Merge branch 'jej/branch-unprotection-disable-ui' into 'master'

Branch unprotection restrictions disable UI

See merge request gitlab-org/gitlab-ee!5296

app/helpers/dropdowns_helper.rb

@@ -45,7 +45,7 @@ module DropdownsHelper
 
   def dropdown_toggle(toggle_text, data_attr, options = {})
     default_label = data_attr[:default_label]
-    content_tag(:button, class: "dropdown-menu-toggle #{options[:toggle_class] if options.key?(:toggle_class)}", id: (options[:id] if options.key?(:id)), type: "button", data: data_attr) do
+    content_tag(:button, disabled: options[:disabled], class: "dropdown-menu-toggle #{options[:toggle_class] if options.key?(:toggle_class)}", id: (options[:id] if options.key?(:id)), type: "button", data: data_attr) do
       output = content_tag(:span, toggle_text, class: "dropdown-toggle-text #{'is-default' if toggle_text == default_label}")
       output << icon('chevron-down')
       output.html_safe

app/views/projects/protected_branches/_branches_list.html.haml

 - can_admin_project = can?(current_user, :admin_project, @project)
 
 = render layout: 'projects/protected_branches/shared/branches_list', locals: { can_admin_project: can_admin_project } do
-  = render partial: 'projects/protected_branches/protected_branch', collection: @protected_branches, locals: { can_admin_project: can_admin_project}
+  = render partial: 'projects/protected_branches/protected_branch', collection: @protected_branches

app/views/projects/protected_branches/shared/_protected_branch.html.haml

@@ -21,4 +21,4 @@
 
   - if can_admin_project
     %td
-      = link_to 'Unprotect', [@project.namespace.becomes(Namespace), @project, protected_branch], data: { confirm: 'Branch will be writable for developers. Are you sure?' }, method: :delete, class: 'btn btn-warning'
+      = link_to 'Unprotect', [@project.namespace.becomes(Namespace), @project, protected_branch], disabled: local_assigns[:disabled], data: { confirm: 'Branch will be writable for developers. Are you sure?' }, method: :delete, class: "btn btn-warning"

ee/app/views/projects/protected_branches/ee/_branches_list.html.haml

 - can_admin_project = can?(current_user, :admin_project, @project)
 
 = render layout: 'projects/protected_branches/shared/branches_list', locals: { can_admin_project: can_admin_project } do
-  = render partial: 'projects/protected_branches/ee/protected_branch', collection: @protected_branches, locals: { can_admin_project: can_admin_project}
+  = render partial: 'projects/protected_branches/ee/protected_branch', collection: @protected_branches

ee/app/views/projects/protected_branches/ee/_protected_branch.html.haml

-= render layout: 'projects/protected_branches/shared/protected_branch', locals: { protected_branch: protected_branch } do
+- can_unprotect = can?(current_user, :destroy_protected_branch, protected_branch)
+
+= render layout: 'projects/protected_branches/shared/protected_branch', locals: { protected_branch: protected_branch, disabled: !can_unprotect } do
   = render partial: 'projects/protected_branches/ee/protected_branch_access_summary', locals: { protected_branch: protected_branch }

ee/app/views/projects/protected_branches/ee/_protected_branch_access_summary.html.haml

+- can_unprotect = can?(current_user, :update_protected_branch, protected_branch)
+
 %td
-  = render partial: 'projects/settings/ee/access_level_dropdown', locals: { protected_branch: protected_branch, access_levels: protected_branch.merge_access_levels, level_frequencies: access_level_frequencies(protected_branch.merge_access_levels), input_basic_name: 'merge_access_levels', toggle_class: 'js-allowed-to-merge qa-allowed-to-merge' }
+  = render partial: 'projects/settings/ee/access_level_dropdown', locals: { protected_branch: protected_branch, access_levels: protected_branch.merge_access_levels, level_frequencies: access_level_frequencies(protected_branch.merge_access_levels), input_basic_name: 'merge_access_levels', disabled: !can_unprotect, toggle_class: 'js-allowed-to-merge qa-allowed-to-merge' }
 
 %td
-  = render partial: 'projects/settings/ee/access_level_dropdown', locals: { protected_branch: protected_branch, access_levels: protected_branch.push_access_levels, level_frequencies: access_level_frequencies(protected_branch.push_access_levels), input_basic_name: 'push_access_levels', toggle_class: 'js-allowed-to-push qa-allowed-to-push' }
+  = render partial: 'projects/settings/ee/access_level_dropdown', locals: { protected_branch: protected_branch, access_levels: protected_branch.push_access_levels, level_frequencies: access_level_frequencies(protected_branch.push_access_levels), input_basic_name: 'push_access_levels', disabled: !can_unprotect, toggle_class: 'js-allowed-to-push qa-allowed-to-push' }

ee/app/views/projects/settings/ee/_access_level_dropdown.html.haml

 - default_label = s_('RepositorySettingsAccessLevel|Select')
 
 %div{ class: "#{input_basic_name}-container" }
-  = dropdown_tag(default_label, options: { toggle_class: "#{toggle_class} js-multiselect", dropdown_class: 'dropdown-menu-user dropdown-menu-selectable', filter: true, data: { default_label: default_label, preselected_items: access_levels_data(access_levels) } })
+  = dropdown_tag(default_label, options: { toggle_class: "#{toggle_class} js-multiselect", disabled: local_assigns[:disabled], dropdown_class: 'dropdown-menu-user dropdown-menu-selectable', filter: true, data: { default_label: default_label, preselected_items: access_levels_data(access_levels) } })

ee/changelogs/unreleased/jej-branch-unprotection-disable-ui.yml

+---
+title: Unprotect and update disabled in UI when prevented by branch unprotect rules
+merge_request: 5296
+author:
+type: changed

ee/spec/support/shared_examples/features/protected_branches_access_control.rb

@@ -166,4 +166,43 @@ shared_examples "protected branches > access control > EE" do
       expect(access_levels.map(&:access_level)).to include(0)
     end
   end
+
+  describe 'protected branch restrictions' do
+    let!(:protected_branch) { create(:protected_branch, project: project) }
+
+    before do
+      stub_licensed_features(unprotection_restrictions: true)
+    end
+
+    it 'unprotect/delete can be performed by a master' do
+      visit project_protected_branches_path(project)
+
+      expect do
+        accept_alert { click_on 'Unprotect' }
+      end.to change(ProtectedBranch, :count).to(0)
+    end
+
+    context 'with unprotect access levels' do
+      before do
+        protected_branch.unprotect_access_levels.create!(access_level: Gitlab::Access::NO_ACCESS)
+      end
+
+      it 'can prevent unprotect/delete' do
+        visit project_protected_branches_path(project)
+
+        expect(page).to have_link('Unprotect')
+        expect(find_link('Unprotect')[:disabled]).to eq 'true'
+      end
+
+      it 'can prevent update' do
+        visit project_protected_branches_path(project)
+
+        %w(push merge).each do |operation|
+          within ".js-protected-branch-edit-form .#{operation}_access_levels-container" do
+            expect(page).to have_css('button[disabled]')
+          end
+        end
+      end
+    end
+  end
 end