Merge branch '216516-test-authorizations-in-graphql-mutations' into 'master'

Resolve "Test authorizations in GraphQL Mutations"

Closes #216516

See merge request gitlab-org/gitlab!31042

spec/graphql/mutations/issues/set_confidential_spec.rb

@@ -8,6 +8,8 @@ describe Mutations::Issues::SetConfidential do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_issue) }
+
   describe '#resolve' do
     let(:confidential) { true }
     let(:mutated_issue) { subject[:issue] }

spec/graphql/mutations/issues/set_due_date_spec.rb

@@ -8,6 +8,8 @@ describe Mutations::Issues::SetDueDate do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_issue) }
+
   describe '#resolve' do
     let(:due_date) { 2.days.since }
     let(:mutated_issue) { subject[:issue] }

spec/graphql/mutations/merge_requests/set_labels_spec.rb

@@ -8,6 +8,8 @@ describe Mutations::MergeRequests::SetLabels do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_merge_request) }
+
   describe '#resolve' do
     let(:label) { create(:label, project: merge_request.project) }
     let(:label2) { create(:label, project: merge_request.project) }

spec/graphql/mutations/merge_requests/set_locked_spec.rb

@@ -8,6 +8,8 @@ describe Mutations::MergeRequests::SetLocked do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_merge_request) }
+
   describe '#resolve' do
     let(:locked) { true }
     let(:mutated_merge_request) { subject[:merge_request] }

spec/graphql/mutations/merge_requests/set_milestone_spec.rb

@@ -8,6 +8,8 @@ describe Mutations::MergeRequests::SetMilestone do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_merge_request) }
+
   describe '#resolve' do
     let(:milestone) { create(:milestone, project: merge_request.project) }
     let(:mutated_merge_request) { subject[:merge_request] }

spec/graphql/mutations/merge_requests/set_subscription_spec.rb

@@ -9,6 +9,8 @@ describe Mutations::MergeRequests::SetSubscription do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_merge_request) }
+
   describe '#resolve' do
     let(:subscribe) { true }
     let(:mutated_merge_request) { subject[:merge_request] }

spec/graphql/mutations/merge_requests/set_wip_spec.rb

@@ -8,6 +8,8 @@ describe Mutations::MergeRequests::SetWip do
 
   subject(:mutation) { described_class.new(object: nil, context: { current_user: user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_merge_request) }
+
   describe '#resolve' do
     let(:wip) { true }
     let(:mutated_merge_request) { subject[:merge_request] }

spec/graphql/mutations/todos/mark_all_done_spec.rb

@@ -17,6 +17,8 @@ describe Mutations::Todos::MarkAllDone do
 
   let_it_be(:user3) { create(:user) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_user) }
+
   describe '#resolve' do
     it 'marks all pending todos as done' do
       updated_todo_ids = mutation_for(current_user).resolve.dig(:updated_ids)

spec/graphql/mutations/todos/mark_done_spec.rb

@@ -16,6 +16,8 @@ describe Mutations::Todos::MarkDone do
 
   let(:mutation) { described_class.new(object: nil, context: { current_user: current_user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_todo) }
+
   describe '#resolve' do
     it 'marks a single todo as done' do
       result = mark_done_mutation(todo1)

spec/graphql/mutations/todos/restore_spec.rb

@@ -14,6 +14,8 @@ describe Mutations::Todos::Restore do
 
   let(:mutation) { described_class.new(object: nil, context: { current_user: current_user }, field: nil) }
 
+  specify { expect(described_class).to require_graphql_authorizations(:update_todo) }
+
   describe '#resolve' do
     it 'restores a single todo' do
       result = restore_mutation(todo1)