Skip to content
Snippets Groups Projects

Guest members cannot set metadata for issues they have authored

    • Closed Issue created by Eugenia Grieff @egrieff

    If a user is a Guest member of a project they have the ability :update_issue for issues they authored or are assigned to:

    issuable_policy 
    # app/policies/issuable_policy.rb:22
  rule { can?(:guest_access) & assignee_or_author & ~is_incident }.policy do
    enable :read_issue
    enable :update_issue
    enable :reopen_issue
  end

    But the ability set_issue_metadata is restricted to them because the issue is already persisted:

    issue_policy 
    # app/policies/issue_policy.rb:81
  rule { ~persisted & is_project_member & can?(:guest_access) }.policy do
    enable :set_issue_metadata
  end

    These permissions impact work items as they rely on set_issue_metadata to set set_work_item_metadata which results in an author not being able to update their work item if they have guest access:

    Screen_Recording_2023-05-24_at_10.15.45

    This inconsistency can be also be seen by querying the work items' permissions with the guest user:

    GraphQL query 
    query getWorkItemsPermissions {
  project(fullPath: "<project-path>") {
    work-items(iid: "<guest_user_work_item_iid>") {
      edges {
        node {
          userPermissions {
            updateWorkItem
            setWorkItemMetadata
          }
        }
      }
    }
  }
}
    {
  "data": {
    "project": {
      "workItems": {
        "edges": [
          {
            "node": {
              "id": "gid://gitlab/WorkItem/128207359",
              "iid": "3",
              "title": "Issue authored by guest",
              "userPermissions": {
                "updateWorkItem": true,
                "setWorkItemMetadata": false
              }
            }
          }
        ]
      }
    }
  }
}

    Proposal

    Add an extra rule for enabling set_issue_metadata when the user can update the issue:

    # app/policies/issue_policy.rb

rule { can?(:update_issue) }.enable :set_issue_metadata

    Designs

      Child items ...

      2. Activity

      Please register or sign in to reply