lib/knowledge/application/gitlab-search-permission-operations'
+import { gitLabSearchPermissionOperations } from '@/lib/knowledge/application/operations'
 import { connectorIsLive } from '@/lib/knowledge/connectors/sync-lock'
 import {
   lockOrganizationSearchApproval,

apps/sim/lib/knowledge/application/gitlab-search-permissions.ts

@@ -1031,6 +1031,23 @@ function defineKnowledgeSessionOperation<const Id extends string>(
   return Object.freeze(operation)
 }
 
+export const gitLabSearchPermissionOperations = {
+  read: defineOrganizationOperation({
+    minimumRole: 'admin',
+    principalKinds: ['personal_api_key', 'oauth_access_token'],
+    capability: 'knowledge.use',
+    id: 'knowledge.search.gitlab_permissions.read',
+    oauthScope: 'api:read',
+  }),
+  replace: defineOrganizationOperation({
+    minimumRole: 'admin',
+    principalKinds: ['personal_api_key', 'oauth_access_token'],
+    capability: 'knowledge.use',
+    id: 'knowledge.search.gitlab_permissions.replace',
+    oauthScope: 'api:write',
+  }),
+} as const
+
 export const knowledgeSessionOperations = {
   // permission-group-exempt: delegates to knowledgeOperations.list, which carries knowledge.use
   list: defineKnowledgeSessionOperation({ id: 'knowledge.session.list', capability: 'none' }),

apps/sim/lib/knowledge/application/operations.ts

@@ -28,6 +28,7 @@
         "!scripts/test-desktop-inbox-e2e.ts",
         "!scripts/test-assistant-actions-e2e.ts",
         "!scripts/test-organization-search-e2e.ts",
+        "!scripts/test-gitlab-csv-permissions-e2e.ts",
         "!scripts/test-docs-search-provider-e2e.ts",
         "!scripts/test-file-*-e2e.ts",
         "!scripts/test-landing-seo-e2e.ts",
@@ -180,6 +181,7 @@
         "!scripts/test-desktop-inbox-e2e.ts",
         "!scripts/test-assistant-actions-e2e.ts",
         "!scripts/test-organization-search-e2e.ts",
+        "!scripts/test-gitlab-csv-permissions-e2e.ts",
         "!scripts/test-docs-search-provider-e2e.ts",
         "!scripts/test-file-*-e2e.ts",
         "!scripts/test-landing-seo-e2e.ts",