Hide edit/delete actions for Planner role users without write permissions

Everyone can contribute. Help move this issue forward while earning points, leveling up and collecting rewards.

• Collaborate/take over this issue

Summary

After enabling :read_code and :download_code permissions for the Planner role in private projects (!212966 (merged)), users with the Planner role can now view repository content. However, the frontend still displays edit and delete actions that these users cannot perform, leading to a poor user experience.

Problem

When a Planner role user navigates to a file in a private project repository, they see:

1. Edit dropdown with options like:

   • Edit single file
   • Open in Web IDE
   • Edit in pipeline editor (if applicable)

2. File actions dropdown (overflow menu) with options like:

   • Replace
   • Delete

When attempting to use these actions:

• Edit single file: Page refreshes without opening the editor
• Open in Web IDE: Link returns a 404 error
• Replace/Delete: Actions fail due to lack of permissions

This creates confusion as users are presented with options they cannot use.

Root Cause Analysis

Permission Model

The Planner role in private projects now has:

• ✅ :read_code - Can view code
• ✅ :download_code - Can clone/download
• ❌ :create_merge_request_in - Cannot create MRs
• ❌ :push_code - Cannot push code (implied)

Implementation Checklist

• Update BlobControls.vue to conditionally render edit dropdown based on permissions
• Update WebIdeLink.vue to handle read-only users appropriately
• Update BlobButtonGroup.vue to check pushCode permission before showing Replace action
• Update BlobDeleteFileGroup.vue to check pushCode permission before showing Delete action
• Add specs for Planner role user scenarios
• Test with other read-only roles (Guest, Reporter in some contexts)
• Update documentation if needed

Additional Context

• Related MR: !212966 (merged)
• Related issue: #550282 (closed)
• Discussion: !212966 (comment 2904080753)

Screenshots

Current behavior (from MR review): User with Planner role sees edit options that don't work when attempting to edit a single file or open in Web IDE - the page refreshes or returns 404.

Note

This is a pre-existing frontend issue that was exposed by !212966 (merged). Before that MR, Planner users couldn't view code in private projects at all, so they never encountered this UI problem. The backend permissions in !212966 (merged) are working correctly - this is purely a frontend UX improvement to handle the read-only-without-fork-ability permission combination.