Merge branch '216881-fix-close-button-showing-for-unauthorized-users' into 'master'

Fix label `x` button showing for unauthorized users

See merge request gitlab-org/gitlab!45189

app/assets/javascripts/sidebar/components/labels/sidebar_labels.vue

@@ -77,7 +77,7 @@ export default {
 <template>
   <labels-select
     class="block labels js-labels-block"
-    :allow-label-remove="true"
+    :allow-label-remove="allowLabelEdit"
     :allow-label-create="allowLabelCreate"
     :allow-label-edit="allowLabelEdit"
     :allow-multiselect="true"

ee/app/assets/javascripts/epic/components/sidebar_items/sidebar_labels.vue

@@ -128,7 +128,7 @@ export default {
 
 <template>
   <labels-select-vue
-    :allow-label-remove="true"
+    :allow-label-remove="canUpdate"
     :allow-label-edit="canUpdate"
     :allow-label-create="true"
     :allow-multiselect="true"

spec/features/issues/user_edits_issue_spec.rb

@@ -13,6 +13,7 @@ RSpec.describe "Issues > User edits issue", :js do
   let_it_be(:milestone) { create(:milestone, project: project) }
   let_it_be(:milestones) { create_list(:milestone, 25, project: project_with_milestones) }
 
+  context 'with authorized user' do
     before do
       project.add_developer(user)
       project_with_milestones.add_developer(user)
@@ -330,4 +331,33 @@ RSpec.describe "Issues > User edits issue", :js do
         end
       end
     end
+  end
+
+  context 'with unauthorized user' do
+    before do
+      sign_in(user)
+    end
+
+    context "from issue#show" do
+      before do
+        visit project_issue_path(project, issue)
+      end
+
+      describe 'updating labels' do
+        it 'cannot edit labels' do
+          page.within '.block.labels' do
+            expect(page).not_to have_button('Edit')
+          end
+        end
+
+        it 'cannot remove label with a click as it has no `x` button' do
+          page.within '.block.labels' do
+            within '.gl-label' do
+              expect(page).not_to have_button
+            end
+          end
+        end
+      end
+    end
+  end
 end