Project graphql query is returning incorrect pathLocks permissions

Summary

The admin_path_locks returning as part of project query, implemented in this MR, is returning incorrect value.

Current Behavior

  1. Creating a path lock requires maintainer+ permissions
  2. Users without maintainer+ permissions cannot destroy path locks they created

Expected Behavior

  1. Creating a path lock should require developer+ permissions (as per documentation)
  2. Users should be able to destroy path locks they created, as long as they are a member of the project (as per documentation)
  3. Additionally, users with maintainer+ permissions should be able to remove any path locks in the project

Technical Details

  • The path lock policy file has two conditions:
    • User is a member of the project
    • User is the author of the lock
  • However, we delete the project policy when resolving the graphql query
  • Frontend is calling the project info query from lock_directory_button.vue component. Permission is being used then to disable the button with a tooltip

Steps to Reproduce

Running the branch from this MR !176182 (merged)

  1. Create a user with developer permissions on a project
  2. Have the user create a path lock
  3. Observe that admin_path_locks returns false in the project query
  4. Unlock button is disabled for the user

This e2e test is failing

Edited Jan 10, 2025 by Chaoyue Zhao
Assignee Loading
Time tracking Loading