Merge branch 'backport-view-condition-improvement-from-ee-460' into 'master'

Fix permission checks in member row (backport from gitlab-org/gitlab-ee!460)

## What does this MR do?

It improves the check we use to display or not the members' access and controls in the members list.

## Are there points in the code the reviewer needs to double check?

No, I replaced an helper with just a permission check so I think it's a better solution.

## Why was this MR needed?

There were a spec failure in gitlab-org/gitlab-ee!460 because of the refactor done in the "request access" MR.

## What are the relevant issue numbers?

None.

## Does this MR meet the acceptance criteria?

- No CHANGELOG needed
- [x] Tests
  - [x] All builds are passing
- [x] Conform by the [style guides](https://gitlab.com/gitlab-org/gitlab-ce/blob/master/CONTRIBUTING.md#style-guides)
- [x] Branch has no merge conflicts with `master` (if you do - rebase it please)
- [x] [Squashed related commits together](https://git-scm.com/book/en/Git-Tools-Rewriting-History#Squashing-Commits)

See merge request !4670

4 files changed, 5 insertions, 10 deletions

diff --git a/app/helpers/members_helper.rb b/app/helpers/members_helper.rb
index a53828ef4e7..877c77050be 100644
--- a/app/helpers/members_helper.rb
+++ b/app/helpers/members_helper.rb
@@ -6,12 +6,6 @@ module MembersHelper
     "#{action}_#{member.type.underscore}".to_sym
   end
 
-  def can_see_member_roles?(source:, user: nil)
-    return false unless user
-
-    user.is_admin? || source.members.exists?(user_id: user.id)
-  end
-
   def remove_member_message(member, user: nil)
     user = current_user if defined?(current_user)
 
diff --git a/app/views/groups/group_members/update.js.haml b/app/views/groups/group_members/update.js.haml
index b0b3a51ce58..da71de4cd1e 100644
--- a/app/views/groups/group_members/update.js.haml
+++ b/app/views/groups/group_members/update.js.haml
@@ -1,2 +1,2 @@
 :plain
-  $("##{dom_id(@group_member)}").replaceWith('#{escape_javascript(render(@group_member, member: @group_member))}');
+  $("##{dom_id(@group_member)}").replaceWith('#{escape_javascript(render('shared/members/member', member: @group_member))}');
diff --git a/app/views/projects/project_members/update.js.haml b/app/views/projects/project_members/update.js.haml
index 2fb3a41d541..45f8ef89060 100644
--- a/app/views/projects/project_members/update.js.haml
+++ b/app/views/projects/project_members/update.js.haml
@@ -1,2 +1,2 @@
 :plain
-  $("##{dom_id(@project_member)}").replaceWith('#{escape_javascript(render("project_member", member: @project_member))}');
+  $("##{dom_id(@project_member)}").replaceWith('#{escape_javascript(render('shared/members/member', member: @project_member))}');
diff --git a/app/views/shared/members/_member.html.haml b/app/views/shared/members/_member.html.haml
index c69d4cbfbe3..0191814849a 100644
--- a/app/views/shared/members/_member.html.haml
+++ b/app/views/shared/members/_member.html.haml
@@ -1,4 +1,5 @@
-- show_roles = local_assigns.fetch(:show_roles, true)
+- default_show_roles = can?(current_user, action_member_permission(:update, member), member) || can?(current_user, action_member_permission(:destroy, member), member)
+- show_roles = local_assigns.fetch(:show_roles, default_show_roles)
 - show_controls = local_assigns.fetch(:show_controls, true)
 - user = member.user
 
@@ -36,7 +37,7 @@
                   method: :post,
                   class: 'btn-xs btn'
 
-  - if show_roles && can_see_member_roles?(source: member.source, user: current_user)
+  - if show_roles
     %span.pull-right
       %strong= member.human_access
       - if show_controls