Release edit button is visible even if the user doesn't have permission to edit the release
Summary
In #26016 (closed), we added the ability to edit a release from the Project overview > Releases page.
To edit a release, a user clicks on the "edit" button in the top-right corner of the release they want to edit.
However, this button is _always_rendered, even if the user doesn't have permission to edit the release. In this case, the user gets a 404.
Steps to reproduce
- Log out of your GitLab account
- Navigate to Project overview > Releases in a project that has published at least one release
What is the current bug behavior?
The edit button is rendered and results in a 404 when clicked.
What is the expected correct behavior?
The edit button should not be rendered.
GIF
Output of checks
This bug happens on GitLab.com.
Well, kind of. We've haven't yet enabled this feature's feature flag, so this bug isn't reproducible by the general public yet.
Edited by Nathan Friend