Function connectWithPAT

apps/web/src/lib/integrations/gitlab-service.ts:834–1010

(
  owner: Owner,
  token: string,
  instanceUrl: string = 'https://gitlab.com'
)

      credential_version: credentialVersion,
      last_validated_at: validatedAt,
    });
  });
}

/**
 * Removes the stored Project Access Token for a project
 * Called when a project is removed from code reviews
 */
export async function removeStoredProjectAccessToken(
  integration: PlatformIntegration,
  projectId: string | number,
  actor: GitLabCredentialActor
): Promise<void> {
  const metadata = integration.metadata as GitLabIntegrationMetadata | null;
  const projectIdStr = requireGitLabProjectId(projectId);
  const storedCredential = await getStoredProjectCredential(integration.id, projectIdStr);
  if (!storedCredential) return;
  const instanceUrl = normalizeInstanceUrl(metadata?.gitlab_instance_url);

  // Try to revoke the token in GitLab
  try {
    const userToken = await getValidGitLabToken(integration, actor);
    await revokeProjectAccessToken(userToken, projectId, storedCredential.tokenId, instanceUrl);
    logExceptInTest('[removeStoredProjectAccessToken] Token revoked in GitLab', {
      projectId,
      tokenId: storedCredential.tokenId,
    });
  } catch (error) {
    // Log but don't fail - the token might already be revoked
    logExceptInTest('[removeStoredProjectAccessToken] Failed to revoke token in GitLab', {
      projectId,
      tokenId: storedCredential.tokenId,
      error: error instanceof Error ? error.message : String(error),
    });
  }

  await db.transaction(async tx => {
    await mutateGitLabMetadataInTransaction(tx, integration.id, currentMetadata => {
      const projectTokens = copyMetadataObject(currentMetadata, 'project_tokens');
      delete projectTokens[projectIdStr];
      return { set: { project_tokens: projectTokens } };
    });
    const deleted = await tx
      .delete(platform_access_token_credentials)
      .where(
        and(
          eq(platform_access_token_credentials.id, storedCredential.credentialId),
          eq(
            platform_access_token_credentials.credential_version,
            storedCredential.credentialVersion
          )
        )
      )
      .returning({ id: platform_access_token_credentials.id });
    if (deleted.length !== 1) {
      throw new Error('GitLab project access token was replaced concurrently');
    }
  });