[23615] Show error response when user is not allowed to create WPs (#4687)

config/routes.rb

@@ -285,6 +285,7 @@ OpenProject::Application.routes.draw do
 
       # states managed by client-side routing on work_package#index
       get '(/*state)' => 'work_packages#index', on: :collection, as: ''
+      get '/create_new' => 'work_packages#index', on: :collection, as: 'new_split'
       get '/new' => 'work_packages#index', on: :collection, as: 'new'
     end
 

frontend/app/components/wp-create/wp-create.controller.ts

@@ -59,19 +59,21 @@ export class WorkPackageCreateController {
               protected wpEditModeState:WorkPackageEditModeStateService,
               protected wpCacheService:WorkPackageCacheService) {
 
-    this.newWorkPackageFromParams($state.params).then(wp => {
-      this.newWorkPackage = wp;
-      this.wpEditModeState.start();
-      wpCacheService.updateWorkPackage(wp);
+    this.newWorkPackageFromParams($state.params)
+      .then(wp => {
+        this.newWorkPackage = wp;
+        this.wpEditModeState.start();
+        wpCacheService.updateWorkPackage(wp);
 
-      if ($state.params.parent_id) {
-        scopedObservable($scope, wpCacheService.loadWorkPackage($state.params.parent_id))
-          .subscribe(parent => {
-            this.parentWorkPackage = parent;
-            this.newWorkPackage.parent = parent;
-          });
-      }
-    });
+        if ($state.params.parent_id) {
+          scopedObservable($scope, wpCacheService.loadWorkPackage($state.params.parent_id))
+            .subscribe(parent => {
+              this.parentWorkPackage = parent;
+              this.newWorkPackage.parent = parent;
+            });
+        }
+      })
+      .catch(error => this.wpNotificationsService.handleErrorResponse(error));
   }
 
   protected newWorkPackageFromParams(stateParams) {

frontend/app/components/wp-edit/wp-notification.service.ts

@@ -26,7 +26,10 @@
 // See doc/COPYRIGHT.rdoc for more details.
 // ++
 
-import {WorkPackageResourceInterface} from '../api/api-v3/hal-resources/work-package-resource.service';
+import {
+  WorkPackageResourceInterface,
+  WorkPackageResource
+} from '../api/api-v3/hal-resources/work-package-resource.service';
 import {ErrorResource} from '../api/api-v3/hal-resources/error-resource.service';
 import {wpServicesModule} from '../../angular-modules';
 
@@ -50,11 +53,17 @@ export class WorkPackageNotificationService {
     this.NotificationsService.addSuccess(message);
   }
 
-  public handleErrorResponse(error, workPackage) {
-    if (!(error.data instanceof ErrorResource)) {
+  public handleErrorResponse(error, workPackage?:WorkPackageResource) {
+    const errorResource = error.data;
+    if (!(errorResource instanceof ErrorResource)) {
       return this.showGeneralError();
     }
-    this.showError(error.data, workPackage);
+
+    if (workPackage) {
+      return this.showError(errorResource, workPackage);
+    }
+
+    this.showApiErrorMessages(errorResource);
   }
 
   public showError(errorResource, workPackage) {

spec/features/work_packages/new_work_package_spec.rb

@@ -216,4 +216,26 @@ describe 'new work package', js: true do
 
     it_behaves_like 'work package creation workflow'
   end
+
+  context 'as a user with no permissions' do
+    let(:user) { FactoryGirl.create(:user, member_in_project: project, member_through_role: role) }
+    let(:role) { FactoryGirl.create :role, permissions: %i(view_work_packages) }
+    let(:wp_page) { ::Pages::Page.new }
+
+    let(:paths) {
+      [
+        new_work_packages_path,
+        new_split_work_packages_path,
+        new_project_work_packages_path(project),
+        new_split_project_work_packages_path(project)
+      ]
+    }
+
+    it 'shows a 403 error on creation paths' do
+      paths.each do |path|
+        visit path
+        wp_page.expect_notification(type: :error, message: I18n.t('api_v3.errors.code_403'))
+      end
+    end
+  end
 end