Merge branch 'change-dashboard-policy' into 'master'

Update Global Policy to Reject Anonymous Users For read_operations_dashboard

See merge request gitlab-org/gitlab!18687

ee/app/policies/ee/global_policy.rb

@@ -13,7 +13,7 @@ module EE
         License.feature_available?(:security_dashboard)
       end
 
-      rule { operations_dashboard_available }.enable :read_operations_dashboard
+      rule { ~anonymous & operations_dashboard_available }.enable :read_operations_dashboard
       rule { ~anonymous & security_dashboard_available }.enable :read_security_dashboard
 
       rule { admin }.policy do

ee/spec/policies/global_policy_spec.rb

@@ -11,11 +11,19 @@ describe GlobalPolicy do
   subject { described_class.new(current_user, [user]) }
 
   describe 'reading operations dashboard' do
-    before do
-      stub_licensed_features(operations_dashboard: true)
-    end
+    context 'when licensed' do
+      before do
+        stub_licensed_features(operations_dashboard: true)
+      end
 
-    it { is_expected.to be_allowed(:read_operations_dashboard) }
+      it { is_expected.to be_allowed(:read_operations_dashboard) }
+
+      context 'and the user is not logged in' do
+        let(:current_user) { nil }
+
+        it { is_expected.not_to be_allowed(:read_operations_dashboard) }
+      end
+    end
 
     context 'when unlicensed' do
       before do