Skip to content

Add GitLab live folders provider (cloud and self-hosted)#13417

Closed
stevenferey wants to merge 12 commits into
zen-browser:devfrom
stevenferey:feat/gitlab-live-folders
Closed

Add GitLab live folders provider (cloud and self-hosted)#13417
stevenferey wants to merge 12 commits into
zen-browser:devfrom
stevenferey:feat/gitlab-live-folders

Conversation

@stevenferey

Copy link
Copy Markdown

Summary

Adds GitLab as a third Live Folders provider, alongside GitHub and RSS, covering both gitlab.com and self-hosted instances (public or private). Built to address discussion
#12453
.

What this PR does

  • Two new menu entries under New Live Folder: GitLab Merge Requests and GitLab Issues
  • New REST v4 provider nsGitlabLiveFolderProvider that mirrors the GitHub provider's contract
  • Cookie-first auth, falling back to a Personal Access Token stored in the Firefox Login Manager (encrypted, never written to zen-live-folders.jsonlz4)
  • Auto-detection of the instance from the active tab when the folder is created
  • Change Instance… menuitem to switch host after creation (needed for non-standard hosts like code.company.com)
  • Filters mirroring GitHub: Created by Me, Assigned to Me, Review Requests (uses reviewer_id + scope=all because older self-hosted versions don't resolve __me__ and the endpoint defaults to
    created_by_me)
  • Per-project exclusion filter, list rebuilt on every fetch from the active items
  • New tanuki SVG icon, full Fluent strings (zen-live-folder-gitlab-*)
  • Mochitest coverage (URL construction, JSON parsing, PRIVATE-TOKEN injection, 401/403 → no-auth, no-filter, network error)
  • Drive-by fix: register zen-live-folders.ftl in crowdin.yml (it was never wired in, so all live-folder strings — GitHub, RSS, GitLab — were stuck in en-US for every other locale)
  • Drive-by spec doc: section in docs/live-folders-specs.md

Screenshots

Capture d’écran 2026-04-26 à 11 11 43
Capture d’écran 2026-04-26 à 11 10 18
Capture d’écran 2026-04-26 à 11 12 56
Capture d’écran 2026-04-26 à 11 13 21

Notes for reviewers

  • Auth pattern (PAT in Login Manager) is inspired by Live Folders: support GitHub Enterprise instances #13044 but kept scoped to GitLab (GitlabAuth.sys.mjs) so it doesn't conflict if Live Folders: support GitHub Enterprise instances #13044 lands. A shared Auth.sys.mjs would be a sensible
    follow-up once Live Folders: support GitHub Enterprise instances #13044's design is final.
  • REST v4 was preferred over GraphQL (cf. closed feat: gitlab live folder #12579) because it stays GET-only, keeps the parent's fetch() signature untouched, and supports cookies natively.
  • PAT is masked in the prompt (promptPassword), never serialized in cleartext, and removed from Login Manager via the dedicated Remove Access Token menuitem.
  • The instance host is auto-detected via getDefaultHost(window) using a heuristic on the active tab's URL (gitlab.com or (^|.)gitlab.). Hosts that don't match (e.g. code.company.com) default to
    gitlab.com; the user changes them via Change Instance…. Switching instance invalidates the per-host cached userId.

