Hides multiple board actions if user doesnt have permissions

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/23678

app/views/projects/boards/_title.html.haml

@@ -23,39 +23,41 @@
               {{ board.name }}
       .dropdown-loading{ "v-if" => "loading" }
         = icon("spin spinner")
-      %board-selector-form{ "inline-template" => true,
-        "v-if" => "currentPage === 'edit'",
-        "type" => "edit",
-        ":current-board.sync" => "currentBoard",
-        ":current-page.sync" => "currentPage",
-        ":reload.sync" => "reload" }
-        = render "projects/boards/components/form"
-      %board-selector-form{ "inline-template" => true,
-        "v-if" => "currentPage === 'new'",
-        "type" => "new",
-        ":current-page.sync" => "currentPage",
-        ":reload.sync" => "reload" }
-        = render "projects/boards/components/form"
-      .dropdown-content.board-selector-page-two{ "v-if" => "currentPage === 'delete'" }
-        %p
-          Are you sure you want to delete this board?
-        .board-delete-btns.clearfix
-          = link_to "",
-            class: "btn btn-danger pull-left",
-            method: :delete,
-            ":href" => "'#{namespace_project_boards_path(@project.namespace, @project)}/' + currentBoard.id" do
-            Delete
-          %button.btn.btn-default.pull-right{ type: "button",
-            "@click.stop.prevent" => "currentPage = ''" }
-            Cancel
-      .dropdown-footer{ "v-if" => "currentPage === ''" }
-        %ul.dropdown-footer-list
-          %li
-            %a{ "href" => "#", "@click.stop.prevent" => "showPage('new')" }
-              Create new board
-          %li
-            %a{ "href" => "#", "@click.stop.prevent" => "showPage('edit')" }
-              Edit board name
-          %li{ "v-if" => "showDelete" }
-            %a.text-danger{ "href" => "#", "@click.stop.prevent" => "showPage('delete')" }
-              Delete board
+      - if can?(current_user, :admin_list, @project)
+        %board-selector-form{ "inline-template" => true,
+          "v-if" => "currentPage === 'edit'",
+          "type" => "edit",
+          ":current-board.sync" => "currentBoard",
+          ":current-page.sync" => "currentPage",
+          ":reload.sync" => "reload" }
+          = render "projects/boards/components/form"
+        %board-selector-form{ "inline-template" => true,
+          "v-if" => "currentPage === 'new'",
+          "type" => "new",
+          ":current-page.sync" => "currentPage",
+          ":reload.sync" => "reload" }
+          = render "projects/boards/components/form"
+        .dropdown-content.board-selector-page-two{ "v-if" => "currentPage === 'delete'" }
+          %p
+            Are you sure you want to delete this board?
+          .board-delete-btns.clearfix
+            = link_to "",
+              class: "btn btn-danger pull-left",
+              method: :delete,
+              ":href" => "'#{namespace_project_boards_path(@project.namespace, @project)}/' + currentBoard.id" do
+              Delete
+            %button.btn.btn-default.pull-right{ type: "button",
+              "@click.stop.prevent" => "currentPage = ''" }
+              Cancel
+      - if can?(current_user, :admin_list, @project)
+        .dropdown-footer{ "v-if" => "currentPage === ''" }
+          %ul.dropdown-footer-list
+            %li
+              %a{ "href" => "#", "@click.stop.prevent" => "showPage('new')" }
+                Create new board
+            %li
+              %a{ "href" => "#", "@click.stop.prevent" => "showPage('edit')" }
+                Edit board name
+            %li{ "v-if" => "showDelete" }
+              %a.text-danger{ "href" => "#", "@click.stop.prevent" => "showPage('delete')" }
+                Delete board

spec/features/boards/multiple_boards_spec.rb

@@ -10,136 +10,155 @@ describe 'Multiple Issue Boards', feature: true, js: true do
   let!(:board)    { create(:board, project: project) }
   let!(:board2)   { create(:board, project: project) }
 
-  before do
-    project.team << [user, :master]
+  context 'authorized user' do
+    before do
+      project.team << [user, :master]
 
-    login_as(user)
+      login_as(user)
 
-    visit namespace_project_boards_path(project.namespace, project)
-    wait_for_vue_resource
-  end
+      visit namespace_project_boards_path(project.namespace, project)
+      wait_for_vue_resource
+    end
 
-  it 'shows current board name' do
-    page.within('.boards-switcher') do
-      expect(page).to have_content(board.name)
+    it 'shows current board name' do
+      page.within('.boards-switcher') do
+        expect(page).to have_content(board.name)
+      end
     end
-  end
 
-  it 'shows a list of boards' do
-    click_button board.name
+    it 'shows a list of boards' do
+      click_button board.name
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      expect(page).to have_content(board.name)
-      expect(page).to have_content(board2.name)
+      page.within('.boards-title-holder .dropdown-menu') do
+        expect(page).to have_content(board.name)
+        expect(page).to have_content(board2.name)
+      end
     end
-  end
 
