Inherit viewability of incidents from issues

app/controllers/projects/incidents_controller.rb

 # frozen_string_literal: true
 
 class Projects::IncidentsController < Projects::ApplicationController
-  before_action :authorize_read_incidents!
+  before_action :authorize_read_issue!
 
   def index
   end

app/helpers/projects_helper.rb

@@ -468,7 +468,7 @@ module ProjectsHelper
       serverless:         :read_cluster,
       error_tracking:     :read_sentry_issue,
       alert_management:   :read_alert_management_alert,
-      incidents:          :read_incidents,
+      incidents:          :read_issue,
       labels:             :read_label,
       issues:             :read_issue,
       project_members:    :read_project_member,
@@ -477,7 +477,14 @@ module ProjectsHelper
   end
 
   def can_view_operations_tab?(current_user, project)
-    [:read_environment, :read_cluster, :metrics_dashboard].any? do |ability|
+    [
+      :metrics_dashboard,
+      :read_alert_management_alert,
+      :read_environment,
+      :read_issue,
+      :read_sentry_issue,
+      :read_cluster
+    ].any? do |ability|
       can?(current_user, ability, project)
     end
   end

app/policies/project_policy.rb

@@ -237,7 +237,6 @@ class ProjectPolicy < BasePolicy
     enable :read_merge_request
     enable :read_sentry_issue
     enable :update_sentry_issue
-    enable :read_incidents
     enable :read_prometheus
     enable :read_metrics_dashboard_annotation
     enable :metrics_dashboard

app/views/layouts/nav/sidebar/_project.html.haml

@@ -235,11 +235,11 @@
                   %span
                     = _('Alerts')
 
-              - if project_nav_tab?(:incidents)
-                = nav_link(controller: :incidents) do
-                  = link_to project_incidents_path(@project), title: _('Incidents'), data: { qa_selector: 'operations_incidents_link' } do
-                    %span
-                      = _('Incidents')
+            - if project_nav_tab?(:incidents)
+              = nav_link(controller: :incidents) do
+                = link_to project_incidents_path(@project), title: _('Incidents'), data: { qa_selector: 'operations_incidents_link' } do
+                  %span
+                    = _('Incidents')
 
             - if project_nav_tab? :environments
               = render_if_exists "layouts/nav/sidebar/tracing_link"

changelogs/unreleased/sy-allow-guests-to-view-incidents.yml

+---
+title: Show incident list for users who can read issues
+merge_request: 43060
+author:
+type: fixed

doc/operations/incident_management/incidents.md

@@ -9,7 +9,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 While no configuration is required to use the [manual features](#create-an-incident-manually)
 of incident management, some simple [configuration](#configure-incidents) is needed to automate incident creation.
 
-For users with at least Reporter [permissions](../../user/permissions.md), the
+For users with at least Guest [permissions](../../user/permissions.md), the
 Incident Management list is available at **Operations > Incidents**
 in your project's sidebar. The list contains the following metrics:
 

spec/controllers/projects/incidents_controller_spec.rb

@@ -8,8 +8,8 @@ RSpec.describe Projects::IncidentsController do
   let_it_be(:guest) { create(:user) }
 
   before_all do
-    project.add_developer(developer)
     project.add_guest(guest)
+    project.add_developer(developer)
   end
 
   describe 'GET #index' do
@@ -17,7 +17,15 @@ RSpec.describe Projects::IncidentsController do
       get :index, params: { namespace_id: project.namespace, project_id: project }
     end
 
-    it 'shows the page for user with developer role' do
+    it 'shows the page for users with guest role' do
+      sign_in(guest)
+      make_request
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response).to render_template(:index)
+    end
+
+    it 'shows the page for users with developer role' do
       sign_in(developer)
       make_request
 
