Merge branch '36257-hide-edit-for-nonallowed' into 'master'

Removed release edit url for user not allowed to update

Closes #36257

See merge request gitlab-org/gitlab!20136

app/presenters/release_presenter.rb

@@ -58,6 +58,7 @@ class ReleasePresenter < Gitlab::View::Presenter::Delegated
   end
 
   def release_edit_page_available?
-    ::Feature.enabled?(:release_edit_page, project, default_enabled: true)
+    ::Feature.enabled?(:release_edit_page, project, default_enabled: true) &&
+      can?(current_user, :update_release, release)
   end
 end

changelogs/unreleased/36257-hide-edit-for-nonallowed.yml

+---
+title: Remove Release edit url for users not allowed to update a release
+merge_request: 20136
+author:
+type: fixed

spec/fixtures/api/schemas/public_api/v4/release.json

@@ -38,7 +38,7 @@
       "additionalProperties": false
     },
     "_links": {
-      "required": ["merge_requests_url", "issues_url", "edit_url"],
+      "required": ["merge_requests_url", "issues_url"],
       "properties": {
         "merge_requests_url": { "type": "string" },
         "issues_url": { "type": "string" },

spec/fixtures/api/schemas/public_api/v4/release/release_for_guest.json

@@ -26,11 +26,10 @@
       "additionalProperties": false
     },
     "_links": {
-      "required": ["merge_requests_url", "issues_url", "edit_url"],
+      "required": ["merge_requests_url", "issues_url"],
       "properties": {
         "merge_requests_url": { "type": "string" },
-        "issues_url": { "type": "string" },
-        "edit_url": { "type": "string"}
+        "issues_url": { "type": "string" }
       }
     }
   },

spec/presenters/release_presenter_spec.rb

@@ -97,5 +97,11 @@ describe ReleasePresenter do
 
       it { is_expected.to be_nil }
     end
+
+    context 'when a user is not allowed to update a release' do
+      let(:presenter) { described_class.new(release, current_user: guest) }
+
+      it { is_expected.to be_nil }
+    end
   end
 end