-  it 'switches current board' do
-    click_button board.name
+    it 'switches current board' do
+      click_button board.name
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      click_link board2.name
-    end
+      page.within('.boards-title-holder .dropdown-menu') do
+        click_link board2.name
+      end
 
-    wait_for_vue_resource
+      wait_for_vue_resource
 
-    page.within('.boards-switcher') do
-      expect(page).to have_content(board2.name)
+      page.within('.boards-switcher') do
+        expect(page).to have_content(board2.name)
+      end
     end
-  end
 
-  it 'creates new board' do
-    click_button board.name
+    it 'creates new board' do
+      click_button board.name
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      click_link 'Edit board name'
+      page.within('.boards-title-holder .dropdown-menu') do
+        click_link 'Edit board name'
 
-      fill_in 'board-new-name', with: 'Testing'
+        fill_in 'board-new-name', with: 'Testing'
 
-      click_button 'Save'
-    end
+        click_button 'Save'
+      end
 
-    wait_for_vue_resource
+      wait_for_vue_resource
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      expect(page).to have_content('Testing')
+      page.within('.boards-title-holder .dropdown-menu') do
+        expect(page).to have_content('Testing')
+      end
     end
-  end
 
-  it 'edits board name' do
-    click_button board.name
+    it 'edits board name' do
+      click_button board.name
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      click_link 'Edit board name'
+      page.within('.boards-title-holder .dropdown-menu') do
+        click_link 'Edit board name'
 
-      fill_in 'board-new-name', with: 'Testing'
+        fill_in 'board-new-name', with: 'Testing'
 
-      click_button 'Save'
-    end
+        click_button 'Save'
+      end
 
-    wait_for_vue_resource
+      wait_for_vue_resource
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      expect(page).to have_content('Testing')
+      page.within('.boards-title-holder .dropdown-menu') do
+        expect(page).to have_content('Testing')
+      end
     end
-  end
 
-  it 'deletes board' do
-    click_button board.name
+    it 'deletes board' do
+      click_button board.name
 
-    wait_for_vue_resource
+      wait_for_vue_resource
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      click_link 'Delete board'
+      page.within('.boards-title-holder .dropdown-menu') do
+        click_link 'Delete board'
 
-      page.within('.dropdown-title') do
-        expect(page).to have_content('Delete board')
+        page.within('.dropdown-title') do
+          expect(page).to have_content('Delete board')
+        end
+
+        click_link 'Delete'
       end
 
-      click_link 'Delete'
+      click_button board2.name
+
+      page.within('.boards-title-holder .dropdown-menu') do
+        expect(page).not_to have_content(board.name)
+        expect(page).to have_content(board2.name)
+      end
     end
 
-    click_button board2.name
+    it 'adds a list to the none default board' do
+      click_button board.name
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      expect(page).not_to have_content(board.name)
-      expect(page).to have_content(board2.name)
-    end
-  end
+      page.within('.boards-title-holder .dropdown-menu') do
+        click_link board2.name
+      end
 
-  it 'adds a list to the none default board' do
-    click_button board.name
+      wait_for_vue_resource
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      click_link board2.name
-    end
+      page.within('.boards-switcher') do
+        expect(page).to have_content(board2.name)
+      end
 
-    wait_for_vue_resource
+      click_button 'Create new list'
 
-    page.within('.boards-switcher') do
-      expect(page).to have_content(board2.name)
-    end
+      wait_for_ajax
 
-    click_button 'Create new list'
+      page.within '.dropdown-menu-issues-board-new' do
+        click_link planning.title
+      end
 
-    wait_for_ajax
+      wait_for_vue_resource
 
-    page.within '.dropdown-menu-issues-board-new' do
-      click_link planning.title
-    end
+      expect(page).to have_selector('.board', count: 3)
 
-    wait_for_vue_resource
+      click_button board2.name
+
+      page.within('.boards-title-holder .dropdown-menu') do
+        click_link board.name
+      end
 
-    expect(page).to have_selector('.board', count: 3)
+      wait_for_vue_resource
 
-    click_button board2.name
+      expect(page).to have_selector('.board', count: 2)
+    end
+  end
 
-    page.within('.boards-title-holder .dropdown-menu') do
-      click_link board.name
+  context 'unauthorized user' do
+    before do
+      visit namespace_project_boards_path(project.namespace, project)
+      wait_for_vue_resource
     end
 
-    wait_for_vue_resource
+    it 'does not show action links' do
+      click_button board.name
 
-    expect(page).to have_selector('.board', count: 2)
+      page.within('.boards-title-holder .dropdown-menu') do
+        expect(page).not_to have_content('Create new board')
+        expect(page).not_to have_content('Edit board name')
+        expect(page).not_to have_content('Delete board')
+      end
+    end
   end
 end