Merge branch 'nfriend-fix-guest-user-releases' into 'master'

Fix the Releases page for Guest Users

Closes #34862

See merge request gitlab-org/gitlab!28447

app/assets/javascripts/releases/components/app_index.vue

@@ -103,7 +103,7 @@ export default {
     <div v-else-if="shouldRenderSuccessState" class="js-success-state">
       <release-block
         v-for="(release, index) in releases"
-        :key="release.tagName"
+        :key="index"
         :release="release"
         :class="{ 'linked-card': releases.length > 1 && index !== releases.length - 1 }"
       />

app/assets/javascripts/releases/components/release_block.vue

@@ -37,7 +37,11 @@ export default {
     };
   },
   computed: {
-    id() {
+    htmlId() {
+      if (!this.release.tagName) {
+        return null;
+      }
+
       return slugify(this.release.tagName);
     },
     assets() {
@@ -72,7 +76,7 @@ export default {
     this.renderGFM();
 
     const hash = getLocationHash();
-    if (hash && slugify(hash) === this.id) {
+    if (hash && slugify(hash) === this.htmlId) {
       this.isHighlighted = true;
       setTimeout(() => {
         this.isHighlighted = false;
@@ -89,7 +93,7 @@ export default {
 };
 </script>
 <template>
-  <div :id="id" :class="{ 'bg-line-target-blue': isHighlighted }" class="card release-block">
+  <div :id="htmlId" :class="{ 'bg-line-target-blue': isHighlighted }" class="card release-block">
     <release-block-header :release="release" />
     <div class="card-body">
       <div v-if="shouldRenderMilestoneInfo">

changelogs/unreleased/nfriend-fix-guest-user-releases.yml

+---
+title: Fix Releases page for Guest users of private projects
+merge_request: 28447
+author:
+type: fixed

spec/features/projects/releases/user_views_releases_spec.rb

@@ -3,14 +3,19 @@
 require 'spec_helper'
 
 describe 'User views releases', :js do
-  let!(:project) { create(:project, :repository) }
-  let!(:release) { create(:release, project: project ) }
-  let!(:user) { create(:user) }
+  let_it_be(:project) { create(:project, :repository, :private) }
+  let_it_be(:release) { create(:release, project: project, name: 'The first release' ) }
+  let_it_be(:maintainer) { create(:user) }
+  let_it_be(:guest) { create(:user) }
 
   before do
-    project.add_maintainer(user)
+    project.add_maintainer(maintainer)
+    project.add_guest(guest)
+  end
 
-    gitlab_sign_in(user)
+  context('when the user is a maintainer') do
+    before do
+      gitlab_sign_in(maintainer)
     end
 
     it 'sees the release' do
@@ -82,4 +87,25 @@ describe 'User views releases', :js do
         expect(page).to have_content(release.tag)
       end
     end
+  end
+
+  context('when the user is a guest') do
+    before do
+      gitlab_sign_in(guest)
+    end
+
+    it 'renders release info except for Git-related data' do
+      visit project_releases_path(project)
+
+      within('.release-block') do
+        expect(page).to have_content(release.description)
+
+        # The following properties (sometimes) include Git info,
+        # so they are not rendered for Guest users
+        expect(page).not_to have_content(release.name)
+        expect(page).not_to have_content(release.tag)
+        expect(page).not_to have_content(release.commit.short_id)
+      end
+    end
+  end
 end

spec/frontend/releases/components/release_block_spec.js

@@ -165,6 +165,14 @@ describe('Release block', () => {
     });
   });
 
+  it('does not set the ID if tagName is missing', () => {
+    release.tagName = undefined;
+
+    return factory(release).then(() => {
+      expect(wrapper.attributes().id).toBeUndefined();
+    });
+  });
+
   describe('evidence block', () => {
     it('renders the evidence block when the evidence is available and the feature flag is true', () =>
       factory(release, { releaseEvidenceCollection: true }).then(() =>