Merge branch 'service-desk-permissions' into 'master'

Only show 'Turn on Service Desk' when permissions are present.

Closes #3509

See merge request gitlab-org/gitlab-ee!3020

changelogs/unreleased-ee/service-desk-permissions.yml

+---
+title: Only show Turn on Service Desk button when user has permissions.
+merge_request:
+author:
+type: fixed

ee/app/views/projects/issues/_service_desk_info_content.html.haml

@@ -3,6 +3,7 @@
 
 - callout_selector = is_empty_state ? 'empty-state' : 'non-empty-state media'
 - svg_path = !is_empty_state ? 'shared/empty_states/icons/service_desk_callout.svg' : 'shared/empty_states/icons/service_desk_empty_state.svg'
+- can_edit_project_settings = can?(current_user, :admin_project, @project)
 
 %div{ class: "#{callout_selector}" }
   .service-desk-graphic
@@ -19,6 +20,6 @@
     %span Those emails automatically become issues (with the comments becoming the email conversation) listed here.
     = link_to 'Read more', help_page_path('user/project/service_desk')
 
-    - if !service_desk_enabled
+    - if can_edit_project_settings && !service_desk_enabled
       .turn-on-btn-container
         = link_to "Turn on Service Desk", edit_project_path(@project), class: 'btn btn-new btn-inverted'

spec/ee/spec/features/issues/service_desk_spec.rb

@@ -31,29 +31,39 @@ describe 'Service Desk Issue Tracker', js: true do
       let(:project_without_service_desk) { create(:project, :private, service_desk_enabled: false) }
 
       describe 'service desk info content' do
-        before do
-          project_without_service_desk.add_master(user)
-          visit service_desk_project_issues_path(project_without_service_desk)
-        end
+        context 'when user has permissions to edit project settings' do
+          before do
+            project_without_service_desk.add_master(user)
+            visit service_desk_project_issues_path(project_without_service_desk)
+          end
 
-        it 'displays the large info box' do
-          expect(page).to have_css('.empty-state')
-        end
+          it 'displays the large info box' do
+            expect(page).to have_css('.empty-state')
+          end
+
+          it 'has a link to the documentation' do
+            expect(page).to have_link('Read more', href: help_page_path('user/project/service_desk'))
+          end
 
-        it 'has a link to the documentation' do
-          expect(page).to have_link('Read more', href: help_page_path('user/project/service_desk'))
+          it 'does show a button configure service desk' do
+            expect(page).to have_link('Turn on Service Desk')
+          end
         end
 
-        it 'does show a button configure service desk' do
-          expect(page).to have_link('Turn on Service Desk')
+        context 'when user does not have permission to edit project settings' do
+          before do
+            project_without_service_desk.add_guest(user)
+            visit service_desk_project_issues_path(project_without_service_desk)
+          end
+
+          it 'does not show a button configure service desk' do
+            expect(page).not_to have_link('Turn on Service Desk')
+          end
         end
       end
     end
 
     context 'when service desk has been activated' do
-      before do
-      end
-
       context 'when there are no issues' do
         describe 'service desk info content' do
           before do