"Contributor analytics" sidebar link is shown to users who can't access it (leads to 404)

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Collaborate/take over this issue

Summary

In a public project where Settings > General > Visibility, project features, permissions > Analytics is set to Only Project Members, users who aren't members (including signed-out users) still see Analyze > Contributor analytics in the left sidebar. When they click it, they get a 404, because the page itself checks permissions correctly.

Expected: hide the sidebar item from users who can't open the page.

Steps to reproduce

1. Create a public project that has at least one commit.
2. Go to Settings > General > Visibility, project features, permissions, set Analytics to Only Project Members, and save.
3. Open the project in a private/incognito browser window (signed out).
4. In the left sidebar, select Analyze > Contributor analytics.
5. You get "404: Page not found".

Real-world example: https://gitlab.com/openfoam/core/openfoam (while signed out).

Root cause

The sidebar item is built in lib/sidebars/projects/menus/repository_menu.rb, in #contributors_menu_item:

def contributors_menu_item
  return false unless context.project.analytics_enabled?
  # ...
end

Project#analytics_enabled? only checks that the Analytics feature isn't disabled. It doesn't check whether the current user can access it.

The page (Projects::GraphsController) runs before_action :authorize_read_repository_graphs!. ProjectPolicy blocks :read_repository_graphs when the user doesn't have access to the analytics feature, so the sidebar and the page disagree.

Other analytics sidebar items already use the right check. For example, repository_analytics_menu_item in lib/sidebars/projects/menus/analytics_menu.rb does this:

can?(context.current_user, :read_repository_graphs, context.project)

Implementation plan

1. In lib/sidebars/projects/menus/repository_menu.rb, change the guard in #contributors_menu_item so the item uses the same permission the controller enforces:

   return false unless can?(context.current_user, :read_repository_graphs, context.project)

2. Add specs to spec/lib/sidebars/projects/menus/repository_menu_spec.rb, in the existing Contributors context:
   • With analytics set to project members only (project.project_feature.update!(analytics_access_level: ProjectFeature::PRIVATE)), an anonymous user does not see the item.
   • With the same setting, a project member does see the item.
3. Run the specs locally:

   bundle exec rspec spec/lib/sidebars/projects/menus/repository_menu_spec.rb

4. Add the Changelog: fixed trailer to your commit message.

Verification

• Follow the reproduction steps above in GDK. After the fix, the signed-out user doesn't see Contributor analytics.
• Sign in as a project member and confirm the item still shows and the page loads.

Getting started

New to contributing? See the contributor onboarding guide and set up the GitLab Development Kit (GDK). Comment on this issue if you have questions.

Original report

Steps to reproduce

1. Load https://gitlab.com/openfoam/core/openfoam
2. Hover over "Analyze" in the sidebar
3. Click on "Contributor analytics"

What is the current bug behavior?

The link points at https://gitlab.com/openfoam/core/openfoam/-/graphs/master?ref_type=heads, which gives "404: Page not found".

What is the expected correct behavior?

Acceptable outcomes:

1. The page shows the contributor analytics,
2. The page shows an error saying the project has disabled contributor analytics, or
3. The link is not shown in the sidebar.

This bug happens on GitLab.com.