Merge branch '34907-dont-show-pipeline-schedule-button-for-non-member' into 'master'

Do not show pipeline schedule button for non-member

Closes #34907

See merge request !12757

3 files changed, 169 insertions, 130 deletions

diff --git a/app/views/projects/pipeline_schedules/index.html.haml b/app/views/projects/pipeline_schedules/index.html.haml
index 05fe80e5fed..c4ee064ac43 100644
--- a/app/views/projects/pipeline_schedules/index.html.haml
+++ b/app/views/projects/pipeline_schedules/index.html.haml
@@ -12,9 +12,10 @@
     - schedule_path_proc = ->(scope) { pipeline_schedules_path(@project, scope: scope) }
     = render "tabs", schedule_path_proc: schedule_path_proc, all_schedules: @all_schedules, scope: @scope
 
-    .nav-controls
-      = link_to new_project_pipeline_schedule_path(@project), class: 'btn btn-create' do
-        %span= _('New schedule')
+    - if can?(current_user, :create_pipeline_schedule, @project)
+      .nav-controls
+        = link_to new_project_pipeline_schedule_path(@project), class: 'btn btn-create' do
+          %span= _('New schedule')
 
   - if @schedules.present?
     %ul.content-list
diff --git a/changelogs/unreleased/34907-dont-show-pipeline-schedule-button-for-non-member.yml b/changelogs/unreleased/34907-dont-show-pipeline-schedule-button-for-non-member.yml
new file mode 100644
index 00000000000..22c9c45bc75
--- /dev/null
+++ b/changelogs/unreleased/34907-dont-show-pipeline-schedule-button-for-non-member.yml
@@ -0,0 +1,4 @@
+---
+title: Do not show pipeline schedule button for non-member
+merge_request: 12757
+author: Takuya Noguchi
diff --git a/spec/features/projects/pipeline_schedules_spec.rb b/spec/features/projects/pipeline_schedules_spec.rb
index 992a68b25a5..033ccf06124 100644
--- a/spec/features/projects/pipeline_schedules_spec.rb
+++ b/spec/features/projects/pipeline_schedules_spec.rb
@@ -9,188 +9,222 @@ feature 'Pipeline Schedules', :feature, js: true do
   let(:scope) { nil }
   let!(:user) { create(:user) }
 
-  before do
-    project.add_master(user)
-    sign_in(user)
-  end
-
-  describe 'GET /projects/pipeline_schedules' do
+  context 'logged in as master' do
     before do
-      visit_pipelines_schedules
+      project.add_master(user)
+      gitlab_sign_in(user)
     end
 
-    describe 'The view' do
-      it 'displays the required information description' do
-        page.within('.pipeline-schedule-table-row') do
-          expect(page).to have_content('pipeline schedule')
-          expect(find(".next-run-cell time")['data-original-title'])
-            .to include(pipeline_schedule.real_next_run.strftime('%b %-d, %Y'))
-          expect(page).to have_link('master')
-          expect(page).to have_link("##{pipeline.id}")
-        end
+    describe 'GET /projects/pipeline_schedules' do
+      before do
+        visit_pipelines_schedules
       end
 
-      it 'creates a new scheduled pipeline' do
-        click_link 'New schedule'
+      describe 'The view' do
+        it 'displays the required information description' do
+          page.within('.pipeline-schedule-table-row') do
+            expect(page).to have_content('pipeline schedule')
+            expect(find(".next-run-cell time")['data-original-title'])
+              .to include(pipeline_schedule.real_next_run.strftime('%b %-d, %Y'))
+            expect(page).to have_link('master')
+            expect(page).to have_link("##{pipeline.id}")
+          end
+        end
 
-        expect(page).to have_content('Schedule a new pipeline')
-      end
+        it 'creates a new scheduled pipeline' do
+          click_link 'New schedule'
 
-      it 'changes ownership of the pipeline' do
-        click_link 'Take ownership'
-        page.within('.pipeline-schedule-table-row') do
-          expect(page).not_to have_content('No owner')
-          expect(page).to have_link('John Doe')
+          expect(page).to have_content('Schedule a new pipeline')
         end
-      end
 
-      it 'edits the pipeline' do
-        page.within('.pipeline-schedule-table-row') do
-          click_link 'Edit'
+        it 'changes ownership of the pipeline' do
+          click_link 'Take ownership'
+          page.within('.pipeline-schedule-table-row') do
+            expect(page).not_to have_content('No owner')
+            expect(page).to have_link('John Doe')
+          end
         end
 
-        expect(page).to have_content('Edit Pipeline Schedule')
+        it 'edits the pipeline' do
+          page.within('.pipeline-schedule-table-row') do
+            click_link 'Edit'
+          end
+
+          expect(page).to have_content('Edit Pipeline Schedule')
+        end
+
+        it 'deletes the pipeline' do
+          click_link 'Delete'
+
+          expect(page).not_to have_css(".pipeline-schedule-table-row")
+        end
       end
 
