Use label permissions in the group labels controller

Diane Russelrequested to merge
dlrussel/group-labels-granular-permissions into master

What does this MR do and why?

Groups::LabelsController still checked admin_label. This MR switches it to the specific label permissions, the same way the project labels controller was switched. Nobody gains or loses access. Reporter and Planner had admin_label and now also get the specific permissions in the group scope.

  • Controller checks create_label on the group (new, create), and update_label (edit, update) and delete_label (destroy) on both the group and the label. A label can belong to an ancestor group, so both checks stay, same as before.
  • Reporter and Planner get create_label, update_label, delete_label in the group scope.
  • Archived groups block the new permissions the same way they blocked admin_label.

No changelog, since user-facing behavior does not change.

References

Screenshots or screen recordings

No UI change.

How to set up and validate locally

bundle exec rspec spec/controllers/groups/labels_controller_spec.rb spec/policies/group_policy_spec.rb
bundle exec rake gitlab:permissions:validate

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports