[#73389] Align sprint menu permissions

Align sprint menu permissions with controller mutability rules.

This hides sprint mutation actions when a sprint is only visible
through work package references so the UI no longer advertises
operations the controllers will reject.

https://community.openproject.org/wp/73389

Author: myabc

modules/backlogs/app/components/backlogs/sprint_menu_component.html.erb

@@ -66,7 +66,7 @@ See COPYRIGHT and LICENSE files for more details.
       end
     end
 
-    if user_allowed?(:create_sprints)
+    if show_edit_sprint_action?
       menu.with_item(
         id: dom_target(sprint, :menu, :edit_sprint),
         label: t(".action_menu.edit_sprint"),

modules/backlogs/app/components/backlogs/sprint_menu_component.rb

@@ -62,11 +62,19 @@ def show_task_board_link?
     end
 
     def show_start_sprint_action?
-      sprint.in_planning? && ::Sprints::StartContract.can_start?(user: current_user, sprint:, project:)
+      mutable_sprint_in_project? &&
+        sprint.in_planning? &&
+        ::Sprints::StartContract.can_start?(user: current_user, sprint:, project:)
     end
 
     def show_finish_sprint_action?
-      sprint.active? && ::Sprints::StartContract.can_start_or_finish?(user: current_user, sprint:)
+      mutable_sprint_in_project? &&
+        sprint.active? &&
+        ::Sprints::StartContract.can_start_or_finish?(user: current_user, sprint:)
+    end
+
+    def show_edit_sprint_action?
+      mutable_sprint_in_project? && user_allowed?(:create_sprints)
     end
 
     def disable_start_sprint_action?
@@ -94,5 +102,9 @@ def project_has_another_active_sprint?
     def resolved_active_sprint_ids
       active_sprint_ids || Agile::Sprint.for_project(sprint.project).active.pluck(:id)
     end
+
+    def mutable_sprint_in_project?
+      project.sprint_source.exists?(id: sprint.project_id)
+    end
   end
 end

modules/backlogs/spec/components/backlogs/sprint_menu_component_spec.rb

@@ -275,5 +275,37 @@ def menu_items
         end
       end
     end
+
+    context "when the sprint is only visible through work package references" do
+      let(:source_project) { create(:project, types: [type_feature, type_task]) }
+      let(:project) { create(:project, types: [type_feature, type_task]) }
+      let(:sprint) do
+        create(:agile_sprint,
+               project: source_project,
+               name: "Referenced Sprint",
+               start_date: Date.yesterday,
+               finish_date: Date.tomorrow,
+               status: "active")
+      end
+      let(:permissions) do
+        %i[view_sprints view_work_packages show_board_views create_sprints manage_sprint_items start_complete_sprint]
+      end
+
+      before do
+        create(:member,
+               project: source_project,
+               principal: user,
+               roles: [create(:project_role, permissions: %i[view_sprints create_sprints start_complete_sprint])])
+        create(:work_package, project:, type: type_feature, sprint:)
+      end
+
+      it "hides mutation actions" do
+        render_component
+
+        expect(page).to have_no_selector(:menuitem, text: "Start sprint")
+        expect(page).to have_no_selector(:menuitem, text: "Finish sprint")
+        expect(page).to have_no_selector(:menuitem, text: "Edit sprint")
+      end
+    end
   end
 end