-      it 'deletes the pipeline' do
-        click_link 'Delete'
+      context 'when ref is nil' do
+        before do
+          pipeline_schedule.update_attribute(:ref, nil)
+          visit_pipelines_schedules
+        end
 
-        expect(page).not_to have_css(".pipeline-schedule-table-row")
+        it 'shows a list of the pipeline schedules with empty ref column' do
+          expect(first('.branch-name-cell').text).to eq('')
+        end
       end
     end
 
-    context 'when ref is nil' do
+    describe 'POST /projects/pipeline_schedules/new' do
       before do
-        pipeline_schedule.update_attribute(:ref, nil)
-        visit_pipelines_schedules
+        visit_new_pipeline_schedule
       end
 
-      it 'shows a list of the pipeline schedules with empty ref column' do
-        expect(first('.branch-name-cell').text).to eq('')
+      it 'sets defaults for timezone and target branch' do
+        expect(page).to have_button('master')
+        expect(page).to have_button('UTC')
       end
-    end
-  end
 
-  describe 'POST /projects/pipeline_schedules/new' do
-    before do
-      visit_new_pipeline_schedule
-    end
+      it 'it creates a new scheduled pipeline' do
+        fill_in_schedule_form
+        save_pipeline_schedule
 
-    it 'sets defaults for timezone and target branch' do
-      expect(page).to have_button('master')
-      expect(page).to have_button('UTC')
-    end
+        expect(page).to have_content('my fancy description')
+      end
 
-    it 'it creates a new scheduled pipeline' do
-      fill_in_schedule_form
-      save_pipeline_schedule
+      it 'it prevents an invalid form from being submitted' do
+        save_pipeline_schedule
 
-      expect(page).to have_content('my fancy description')
+        expect(page).to have_content('This field is required')
+      end
     end
 
-    it 'it prevents an invalid form from being submitted' do
-      save_pipeline_schedule
+    describe 'PATCH /projects/pipelines_schedules/:id/edit' do
+      before do
+        edit_pipeline_schedule
+      end
 
-      expect(page).to have_content('This field is required')
-    end
-  end
+      it 'it displays existing properties' do
+        description = find_field('schedule_description').value
+        expect(description).to eq('pipeline schedule')
+        expect(page).to have_button('master')
+        expect(page).to have_button('UTC')
+      end
 
-  describe 'PATCH /projects/pipelines_schedules/:id/edit' do
-    before do
-      edit_pipeline_schedule
-    end
+      it 'edits the scheduled pipeline' do
+        fill_in 'schedule_description', with: 'my brand new description'
 
-    it 'it displays existing properties' do
-      description = find_field('schedule_description').value
-      expect(description).to eq('pipeline schedule')
-      expect(page).to have_button('master')
-      expect(page).to have_button('UTC')
-    end
+        save_pipeline_schedule
 
-    it 'edits the scheduled pipeline' do
-      fill_in 'schedule_description', with: 'my brand new description'
+        expect(page).to have_content('my brand new description')
+      end
 
-      save_pipeline_schedule
+      context 'when ref is nil' do
+        before do
+          pipeline_schedule.update_attribute(:ref, nil)
+          edit_pipeline_schedule
+        end
 
-      expect(page).to have_content('my brand new description')
+        it 'shows the pipeline schedule with default ref' do
+          page.within('.js-target-branch-dropdown') do
+            expect(first('.dropdown-toggle-text').text).to eq('master')
+          end
+        end
+      end
     end
 
-    context 'when ref is nil' do
-      before do
-        pipeline_schedule.update_attribute(:ref, nil)
-        edit_pipeline_schedule
+    context 'when user creates a new pipeline schedule with variables' do
+      background do
+        visit_pipelines_schedules
+        click_link 'New schedule'
+        fill_in_schedule_form
+        all('[name="schedule[variables_attributes][][key]"]')[0].set('AAA')
+        all('[name="schedule[variables_attributes][][value]"]')[0].set('AAA123')
+        all('[name="schedule[variables_attributes][][key]"]')[1].set('BBB')
+        all('[name="schedule[variables_attributes][][value]"]')[1].set('BBB123')
+        save_pipeline_schedule
       end
 
-      it 'shows the pipeline schedule with default ref' do
-        page.within('.js-target-branch-dropdown') do
-          expect(first('.dropdown-toggle-text').text).to eq('master')
+      scenario 'user sees the new variable in edit window' do
+        find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
+        page.within('.pipeline-variable-list') do
+          expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-key-input").value).to eq('AAA')
+          expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-value-input").value).to eq('AAA123')
+          expect(find(".pipeline-variable-row:nth-child(2) .pipeline-variable-key-input").value).to eq('BBB')
+          expect(find(".pipeline-variable-row:nth-child(2) .pipeline-variable-value-input").value).to eq('BBB123')
         end
       end
     end
-  end
 
