Merge branch '52545-guest-create-issue-in-group-board' into 'master'

Resolve "Adding issues from group/project board is not allowed for project-level users"

See merge request gitlab-org/gitlab-ce!22557

app/assets/javascripts/boards/components/board.js

@@ -53,6 +53,9 @@ export default Vue.extend({
       const { issuesSize } = this.list;
       return `${n__('%d issue', '%d issues', issuesSize)}`;
     },
+    isNewIssueShown() {
+      return this.list.type === 'backlog' || (!this.disabled && this.list.type !== 'closed');
+    }
   },
   watch: {
     filter: {

app/assets/javascripts/boards/components/project_select.vue

@@ -46,7 +46,7 @@ export default {
       selectable: true,
       data: (term, callback) => {
         this.loading = true;
-        return Api.groupProjects(this.groupId, term, {}, projects => {
+        return Api.groupProjects(this.groupId, term, {with_issues_enabled: true}, projects => {
           this.loading = false;
           callback(projects);
         });

app/controllers/concerns/boards_responses.rb

@@ -50,7 +50,10 @@ module BoardsResponses
   end
 
   def authorize_create_issue
-    authorize_action_for!(project, :admin_issue)
+    list = List.find(issue_params[:list_id])
+    action = list.backlog? ? :create_issue : :admin_issue
+
+    authorize_action_for!(project, action)
   end
 
   def authorize_admin_list

app/views/shared/boards/components/_board.html.haml

@@ -39,14 +39,13 @@
             {{ list.issuesSize }}
           = render_if_exists "shared/boards/components/list_weight"
 
-        - if can?(current_user, :admin_list, current_board_parent)
-          %button.issue-count-badge-add-button.btn.btn-sm.btn-default.ml-1.has-tooltip.js-no-trigger-collapse{ type: "button",
-            "@click" => "showNewIssueForm",
-            "v-if" => 'list.type !== "closed"',
-            "aria-label" => _("New issue"),
-            "title" => _("New issue"),
-            data: { placement: "top", container: "body" } }
-            = icon("plus", class: "js-no-trigger-collapse")
+        %button.issue-count-badge-add-button.btn.btn-sm.btn-default.ml-1.has-tooltip.js-no-trigger-collapse{ type: "button",
+          "@click" => "showNewIssueForm",
+          "v-if" => "isNewIssueShown",
+          "aria-label" => _("New issue"),
+          "title" => _("New issue"),
+          data: { placement: "top", container: "body" } }
+          = icon("plus", class: "js-no-trigger-collapse")
 
     %board-list{ "v-if" => 'list.type !== "blank" && list.type !== "promotion"',
       ":list" => "list",

changelogs/unreleased/52545-guest-create-issue-in-group-board.yml

+---
+title: Always show new issue button in boards' Open list
+merge_request: 22557
+author: Heinrich Lee Yu
+type: fixed

spec/controllers/boards/issues_controller_spec.rb

@@ -208,11 +208,22 @@ describe Boards::IssuesController do
       end
     end
 
-    context 'with unauthorized user' do
-      it 'returns a forbidden 403 response' do
-        create_issue user: guest, board: board, list: list1, title: 'New issue'
+    context 'with guest user' do
+      context 'in open list' do
+        it 'returns a successful 200 response' do
+          open_list = board.lists.create(list_type: :backlog)
+          create_issue user: guest, board: board, list: open_list, title: 'New issue'
 
-        expect(response).to have_gitlab_http_status(403)
+          expect(response).to have_gitlab_http_status(200)
+        end
+      end
+
+      context 'in label list' do
+        it 'returns a forbidden 403 response' do
+          create_issue user: guest, board: board, list: list1, title: 'New issue'
+
+          expect(response).to have_gitlab_http_status(403)
+        end
       end
     end
 

spec/features/boards/new_issue_spec.rb

@@ -94,8 +94,14 @@ describe 'Issue Boards new issue', :js do
       wait_for_requests
     end
 
-    it 'does not display new issue button' do
-      expect(page).to have_selector('.issue-count-badge-add-button', count: 0)
+    it 'displays new issue button in open list' do
+      expect(first('.board')).to have_selector('.issue-count-badge-add-button', count: 1)
+    end
+
+    it 'does not display new issue button in label list' do
+      page.within('.board:nth-child(2)') do
+        expect(page).not_to have_selector('.issue-count-badge-add-button')
+      end
     end
   end
 end