Raise support bot permission to reporter

When service desk is enabled suport bot receives
reporter permissions.
This allows quick actions present on service desk issue
templates to be applied.

changelogs/unreleased/issue_2030_2.yml

+---
+title: Process quick actions when using Service Desk templates
+merge_request: 21948
+author:
+type: fixed

ee/app/policies/ee/global_policy.rb

@@ -27,8 +27,6 @@ module EE
 
       rule { admin & pages_size_limit_available }.enable :update_max_pages_size
 
-      rule { support_bot }.prevent :use_quick_actions
-
       rule { ~anonymous }.policy do
         enable :view_productivity_analytics
         enable :view_code_analytics

ee/app/policies/ee/project_policy.rb

@@ -308,7 +308,7 @@ module EE
     def lookup_access_level!
       return ::Gitlab::Access::NO_ACCESS if needs_new_sso_session?
       return ::Gitlab::Access::REPORTER if alert_bot?
-      return ::Gitlab::Access::GUEST if support_bot? && service_desk_enabled?
+      return ::Gitlab::Access::REPORTER if support_bot? && service_desk_enabled?
       return ::Gitlab::Access::NO_ACCESS if visual_review_bot?
 
       super

ee/lib/ee/gitlab/email/handler/reply_processing.rb

+# frozen_string_literal: true
+
+module EE
+  module Gitlab
+    module Email
+      module Handler
+        module ReplyProcessing
+          extend ::Gitlab::Utils::Override
+
+          private
+
+          # Support bot is specifically forbidden
+          # from using slash commands.
+          def strip_quick_actions(content)
+            return content unless author.support_bot?
+
+            command_definitions = ::QuickActions::InterpretService.command_definitions
+            extractor = ::Gitlab::QuickActions::Extractor.new(command_definitions)
+
+            extractor.extract_commands(content)[0]
+          end
+
+          override :process_message
+          def process_message(**kwargs)
+            strip_quick_actions(super(kwargs))
+          end
+        end
+      end
+    end
+  end
+end

ee/lib/gitlab/email/handler/ee/service_desk_handler.rb

@@ -56,9 +56,6 @@ module Gitlab
           end
 
           def create_issue!
-            # NB: the support bot is specifically forbidden
-            # from mentioning any entities, or from using
-            # slash commands.
             @issue = Issues::CreateService.new(
               project,
               User.support_bot,
@@ -129,6 +126,10 @@ module Gitlab
           def can_handle_legacy_format?
             project_path && project_path.include?('/') && !mail_key.include?('+')
           end
+
+          def author
+            User.support_bot
+          end
         end
       end
     end

ee/spec/fixtures/emails/service_desk.eml

@@ -22,3 +22,7 @@ Service desk stuff!
 ```
 a = b
 ```
+
+/label ~label1
+/assign @user1
+/close

ee/spec/fixtures/emails/valid_reply_with_quick_actions.eml

+Return-Path: <jake@adventuretime.ooo>
+Received: from iceking.adventuretime.ooo ([unix socket]) by iceking (Cyrus v2.2.13-Debian-2.2.13-19+squeeze3) with LMTPA; Thu, 13 Jun 2013 17:03:50 -0400
+Received: from mail-ie0-x234.google.com (mail-ie0-x234.google.com [IPv6:2607:f8b0:4001:c03::234]) by iceking.adventuretime.ooo (8.14.3/8.14.3/Debian-9.4) with ESMTP id r5DL3nFJ016967 (version=TLSv1/SSLv3 cipher=RC4-SHA bits=128 verify=NOT) for <reply+59d8df8370b7e95c5a49fbf86aeb2c93@appmail.adventuretime.ooo>; Thu, 13 Jun 2013 17:03:50 -0400
+Received: by mail-ie0-f180.google.com with SMTP id f4so21977375iea.25 for <reply+59d8df8370b7e95c5a49fbf86aeb2c93@appmail.adventuretime.ooo>; Thu, 13 Jun 2013 14:03:48 -0700
+Received: by 10.0.0.1 with HTTP; Thu, 13 Jun 2013 14:03:48 -0700
+Date: Thu, 13 Jun 2013 17:03:48 -0400
+From: Jake the Dog <jake@adventuretime.ooo>
+To: reply+59d8df8370b7e95c5a49fbf86aeb2c93@appmail.adventuretime.ooo
+Message-ID: <CADkmRc+rNGAGGbV2iE5p918UVy4UyJqVcXRO2=otppgzduJSg@mail.gmail.com>
+In-Reply-To: <issue_1@localhost>
+References: <reply-59d8df8370b7e95c5a49fbf86aeb2c93@localhost> <issue_1@localhost>
+Subject: re: [Discourse Meta] eviltrout posted in 'Adventure Time Sux'
+Mime-Version: 1.0
+Content-Type: text/plain;
+ charset=ISO-8859-1
+Content-Transfer-Encoding: 7bit
+X-Sieve: CMU Sieve 2.2
+X-Received: by 10.0.0.1 with SMTP id n7mr11234144ipb.85.1371157428600; Thu,
+ 13 Jun 2013 14:03:48 -0700 (PDT)
+X-Scanned-By: MIMEDefang 2.69 on IPv6:2001:470:1d:165::1
+
+I could not disagree more. I am obviously biased but adventure time is the
+greatest show ever created. Everyone should watch it.
+
+- Jake out
+
+/close
+/title test
+
+
+On Sun, Jun 9, 2013 at 1:39 PM, eviltrout via Discourse Meta
+<reply+59d8df8370b7e95c5a49fbf86aeb2c93@appmail.adventuretime.ooo> wrote:
+>
+>
+>
+> eviltrout posted in 'Adventure Time Sux' on Discourse Meta:
+>
+> ---
+> hey guys everyone knows adventure time sucks!
+>
+> ---
+> Please visit this link to respond: http://localhost:3000/t/adventure-time-sux/1234/3
+>
+> To unsubscribe from these emails, visit your [user preferences](http://localhost:3000/user_preferences).
+>

