Button to resolve discussions on merge requests is visible users that do not have the permissions to do so
Summary
On merge requests, users that can view the request (such as reporters, or public users in a public/internal repo) but don't have developer/maintainer/owner permissions to resolve discussions can still see the button to do so. Clicking it does nothing, so this is just a visual bug from what I can tell.
Steps to reproduce
- Create a repository and file a merge request against it. Comment on the diff to create a discussion.
- (Optional, if the project is private) Add a different user as a Reporter on the project.
- As the user in step 2, view the merge request and scroll down to the Discussion section.
- Click the "Resolve discussion" button.
Example Project
dminer/resolve-discussion-example!1
What is the current bug behavior?
The "Resolve discussion" button is visible (but non-functioning) to a public/reporter user.
What is the expected correct behavior?
The button should not be visible to a user that doesn't have permissions to resolve discussions.
Relevant logs and/or screenshots
Output of checks
This bug happens on GitLab.com
Possible fixes
This seems like the line that would be responsible. It looks mostly correct though and the other privileged buttons (like closing the request) aren't visible to the unprivileged user like you'd expect.