References

stevenferey and others added 11 commits April 25, 2026 14:43
Implements nsGitlabLiveFolderProvider on top of the existing
nsZenLiveFolderProvider contract, with cookie-first auth and
optional PAT fallback stored in the Firefox Login Manager via
a small GitlabAuth wrapper. Covers gitlab.com and self-hosted
instances; the host is auto-detected from the active tab when
the folder is created.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds the two new menuitems (Merge Requests / Issues) to the
"Create Live Folder" toolbar menu and routes their commands
through ZenLiveFoldersManager.createFolder. Auto-detects the
GitLab host from the active tab via ProviderClass.getDefaultHost
when available, falling back to gitlab.com.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Adds the GitLab tanuki silhouette as a selectable single-color
icon, the en-US Fluent strings for menu labels, options, errors
and the PAT prompt, and a GitLab section in live-folders-specs
covering host detection, the cookie-first auth model and the
PAT fallback stored in the Firefox Login Manager.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Mirrors browser_github_live_folder.js with sinon-stubbed
fetch and GitlabAuth: covers URL construction for the
assigned/created/review-requested scopes, the issues
endpoint switch, self-hosted host overrides, JSON parsing
into folder items, PRIVATE-TOKEN injection presence vs.
absence, 401/403 → no-auth, no filters → no-filter, and
network failure → failed-fetch.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Applies the Mozilla prettier config (arrowParens: avoid,
trailing comma none for last fn arg) so the new GitLab files
match the style of the surrounding live-folders/ codebase.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The Mozilla preprocessor now rejects files marked for
preprocessing that contain no # directives. Our SVG has
no substitutions, so the leading * is removed for this
single entry to copy the file verbatim.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Auto-detection only matches hosts containing "gitlab" in the
name; instances like forge.example.org default to gitlab.com
and need a manual override. Adds a "Change Instance…" menuitem
that prompts for a host (accepts full URL, strips scheme/path)
and resets per-host state (project list, excludes) so the next
refresh hits the new instance cleanly.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
nsILoginInfo.init() is a void mutator, so chaining
.createInstance(...).init(...) returned undefined, and
addLoginAsync(undefined) raised "TypeError: can't access
property origin, login is null" inside LoginManager. The
PAT never made it to the Login Manager, leaving folders
on self-hosted instances stuck in no-auth mode. Build the
loginInfo over two statements so the instance itself is
returned to the caller.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Three issues prevented self-hosted GitLab folders from working:

* Older self-hosted versions don't resolve __me__ in the REST
  API, so reviewer_username=__me__ silently returned []. Resolve
  the user via /api/v4/user once and cache the numeric id in
  state, then query reviewer_id=<id>.

* /api/v4/merge_requests defaults to scope=created_by_me on the
  server. Combined with a reviewer filter that left scope unset,
  the intersection was empty whenever someone else opened the
  MR — i.e. the typical reviewer case. The reviewer query now
  forces scope=all.

* The PAT prompt was passed as the dialog title (2nd arg of
  Services.prompt.prompt), which has a fixed-width header and
  truncated the long "Personal access token for <host>…" label.
  Move it to the text body (3rd arg).

The cached user id is invalidated when the instance is changed,
since it belongs to the previous host.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
The file was added when live folders shipped but never wired
into crowdin.yml, so all live-folder strings (GitHub, RSS,
GitLab) were stuck in en-US for every other locale. Adding
the entry exposes ~30 keys to translators going forward.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Services.prompt.prompt() with an empty title falls back to a
generic "Prompt" header, and a plain text input lets a personal
access token sit in cleartext on screen during entry. Switch
the PAT prompt to promptPassword() so the field renders as
••••••, and add Fluent strings for both dialog titles
("GitLab access token" / "GitLab instance").

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@stevenferey stevenferey requested a review from mr-cheffy as a code owner April 26, 2026 09:18
@dosubot dosubot Bot added size:XL This PR changes 500-999 lines, ignoring generated files. Feature labels Apr 26, 2026
@mr-cheffy

Copy link
Copy Markdown
Member

Sorry, we don't accept code generated by claude

@mr-cheffy mr-cheffy closed this Apr 26, 2026
@stevenferey

Copy link
Copy Markdown
Author

Hi @mr-cheffy Thanks for taking the time to look at this. I respect the decision to close — just hoping to understand the rule a bit better for future contributions. Could you point me to where the policy on
AI-assisted contributions is documented? I looked through CODE_OF_CONDUCT.md, README.md and docs/contribute.md but couldn't find it.

If there's any nuance (e.g. the issue is unreviewed bulk generation vs. assisted authoring where I read, tested and own every line), I'd appreciate the clarification so I don't waste a reviewer's time
again. Thanks! 🙏

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Feature size:XL This PR changes 500-999 lines, ignoring generated files.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants