Merge branch 'kp-fix-new-requirement-access' into 'master'

Fix new requirement & reopen button visibility

See merge request gitlab-org/gitlab!29715

ee/app/assets/javascripts/requirements/components/requirement_item.vue

@@ -170,7 +170,7 @@ export default {
                 <gl-loading-icon v-else />
               </gl-deprecated-button>
             </li>
-            <li v-if="isArchived" class="requirement-reopen d-sm-block">
+            <li v-if="canArchive && isArchived" class="requirement-reopen d-sm-block">
               <gl-deprecated-button
                 size="xs"
                 class="p-2"

ee/app/views/projects/requirements/index.html.haml

@@ -37,7 +37,7 @@
         %span.badge.badge-pill.js-all-count= total_requirements
 
   .nav-controls
-    - if is_open_tab
+    - if is_open_tab && can?(current_user, :create_requirement, @project)
       %button.btn.btn-success.js-new-requirement.qa-new-requirement-button{ type: 'button' }
         = _('New requirement')
 

ee/spec/features/projects/requirements/requirements_list_spec.rb

@@ -4,6 +4,7 @@ require 'spec_helper'
 
 describe 'Requirements list', :js do
   let_it_be(:user) { create(:user) }
+  let_it_be(:user_guest) { create(:user) }
   let_it_be(:project) { create(:project, :repository) }
   let_it_be(:requirement1) { create(:requirement, project: project, title: 'Some requirement-1', author: user, created_at: 5.days.ago, updated_at: 2.days.ago) }
   let_it_be(:requirement2) { create(:requirement, project: project, title: 'Some requirement-2', author: user, created_at: 6.days.ago, updated_at: 2.days.ago) }
@@ -27,6 +28,7 @@ describe 'Requirements list', :js do
     stub_licensed_features(requirements: true)
     stub_feature_flags(requirements_management: { enabled: true, thing: project })
     project.add_maintainer(user)
+    project.add_guest(user_guest)
 
     sign_in(user)
   end
@@ -242,4 +244,19 @@ describe 'Requirements list', :js do
       end
     end
   end
+
+  context 'when accessing project as guest user' do
+    before do
+      sign_in(user_guest)
+      visit project_requirements_path(project)
+
+      wait_for_requests
+    end
+
+    it 'open tab does not show button "New requirement"' do
+      page.within('.nav-controls') do
+        expect(page).not_to have_selector('button.js-new-requirement')
+      end
+    end
+  end
 end

ee/spec/frontend/requirements/components/requirement_item_spec.js

@@ -235,7 +235,7 @@ describe('RequirementItem', () => {
       });
     });
 
-    it('renders `Reopen` button when current requirement is archived', () => {
+    it('renders `Reopen` button when current requirement is archived and `requirement.userPermissions.adminRequirement` is true', () => {
       const reopenButton = wrapperArchived.find('.requirement-reopen').find(GlDeprecatedButton);
 
       expect(reopenButton.exists()).toBe(true);
@@ -243,6 +243,22 @@ describe('RequirementItem', () => {
       expect(reopenButton.text()).toBe('Reopen');
     });
 
+    it('does not render `Reopen` button when current requirement is archived and `requirement.userPermissions.adminRequirement` is false', () => {
+      wrapperArchived.setProps({
+        requirement: {
+          ...requirementArchived,
+          userPermissions: {
+            ...mockUserPermissions,
+            adminRequirement: false,
+          },
+        },
+      });
+
+      return wrapperArchived.vm.$nextTick(() => {
+        expect(wrapperArchived.contains('.controls .requirement-reopen')).toBe(false);
+      });
+    });
+
     it('renders element containing requirement updated at', () => {
       const updatedAtEl = wrapper.find('.issuable-meta .issuable-updated-at > span');