Hide mirror admin actions from developers

changelogs/unreleased/35305-hide-unauthorized-mirroring-actions.yml

+---
+title: Hide mirror admin actions from developers
+merge_request: 21569
+author:
+type: fixed

ee/app/views/shared/_mirror_update_button.html.haml

@@ -8,10 +8,14 @@
       %span.btn.disabled
         = icon("refresh spin")
         Updating…
-    - else
+    - elsif can?(current_user, :admin_project, @project)
       = link_to update_now_project_mirror_path(@project), method: :post, class: 'btn' do
         = icon("refresh")
         Update Now
+    - else
+      %span.btn.disabled
+        = icon("refresh")
+        Update Now
     - if @project.mirror_last_update_succeeded?
       %p.inline.prepend-left-10
         Successfully updated #{time_ago_with_tooltip(@project.import_state.last_successful_update_at)}.

ee/spec/views/shared/_mirror_update_button.html.haml_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'shared/mirror_update_button' do
+  let(:partial) { 'shared/mirror_update_button' }
+
+  let_it_be(:project) { create(:project, :mirror) }
+
+  let(:import_state) { project.import_state }
+
+  let(:owner) { project.owner }
+  let(:developer) { create(:user).tap { |user| project.team.add_developer(user) } }
+  let(:reporter) { create(:user).tap { |user| project.team.add_reporter(user) } }
+
+  let(:update_link) { update_now_project_mirror_path(project) }
+  let(:have_update_button) { have_link('Update Now', href: update_link) }
+
+  before do
+    @project = project
+  end
+
+  subject { rendered }
+
+  context 'mirror update can be triggered' do
+    context 'user is owner' do
+      it 'renders a working update button' do
+        render partial, current_user: owner
+
+        is_expected.to have_update_button
+      end
+    end
+
+    context 'user is developer' do
+      it 'renders a disabled update button' do
+        render partial, current_user: developer
+
+        is_expected.to have_text('Update Now')
+        is_expected.not_to have_update_button
+      end
+    end
+
+    context 'user is anonymous' do
+      it 'renders nothing' do
+        render partial, current_user: nil
+
+        is_expected.to eq('')
+      end
+    end
+  end
+
+  context 'mirror update due' do
+    it 'renders a disabled update button' do
+      expect(import_state).to receive(:mirror_update_due?) { true }
+      allow(import_state).to receive(:last_successful_update_at) { Time.now }
+
+      render partial, current_user: owner
+
+      is_expected.to have_text('Scheduled…')
+      is_expected.not_to have_update_button
+    end
+  end
+
+  context 'mirror is currently updating' do
+    it 'renders a disabled update button' do
+      expect(import_state).to receive(:updating_mirror?) { true }
+
+      render partial, current_user: owner
+
+      is_expected.to have_text('Updating…')
+      is_expected.not_to have_update_button
+    end
+  end
+
+  context 'project is not a mirror' do
+    let(:project) { create(:project) }
+
+    it 'renders nothing' do
+      is_expected.to eq('')
+    end
+  end
+
+  it 'renders a notification if the last update succeeded' do
+    expect(project).to receive(:mirror_last_update_succeeded?) { true }
+    expect(import_state).to receive(:last_successful_update_at) { Time.now }
+
+    render partial, current_user: developer
+
+    is_expected.to have_text('Successfully updated')
+  end
+
+  it 'renders no notification if the last update did not succeed' do
+    expect(project).to receive(:mirror_last_update_succeeded?) { false }
+
+    render partial, current_user: developer
+
+    is_expected.not_to have_text('Successfully updated')
+  end
+
+  it "renders nothing if the user can't push code" do
+    render partial, current_user: reporter
+
+    is_expected.to eq('')
+  end
+end