Merge branch...

Merge branch '36104-environment-pod-logs-in-menu-lands-in-404-if-the-user-has-no-permissions-to-see-logs' into 'master'

Enable pod logs nav menu only for maintainers in projects with k8s environments

Closes #36104

See merge request gitlab-org/gitlab!19927

ee/app/views/layouts/nav/sidebar/_pod_logs_link.html.haml

+- return unless can?(current_user, :read_pod_logs, @project)
 - return unless project_nav_tab?(:environments)
 
 = nav_link(controller: :environments, action: [:logs, :logs_redirect]) do

ee/changelogs/unreleased/36104-environment-pod-logs-in-menu-lands-in-404-if-the-user-has-no-per.yml

+---
+title: Enable pod logs nav menu only for maintainers in projects with k8s environments
+merge_request: 19927
+author:
+type: fixed

ee/spec/views/layouts/nav/sidebar/_project.html.haml_spec.rb

@@ -94,6 +94,41 @@ describe 'layouts/nav/sidebar/_project' do
     end
   end
 
+  describe 'Operations > Pod logs' do
+    before do
+      allow(view).to receive(:can?).with(nil, :read_environment, project).and_return(can_read_environment)
+      allow(view).to receive(:can?).with(nil, :read_pod_logs, project).and_return(can_read_pod_logs)
+      render
+    end
+
+    describe 'when the user can read environments and logs' do
+      let(:can_read_environment) { true }
+      let(:can_read_pod_logs) { true }
+
+      it 'link is visible ' do
+        expect(rendered).to have_link('Pod logs', href: logs_project_environments_path(project))
+      end
+    end
+
+    describe 'when the user cannot read environment or logs' do
+      let(:can_read_environment) { false }
+      let(:can_read_pod_logs) { false }
+
+      it 'link is not visible ' do
+        expect(rendered).not_to have_link 'Pod logs'
+      end
+    end
+
+    describe 'when the user can read environment but not logs' do
+      let(:can_read_environment) { true }
+      let(:can_read_pod_logs) { false }
+
+      it 'link is not visible ' do
+        expect(rendered).not_to have_link 'Pod logs'
+      end
+    end
+  end
+
   describe 'Security and Compliance' do
     before do
       allow(view).to receive(:can?).with(nil, :read_dependencies, project).and_return(can_read_dependencies)