Add confidential attr to graphQL for notes update

- update mutation and specs
- update graphql docs

app/graphql/mutations/notes/update/base.rb

@@ -40,7 +40,7 @@ module Mutations
         end
 
         def note_params(_note, args)
-          { note: args[:body] }.compact
+          { note: args[:body], confidential: args[:confidential] }.compact
         end
       end
     end

app/graphql/mutations/notes/update/note.rb

@@ -8,9 +8,14 @@ module Mutations
 
         argument :body,
                   GraphQL::STRING_TYPE,
-                  required: true,
+                  required: false,
                   description: copy_field_description(Types::Notes::NoteType, :body)
 
+        argument :confidential,
+                  GraphQL::BOOLEAN_TYPE,
+                  required: false,
+                  description: 'The confidentiality flag of a note. Default is false.'
+
         private
 
         def pre_update_checks!(note, _args)

changelogs/unreleased/207473-graphl-update-note-conf.yml

+---
+title: Add confidential attribute to graphQL for notes update
+merge_request: 37920
+author:
+type: added

doc/api/graphql/reference/gitlab_schema.graphql

@@ -14312,13 +14312,18 @@ input UpdateNoteInput {
   """
   Content of the note
   """
-  body: String!
+  body: String
 
   """
   A unique identifier for the client performing the mutation.
   """
   clientMutationId: String
 
+  """
+  The confidentiality flag of a note. Default is false.
+  """
+  confidential: Boolean
+
   """
   The global id of the note to update
   """

doc/api/graphql/reference/gitlab_schema.json

@@ -42306,13 +42306,19 @@
               "name": "body",
               "description": "Content of the note",
               "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
                 "kind": "SCALAR",
                 "name": "String",
                 "ofType": null
-                }
+              },
+              "defaultValue": null
+            },
+            {
+              "name": "confidential",
+              "description": "The confidentiality flag of a note. Default is false.",
+              "type": {
+                "kind": "SCALAR",
+                "name": "Boolean",
+                "ofType": null
               },
               "defaultValue": null
             },

spec/requests/api/graphql/mutations/notes/update/note_spec.rb

@@ -8,11 +8,9 @@ RSpec.describe 'Updating a Note' do
   let!(:note) { create(:note, note: original_body) }
   let(:original_body) { 'Initial body text' }
   let(:updated_body) { 'Updated body text' }
+  let(:params) { { body: updated_body, confidential: true } }
   let(:mutation) do
-    variables = {
-      id: GitlabSchema.id_from_object(note).to_s,
-      body: updated_body
-    }
+    variables = params.merge(id: GitlabSchema.id_from_object(note).to_s)
 
     graphql_mutation(:update_note, variables)
   end
@@ -31,6 +29,7 @@ RSpec.describe 'Updating a Note' do
       post_graphql_mutation(mutation, current_user: current_user)
 
       expect(note.reload.note).to eq(original_body)
+      expect(note.confidential).to be_falsey
     end
   end
 
@@ -43,12 +42,40 @@ RSpec.describe 'Updating a Note' do
       post_graphql_mutation(mutation, current_user: current_user)
 
       expect(note.reload.note).to eq(updated_body)
+      expect(note.confidential).to be_truthy
     end
 
     it 'returns the updated Note' do
       post_graphql_mutation(mutation, current_user: current_user)
 
       expect(mutation_response['note']['body']).to eq(updated_body)
+      expect(mutation_response['note']['confidential']).to be_truthy
+    end
+
+    context 'when only confidential param is present' do
+      let(:params) { { confidential: true } }
+
+      it 'updates only the note confidentiality' do
+        post_graphql_mutation(mutation, current_user: current_user)
+
+        expect(note.reload.note).to eq(original_body)
+        expect(note.confidential).to be_truthy
+      end
+    end
+
+    context 'when only body param is present' do
+      let(:params) { { body: updated_body } }
+
+      before do
+        note.update_column(:confidential, true)
+      end
+
+      it 'updates only the note body' do
+        post_graphql_mutation(mutation, current_user: current_user)
+
+        expect(note.reload.note).to eq(updated_body)
+        expect(note.confidential).to be_truthy
+      end
     end
 
     context 'when there are ActiveRecord validation errors' do
@@ -60,12 +87,14 @@ RSpec.describe 'Updating a Note' do
         post_graphql_mutation(mutation, current_user: current_user)
 
         expect(note.reload.note).to eq(original_body)
+        expect(note.confidential).to be_falsey
       end
 
-      it 'returns the Note with its original body' do
+      it 'returns the original Note' do
         post_graphql_mutation(mutation, current_user: current_user)
 
         expect(mutation_response['note']['body']).to eq(original_body)
+        expect(mutation_response['note']['confidential']).to be_falsey
       end
     end
 

spec/services/notes/update_service_spec.rb

@@ -36,6 +36,16 @@ RSpec.describe Notes::UpdateService do
       end
     end
 
+    context 'with system note' do
+      before do
+        note.update_column(:system, true)
+      end
+
+      it 'does not update the note' do
+        expect { update_note(note: 'new text') }.not_to change { note.reload.note }
+      end
+    end
+
     context 'suggestions' do
       it 'refreshes note suggestions' do
         markdown = <<-MARKDOWN.strip_heredoc