Merge branch 'issue_32215' into 'master'

Allow DEVELOPER role to admin milestones

Closes #32215

See merge request gitlab-org/gitlab-ce!14257

app/policies/group_policy.rb

@@ -9,6 +9,7 @@ class GroupPolicy < BasePolicy
   condition(:has_access) { access_level != GroupMember::NO_ACCESS }
 
   condition(:guest) { access_level >= GroupMember::GUEST }
+  condition(:developer) { access_level >= GroupMember::DEVELOPER }
   condition(:owner) { access_level >= GroupMember::OWNER }
   condition(:master) { access_level >= GroupMember::MASTER }
   condition(:reporter) { access_level >= GroupMember::REPORTER }
@@ -33,11 +34,11 @@ class GroupPolicy < BasePolicy
   rule { admin }             .enable :read_group
   rule { has_projects }      .enable :read_group
 
+  rule { developer }.enable :admin_milestones
   rule { reporter }.enable :admin_label
 
   rule { master }.policy do
     enable :create_projects
-    enable :admin_milestones
     enable :admin_pipeline
     enable :admin_build
   end

app/policies/project_policy.rb

@@ -155,6 +155,7 @@ class ProjectPolicy < BasePolicy
 
   rule { can?(:developer_access) }.policy do
     enable :admin_merge_request
+    enable :admin_milestone
     enable :update_merge_request
     enable :create_commit_status
     enable :update_commit_status
@@ -178,7 +179,6 @@ class ProjectPolicy < BasePolicy
     enable :update_project_snippet
     enable :update_environment
     enable :update_deployment
-    enable :admin_milestone
     enable :admin_project_snippet
     enable :admin_project_member
     enable :admin_note

changelogs/unreleased/issue_32215.yml

+---
+title: Allow developer role to admin milestones
+merge_request:
+author:
+type: changed

spec/policies/group_policy_spec.rb

@@ -11,10 +11,11 @@ describe GroupPolicy do
 
   let(:reporter_permissions) { [:admin_label] }
 
+  let(:developer_permissions) { [:admin_milestones] }
+
   let(:master_permissions) do
     [
-      :create_projects,
-      :admin_milestones
+      :create_projects
     ]
   end
 
@@ -52,6 +53,7 @@ describe GroupPolicy do
     it do
       expect_allowed(:read_group)
       expect_disallowed(*reporter_permissions)
+      expect_disallowed(*developer_permissions)
       expect_disallowed(*master_permissions)
       expect_disallowed(*owner_permissions)
     end
@@ -63,6 +65,7 @@ describe GroupPolicy do
     it do
       expect_allowed(:read_group)
       expect_disallowed(*reporter_permissions)
+      expect_disallowed(*developer_permissions)
       expect_disallowed(*master_permissions)
       expect_disallowed(*owner_permissions)
     end
@@ -74,6 +77,7 @@ describe GroupPolicy do
     it do
       expect_allowed(:read_group)
       expect_allowed(*reporter_permissions)
+      expect_disallowed(*developer_permissions)
       expect_disallowed(*master_permissions)
       expect_disallowed(*owner_permissions)
     end
@@ -85,6 +89,7 @@ describe GroupPolicy do
     it do
       expect_allowed(:read_group)
       expect_allowed(*reporter_permissions)
+      expect_allowed(*developer_permissions)
       expect_disallowed(*master_permissions)
       expect_disallowed(*owner_permissions)
     end
@@ -96,6 +101,7 @@ describe GroupPolicy do
     it do
       expect_allowed(:read_group)
       expect_allowed(*reporter_permissions)
+      expect_allowed(*developer_permissions)
       expect_allowed(*master_permissions)
       expect_disallowed(*owner_permissions)
     end
@@ -109,6 +115,7 @@ describe GroupPolicy do
 
       expect_allowed(:read_group)
       expect_allowed(*reporter_permissions)
+      expect_allowed(*developer_permissions)
       expect_allowed(*master_permissions)
       expect_allowed(*owner_permissions)
     end
@@ -122,6 +129,7 @@ describe GroupPolicy do
 
       expect_allowed(:read_group)
       expect_allowed(*reporter_permissions)
+      expect_allowed(*developer_permissions)
       expect_allowed(*master_permissions)
       expect_allowed(*owner_permissions)
     end
@@ -180,6 +188,7 @@ describe GroupPolicy do
       it do
         expect_disallowed(:read_group)
         expect_disallowed(*reporter_permissions)
+        expect_disallowed(*developer_permissions)
         expect_disallowed(*master_permissions)
         expect_disallowed(*owner_permissions)
       end
@@ -191,6 +200,7 @@ describe GroupPolicy do
       it do
         expect_allowed(:read_group)
         expect_disallowed(*reporter_permissions)
+        expect_disallowed(*developer_permissions)
         expect_disallowed(*master_permissions)
         expect_disallowed(*owner_permissions)
       end
@@ -202,6 +212,7 @@ describe GroupPolicy do
       it do
         expect_allowed(:read_group)
         expect_allowed(*reporter_permissions)
+        expect_disallowed(*developer_permissions)
         expect_disallowed(*master_permissions)
         expect_disallowed(*owner_permissions)
       end
@@ -213,6 +224,7 @@ describe GroupPolicy do
       it do
         expect_allowed(:read_group)
         expect_allowed(*reporter_permissions)
+        expect_allowed(*developer_permissions)
         expect_disallowed(*master_permissions)
         expect_disallowed(*owner_permissions)
       end
@@ -224,6 +236,7 @@ describe GroupPolicy do
       it do
         expect_allowed(:read_group)
         expect_allowed(*reporter_permissions)
+        expect_allowed(*developer_permissions)
         expect_allowed(*master_permissions)
         expect_disallowed(*owner_permissions)
       end
@@ -237,6 +250,7 @@ describe GroupPolicy do
 
         expect_allowed(:read_group)
         expect_allowed(*reporter_permissions)
+        expect_allowed(*developer_permissions)
         expect_allowed(*master_permissions)
         expect_allowed(*owner_permissions)
       end

spec/policies/project_policy_spec.rb

@@ -33,7 +33,7 @@ describe ProjectPolicy do
 
   let(:developer_permissions) do
     %i[
-      admin_merge_request update_merge_request create_commit_status
+      admin_milestone admin_merge_request update_merge_request create_commit_status
       update_commit_status create_build update_build create_pipeline
       update_pipeline create_merge_request create_wiki push_code
       resolve_note create_container_image update_container_image
@@ -44,7 +44,7 @@ describe ProjectPolicy do
   let(:master_permissions) do
     %i[
       delete_protected_branch update_project_snippet update_environment
-      update_deployment admin_milestone admin_project_snippet
+      update_deployment admin_project_snippet
       admin_project_member admin_note admin_wiki admin_project
       admin_commit_status admin_build admin_container_image
       admin_pipeline admin_environment admin_deployment