Tie metric-image permissions to issue edit access

Sreeram Narayananrequested to merge
536635-incident-metric-image-permissions into master

What does this MR do and why?

This merge request refactors the metric-image permission rules in ee/app/policies/ee/issuable_policy.rb, following the cleaner design suggested by a reviewer on the prior merge request at !257244 (comment 3905595798). It removes the is_author arm that unconditionally granted metric-image update and delete to the issuable author, removes the incident-specific prevent rule that the prior merge request added, and folds update and delete into the existing rule that already gates upload on can?(:create_issue) & can?(:update_issue). All three metric-image actions now simply follow the issue's edit permission, replacing an author bypass plus a targeted incident prevent with a single rule.

For incidents, behavior is unchanged from the current merged state: editing an incident already requires at least the Reporter role, so a downgraded Guest or Planner author is still denied and a Reporter is still allowed. For archived projects, this closes a gap the prior merge request did not cover: archived projects are read-only, so the author no longer has issue-edit rights there, and under the old is_author arm an author could still manage metric images in an archived project, which is no longer possible. For regular, non-incident, non-archived issues, behavior is unchanged, since a regular-issue author already holds update permission on their own issue.

References

Note: the related issue is confidential and carries the security-fix-in-public label, which is why this work is on the canonical project rather than a security mirror.

Screenshots or screen recordings

Before After

No UI changes.

How to set up and validate locally

  1. Ensure your local instance has a Premium or Ultimate license active, since metric images are a licensed feature.
  2. Reproduce the incident case: create an incident as a Reporter, then upload a metric image via the REST API POST /projects/:id/issues/:incident_iid/metric_images. Downgrade the author to Planner and confirm that PUT and DELETE on /metric_images/:image_id both return 403. Promote the author back to Reporter and confirm both requests succeed.
  3. Reproduce the archived-project case: as the issue author, archive the project and confirm that update and delete of the metric image now return 403.
  4. Run the specs: bin/rspec ee/spec/policies/issuable_policy_spec.rb ee/spec/policies/issue_policy_spec.rb ee/spec/policies/work_item_policy_spec.rb ee/spec/requests/api/issues_spec.rb.

MR acceptance checklist

Evaluate this MR against the MR acceptance checklist. It helps you analyze changes to reduce risks in quality, performance, reliability, security, and maintainability.

Merge request reports