1 files changed, 12 insertions, 0 deletions
diff --git a/spec/requests/api/graphql/ci/instance_variables_spec.rb b/spec/requests/api/graphql/ci/instance_variables_spec.rb
index 7acf73a4e7a..c5c88697bf4 100644
--- a/spec/requests/api/graphql/ci/instance_variables_spec.rb
+++ b/spec/requests/api/graphql/ci/instance_variables_spec.rb
@@ -57,4 +57,16 @@ RSpec.describe 'Query.ciVariables' do
       expect(graphql_data.dig('ciVariables')).to be_nil
     end
   end
+
+  context 'when the user is unauthenticated' do
+    let_it_be(:user) { nil }
+
+    it 'returns nothing' do
+      create(:ci_instance_variable, value: 'verysecret', masked: true)
+
+      post_graphql(query, current_user: user)
+
+      expect(graphql_data.dig('ciVariables')).to be_nil
+    end
+  end
 end