Merge branch '13809-missing-error-handling-for-epic-quick-action' into 'master'

Missing error handling for /epic quick action

Closes #13809

See merge request gitlab-org/gitlab!15648

ee/changelogs/unreleased/13809-missing-error-handling-for-epic-quick-action.yml

+---
+title: Add missing error handling for epic quick actions
+merge_request: 15648
+author:
+type: fixed

ee/lib/ee/gitlab/quick_actions/epic_actions.rb

@@ -20,17 +20,14 @@ module EE
           command :child_epic do |epic_param|
             child_epic = extract_epic(epic_param)
 
-            if child_epic && !quick_action_target.child?(child_epic.id)
-              EpicLinks::CreateService.new(quick_action_target, current_user, { target_issuable: child_epic }).execute
-              @execution_message[:child_epic] = _("Added %{epic_ref} as child epic.") % { epic_ref: child_epic.to_reference(quick_action_target) }
-            end
+            @execution_message[:child_epic] = add_child_epic(quick_action_target, child_epic)
           end
 
           desc _('Remove child epic from an epic')
           explanation do |epic_param|
             child_epic = extract_epic(epic_param)
 
-            _("Removes %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) }
+            _("Removes %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) } if child_epic
           end
           types Epic
           condition { action_allowed? }
@@ -38,10 +35,14 @@ module EE
           command :remove_child_epic do |epic_param|
             child_epic = extract_epic(epic_param)
 
-            if child_epic && quick_action_target.child?(child_epic.id)
-              EpicLinks::DestroyService.new(child_epic, current_user).execute
-              @execution_message[:remove_child_epic] = _("Removed %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) }
-            end
+            @execution_message[:remove_child_epic] =
+              if child_epic && quick_action_target.child?(child_epic.id)
+                EpicLinks::DestroyService.new(child_epic, current_user).execute
+
+                _("Removed %{epic_ref} from child epics.") % { epic_ref: child_epic.to_reference(quick_action_target) }
+              else
+                _("Child epic does not exist.")
+              end
           end
 
           desc _('Set parent epic to an epic')
@@ -56,26 +57,28 @@ module EE
           command :parent_epic do |epic_param|
             parent_epic = extract_epic(epic_param)
 
-            if parent_epic && !parent_epic.child?(quick_action_target.id)
-              EpicLinks::CreateService.new(parent_epic, current_user, { target_issuable: quick_action_target }).execute
-              @execution_message[:parent_epic] = _("Set %{epic_ref} as parent epic.") % { epic_ref: parent_epic.to_reference(quick_action_target) }
-            end
+            @execution_message[:parent_epic] = set_parent_epic(quick_action_target, parent_epic)
           end
 
           desc _('Remove parent epic from an epic')
           explanation do
             parent_epic = quick_action_target.parent
 
-            _('Removes parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) }
+            _('Removes parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) } if parent_epic
           end
           types Epic
-          condition do
-            action_allowed? && quick_action_target.parent.present?
-          end
+          condition { action_allowed? }
           command :remove_parent_epic do
             parent_epic = quick_action_target.parent
-            EpicLinks::DestroyService.new(quick_action_target, current_user).execute
-            @execution_message[:remove_parent_epic] = _('Removed parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) }
+
+            @execution_message[:remove_parent_epic] =
+              if parent_epic
+                EpicLinks::DestroyService.new(quick_action_target, current_user).execute
+
+                _('Removed parent epic %{epic_ref}.') % { epic_ref: parent_epic.to_reference(quick_action_target) }
+              else
+                _("Parent epic is not present.")
+              end
           end
 
