Update manual job message for protected jobs

Update the text that shows up on the manual jobs page
because for jobs that are linked to protected environments
the text could be misleading if the user doesn't have the
permissions to trigger the job.

Changelog: fixed
EE: true

ee/lib/ee/gitlab/ci/status/build/manual.rb

+# frozen_string_literal: true
+
+module EE
+  module Gitlab
+    module Ci
+      module Status
+        module Build
+          module Manual
+            extend ActiveSupport::Concern
+            extend ::Gitlab::Utils::Override
+
+            private
+
+            override :generic_permission_failure_message
+            def generic_permission_failure_message
+              if subject.persisted_environment.try(:protected_from?, user)
+                _("This deployment job does not run automatically and must be started manually, but you do not have access to this job's protected environment. The job can only be started by a project member allowed to deploy to the environment.")
+              else
+                super
+              end
+            end
+          end
+        end
+      end
+    end
+  end
+end

ee/spec/lib/ee/gitlab/ci/status/build/manual_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Ci::Status::Build::Manual do
+  let_it_be(:user) { create(:user) }
+  let_it_be_with_refind(:job) { create(:ci_build, :manual, :deploy_to_production, :with_deployment) }
+
+  describe '#illustration' do
+    subject(:illustration) do
+      described_class
+        .new(Gitlab::Ci::Status::Core.new(job, user))
+        .illustration
+    end
+
+    it { is_expected.to include(:image, :size, :title, :content) }
+
+    context 'with protected environments' do
+      let_it_be(:protected_environment) do
+        create(:protected_environment, name: job.environment, project: job.project)
+      end
+
+      let_it_be(:protected_environment_deploy_access_level) do
+        create(:protected_environment_deploy_access_level, :maintainer_access,
+          protected_environment: protected_environment)
+      end
+
+      before do
+        stub_licensed_features(protected_environments: true)
+      end
+
+      context 'when user does not have access' do
+        before do
+          job.project.add_developer(user)
+        end
+
+        it { expect(illustration[:content]).to match /This deployment job does not run automatically and must be started manually, but you do not have access to this job's protected environment/ }
+      end
+
+      context 'when user has access' do
+        before do
+          job.project.add_maintainer(user)
+        end
+
+        it { expect(illustration[:content]).to match /This job requires manual intervention to start/ }
+      end
+    end
+  end
+end

lib/gitlab/ci/status/build/manual.rb

@@ -5,20 +5,36 @@ module Gitlab
     module Status
       module Build
         class Manual < Status::Extended
+          def self.matches?(build, user)
+            build.playable?
+          end
+
           def illustration
             {
               image: 'illustrations/manual_action.svg',
               size: 'svg-394',
               title: _('This job requires a manual action'),
-              content: _('This job requires manual intervention to start. Before starting this job, you can add variables below for last-minute configuration changes.')
+              content: illustration_content
             }
           end
 
-          def self.matches?(build, user)
-            build.playable?
+          private
+
+          def illustration_content
+            if can?(user, :update_build, subject)
+              _('This job requires manual intervention to start. Before starting this job, you can add variables below for last-minute configuration changes.')
+            else
+              generic_permission_failure_message
+            end
+          end
+
+          def generic_permission_failure_message
+            _("This job does not run automatically and must be started manually, but you do not have access to it.")
           end
         end
       end
     end
   end
 end
+
+Gitlab::Ci::Status::Build::Manual.prepend_mod_with('Gitlab::Ci::Status::Build::Manual')

locale/gitlab.pot

@@ -37976,6 +37976,9 @@ msgstr ""
 msgid "This deployment is not waiting for approvals."
 msgstr ""
 
+msgid "This deployment job does not run automatically and must be started manually, but you do not have access to this job's protected environment. The job can only be started by a project member allowed to deploy to the environment."
+msgstr ""
+
 msgid "This device has already been registered with us."
 msgstr ""
 
@@ -38138,6 +38141,9 @@ msgstr ""
 msgid "This job does not have a trace."
 msgstr ""
 
+msgid "This job does not run automatically and must be started manually, but you do not have access to it."
+msgstr ""
+
 msgid "This job has been canceled"
 msgstr ""
 

spec/lib/gitlab/ci/status/build/manual_spec.rb

@@ -3,15 +3,27 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::Ci::Status::Build::Manual do
-  let(:user) { create(:user) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:job) { create(:ci_build, :manual) }
 
   subject do
-    build = create(:ci_build, :manual)
-    described_class.new(Gitlab::Ci::Status::Core.new(build, user))
+    described_class.new(Gitlab::Ci::Status::Core.new(job, user))
   end
 
   describe '#illustration' do
     it { expect(subject.illustration).to include(:image, :size, :title, :content) }
+
+    context 'when the user can trigger the job' do
+      before do
+        job.project.add_maintainer(user)
+      end
+
+      it { expect(subject.illustration[:content]).to match /This job requires manual intervention to start/ }
+    end
+
+    context 'when the user can not trigger the job' do
+      it { expect(subject.illustration[:content]).to match /This job does not run automatically and must be started manually/ }
+    end
   end
 
   describe '.matches?' do