ee/spec/lib/gitlab/email/handler/create_note_handler_spec.rb

@@ -119,8 +119,9 @@ describe Gitlab::Email::Handler::CreateNoteHandler do
   context 'when the service desk' do
     let(:project) { create(:project, :public, service_desk_enabled: true) }
     let(:support_bot) { User.support_bot }
-    let(:noteable) { create(:issue, project: project, author: support_bot) }
+    let(:noteable) { create(:issue, project: project, author: support_bot, title: 'service desk issue') }
     let(:note) { create(:note, project: project, noteable: noteable) }
+    let(:email_raw) { fixture_file('emails/valid_reply_with_quick_actions.eml', dir: 'ee') }
 
     let!(:sent_notification) do
       SentNotification.record_note(note, support_bot.id, mail_key)
@@ -139,6 +140,18 @@ describe Gitlab::Email::Handler::CreateNoteHandler do
         it 'creates a comment' do
           expect { receiver.execute }.to change { noteable.notes.count }.by(1)
         end
+
+        context 'when quick actions are present' do
+          it 'strips quick actions from email' do
+            receiver.execute
+            noteable.reload
+
+            expect(note.note).not_to include('/close')
+            expect(note.note).not_to include('/title')
+            expect(noteable.title).to eq('service desk issue')
+            expect(noteable).to be_opened
+          end
+        end
       end
 
       context 'when issues are protected members only' do

ee/spec/lib/gitlab/email/handler/ee/service_desk_handler_spec.rb

@@ -61,10 +61,14 @@ describe Gitlab::Email::Handler::EE::ServiceDeskHandler do
         end
 
         context 'and template is present' do
+          def set_template_file(file_name, content)
+            file_path = ".gitlab/issue_templates/#{file_name}.md"
+            project.repository.create_file(user, file_path, content, message: 'message', branch_name: 'master')
+            ServiceDeskSetting.update_template_key_for(project: project, issue_template_key: file_name)
+          end
+
           it 'appends template text to issue description' do
-            template_path = '.gitlab/issue_templates/service_desk.md'
-            project.repository.create_file(user, template_path, 'text from template', message: 'message', branch_name: 'master')
-            ServiceDeskSetting.update_template_key_for(project: project, issue_template_key: 'service_desk')
+            set_template_file('service_desk', 'text from template')
 
             receiver.execute
 
@@ -72,6 +76,42 @@ describe Gitlab::Email::Handler::EE::ServiceDeskHandler do
             expect(issue_description).to include(expected_description)
             expect(issue_description.lines.last).to eq('text from template')
           end
+
+          context 'when quick actions are present' do
+            let(:label) { create(:label, project: project, title: 'label1') }
+            let(:milestone) { create(:milestone, project: project) }
+            let!(:user) { create(:user, username: 'user1') }
+
+            before do
+              project.add_developer(user)
+            end
+
+            it 'applies quick action commands present on templates' do
+              file_content = %(Text from template \n/label ~#{label.title} \n/milestone %"#{milestone.name}"")
+              set_template_file('with_slash_commands', file_content)
+
+              receiver.execute
+
+              issue = Issue.last
+              expect(issue.description).to include('Text from template')
+              expect(issue.label_ids).to include(label.id)
+              expect(issue.milestone).to eq(milestone)
+            end
+
+            it 'does not apply quick actions present on user email body' do
+              set_template_file('service_desk1', 'text from template')
+
+              receiver.execute
+
+              issue = Issue.last
+              expect(issue).to be_opened
+              expect(issue.description).not_to include('/label ~label1')
+              expect(issue.description).not_to include('/assign @user1')
+              expect(issue.description).not_to include('/close')
+              expect(issue.assignees).to be_empty
+              expect(issue.milestone).to be_nil
+            end
+          end
         end
 
         context 'and template cannot be found' do

ee/spec/policies/project_policy_spec.rb

@@ -1048,14 +1048,14 @@ describe ProjectPolicy do
         allow(::EE::Gitlab::ServiceDesk).to receive(:enabled?).with(project: project).and_return(true)
       end
 
-      it { expect_allowed(:guest_access, :create_note, :read_issue) }
+      it { expect_allowed(:reporter_access, :create_note, :read_issue) }
 
       context 'when issues are protected members only' do
         before do
           project.project_feature.update!(issues_access_level: ProjectFeature::PRIVATE)
         end
 
-        it { expect_allowed(:guest_access, :create_note, :read_issue) }
+        it { expect_allowed(:reporter_access, :create_note, :read_issue) }
       end
     end
   end

lib/gitlab/email/handler/reply_processing.rb

@@ -79,3 +79,5 @@ module Gitlab
     end
   end
 end
+
+Gitlab::Email::Handler::ReplyProcessing.prepend_if_ee('::EE::Gitlab::Email::Handler::ReplyProcessing')