1 files changed, 82 insertions, 1 deletions
diff --git a/spec/requests/api/merge_request_approvals_spec.rb b/spec/requests/api/merge_request_approvals_spec.rb
index b18f3017e03..a1d6abec97e 100644
--- a/spec/requests/api/merge_request_approvals_spec.rb
+++ b/spec/requests/api/merge_request_approvals_spec.rb
@@ -2,8 +2,10 @@
 
 require 'spec_helper'
 
-RSpec.describe API::MergeRequestApprovals do
+RSpec.describe API::MergeRequestApprovals, feature_category: :source_code_management do
   let_it_be(:user) { create(:user) }
+  let_it_be(:user2) { create(:user) }
+  let_it_be(:bot) { create(:user, :project_bot) }
   let_it_be(:project) { create(:project, :public, :repository, creator: user, namespace: user.namespace) }
   let_it_be(:approver) { create :user }
   let_it_be(:group) { create :group }
@@ -87,4 +89,83 @@ RSpec.describe API::MergeRequestApprovals do
       end
     end
   end
+
+  describe 'PUT :id/merge_requests/:merge_request_iid/reset_approvals' do
+    before do
+      merge_request.approvals.create!(user: user2)
+      create(:project_member, :maintainer, user: bot, source: project)
+    end
+
+    context 'for a bot user' do
+      it 'clears approvals of the merge_request' do
+        put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/reset_approvals", bot)
+
+        merge_request.reload
+        expect(response).to have_gitlab_http_status(:accepted)
+        expect(merge_request.approvals).to be_empty
+      end
+
+      context 'when bot user approved the merge request' do
+        before do
+          merge_request.approvals.create!(user: bot)
+        end
+
+        it 'clears approvals of the merge_request' do
+          put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/reset_approvals", bot)
+
+          merge_request.reload
+          expect(response).to have_gitlab_http_status(:accepted)
+          expect(merge_request.approvals).to be_empty
+        end
+      end
+    end
+
+    context 'for users with non-bot roles' do
+      let(:human_user) { create(:user) }
+
+      [:add_owner, :add_maintainer, :add_developer, :add_guest].each do |role_method|
+        it 'returns 401' do
+          project.send(role_method, human_user)
+
+          put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/reset_approvals", human_user)
+
+          merge_request.reload
+          expect(response).to have_gitlab_http_status(:unauthorized)
+          expect(merge_request.approvals.pluck(:user_id)).to contain_exactly(user2.id)
+        end
+      end
+    end
+
+    context 'for bot-users from external namespaces' do
+      let_it_be(:external_bot) { create(:user, :project_bot) }
+
+      context 'for external group bot-user' do
+        before do
+          create(:group_member, :maintainer, user: external_bot, source: create(:group))
+        end
+
+        it 'returns 401' do
+          put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/reset_approvals", external_bot)
+
+          merge_request.reload
+          expect(response).to have_gitlab_http_status(:unauthorized)
+          expect(merge_request.approvals.pluck(:user_id)).to contain_exactly(user2.id)
+        end
+      end
+
+      context 'for external project bot-user' do
+        before do
+          create(:project_member, :maintainer, user: external_bot, source: create(:project))
+        end
+
+        it 'returns 401' do
+          put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/reset_approvals", external_bot)
+
+          merge_request.reload
+          expect(response).to have_gitlab_http_status(:unauthorized)
+          expect(merge_request.approvals.pluck(:user_id)).to contain_exactly(user2.id)
+        end
+      end
+    end
+  end
 end