Limit scope of admin mode in Groups::PushRulesController specs

ee/spec/controllers/groups/push_rules_controller_spec.rb

@@ -74,15 +74,15 @@ describe Groups::PushRulesController do
       patch :update, params: { group_id: group, push_rule: { prevent_secrets: true } }
     end
 
-    context 'when user is at least a maintainer' do
     before do
       sign_in(user)
-        group.add_maintainer(user)
     end
 
     context 'push rules unlicensed' do
       before do
         stub_licensed_features(push_rules: false)
+
+        group.add_maintainer(user)
       end
 
       it 'returns 404 status' do
@@ -92,18 +92,11 @@ describe Groups::PushRulesController do
       end
     end
 
-      context 'push rules licensed', :enable_admin_mode do
+    context 'push rules licensed' do
       before do
         stub_licensed_features(push_rules: true)
       end
 
-        it 'updates the push rule' do
-          do_update
-
-          expect(response).to have_gitlab_http_status(:found)
-          expect(group.reload.push_rule.prevent_secrets).to be_truthy
-        end
-
       shared_examples 'updateable setting' do |rule_attr, new_value|
         it 'updates the setting' do
           patch :update, params: { group_id: group, push_rule: { rule_attr => new_value } }
@@ -169,14 +162,27 @@ describe Groups::PushRulesController do
           context 'as an admin' do
             let(:user) { create(:admin) }
 
+            context 'when admin mode enabled', :enable_admin_mode do
               it_behaves_like 'an updatable setting with global default', rule_attr, updates: true
             end
 
+            context 'when admin mode disabled' do
+              it_behaves_like 'a not updatable setting with global default', rule_attr, updates: true
+            end
+          end
+
           context 'as a maintainer user' do
             before do
               group.add_maintainer(user)
             end
 
+            it 'updates the push rule' do
+              do_update
+
+              expect(response).to have_gitlab_http_status(:found)
+              expect(group.reload.push_rule.prevent_secrets).to be_truthy
+            end
+
             context "when global setting #{rule_attr} is disabled" do
               before do
                 stub_licensed_features(rule_attr => false)
@@ -206,7 +212,6 @@ describe Groups::PushRulesController do
         end
       end
     end
-    end
 
     context 'when user role is lower than maintainer' do
       before do