Merge branch 'mwaw/remove_logs_path_for_not_authorised_users' into 'master'

Remove un accessible links from embded dashboards context menu

Closes #207184

See merge request gitlab-org/gitlab!25892

changelogs/unreleased/mwaw-remove_logs_path_for_not_authorised_users.yml

+---
+title: Remove unreachable link from embded dashboard context menu
+merge_request: 25892
+author:
+type: fixed

ee/app/helpers/ee/environments_helper.rb

@@ -45,9 +45,9 @@ module EE
         "validate-query-path" => validate_query_project_prometheus_metrics_path(project),
         "custom-metrics-available" => "#{custom_metrics_available?(project)}",
         "alerts-endpoint" => project_prometheus_alerts_path(project, environment_id: environment.id, format: :json),
-        "prometheus-alerts-available" => "#{can?(current_user, :read_prometheus_alerts, project)}",
-        "logs_path" => project_logs_path(project, environment_name: environment.name)
+        "prometheus-alerts-available" => "#{can?(current_user, :read_prometheus_alerts, project)}"
       }
+      ee_metrics_data["logs_path"] = project_logs_path(project, environment_name: environment.name) if can?(current_user, :read_pod_logs, project)
 
       super.merge(ee_metrics_data)
     end

ee/spec/helpers/ee/environments_helper_spec.rb

@@ -10,6 +10,7 @@ describe EnvironmentsHelper do
   describe '#metrics_data' do
     subject { helper.metrics_data(project, environment) }
 
+    context 'user has all accesses' do
       before do
         allow(helper).to receive(:current_user).and_return(user)
         allow(helper).to receive(:can?)
@@ -18,6 +19,9 @@ describe EnvironmentsHelper do
         allow(helper).to receive(:can?)
           .with(user, :admin_project, project)
           .and_return(true)
+        allow(helper).to receive(:can?)
+          .with(user, :read_pod_logs, project)
+          .and_return(true)
       end
 
       it 'returns additional configuration' do
@@ -32,6 +36,26 @@ describe EnvironmentsHelper do
       end
     end
 
+    context 'user does not have access to pod logs' do
+      before do
+        allow(helper).to receive(:current_user).and_return(user)
+        allow(helper).to receive(:can?)
+                           .with(user, :read_prometheus_alerts, project)
+                           .and_return(true)
+        allow(helper).to receive(:can?)
+                           .with(user, :admin_project, project)
+                           .and_return(true)
+        allow(helper).to receive(:can?)
+                           .with(user, :read_pod_logs, project)
+                           .and_return(false)
+      end
+
+      it 'returns additional configuration' do
+        expect(subject.keys).not_to include('logs_path')
+      end
+    end
+  end
+
   describe '#environment_logs_data' do
     subject { helper.environment_logs_data(project, environment) }