Better handle the current permission restriction when attempting to assign a guest to a confidential issue
Summary
When trying to assign a guest user to a confidential issue nothing happens and no errors are shown.
The docs says:
The general rule is that confidential issues are visible only to members of a project with at least Reporter access. However, a guest user can also create confidential issues, but can only view the ones that they created themselves.
Should we let guest users be assigned to confidential issues and then be able to read them? If not we should at least display an error message.
Steps to reproduce
- Create a confidential issue on a public project
- At the sidebar try to assign a guest user to it
What is the current bug behavior?
The guest user seems to get assigned to the issue, but after the page is refreshed it gets to its previous state.
What is the expected correct behavior?
- Assign the guest user to the confidential issue or if that is not allowed at least show an error message.
Possible fixes
- The current permissions model restricts a non-author guest from viewing confidential issues.
- We should adhere to the current permissions model by showing an error message when attempting to assign a guest user to a confidential issue OR omit guest members from the assignees dropdown and quick action autocomplete.
Edited by Gabe Weaver