# frozen_string_literal: true

require 'spec_helper'

RSpec.describe GitlabSchema.types['Vulnerability'] do
  let_it_be(:project) { create(:project) }
  let_it_be(:user) { create(:user) }
  let_it_be(:vulnerability) { create(:vulnerability, project: project) }
  let_it_be(:fields) do
    %i[userPermissions
       id
       title
       description
       user_notes_count
       state
       severity
       report_type
       resolved_on_default_branch
       vulnerability_path
       location
       scanner
       primary_identifier
       identifiers
       project
       issueLinks
       detected_at
       notes
       discussions]
  end

  before do
    stub_licensed_features(security_dashboard: true)

    project.add_developer(user)
  end

  subject { GitlabSchema.execute(query, context: { current_user: user }).as_json }

  it { expect(described_class).to have_graphql_fields(fields) }
  it { expect(described_class).to require_graphql_authorizations(:read_vulnerability) }

  describe 'vulnerability_path' do
    let(:query) do
      %(
        query {
          project(fullPath: "#{project.full_path}") {
            name
            vulnerabilities {
              nodes {
                vulnerabilityPath
              }
            }
          }
        }
      )
    end

    it "is the path to the vulnerability's detail page" do
      vulnerabilities = subject.dig('data', 'project', 'vulnerabilities', 'nodes')

      expect(vulnerabilities.first['vulnerabilityPath']).to eq(
        ::Gitlab::Routing.url_helpers.project_security_vulnerability_path(project, vulnerability)
      )
    end
  end
end
