Merge branch '18724-dont-show-leave-project-to-group-member' into 'master'

Don't show 'Leave Project' to group members

## What does this MR do?

It hides the 'Leave Project' button to group members that are not explicitly a member of the project.

## Are there points in the code the reviewer needs to double check?

No.

## Why was this MR needed?

Because there was an issue opened!

## What are the relevant issue numbers?

Fixes #18724.

## Does this MR meet the acceptance criteria?

- [x] [CHANGELOG](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CHANGELOG) entry added
- [x] Tests
  - [x] Added for this feature/bug
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4739

3 files changed, 21 insertions, 2 deletions

diff --git a/CHANGELOG b/CHANGELOG
index 030bb61703a..148ec575f84 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -15,6 +15,7 @@ v 8.9.0 (unreleased)
     background during a refresh.
   - Make EmailsOnPushWorker use Sidekiq mailers queue
   - Redesign all Devise emails. !4297
+  - Don't show 'Leave Project' to group members
   - Fix wiki page events' webhook to point to the wiki repository
   - Don't show tags for revert and cherry-pick operations
   - Fix issue todo not remove when leave project !4150 (Long Nguyen)
diff --git a/app/views/layouts/nav/_project.html.haml b/app/views/layouts/nav/_project.html.haml
index a851cae4b56..39ea4920ccc 100644
--- a/app/views/layouts/nav/_project.html.haml
+++ b/app/views/layouts/nav/_project.html.haml
@@ -5,18 +5,19 @@
         = icon('cog')
         = icon('caret-down')
       %ul.dropdown-menu.dropdown-menu-align-right
+        - is_project_member = @project.users.exists?(current_user.id)
         - access = @project.team.max_member_access(current_user.id)
         - can_edit = can?(current_user, :admin_project, @project)
 
         = render 'layouts/nav/project_settings', access: access, can_edit: can_edit
 
-        - if can_edit || access
+        - if can_edit || is_project_member
           %li.divider
           - if can_edit
             %li
               = link_to edit_project_path(@project) do
                 Edit Project
-          - if access
+          - if is_project_member
             %li
               = link_to polymorphic_path([:leave, @project, :members]),
                 data: { confirm: leave_confirmation_message(@project) }, method: :delete, title: 'Leave project' do
diff --git a/spec/features/projects/members/group_member_cannot_leave_group_project_spec.rb b/spec/features/projects/members/group_member_cannot_leave_group_project_spec.rb
new file mode 100644
index 00000000000..728c0e16361
--- /dev/null
+++ b/spec/features/projects/members/group_member_cannot_leave_group_project_spec.rb
@@ -0,0 +1,17 @@
+require 'spec_helper'
+
+feature 'Projects > Members > Group member cannot leave group project', feature: true do
+  let(:user) { create(:user) }
+  let(:group) { create(:group) }
+  let(:project) { create(:project, namespace: group) }
+
+  background do
+    group.add_developer(user)
+    login_as(user)
+    visit namespace_project_path(project.namespace, project)
+  end
+
+  scenario 'user does not see a "Leave project" link' do
+    expect(page).not_to have_content 'Leave Project'
+  end
+end