Fix user permissions for job

Do not show retry button to user
if they cannot update the build.

app/assets/javascripts/jobs/components/table/cells/actions_cell.vue

@@ -64,6 +64,9 @@ export default {
     canReadJob() {
       return this.job.userPermissions?.readBuild;
     },
+    canUpdateJob() {
+      return this.job.userPermissions?.updateBuild;
+    },
     isActive() {
       return this.job.active;
     },
@@ -139,7 +142,7 @@ export default {
 
 <template>
   <gl-button-group>
-    <template v-if="canReadJob">
+    <template v-if="canReadJob && canUpdateJob">
       <gl-button
         v-if="isActive"
         data-testid="cancel-button"

app/assets/javascripts/jobs/components/table/graphql/queries/get_jobs.query.graphql

@@ -75,6 +75,7 @@ query getJobs(
         userPermissions {
           readBuild
           readJobArtifacts
+          updateBuild
         }
       }
     }

spec/frontend/jobs/components/table/cells/actions_cell_spec.js

@@ -5,7 +5,14 @@ import ActionsCell from '~/jobs/components/table/cells/actions_cell.vue';
 import JobPlayMutation from '~/jobs/components/table/graphql/mutations/job_play.mutation.graphql';
 import JobRetryMutation from '~/jobs/components/table/graphql/mutations/job_retry.mutation.graphql';
 import JobUnscheduleMutation from '~/jobs/components/table/graphql/mutations/job_unschedule.mutation.graphql';
-import { playableJob, retryableJob, scheduledJob } from '../../../mock_data';
+import {
+  playableJob,
+  retryableJob,
+  scheduledJob,
+  cannotRetryJob,
+  cannotPlayJob,
+  cannotPlayScheduledJob,
+} from '../../../mock_data';
 
 describe('Job actions cell', () => {
   let wrapper;
@@ -57,6 +64,17 @@ describe('Job actions cell', () => {
     expect(findDownloadArtifactsButton().exists()).toBe(false);
   });
 
+  it.each`
+    button                        | action                  | jobType
+    ${findPlayButton}             | ${'play'}               | ${cannotPlayJob}
+    ${findRetryButton}            | ${'retry'}              | ${cannotRetryJob}
+    ${findPlayScheduledJobButton} | ${'download artifacts'} | ${cannotPlayScheduledJob}
+  `('does not display the $action button if user cannot update build', ({ button, jobType }) => {
+    createComponent(jobType);
+
+    expect(button().exists()).toBe(false);
+  });
+
   it.each`
     button                         | action                  | jobType
     ${findPlayButton}              | ${'play'}               | ${playableJob}

spec/frontend/jobs/mock_data.js

@@ -1636,10 +1636,15 @@ export const retryableJob = {
   cancelable: false,
   active: false,
   stuck: false,
-  userPermissions: { readBuild: true, __typename: 'JobPermissions' },
+  userPermissions: { readBuild: true, updateBuild: true, __typename: 'JobPermissions' },
   __typename: 'CiJob',
 };
 
+export const cannotRetryJob = {
+  ...retryableJob,
+  userPermissions: { readBuild: true, updateBuild: false, __typename: 'JobPermissions' },
+};
+
 export const playableJob = {
   artifacts: {
     nodes: [
@@ -1700,10 +1705,25 @@ export const playableJob = {
   cancelable: false,
   active: false,
   stuck: false,
-  userPermissions: { readBuild: true, readJobArtifacts: true, __typename: 'JobPermissions' },
+  userPermissions: {
+    readBuild: true,
+    readJobArtifacts: true,
+    updateBuild: true,
+    __typename: 'JobPermissions',
+  },
   __typename: 'CiJob',
 };
 
+export const cannotPlayJob = {
+  ...playableJob,
+  userPermissions: {
+    readBuild: true,
+    readJobArtifacts: true,
+    updateBuild: false,
+    __typename: 'JobPermissions',
+  },
+};
+
 export const scheduledJob = {
   artifacts: { nodes: [], __typename: 'CiJobArtifactConnection' },
   allowFailure: false,
@@ -1756,6 +1776,16 @@ export const scheduledJob = {
   cancelable: false,
   active: false,
   stuck: false,
-  userPermissions: { readBuild: true, __typename: 'JobPermissions' },
+  userPermissions: { readBuild: true, updateBuild: true, __typename: 'JobPermissions' },
   __typename: 'CiJob',
 };
+
+export const cannotPlayScheduledJob = {
+  ...scheduledJob,
+  userPermissions: {
+    readBuild: true,
+    readJobArtifacts: true,
+    updateBuild: false,
+    __typename: 'JobPermissions',
+  },
+};