Guest users are not able to subscribe to work items
A user with guest access should be able to subscribe/unsubscribe from work item notifications despite not having permissions to update the work item.
We are observing this bug because the GraphQL mutation that updates all widgets checks update_work_item
permission when this particular widget requires the more lenient update_subscription
permission.
Steps to replicate
- Log in as a
Guest
user and visit an issue in the project, for examplehttps://gdk.test:3000/gitlab-org/gitlab-test/-/issues/1
- The user should be able to reveal the notifications toggle in the top menu
- Visit the same issue using the work item view for example
https://gdk.test:3000/gitlab-org/gitlab-test/-/work_items/1
- The option to toggle notifications is not displayed