Don't show links to tag a commit for non permitted users

app/views/projects/commit/_commit_box.html.haml

@@ -34,8 +34,9 @@
             = revert_commit_link(@commit, namespace_project_commit_path(@project.namespace, @project, @commit.id), has_tooltip: false)
         %li.clearfix
           = cherry_pick_commit_link(@commit, namespace_project_commit_path(@project.namespace, @project, @commit.id), has_tooltip: false)
-        %li.clearfix
-          = link_to "Tag", new_namespace_project_tag_path(@project.namespace, @project, ref: @commit)
+        - if can_collaborate_with_project?
+          %li.clearfix
+            = link_to "Tag", new_namespace_project_tag_path(@project.namespace, @project, ref: @commit)
         %li.divider
         %li.dropdown-header
           Download

changelogs/unreleased/26188-tag-creation-404-for-guests.yml

+---
+title: Don't show links to tag a commit for users that are not permitted
+merge_request: 8407
+author:

spec/views/projects/commit/_commit_box.html.haml_spec.rb

@@ -3,11 +3,13 @@ require 'spec_helper'
 describe 'projects/commit/_commit_box.html.haml' do
   include Devise::Test::ControllerHelpers
 
+  let(:user) { create(:user) }
   let(:project) { create(:project) }
 
   before do
     assign(:project, project)
     assign(:commit, project.commit)
+    allow(view).to receive(:can_collaborate_with_project?).and_return(false)
   end
 
   it 'shows the commit SHA' do
@@ -25,4 +27,30 @@ describe 'projects/commit/_commit_box.html.haml' do
 
     expect(rendered).to have_text("Pipeline ##{third_pipeline.id} for #{Commit.truncate_sha(project.commit.sha)} failed")
   end
+
+  context 'viewing a commit' do
+    context 'as a developer' do
+      before do
+        expect(view).to receive(:can_collaborate_with_project?).and_return(true)
+      end
+
+      it 'has a link to create a new tag' do
+        render
+
+        expect(rendered).to have_link('Tag')
+      end
+    end
+
+    context 'as a non-developer' do
+      before do
+        expect(view).to receive(:can_collaborate_with_project?).and_return(false)
+      end
+
+      it 'does not have a link to create a new tag' do
+        render
+
+        expect(rendered).not_to have_link('Tag')
+      end
+    end
+  end
 end