@@ -27,20 +35,10 @@ RSpec.describe Projects::IncidentsController do
 
     context 'when user is unauthorized' do
       it 'redirects to the login page' do
-        sign_out(developer)
         make_request
 
         expect(response).to redirect_to(new_user_session_path)
       end
     end
-
-    context 'when user is a guest' do
-      it 'shows 404' do
-        sign_in(guest)
-        make_request
-
-        expect(response).to have_gitlab_http_status(:not_found)
-      end
-    end
   end
 end

spec/features/operations_sidebar_link_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Operations dropdown sidebar' do
+  let_it_be(:project) { create(:project, :repository) }
+  let(:user) { create(:user) }
+
+  before do
+    project.add_role(user, role)
+    sign_in(user)
+    visit project_issues_path(project)
+  end
+
+  context 'user has guest role' do
+    let(:role) { :guest }
+
+    it 'has the correct `Operations` menu items' do
+      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
+
+      expect(page).not_to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).not_to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
+      expect(page).not_to have_link(title: 'Environments', href: project_environments_path(project))
+      expect(page).not_to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).not_to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
+      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link(title: 'Logs', href: project_logs_path(project))
+      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+    end
+  end
+
+  context 'user has reporter role' do
+    let(:role) { :reporter }
+
+    it 'has the correct `Operations` menu items' do
+      expect(page).to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
+      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
+      expect(page).to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
+
+      expect(page).not_to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
+      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link(title: 'Logs', href: project_logs_path(project))
+      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+    end
+  end
+
+  context 'user has developer role' do
+    let(:role) { :developer }
+
+    it 'has the correct `Operations` menu items' do
+      expect(page).to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
+      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
+      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
+      expect(page).to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
+      expect(page).to have_link(title: 'Logs', href: project_logs_path(project))
+
+      expect(page).not_to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
+      expect(page).not_to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+    end
+  end
+
+  context 'user has maintainer role' do
+    let(:role) { :maintainer }
+
+    it 'has the correct `Operations` menu items' do
+      expect(page).to have_link(title: 'Metrics', href: project_metrics_dashboard_path(project))
+      expect(page).to have_link(title: 'Alerts', href: project_alert_management_index_path(project))
+      expect(page).to have_link(title: 'Incidents', href: project_incidents_path(project))
+      expect(page).to have_link(title: 'Environments', href: project_environments_path(project))
+      expect(page).to have_link(title: 'Error Tracking', href: project_error_tracking_index_path(project))
+      expect(page).to have_link(title: 'Product Analytics', href: project_product_analytics_path(project))
+      expect(page).to have_link(title: 'Serverless', href: project_serverless_functions_path(project))
+      expect(page).to have_link(title: 'Logs', href: project_logs_path(project))
+      expect(page).to have_link(title: 'Kubernetes', href: project_clusters_path(project))
+    end
+  end
+end

spec/features/projects/user_sees_sidebar_spec.rb

@@ -145,11 +145,11 @@ RSpec.describe 'Projects > User sees sidebar' do
         expect(page).to have_content 'Project'
         expect(page).to have_content 'Issues'
         expect(page).to have_content 'Wiki'
+        expect(page).to have_content 'Operations'
 
         expect(page).not_to have_content 'Repository'
         expect(page).not_to have_content 'CI / CD'
         expect(page).not_to have_content 'Merge Requests'
-        expect(page).not_to have_content 'Operations'
       end
     end
 

spec/helpers/projects_helper_spec.rb

@@ -524,7 +524,14 @@ RSpec.describe ProjectsHelper do
 
     subject { helper.send(:can_view_operations_tab?, user, project) }
 
-    [:read_environment, :read_cluster, :metrics_dashboard].each do |ability|
+    [
+      :metrics_dashboard,
+      :read_alert_management_alert,
+      :read_environment,
+      :read_issue,
+      :read_sentry_issue,
+      :read_cluster
+    ].each do |ability|
       it 'includes operations tab' do
         allow(helper).to receive(:can?).and_return(false)
         allow(helper).to receive(:can?).with(user, ability, project).and_return(true)