diff options
Diffstat (limited to 'spec/support/shared_examples/graphql/mutations/merge_requests/permission_check_shared_examples.rb')
-rw-r--r-- | spec/support/shared_examples/graphql/mutations/merge_requests/permission_check_shared_examples.rb | 73 |
1 files changed, 73 insertions, 0 deletions
diff --git a/spec/support/shared_examples/graphql/mutations/merge_requests/permission_check_shared_examples.rb b/spec/support/shared_examples/graphql/mutations/merge_requests/permission_check_shared_examples.rb new file mode 100644 index 00000000000..1ddbad1cea7 --- /dev/null +++ b/spec/support/shared_examples/graphql/mutations/merge_requests/permission_check_shared_examples.rb @@ -0,0 +1,73 @@ +# frozen_string_literal: true + +RSpec.shared_examples 'permission level for merge request mutation is correctly verified' do + before do + merge_request.assignees = [] + merge_request.reviewers = [] + merge_request.author = nil + end + + shared_examples_for 'when the user does not have access to the resource' do |raise_for_assigned| + it 'raises an error' do + expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable) + end + + context 'even if assigned to the merge request' do + before do + merge_request.assignees.push(user) + end + + it 'does not modify merge request' do + if raise_for_assigned + expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable) + else + # In some cases we simply do nothing instead of raising + # https://gitlab.com/gitlab-org/gitlab/-/issues/196241 + expect(subject[:merge_request]).to eq merge_request + end + end + end + + context 'even if reviewer of the merge request' do + before do + merge_request.reviewers.push(user) + end + + it 'raises an error' do + expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable) + end + end + + context 'even if author of the merge request' do + before do + merge_request.author = user + end + + it 'raises an error' do + expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable) + end + end + end + + context 'when the user is not a project member' do + it_behaves_like 'when the user does not have access to the resource', true + end + + context 'when the user is a project member' do + context 'with guest role' do + before do + merge_request.project.add_guest(user) + end + + it_behaves_like 'when the user does not have access to the resource', true + end + + context 'with reporter role' do + before do + merge_request.project.add_reporter(user) + end + + it_behaves_like 'when the user does not have access to the resource', false + end + end +end |