Hide "New merge request" button from Auditors on "Code review" page
requested to merge 324974-hide-new-merge-request-button-on-analytics-code_reviews-from-auditors into master
📖 What does this MR do?
Related to #324974 (closed)
Hides "New merge request" button from Auditors on "Project" -> "Analytics" -> "Code Review" page. Auditors have read-only access to all projects on the GitLab instance so clicking that button returns a 404.
As a side effect of this change the "New merge request" button is also hidden for logged out users. Previously it would return a 404 if a logged out user clicked it.
💻 Local testing
- Log in with an admin account (
root) - Navigate to
/admin/users/new - Fill out required fields and choose "Auditor" in the "Access level"
- Create a new project
- Log out and then log in with newly create Auditor account
- Navigate to newly created project -> "Analytics" -> "Code Review"
📷 Screenshots
| View | Before | After |
|---|---|---|
| Auditor that is not a member of project |  |
 |
| Logged out user |  |
 |
Below screenshots should be the same
| View | Before | After |
|---|---|---|
| Auditor that is member of project |  |
 |
| Regular user that is member of project |  |
 |
🚦 Does this MR meet the acceptance criteria?
Conformity
-
📋 Does this MR need a changelog?-
I have included a changelog entry. -
I have not included a changelog entry because _____.
-
- [-] Documentation (if required)
-
Code review guidelines -
Merge request performance guidelines -
Style guides - [-] Database guides
-
Separation of EE specific content
Availability and Testing
-
Review and add/update tests for this feature/bug. Consider all test levels. See the Test Planning Process. -
Tested in all supported browsers - [-] Informed Infrastructure department of a default or new setting change, if applicable per definition of done
Security
If this MR contains changes to processing or storing of credentials or tokens, authorization and authentication methods and other items described in the security review guidelines:
- [-] Label as security and @ mention
@gitlab-com/gl-security/appsec - [-] The MR includes necessary changes to maintain consistency between UI, API, email, or other methods
- [-] Security reports checked/validated by a reviewer from the AppSec team
Edited by Peter Hegman