Only show `/copy_metadata` when usable

6639aa3f · Lee Tickett · Douglas Barbosa Alexandre · af0eb56e · 6639aa3f · 6639aa3f
--- a/changelogs/unreleased/31735-only-show-copy_metadata-when-usable.yml
+++ b/changelogs/unreleased/31735-only-show-copy_metadata-when-usable.yml
+---
+title: Only show /copy_metadata quick action when usable
+merge_request: 31735
+author: Lee Tickett
+type: fixed
--- a/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
+++ b/lib/gitlab/quick_actions/issue_and_merge_request_actions.rb
@@ -122,7 +122,7 @@ module IssueAndMergeRequestActions
        params '#issue | !merge_request'
        types Issue, MergeRequest
        condition do
-          current_user.can?(:"update_#{quick_action_target.to_ability_name}", quick_action_target)
+          current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
        end
        parse_params do |issuable_param|
          extract_references(issuable_param, :issue).first ||

--- a/spec/services/quick_actions/interpret_service_spec.rb
+++ b/spec/services/quick_actions/interpret_service_spec.rb
@@ -1140,6 +1140,19 @@
      let(:todo_label) { create(:label, project: project, title: 'To Do') }
      let(:inreview_label) { create(:label, project: project, title: 'In Review') }

+      it 'is available when the user is a developer' do
+        expect(service.available_commands(issue)).to include(a_hash_including(name: :copy_metadata))
+      end
+
+      context 'when the user does not have permission' do
+        let(:guest) { create(:user) }
+        let(:service) { described_class.new(project, guest) }
+
+        it 'is not available' do
+          expect(service.available_commands(issue)).not_to include(a_hash_including(name: :copy_metadata))
+        end
+      end
+
      it_behaves_like 'empty command' do
        let(:content) { '/copy_metadata' }
        let(:issuable) { issue }