Check access when rendering empty snippets state

When there are snippets to show, the New Snippet button uses
new_project_snippet_path for the button. However, the empty snippets
state partial was using new_namespace_project_snippet_path.

There are no other usages of new_namespace_project_snippet_path in the
codebase so making them both use the same new_project_snippet path.

app/views/projects/snippets/index.html.haml

 - page_title _("Snippets")
+- new_project_snippet_link = new_project_snippet_path(@project) if can?(current_user, :create_snippet, @project)
 
 - if @snippets.exists?
   - if current_user
@@ -6,10 +7,10 @@
       - include_private = @project.team.member?(current_user) || current_user.admin?
       = render partial: 'snippets/snippets_scope_menu', locals: { subject: @project, include_private: include_private }
 
-      - if can?(current_user, :create_snippet, @project)
+      - if new_project_snippet_link.present?
         .nav-controls
-          = link_to _("New snippet"), new_project_snippet_path(@project), class: "btn btn-success", title: _("New snippet")
+          = link_to _("New snippet"), new_project_snippet_link, class: "btn btn-success", title: _("New snippet")
 
   = render 'shared/snippets/list'
 - else
-  = render 'shared/empty_states/snippets', button_path: new_namespace_project_snippet_path(@project.namespace, @project)
+  = render 'shared/empty_states/snippets', button_path: new_project_snippet_link

app/views/shared/empty_states/_profile_tabs.html.haml

@@ -14,6 +14,7 @@
         - if secondary_button_link.present?
           = link_to secondary_button_label, secondary_button_link, class: 'btn btn-success btn-inverted'
 
-        = link_to primary_button_label, primary_button_link, class: 'btn btn-success'
+        - if primary_button_link.present?
+          = link_to primary_button_label, primary_button_link, class: 'btn btn-success'
       - else
         %h5= visitor_empty_message

changelogs/unreleased/al-55240-access-policy-check-for-new-snippet-button.yml

+---
+title: Ensure New Snippet button is displayed based on the :create_snippet permission
+  in Project Snippets page and User profile > Snippets tab
+merge_request: 55240
+author:
+type: fixed

spec/features/projects/snippets/user_views_snippets_spec.rb

@@ -3,32 +3,97 @@
 require 'spec_helper'
 
 describe 'Projects > Snippets > User views snippets' do
-  let(:project) { create(:project) }
-  let!(:project_snippet) { create(:project_snippet, project: project, author: user) }
-  let!(:snippet) { create(:snippet, author: user) }
-  let(:snippets) { [project_snippet, snippet] } # Used by the shared examples
+  let_it_be(:project) { create(:project) }
   let(:user) { create(:user) }
 
-  before do
-    project.add_maintainer(user)
-    sign_in(user)
-
+  def visit_project_snippets
     visit(project_snippets_path(project))
   end
 
-  context 'pagination' do
+  context 'snippets list' do
+    let!(:project_snippet) { create(:project_snippet, project: project, author: user) }
+    let!(:snippet) { create(:snippet, author: user) }
+    let(:snippets) { [project_snippet, snippet] } # Used by the shared examples
+
     before do
-      create(:project_snippet, project: project, author: user)
-      allow(Snippet).to receive(:default_per_page).and_return(1)
+      project.add_maintainer(user)
+      sign_in(user)
+    end
+
+    context 'pagination' do
+      before do
+        create(:project_snippet, project: project, author: user)
+        allow(Snippet).to receive(:default_per_page).and_return(1)
 
-      visit project_snippets_path(project)
+        visit_project_snippets
+      end
+
+      it_behaves_like 'paginated snippets'
     end
 
-    it_behaves_like 'paginated snippets'
+    it 'shows snippets' do
+      visit_project_snippets
+
+      expect(page).to have_link(project_snippet.title, href: project_snippet_path(project, project_snippet))
+      expect(page).not_to have_content(snippet.title)
+    end
   end
 
-  it 'shows snippets' do
-    expect(page).to have_link(project_snippet.title, href: project_snippet_path(project, project_snippet))
-    expect(page).not_to have_content(snippet.title)
+  context 'when current user is a guest' do
+    before do
+      project.add_guest(user)
+      sign_in(user)
+    end
+
+    context 'when snippets list is empty' do
+      it 'hides New Snippet button' do
+        visit_project_snippets
+
+        page.within(find('.empty-state')) do
+          expect(page).not_to have_link('New snippet')
+        end
+      end
+    end
+
+    context 'when project has snippets' do
+      let!(:project_snippet) { create(:project_snippet, project: project, author: user) }
+
+      it 'hides New Snippet button' do
+        visit_project_snippets
+
+        page.within(find('.top-area')) do
+          expect(page).not_to have_link('New snippet')
+        end
+      end
+    end
+  end
+
+  context 'when current user is not a guest' do
+    before do
+      project.add_developer(user)
+      sign_in(user)
+    end
+
+    context 'when snippets list is empty' do
+      it 'shows New Snippet button' do
+        visit_project_snippets
+
+        page.within(find('.empty-state')) do
+          expect(page).to have_link('New snippet')
+        end
+      end
+    end
+
+    context 'when project has snippets' do
+      let!(:project_snippet) { create(:project_snippet, project: project, author: user) }
+
+      it 'shows New Snippet button' do
+        visit_project_snippets
+
+        page.within(find('.top-area')) do
+          expect(page).to have_link('New snippet')
+        end
+      end
+    end
   end
 end