Classify stale GitLab credentials

[krlvi]

Context

A stored GitLab token can become invalid after its profile has already been cached. When GitLab then returns 401 or 403 from the user endpoint, GitButler clears the stale profile but currently reports the failure as Unknown. That leaves Desktop without a stable terminal authentication state and allows repeated query-error reporting.

Trigger: a previously valid stored GitLab token later receives 401 or 403 from the authenticated-user endpoint.

Impact: Desktop cleared the stale profile but reported Unknown, repeated query-error telemetry, and did not automatically recover after credentials changed.

Source: GB-2006

Change

• reuse the existing safe GitLab 401/403 classifier when refreshing stored accounts while preserving profile-cache clearing and network fallbacks
• classify the existing GitLab auth codes as terminal in Desktop, with static replacement-token and scope guidance
• invalidate rejected GitLab account queries only after replacement credentials are stored successfully, so failed stores do not immediately retry unchanged credentials
• cover sequential success-to-rejection behavior, terminal classification, and successful versus failed credential-update recovery

Fixes GB-2006

FYI @PavelLaptev

[linear-code]

GB-2006

[Copilot]

🟡 Changes recommended

getGitLabUser’s providesTags currently builds a tag id from an object (not a username string), which can break RTK Query caching/invalidation and the intended refetch-after-reauth behavior.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR improves GitLab authentication handling across the Rust GitLab client and the Desktop app by preserving existing cache-clearing behavior while correctly classifying stale-token 401/403 responses as terminal authentication failures with actionable guidance.

Changes:

• Reuse the existing GitLab PAT 401/403 classifier when refreshing stored GitLab accounts (get_gl_user) so Desktop gets stable auth error codes.
• Add Desktop error classifications for GitLabUnauthorized / GitLabForbidden as terminal, with static “store a replacement token / check scopes” guidance.
• Update Desktop GitLab RTK Query tagging/invalidation and add tests to ensure a previously rejected getGitLabUser query refetches after storing a replacement token; add Rust tests to cover success→rejection refresh behavior and profile-cache clearing.

File summaries

File	Description
crates/but-gitlab/tests/gitlab_auth.rs	Adds a sequential-response mock and new tests verifying stored-token refresh classification and cached-profile clearing.
crates/but-gitlab/src/lib.rs	Ensures get_gl_user applies PAT validation classification to stored-token refresh errors.
apps/desktop/src/lib/forge/gitlab/gitlabUserService.test.ts	Adds RTK Query tests proving a mounted rejected user query refetches after storing a replacement PAT.
apps/desktop/src/lib/forge/gitlab/gitlabUserService.svelte.ts	Exposes endpoint injection for testing and adjusts getGitLabUser tagging to support credential-update recovery via invalidation.
apps/desktop/src/lib/error/errorClassification.ts	Introduces terminal Desktop classifications for GitLab 401/403 auth codes with user guidance.
apps/desktop/src/lib/error/errorClassification.test.ts	Adds tests asserting the new GitLab codes are terminal and contain the expected guidance text.

Review details

• Files reviewed: 6/6 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: aafa6019d8

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T03:24:40.842794Z	aafa601	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🔵 Needs a closer look

getGitLabUser’s providesTags currently treats the query arg as a username string, producing gitlab:[object Object] tag ids and breaking per-account cache tagging/invalidation.

Review details

Suppressed comments (1)

apps/desktop/src/lib/forge/gitlab/gitlabUserService.svelte.ts:190

• providesTags receives the original query arg (here { account }), but the callback currently treats it as a username string. This makes the ForgeUser tag id become gitlab:[object Object], collapsing cache keys/invalidation across accounts and breaking per-account tagging.

				providesTags: (_result, _error, username) => [
					...providesItem(ReduxTag.ForgeUser, `gitlab:${username}`),
					providesList(ReduxTag.GitLabUserList),
				],

• Files reviewed: 6/6 changed files
• Comments generated: 0 new
• Review effort level: Lite