Fix ability for non project member to subscribe to an issue

app/assets/javascripts/sidebar/components/subscriptions/sidebar_subscriptions_widget.vue

@@ -24,7 +24,6 @@ export default {
     GlToggle,
     SidebarEditableItem,
   },
-  inject: ['canUpdate'],
   props: {
     iid: {
       type: String,
@@ -102,6 +101,9 @@ export default {
         parent: this.parentIsGroup ? 'group' : 'project',
       });
     },
+    isLoggedIn() {
+      return Boolean(gon.current_user_id);
+    },
   },
   methods: {
     setSubscribed(subscribed) {
@@ -174,7 +176,7 @@ export default {
       <gl-toggle
         :value="subscribed"
         :is-loading="isLoading"
-        :disabled="emailsDisabled || !canUpdate"
+        :disabled="emailsDisabled || !isLoggedIn"
         class="hide-collapsed gl-ml-auto"
         data-testid="subscription-toggle"
         :label="$options.i18n.notifications"

spec/features/issues/user_toggles_subscription_spec.rb

@@ -5,35 +5,70 @@ require "spec_helper"
 RSpec.describe "User toggles subscription", :js do
   let(:project) { create(:project_empty_repo, :public) }
   let(:user) { create(:user) }
+  let(:user2) { create(:user) }
   let(:issue) { create(:issue, project: project, author: user) }
 
-  before do
-    project.add_developer(user)
-    sign_in(user)
+  context 'user is not logged in' do
+    before do
+      visit(project_issue_path(project, issue))
+    end
 
-    visit(project_issue_path(project, issue))
+    it 'toggle does not display' do
+      expect(page).not_to have_button('Notifications')
+    end
   end
 
-  it "unsubscribes from issue" do
-    subscription_button = find('[data-testid="subscription-toggle"]')
+  context 'user is logged in' do
+    before do
+      project.add_developer(user)
+      sign_in(user)
+
+      visit(project_issue_path(project, issue))
+    end
+
+    it 'unsubscribes from issue' do
+      subscription_button = find('[data-testid="subscription-toggle"]')
+
+      # Check we're subscribed.
+      expect(subscription_button).to have_css("button.is-checked")
+
+      # Toggle subscription.
+      find('[data-testid="subscription-toggle"]').click
+      wait_for_requests
 
-    # Check we're subscribed.
-    expect(subscription_button).to have_css("button.is-checked")
+      # Check we're unsubscribed.
+      expect(subscription_button).to have_css("button:not(.is-checked)")
+    end
 
-    # Toggle subscription.
-    find('[data-testid="subscription-toggle"]').click
-    wait_for_requests
+    context 'when project emails are disabled' do
+      let(:project) { create(:project_empty_repo, :public, emails_disabled: true) }
 
-    # Check we're unsubscribed.
-    expect(subscription_button).to have_css("button:not(.is-checked)")
+      it 'is disabled' do
+        expect(page).to have_content('Disabled by project owner')
+        expect(page).to have_button('Notifications', class: 'is-disabled')
+      end
+    end
   end
 
-  context 'when project emails are disabled' do
-    let(:project) { create(:project_empty_repo, :public, emails_disabled: true) }
+  context 'user is logged in without edit permission' do
+    before do
+      sign_in(user2)
+
+      visit(project_issue_path(project, issue))
+    end
+
+    it 'subscribes to issue' do
+      subscription_button = find('[data-testid="subscription-toggle"]')
+
+      # Check we're not subscribed.
+      expect(subscription_button).to have_css("button:not(.is-checked)")
+
+      # Toggle subscription.
+      find('[data-testid="subscription-toggle"]').click
+      wait_for_requests
 
-    it 'is disabled' do
-      expect(page).to have_content('Disabled by project owner')
-      expect(page).to have_button('Notifications', class: 'is-disabled')
+      # Check we're subscribed.
+      expect(subscription_button).to have_css("button.is-checked")
     end
   end
 end