Do not show artifacts keep button if not allowed

app/views/projects/builds/_sidebar.html.haml

@@ -29,7 +29,7 @@
 
         - if @build.artifacts?
           .btn-group.btn-group-justified{ role: :group }
-            - if @build.artifacts_expire_at
+            - if @build.artifacts_expire_at && can?(current_user, :update_build, @build)
               = link_to keep_namespace_project_build_artifacts_path(@project.namespace, @project, @build), class: 'btn btn-sm btn-default', method: :post do
                 Keep
 

spec/features/projects/builds_spec.rb

@@ -3,6 +3,7 @@ require 'tempfile'
 
 feature 'Builds', :feature do
   let(:user) { create(:user) }
+  let(:user_access_level) { :developer }
   let(:project) { create(:project) }
   let(:pipeline) { create(:ci_pipeline, project: project) }
 
@@ -14,7 +15,7 @@ feature 'Builds', :feature do
   end
 
   before do
-    project.team << [user, :developer]
+    project.team << [user, user_access_level]
     login_as(user)
   end
 
@@ -131,7 +132,9 @@ feature 'Builds', :feature do
 
     context 'Artifacts expire date' do
       before do
-        build.update_attributes(artifacts_file: artifacts_file, artifacts_expire_at: expire_at)
+        build.update_attributes(artifacts_file: artifacts_file,
+                                artifacts_expire_at: expire_at)
+
         visit namespace_project_build_path(project.namespace, project, build)
       end
 
@@ -146,8 +149,10 @@ feature 'Builds', :feature do
       context 'when expire date is defined' do
         let(:expire_at) { Time.now + 7.days }
 
-        it 'keeps artifacts when Keep button is clicked' do
+        context 'when user has ability to update build' do
+          it 'keeps artifacts when keep button is clicked' do
             expect(page).to have_content 'The artifacts will be removed'
+
             click_link 'Keep'
 
             expect(page).not_to have_link 'Keep'
@@ -155,6 +160,15 @@ feature 'Builds', :feature do
           end
         end
 
+        context 'when user does not have ability to update build' do
+          let(:user_access_level) { :guest }
+
+          it 'does not have keep button' do
+            expect(page).to have_no_link 'Keep'
+          end
+        end
+      end
+
       context 'when artifacts expired' do
         let(:expire_at) { Time.now - 7.days }