fix(subgroups): add verification of group creation capability to subgroup UI

app/models/user.rb

@@ -570,6 +570,10 @@ class User < ActiveRecord::Base
     can?(:create_group)
   end
 
+  def can_create_subgroup?(group)
+    can?(:create_group) && can?(:admin_group, group)
+  end
+
   def can_select_namespace?
     several_namespaces? || admin
   end

app/views/groups/subgroups.html.haml

@@ -9,7 +9,7 @@
     .nav-controls
       = form_tag request.path, method: :get do |f|
         = search_field_tag :filter_groups, params[:filter_groups], placeholder: 'Filter by name', class: 'form-control', spellcheck: false
-      - if can? current_user, :admin_group, @group
+      - if current_user.can_create_subgroup? @group
         = link_to new_group_path(parent_id: @group.id), class: 'btn btn-new pull-right' do
           New Subgroup
 

spec/models/user_spec.rb

@@ -464,6 +464,28 @@ describe User, models: true do
     it { expect(@user2.several_namespaces?).to be_truthy }
   end
 
+  describe 'subgroups' do
+    let(:group) { create :group }
+
+    it 'allows if owner' do
+      user = create :user
+      group.add_user(user, GroupMember::OWNER)
+      expect(user.can_create_subgroup?(group)).to be_truthy
+    end
+
+    it 'disallows if missing right' do
+      user = create(:user, can_create_group: false)
+      group.add_user(user, GroupMember::MASTER)
+      expect(user.can_create_subgroup?(group)).to be_falsey
+    end
+
+    it 'disallows if developer' do
+      user = create :user
+      group.add_user(user, GroupMember::DEVELOPER)
+      expect(user.can_create_subgroup?(group)).to be_falsey
+    end
+  end
+
   describe 'namespaced' do
     before do
       @user = create :user