Only show /copy_metadata when usable

changelogs/unreleased/31735-only-show-copy_metadata-when-usable.yml

@@ -0,0 +1,5 @@
+---
+title: Only show /copy_metadata quick action when usable
+merge_request: 31735
+author: Lee Tickett
+type: fixed

lib/gitlab/quick_actions/issue_and_merge_request_actions.rb

@@ -122,7 +122,7 @@ module Gitlab
         params '#issue | !merge_request'
         types Issue, MergeRequest
         condition do
-          current_user.can?(:"update_#{quick_action_target.to_ability_name}", quick_action_target)
+          current_user.can?(:"admin_#{quick_action_target.to_ability_name}", quick_action_target)
         end
         parse_params do |issuable_param|
           extract_references(issuable_param, :issue).first ||

spec/services/quick_actions/interpret_service_spec.rb

@@ -1140,6 +1140,19 @@ describe QuickActions::InterpretService do
       let(:todo_label) { create(:label, project: project, title: 'To Do') }
       let(:inreview_label) { create(:label, project: project, title: 'In Review') }
 
+      it 'is available when the user is a developer' do
+        expect(service.available_commands(issue)).to include(a_hash_including(name: :copy_metadata))
+      end
+
+      context 'when the user does not have permission' do
+        let(:guest) { create(:user) }
+        let(:service) { described_class.new(project, guest) }
+
+        it 'is not available' do
+          expect(service.available_commands(issue)).not_to include(a_hash_including(name: :copy_metadata))
+        end
+      end
+
       it_behaves_like 'empty command' do
         let(:content) { '/copy_metadata' }
         let(:issuable) { issue }