Commit 737d194c authored by Sean McGivern's avatar Sean McGivern

Allow group reporters to promote labels

They can admin group labels anyway, we weren't checking the more specific
permission.
parent 8ce11fc3
...@@ -8,7 +8,7 @@ class Projects::LabelsController < Projects::ApplicationController ...@@ -8,7 +8,7 @@ class Projects::LabelsController < Projects::ApplicationController
before_action :authorize_admin_labels!, only: [:new, :create, :edit, :update, before_action :authorize_admin_labels!, only: [:new, :create, :edit, :update,
:generate, :destroy, :remove_priority, :generate, :destroy, :remove_priority,
:set_priorities] :set_priorities]
before_action :authorize_admin_group!, only: [:promote] before_action :authorize_admin_group_labels!, only: [:promote]
respond_to :js, :html respond_to :js, :html
...@@ -161,7 +161,7 @@ class Projects::LabelsController < Projects::ApplicationController ...@@ -161,7 +161,7 @@ class Projects::LabelsController < Projects::ApplicationController
return render_404 unless can?(current_user, :admin_label, @project) return render_404 unless can?(current_user, :admin_label, @project)
end end
def authorize_admin_group! def authorize_admin_group_labels!
return render_404 unless can?(current_user, :admin_group, @project.group) return render_404 unless can?(current_user, :admin_label, @project.group)
end end
end end
...@@ -64,7 +64,7 @@ ...@@ -64,7 +64,7 @@
%a.js-subscribe-button{ data: { url: toggle_subscription_group_label_path(label.group, label) } } %a.js-subscribe-button{ data: { url: toggle_subscription_group_label_path(label.group, label) } }
Group level Group level
- if label.is_a?(ProjectLabel) && label.project.group && can?(current_user, :admin_group, label.project.group) - if label.is_a?(ProjectLabel) && label.project.group && can?(current_user, :admin_label, label.project.group)
= link_to promote_namespace_project_label_path(label.project.namespace, label.project, label), title: "Promote to Group Label", class: 'btn btn-transparent btn-action', data: {confirm: "Promoting this label will make this label available to all projects inside this group. Existing project labels with the same name will be merged. Are you sure?", toggle: "tooltip"}, method: :post do = link_to promote_namespace_project_label_path(label.project.namespace, label.project, label), title: "Promote to Group Label", class: 'btn btn-transparent btn-action', data: {confirm: "Promoting this label will make this label available to all projects inside this group. Existing project labels with the same name will be merged. Are you sure?", toggle: "tooltip"}, method: :post do
%span.sr-only Promote to Group %span.sr-only Promote to Group
= icon('level-up') = icon('level-up')
......
---
title: Allow reporters to promote project labels to group labels
merge_request:
author:
...@@ -117,7 +117,7 @@ describe Projects::LabelsController do ...@@ -117,7 +117,7 @@ describe Projects::LabelsController do
let!(:promoted_label_name) { "Promoted Label" } let!(:promoted_label_name) { "Promoted Label" }
let!(:label_1) { create(:label, title: promoted_label_name, project: project) } let!(:label_1) { create(:label, title: promoted_label_name, project: project) }
context 'not group owner' do context 'not group reporters' do
it 'denies access' do it 'denies access' do
post :promote, namespace_id: project.namespace.to_param, project_id: project, id: label_1.to_param post :promote, namespace_id: project.namespace.to_param, project_id: project, id: label_1.to_param
...@@ -125,9 +125,9 @@ describe Projects::LabelsController do ...@@ -125,9 +125,9 @@ describe Projects::LabelsController do
end end
end end
context 'group owner' do context 'group reporter' do
before do before do
GroupMember.add_users(group, [user], :owner) group.add_reporter(user)
end end
it 'gives access' do it 'gives access' do
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment