Add missing error handling for epic quick actions

Include error messages for epic quick actions when
epics don't exist, are already related, or user
has no permission to read them

ee/changelogs/unreleased/13809-missing-error-handling-for-epic-quick-action.yml

+---
+title: Add missing error handling for epic quick actions
+merge_request: 15648
+author:
+type: fixed

ee/lib/ee/gitlab/quick_actions/epic_actions.rb

@@ -20,17 +20,14 @@ module EE
           command :child_epic do |epic_param|
             child_epic = extract_epic(epic_param)
 
-            if child_epic && !quick_action_target.child?(child_epic.id)
-              EpicLinks::CreateService.new(quick_action_target, current_user, { target_issuable: child_epic }).execute
-              @execution_message[:child_epic] = _("Added %{epic_ref} as child epic.") % { epic_ref: child_epic.to_reference(quick_action_target) }
-            end
+            @execution_message[:child_epic] = add_child_epic(quick_action_target, child_epic)
           end
 
           desc _('Remove child epic from an epic')
           explanation do |epic_param|
             child_epic = extract_epic(epic_param)
 
-            _("Removes %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) }
+            _("Removes %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) } if child_epic
           end
           types Epic
           condition { action_allowed? }
@@ -38,10 +35,14 @@ module EE
           command :remove_child_epic do |epic_param|
             child_epic = extract_epic(epic_param)
 
-            if child_epic && quick_action_target.child?(child_epic.id)
-              EpicLinks::DestroyService.new(child_epic, current_user).execute
-              @execution_message[:remove_child_epic] = _("Removed %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) }
-            end
+            @execution_message[:remove_child_epic] =
+              if child_epic && quick_action_target.child?(child_epic.id)
+                EpicLinks::DestroyService.new(child_epic, current_user).execute
+
+                _("Removed %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) }
+              else
+                _("Child epic does not exist.")
+              end
           end
 
           desc _('Set parent epic to an epic')
@@ -56,26 +57,28 @@ module EE
           command :parent_epic do |epic_param|
             parent_epic = extract_epic(epic_param)
 
-            if parent_epic && !parent_epic.child?(quick_action_target.id)
-              EpicLinks::CreateService.new(parent_epic, current_user, { target_issuable: quick_action_target }).execute
-              @execution_message[:parent_epic] = _("Set %{epic_ref} as parent epic.") % { epic_ref: parent_epic.to_reference(quick_action_target) }
-            end
+            @execution_message[:parent_epic] = set_parent_epic(quick_action_target, parent_epic)
           end
 
           desc _('Remove parent epic from an epic')
           explanation do
             parent_epic = quick_action_target.parent
 
-            _('Removes parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) }
+            _('Removes parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) } if parent_epic
           end
           types Epic
-          condition do
-            action_allowed? && quick_action_target.parent.present?
-          end
+          condition { action_allowed? }
           command :remove_parent_epic do
             parent_epic = quick_action_target.parent
-            EpicLinks::DestroyService.new(quick_action_target, current_user).execute
-            @execution_message[:remove_parent_epic] = _('Removed parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) }
+
+            @execution_message[:remove_parent_epic] =
+              if parent_epic
+                EpicLinks::DestroyService.new(quick_action_target, current_user).execute
+
+                _('Removed parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) }
+              else
+                _("Parent epic is not present.")
+              end
           end
 
           private
@@ -90,6 +93,52 @@ module EE
             quick_action_target.group&.feature_available?(:epics) &&
               current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
           end
+
+          def epics_related?(epic, target_epic)
+            epic.child?(target_epic.id) || target_epic.child?(epic.id)
+          end
+
+          def add_child_epic(target_epic, child_epic)
+            return child_error_message(:not_present) unless child_epic.present?
+            return child_error_message(:already_related) if epics_related?(child_epic, target_epic)
+            return child_error_message(:no_permission) unless current_user.can?(:read_epic, child_epic)
+
+            EpicLinks::CreateService.new(target_epic, current_user, { target_issuable: child_epic }).execute
+
+            _("Added %{epic_ref} as a child epic.") % { epic_ref: child_epic.to_reference(target_epic) }
+          end
+
+          def set_parent_epic(target_epic, parent_epic)
+            return parent_error_message(:not_present) unless parent_epic.present?
+            return parent_error_message(:already_related) if epics_related?(parent_epic, target_epic)
+            return parent_error_message(:no_permission) unless current_user.can?(:read_epic, parent_epic)
+
+            EpicLinks::CreateService.new(parent_epic, current_user, { target_issuable: target_epic }).execute
+
+            _("Set %{epic_ref} as the parent epic.") % { epic_ref: parent_epic.to_reference(target_epic) }
+          end
+
+          def parent_error_message(reason)
+            case reason
+            when :not_present
+              _("Parent epic doesn't exist.")
+            when :already_related
+              _("Given epic is already related to this epic.")
+            when :no_permission
+              _("You don't have sufficient permission to perform this action.")
+            end
+          end
+
+          def child_error_message(reason)
+            case reason
+            when :not_present
+              _("Child epic doesn't exist.")
+            when :already_related
+              _("Given epic is already related to this epic.")
+            when :no_permission
+              _("You don't have sufficient permission to perform this action.")
+            end
+          end
         end
       end
     end

ee/lib/ee/gitlab/quick_actions/issue_actions.rb

@@ -10,7 +10,6 @@ module EE
         included do
           desc _('Add to epic')
           explanation _('Adds an issue to an epic.')
-          execution_message _('Added an issue to an epic.')
           types Issue
           condition do
             quick_action_target.project.group&.feature_available?(:epics) &&
@@ -18,7 +17,16 @@ module EE
           end
           params '<&epic | group&epic | Epic URL>'
           command :epic do |epic_param|
-            @updates[:epic] = extract_epic(epic_param)
+            epic = extract_epic(epic_param)
+
+            if epic && current_user.can?(:read_epic, epic)
+              @updates[:epic] = epic
+              message = _('Added an issue to an epic.')
+            else
+              message = _("This epic does not exist or you don't have sufficient permission.")
+            end
+
+            @execution_message[:epic] = message
           end
 
           desc _('Remove from epic')

locale/gitlab.pot

@@ -985,7 +985,7 @@ msgstr ""
 msgid "Added"
 msgstr ""
 
-msgid "Added %{epic_ref} as child epic."
+msgid "Added %{epic_ref} as a child epic."
 msgstr ""
 
 msgid "Added %{label_references} %{label_text}."
@@ -2934,6 +2934,12 @@ msgstr ""
 msgid "Cherry-pick this merge request"
 msgstr ""
 
+msgid "Child epic does not exist."
+msgstr ""
+
+msgid "Child epic doesn't exist."
+msgstr ""
+
 msgid "Choose <strong>Create archive</strong> and wait for archiving to complete."
 msgstr ""
 
@@ -7652,6 +7658,9 @@ msgstr ""
 msgid "Given access %{time_ago}"
 msgstr ""
 
+msgid "Given epic is already related to this epic."
+msgstr ""
+
 msgid "Global Shortcuts"
 msgstr ""
 
@@ -11087,6 +11096,12 @@ msgstr ""
 msgid "Parameter"
 msgstr ""
 
+msgid "Parent epic doesn't exist."
+msgstr ""
+
+msgid "Parent epic is not present."
+msgstr ""
+
 msgid "Part of merge request changes"
 msgstr ""
 
@@ -14243,7 +14258,7 @@ msgstr ""
 msgid "Session expiration, projects limit and attachment size."
 msgstr ""
 
-msgid "Set %{epic_ref} as parent epic."
+msgid "Set %{epic_ref} as the parent epic."
 msgstr ""
 
 msgid "Set a default template for issue descriptions."
@@ -16074,6 +16089,9 @@ msgstr ""
 msgid "This environment has no deployments yet."
 msgstr ""
 
+msgid "This epic does not exist or you don't have sufficient permission."
+msgstr ""
+
 msgid "This feature requires local storage to be enabled"
 msgstr ""
 
@@ -18282,6 +18300,9 @@ msgstr ""
 msgid "You don't have any recent searches"
 msgstr ""
 
+msgid "You don't have sufficient permission to perform this action."
+msgstr ""
+
 msgid "You don’t have access to Cycle Analytics for this group"
 msgstr ""