1 files changed, 34 insertions, 0 deletions
diff --git a/spec/requests/api/v3/boards_spec.rb b/spec/requests/api/v3/boards_spec.rb
index 8aaf3be4f87..eb95934f354 100644
--- a/spec/requests/api/v3/boards_spec.rb
+++ b/spec/requests/api/v3/boards_spec.rb
@@ -5,6 +5,7 @@ describe API::V3::Boards, api: true  do
 
   let(:user)        { create(:user) }
   let(:guest)       { create(:user) }
+  let(:non_member)  { create(:user) }
   let!(:project)    { create(:empty_project, :public, creator_id: user.id, namespace: user.namespace ) }
 
   let!(:dev_label) do
@@ -76,4 +77,37 @@ describe API::V3::Boards, api: true  do
       expect(response).to have_http_status(404)
     end
   end
+
+  describe "DELETE /projects/:id/board/lists/:list_id" do
+    let(:base_url) { "/projects/#{project.id}/boards/#{board.id}/lists" }
+
+    it "rejects a non member from deleting a list" do
+      delete v3_api("#{base_url}/#{dev_list.id}", non_member)
+
+      expect(response).to have_http_status(403)
+    end
+
+    it "rejects a user with guest role from deleting a list" do
+      delete v3_api("#{base_url}/#{dev_list.id}", guest)
+
+      expect(response).to have_http_status(403)
+    end
+
+    it "returns 404 error if list id not found" do
+      delete v3_api("#{base_url}/44444", user)
+
+      expect(response).to have_http_status(404)
+    end
+
+    context "when the user is project owner" do
+      let(:owner)     { create(:user) }
+      let(:project)   { create(:empty_project, namespace: owner.namespace) }
+
+      it "deletes the list if an admin requests it" do
+        delete v3_api("#{base_url}/#{dev_list.id}", owner)
+
+        expect(response).to have_http_status(200)
+      end
+    end
+  end
 end