-  context 'when user creates a new pipeline schedule with variables' do
-    background do
-      visit_pipelines_schedules
-      click_link 'New schedule'
-      fill_in_schedule_form
-      all('[name="schedule[variables_attributes][][key]"]')[0].set('AAA')
-      all('[name="schedule[variables_attributes][][value]"]')[0].set('AAA123')
-      all('[name="schedule[variables_attributes][][key]"]')[1].set('BBB')
-      all('[name="schedule[variables_attributes][][value]"]')[1].set('BBB123')
-      save_pipeline_schedule
-    end
+    context 'when user edits a variable of a pipeline schedule' do
+      background do
+        create(:ci_pipeline_schedule, project: project, owner: user).tap do |pipeline_schedule|
+          create(:ci_pipeline_schedule_variable, key: 'AAA', value: 'AAA123', pipeline_schedule: pipeline_schedule)
+        end
 
-    scenario 'user sees the new variable in edit window' do
-      find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
-      page.within('.pipeline-variable-list') do
-        expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-key-input").value).to eq('AAA')
-        expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-value-input").value).to eq('AAA123')
-        expect(find(".pipeline-variable-row:nth-child(2) .pipeline-variable-key-input").value).to eq('BBB')
-        expect(find(".pipeline-variable-row:nth-child(2) .pipeline-variable-value-input").value).to eq('BBB123')
+        visit_pipelines_schedules
+        find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
+        all('[name="schedule[variables_attributes][][key]"]')[0].set('foo')
+        all('[name="schedule[variables_attributes][][value]"]')[0].set('bar')
+        click_button 'Save pipeline schedule'
       end
-    end
-  end
 
-  context 'when user edits a variable of a pipeline schedule' do
-    background do
-      create(:ci_pipeline_schedule, project: project, owner: user).tap do |pipeline_schedule|
-        create(:ci_pipeline_schedule_variable, key: 'AAA', value: 'AAA123', pipeline_schedule: pipeline_schedule)
+      scenario 'user sees the updated variable in edit window' do
+        find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
+        page.within('.pipeline-variable-list') do
+          expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-key-input").value).to eq('foo')
+          expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-value-input").value).to eq('bar')
+        end
       end
-
-      visit_pipelines_schedules
-      find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
-      all('[name="schedule[variables_attributes][][key]"]')[0].set('foo')
-      all('[name="schedule[variables_attributes][][value]"]')[0].set('bar')
-      click_button 'Save pipeline schedule'
     end
 
-    scenario 'user sees the updated variable in edit window' do
-      find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
-      page.within('.pipeline-variable-list') do
-        expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-key-input").value).to eq('foo')
-        expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-value-input").value).to eq('bar')
+    context 'when user removes a variable of a pipeline schedule' do
+      background do
+        create(:ci_pipeline_schedule, project: project, owner: user).tap do |pipeline_schedule|
+          create(:ci_pipeline_schedule_variable, key: 'AAA', value: 'AAA123', pipeline_schedule: pipeline_schedule)
+        end
+
+        visit_pipelines_schedules
+        find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
+        find('.pipeline-variable-list .pipeline-variable-row-remove-button').click
+        click_button 'Save pipeline schedule'
+      end
+
+      scenario 'user does not see the removed variable in edit window' do
+        find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
+        page.within('.pipeline-variable-list') do
+          expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-key-input").value).to eq('')
+          expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-value-input").value).to eq('')
+        end
       end
     end
   end
 
-  context 'when user removes a variable of a pipeline schedule' do
-    background do
-      create(:ci_pipeline_schedule, project: project, owner: user).tap do |pipeline_schedule|
-        create(:ci_pipeline_schedule_variable, key: 'AAA', value: 'AAA123', pipeline_schedule: pipeline_schedule)
+  context 'logged in as non-member' do
+    before do
+      gitlab_sign_in(user)
+    end
+
+    describe 'GET /projects/pipeline_schedules' do
+      before do
+        visit_pipelines_schedules
       end
 
-      visit_pipelines_schedules
-      find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
-      find('.pipeline-variable-list .pipeline-variable-row-remove-button').click
-      click_button 'Save pipeline schedule'
+      describe 'The view' do
+        it 'does not show create schedule button' do
+          expect(page).not_to have_link('New schedule')
+        end
+      end
     end
+  end
+
+  context 'not logged in' do
+    describe 'GET /projects/pipeline_schedules' do
+      before do
+        visit_pipelines_schedules
+      end
 
-    scenario 'user does not see the removed variable in edit window' do
-      find(".content-list .pipeline-schedule-table-row:nth-child(1) .btn-group a[title='Edit']").click
-      page.within('.pipeline-variable-list') do
-        expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-key-input").value).to eq('')
-        expect(find(".pipeline-variable-row:nth-child(1) .pipeline-variable-value-input").value).to eq('')
+      describe 'The view' do
+        it 'does not show create schedule button' do
+          expect(page).not_to have_link('New schedule')
+        end
       end
     end
   end