           private
@@ -90,6 +93,52 @@ module EE
             quick_action_target.group&.feature_available?(:epics) &&
               current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
           end
+
+          def epics_related?(epic, target_epic)
+            epic.child?(target_epic.id) || target_epic.child?(epic.id)
+          end
+
+          def add_child_epic(target_epic, child_epic)
+            return child_error_message(:not_present) unless child_epic.present?
+            return child_error_message(:already_related) if epics_related?(child_epic, target_epic)
+            return child_error_message(:no_permission) unless current_user.can?(:read_epic, child_epic)
+
+            EpicLinks::CreateService.new(target_epic, current_user, { target_issuable: child_epic }).execute
+
+            _("Added %{epic_ref} as a child epic.") % { epic_ref: child_epic.to_reference(target_epic) }
+          end
+
+          def set_parent_epic(target_epic, parent_epic)
+            return parent_error_message(:not_present) unless parent_epic.present?
+            return parent_error_message(:already_related) if epics_related?(parent_epic, target_epic)
+            return parent_error_message(:no_permission) unless current_user.can?(:read_epic, parent_epic)
+
+            EpicLinks::CreateService.new(parent_epic, current_user, { target_issuable: target_epic }).execute
+
+            _("Set %{epic_ref} as the parent epic.") % { epic_ref: parent_epic.to_reference(target_epic) }
+          end
+
+          def parent_error_message(reason)
+            case reason
+            when :not_present
+              _("Parent epic doesn't exist.")
+            when :already_related
+              _("Given epic is already related to this epic.")
+            when :no_permission
+              _("You don't have sufficient permission to perform this action.")
+            end
+          end
+
+          def child_error_message(reason)
+            case reason
+            when :not_present
+              _("Child epic doesn't exist.")
+            when :already_related
+              _("Given epic is already related to this epic.")
+            when :no_permission
+              _("You don't have sufficient permission to perform this action.")
+            end
+          end
         end
       end
     end

ee/lib/ee/gitlab/quick_actions/issue_actions.rb

@@ -10,7 +10,6 @@ module EE
         included do
           desc _('Add to epic')
           explanation _('Adds an issue to an epic.')
-          execution_message _('Added an issue to an epic.')
           types Issue
           condition do
             quick_action_target.project.group&.feature_available?(:epics) &&
@@ -18,7 +17,16 @@ module EE
           end
           params '<&epic | group&epic | Epic URL>'
           command :epic do |epic_param|
-            @updates[:epic] = extract_epic(epic_param)
+            epic = extract_epic(epic_param)
+
+            if epic && current_user.can?(:read_epic, epic)
+              @updates[:epic] = epic
+              message = _('Added an issue to an epic.')
+            else
+              message = _("This epic does not exist or you don't have sufficient permission.")
+            end
+
+            @execution_message[:epic] = message
           end
 
           desc _('Remove from epic')

locale/gitlab.pot

@@ -985,7 +985,7 @@ msgstr ""
 msgid "Added"
 msgstr ""
 
-msgid "Added %{epic_ref} as child epic."
+msgid "Added %{epic_ref} as a child epic."
 msgstr ""
 
 msgid "Added %{label_references} %{label_text}."
@@ -2934,6 +2934,12 @@ msgstr ""
 msgid "Cherry-pick this merge request"
 msgstr ""
 
+msgid "Child epic does not exist."
+msgstr ""
+
+msgid "Child epic doesn't exist."
+msgstr ""
+
 msgid "Choose <strong>Create archive</strong> and wait for archiving to complete."
 msgstr ""
 
@@ -7700,6 +7706,9 @@ msgstr ""
 msgid "Given access %{time_ago}"
 msgstr ""
 
+msgid "Given epic is already related to this epic."
+msgstr ""
+
 msgid "Global Shortcuts"
 msgstr ""
 
@@ -11141,6 +11150,12 @@ msgstr ""
 msgid "Parameter"
 msgstr ""
 
+msgid "Parent epic doesn't exist."
+msgstr ""
+
+msgid "Parent epic is not present."
+msgstr ""
+
 msgid "Part of merge request changes"
 msgstr ""
 
@@ -14306,7 +14321,7 @@ msgstr ""
 msgid "Session expiration, projects limit and attachment size."
 msgstr ""
 
-msgid "Set %{epic_ref} as parent epic."
+msgid "Set %{epic_ref} as the parent epic."
 msgstr ""
 
 msgid "Set a default template for issue descriptions."
@@ -16146,6 +16161,9 @@ msgstr ""
 msgid "This environment has no deployments yet."
 msgstr ""
 
+msgid "This epic does not exist or you don't have sufficient permission."
+msgstr ""
+
 msgid "This feature requires local storage to be enabled"
 msgstr ""
 
@@ -18354,6 +18372,9 @@ msgstr ""
 msgid "You don't have any recent searches"
 msgstr ""
 
+msgid "You don't have sufficient permission to perform this action."
+msgstr ""
+
 msgid "You don’t have access to Cycle Analytics for this group"
 msgstr ""