Merge branch 'hide-edit-comment-and-report-as-abuse-conditionally' into 'master'

Only show 'Edit comment'/'Report as abuse' when user has perms/isnt current_user

See merge request !12096

4 files changed, 67 insertions, 31 deletions

diff --git a/app/views/projects/notes/_more_actions_dropdown.html.haml b/app/views/projects/notes/_more_actions_dropdown.html.haml
index e0d45054854..75a4687e1e3 100644
--- a/app/views/projects/notes/_more_actions_dropdown.html.haml
+++ b/app/views/projects/notes/_more_actions_dropdown.html.haml
@@ -1,14 +1,19 @@
-.dropdown.more-actions
-  = button_tag title: 'More actions', class: 'note-action-button more-actions-toggle has-tooltip btn btn-transparent', data: { toggle: 'dropdown', container: 'body' } do
-    = icon('ellipsis-v', class: 'icon')
-  %ul.dropdown-menu.more-actions-dropdown.dropdown-open-left
-    %li
-      = button_tag 'Edit comment', class: 'js-note-edit btn btn-transparent'
-    %li.divider
-      %li
-        = link_to new_abuse_report_path(user_id: note.author.id, ref_url: noteable_note_url(note)) do
-          Report as abuse
-    - if note_editable
-      %li
-        = link_to note_url(note), method: :delete, data: { confirm: 'Are you sure you want to delete this comment?' }, remote: true, class: 'js-note-delete' do
-          %span.text-danger Delete comment
+- is_current_user = current_user == note.author
+
+- if note_editable || !is_current_user
+  .dropdown.more-actions
+    = button_tag title: 'More actions', class: 'note-action-button more-actions-toggle has-tooltip btn btn-transparent', data: { toggle: 'dropdown', container: 'body' } do
+      = icon('ellipsis-v', class: 'icon')
+    %ul.dropdown-menu.more-actions-dropdown.dropdown-open-left
+      - if note_editable
+        %li
+          = button_tag 'Edit comment', class: 'js-note-edit btn btn-transparent'
+        %li.divider
+      - unless is_current_user
+        %li
+          = link_to new_abuse_report_path(user_id: note.author.id, ref_url: noteable_note_url(note)) do
+            Report as abuse
+      - if note_editable
+        %li
+          = link_to note_url(note), method: :delete, data: { confirm: 'Are you sure you want to delete this comment?' }, remote: true, class: 'js-note-delete' do
+            %span.text-danger Delete comment
diff --git a/spec/features/reportable_note/snippets_spec.rb b/spec/features/reportable_note/snippets_spec.rb
index a88990eada0..5bee4a31379 100644
--- a/spec/features/reportable_note/snippets_spec.rb
+++ b/spec/features/reportable_note/snippets_spec.rb
@@ -19,15 +19,4 @@ describe 'Reportable note on snippets', :feature, :js do
 
     it_behaves_like 'reportable note'
   end
-
-  describe 'on personal snippet' do
-    let(:snippet) { create(:personal_snippet, :public, author: user) }
-    let!(:note) { create(:note_on_personal_snippet, noteable: snippet, author: user) }
-
-    before do
-      visit snippet_path(snippet)
-    end
-
-    it_behaves_like 'reportable note'
-  end
 end
diff --git a/spec/support/features/reportable_note_shared_examples.rb b/spec/support/features/reportable_note_shared_examples.rb
index 0d80c95e826..27e079c01dd 100644
--- a/spec/support/features/reportable_note_shared_examples.rb
+++ b/spec/support/features/reportable_note_shared_examples.rb
@@ -13,9 +13,7 @@ shared_examples 'reportable note' do
 
   it 'dropdown has Edit, Report and Delete links' do
     dropdown = comment.find(more_actions_selector)
-
-    dropdown.click
-    dropdown.find('.dropdown-menu li', match: :first)
+    open_dropdown(dropdown)
 
     expect(dropdown).to have_button('Edit comment')
     expect(dropdown).to have_link('Report as abuse', href: abuse_report_path)
@@ -24,13 +22,16 @@ shared_examples 'reportable note' do
 
   it 'Report button links to a report page' do
     dropdown = comment.find(more_actions_selector)
-
-    dropdown.click
-    dropdown.find('.dropdown-menu li', match: :first)
+    open_dropdown(dropdown)
 
     dropdown.click_link('Report as abuse')
 
     expect(find('#user_name')['value']).to match(note.author.username)
     expect(find('#abuse_report_message')['value']).to match(noteable_note_url(note))
   end
+
+  def open_dropdown(dropdown)
+    dropdown.click
+    dropdown.find('.dropdown-menu li', match: :first)
+  end
 end
diff --git a/spec/views/projects/notes/_more_actions_dropdown.html.haml_spec.rb b/spec/views/projects/notes/_more_actions_dropdown.html.haml_spec.rb
new file mode 100644
index 00000000000..e56c0f6be03
--- /dev/null
+++ b/spec/views/projects/notes/_more_actions_dropdown.html.haml_spec.rb
@@ -0,0 +1,41 @@
+require 'spec_helper'
+
+describe 'projects/notes/_more_actions_dropdown', :view do
+  let(:author_user) { create(:user) }
+  let(:not_author_user) { create(:user) }
+
+  let(:project) { create(:empty_project) }
+  let(:issue) { create(:issue, project: project) }
+  let!(:note) { create(:note_on_issue, author: author_user, noteable: issue, project: project) }
+
+  before do
+    assign(:project, project)
+  end
+
+  it 'shows Report as abuse button if not editable and not current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: not_author_user, note_editable: false, note: note
+
+    expect(rendered).to have_link('Report as abuse')
+  end
+
+  it 'does not show the More actions button if not editable and current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: author_user, note_editable: false, note: note
+
+    expect(rendered).not_to have_selector('.dropdown.more-actions')
+  end
+
+  it 'shows Report as abuse, Edit and Delete buttons if editable and not current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: not_author_user, note_editable: true, note: note
+
+    expect(rendered).to have_link('Report as abuse')
+    expect(rendered).to have_button('Edit comment')
+    expect(rendered).to have_link('Delete comment')
+  end
+
+  it 'shows Edit and Delete buttons if editable and current users comment' do
+    render 'projects/notes/more_actions_dropdown', current_user: author_user, note_editable: true, note: note
+
+    expect(rendered).to have_button('Edit comment')
+    expect(rendered).to have_link('Delete comment')
+  end
+end