"Cancel running" and "Retry" buttons on pipeline details are displayed to users who don't have permission

Summary

When inspecting a pipeline run, the Cancel running and sometimes even the Retry buttons appear for users who don't have access (or aren't even signed in).

Steps to reproduce

  1. Go to a repo you don't own
  2. Find a pipeline that is currently running.
  3. See the buttons appear.

What is the current bug behavior?

The buttons appear and when I click on either of them, I get an "unknown error" and a spinner that doesn't load anything.

What is the expected correct behavior?

The better approach to this would be to hide these buttons from the users, who don't have permission to the resource or at least show a permission error in the dialog box.

Relevant logs and/or screenshots

image image image

Output of checks

Results of GitLab environment info

Running GitLab Current (gitlab.com), version 13.11.0-pre@a3f68244027.

Possible fixes

Not sure, but it will be in the part of the code where the GraphQL response is handled.

Edited by Filip Troníček