[AGILE-361] Cover the viewer who cannot select

Selection consumes Space, the arrows, Home/End and Ctrl/Cmd+A, so a
page that offers no selection must not attach anything that swallows
them. Nothing covered that, which made the permission gate the least
tested of the fixes and the one that reaches the most users.

The context re-visits after logging in: `current_user` declared inside
a describe registers its login after the outer visit hook, so the first
navigation lands before the user exists and the browser sits on the
rack-session page.

https://community.openproject.org/wp/AGILE-361

Author: myabc

modules/backlogs/spec/features/work_packages/batch_selection_spec.rb

@@ -179,7 +179,7 @@
     # Root-wide, not list-scoped: the fixtures span a sprint and a bucket
     # precisely so a regression that only selects the focused card's own list
     # would leave this short of all six.
-    it "selects every movable card across the whole root with Ctrl/Cmd+A" do
+    it "selects every orderable card across the whole root with Ctrl/Cmd+A" do
       backlogs_page.send_work_package_card_keys(story1, [:control, "a"])
 
       expect(page).to have_css("[data-batch-selected]", count: 6)
@@ -255,4 +255,35 @@
       backlogs_page.expect_work_package_card_not_described(story3)
     end
   end
+
+  # Selection consumes Space, the arrows, Home/End and Ctrl/Cmd+A. On a page
+  # where the permission makes every card fixed that is pure loss: the keys
+  # would stop scrolling the page and announce a refusal for a capability the
+  # page never offers. The root does not opt in at all, so there is nothing
+  # attached to consume them.
+  describe "without the permission to manage sprint items" do
+    let(:view_role) do
+      create(:project_role, permissions: %i(view_sprints view_work_packages))
+    end
+
+    current_user do
+      create(:user, member_with_roles: { project => view_role })
+    end
+
+    # The outer `before` visits the page, and `current_user` declared here
+    # registers its login after that hook — so the first visit lands before
+    # this user exists. Visit again once they do.
+    before do
+      backlogs_page.visit!
+    end
+
+    it "does not enable selection, and leaves its gestures to the browser" do
+      backlogs_page.expect_batch_selection_disabled
+
+      backlogs_page.toggle_card(story1)
+      backlogs_page.send_work_package_card_keys(story2, [:space])
+
+      expect(page).to have_no_css("[data-batch-selected]")
+    end
+  end
 end

modules/backlogs/spec/support/pages/backlog.rb

@@ -680,7 +680,7 @@ def expect_and_confirm_backlog_bucket_delete_modal
 
     # Every row now carries `data-sortable-lists--item-id-value` regardless of
     # whether the user may move it (a fixed row still anchors a neighbour's
-    # drop), so the item id is no longer what distinguishes a movable row.
+    # drop), so the item id is no longer what distinguishes an orderable row.
     # `draggable` and the item's `mobility` value are set independently by the
     # component and read by separate consumers (the browser's native drag
     # start, and the item controller's own drag registration), so both are
@@ -751,6 +751,16 @@ def extend_selection_to(work_package)
       modified_click(work_package, :shift)
     end
 
+    # The root advertises whether it opted into selection at all. Asserted
+    # directly because the absence of a batch proves nothing on its own: a
+    # root that opted in and simply refused every gesture looks identical
+    # from the outside, and the two differ in whether the browser still gets
+    # the keystroke.
+    def expect_batch_selection_disabled
+      expect(page).to have_css("[data-controller~='sortable-lists'][data-sortable-lists-selection-enabled-value='false']",
+                               visible: :all)
+    end
+
     # Live batch membership, in document order.
     def selected_card_ids
       all("[data-batch-selected]").pluck("data-sortable-lists--item-id-value")