Subepic cannot be removed from epic

It appears that an epic can be added as a child epic by a user, but then cannot be removed due to what appears to be a permissions issue.

When I tried to reproduce this issue, I got the following:

In gitlab-com&107, trying to remove gitlab-com/support&12 (closed) results in the following error:

image

Looks like it's a permissions issue from the REST API:

image

How to reproduce locally:

  • Pick an epic in a group with lots of epics. (e.g. &9)
  • Create a subgroup that group. Create only one epic in that group (e.g. &1)
  • Add group/subgroup&1 to the epic tree in group&9)
  • The error in the console is 403.

The 403 behaviour occurs when the parent epic iid (☝ &9 does NOT exist in the subgroup - in this case, when there is no group/subgroup&9).

MR: !20610 (merged)

/cc @j.carey @gweaver @johnhope @kokeefe @smcgivern

Edited by charlie ablett