Add latest changes from gitlab-org/gitlab@15-4-stable-eev15.4.0-rc42

8 files changed, 441 insertions, 204 deletions

diff --git a/spec/graphql/mutations/boards/issues/issue_move_list_spec.rb b/spec/graphql/mutations/boards/issues/issue_move_list_spec.rb
index 10aed8a1f00..8e9a567f614 100644
--- a/spec/graphql/mutations/boards/issues/issue_move_list_spec.rb
+++ b/spec/graphql/mutations/boards/issues/issue_move_list_spec.rb
@@ -55,7 +55,7 @@ RSpec.describe Mutations::Boards::Issues::IssueMoveList do
       let(:move_params) { {} }
 
       it 'generates an error' do
-        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError, 'At least one of the arguments fromListId, toListId, afterId or beforeId is required') do
+        expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError, 'At least one of the arguments fromListId, toListId, positionInList, moveAfterId, or moveBeforeId is required') do
           subject
         end
       end
@@ -71,6 +71,50 @@ RSpec.describe Mutations::Boards::Issues::IssueMoveList do
       end
     end
 
+    context 'when positionInList is given' do
+      let(:move_params) { { from_list_id: list1.id, to_list_id: list2.id, position_in_list: 0 } }
+
+      context 'when fromListId and toListId are missing' do
+        let(:move_params) { { position_in_list: 0 } }
+
+        it 'generates an error' do
+          expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError, 'Both fromListId and toListId are required when positionInList is given') do
+            subject
+          end
+        end
+      end
+
+      context 'when move_before_id is also given' do
+        let(:move_params) { { from_list_id: list1.id, to_list_id: list2.id, position_in_list: 0, move_before_id: 1 } }
+
+        it 'generates an error' do
+          expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError, 'positionInList is mutually exclusive with any of moveBeforeId or moveAfterId') do
+            subject
+          end
+        end
+      end
+
+      context 'when move_after_id is also given' do
+        let(:move_params) { { from_list_id: list1.id, to_list_id: list2.id, position_in_list: 0, move_after_id: 1 } }
+
+        it 'generates an error' do
+          expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError, 'positionInList is mutually exclusive with any of moveBeforeId or moveAfterId') do
+            subject
+          end
+        end
+      end
+
+      context 'when position_in_list is invalid' do
+        let(:move_params) { { from_list_id: list1.id, to_list_id: list2.id, position_in_list: -5 } }
+
+        it 'generates an error' do
+          expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError, "positionInList must be >= 0 or #{Boards::Issues::MoveService::LIST_END_POSITION}") do
+            subject
+          end
+        end
+      end
+    end
+
     context 'when user have access to resources' do
       it 'moves and repositions issue' do
         subject
diff --git a/spec/graphql/mutations/ci/runner/update_spec.rb b/spec/graphql/mutations/ci/runner/update_spec.rb
index b8efd4213fa..39fe2a53a68 100644
--- a/spec/graphql/mutations/ci/runner/update_spec.rb
+++ b/spec/graphql/mutations/ci/runner/update_spec.rb
@@ -6,10 +6,13 @@ RSpec.describe Mutations::Ci::Runner::Update do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
-  let_it_be(:runner) { create(:ci_runner, active: true, locked: false, run_untagged: true) }
+  let_it_be(:project1) { create(:project) }
+  let_it_be(:runner) do
+    create(:ci_runner, :project, projects: [project1], active: true, locked: false, run_untagged: true)
+  end
 
   let(:current_ctx) { { current_user: user } }
-  let(:mutated_runner) { subject[:runner] }
+  let(:mutated_runner) { response[:runner] }
 
   let(:mutation_params) do
     {
@@ -21,14 +24,14 @@ RSpec.describe Mutations::Ci::Runner::Update do
   specify { expect(described_class).to require_graphql_authorizations(:update_runner) }
 
   describe '#resolve' do
-    subject do
+    subject(:response) do
       sync(resolve(described_class, args: mutation_params, ctx: current_ctx))
     end
 
     context 'when the user cannot admin the runner' do
       it 'generates an error' do
         expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ResourceNotAvailable) do
-          subject
+          response
         end
       end
     end
@@ -37,7 +40,7 @@ RSpec.describe Mutations::Ci::Runner::Update do
       let(:mutation_params) { {} }
 
       it 'raises an error' do
-        expect { subject }.to raise_error(ArgumentError, "Arguments must be provided: id")
+        expect { response }.to raise_error(ArgumentError, "Arguments must be provided: id")
       end
     end
 
@@ -45,41 +48,150 @@ RSpec.describe Mutations::Ci::Runner::Update do
       let(:admin_user) { create(:user, :admin) }
       let(:current_ctx) { { current_user: admin_user } }
 
-      let(:mutation_params) do
-        {
-          id: runner.to_global_id,
-          description: 'updated description',
-          maintenance_note: 'updated maintenance note',
-          maximum_timeout: 900,
-          access_level: 'ref_protected',
-          active: false,
-          locked: true,
-          run_untagged: false,
-          tag_list: %w(tag1 tag2)
-        }
-      end
-
       context 'with valid arguments' do
+        let(:mutation_params) do
+          {
+            id: runner.to_global_id,
+            description: 'updated description',
+            maintenance_note: 'updated maintenance note',
+            maximum_timeout: 900,
+            access_level: 'ref_protected',
+            active: false,
+            locked: true,
+            run_untagged: false,
+            tag_list: %w(tag1 tag2)
+          }
+        end
+
         it 'updates runner with correct values' do
           expected_attributes = mutation_params.except(:id, :tag_list)
 
-          subject
+          response
 
-          expect(subject[:errors]).to be_empty
-          expect(subject[:runner]).to be_an_instance_of(Ci::Runner)
-          expect(subject[:runner]).to have_attributes(expected_attributes)
-          expect(subject[:runner].tag_list).to contain_exactly(*mutation_params[:tag_list])
+          expect(response[:errors]).to be_empty
+          expect(response[:runner]).to be_an_instance_of(Ci::Runner)
+          expect(response[:runner]).to have_attributes(expected_attributes)
+          expect(response[:runner].tag_list).to contain_exactly(*mutation_params[:tag_list])
           expect(runner.reload).to have_attributes(expected_attributes)
           expect(runner.tag_list).to contain_exactly(*mutation_params[:tag_list])
         end
       end
 
+      context 'with associatedProjects argument' do
+        let_it_be(:project2) { create(:project) }
+
+        context 'with id set to project runner' do
+          let(:mutation_params) do
+            {
+              id: runner.to_global_id,
+              description: 'updated description',
+              associated_projects: [project2.to_global_id.to_s]
+            }
+          end
+
+          it 'updates runner attributes and project relationships', :aggregate_failures do
+            expect_next_instance_of(
+              ::Ci::Runners::SetRunnerAssociatedProjectsService,
+              {
+                runner: runner,
+                current_user: admin_user,
+                project_ids: [project2.id]
+              }
+            ) do |service|
+              expect(service).to receive(:execute).and_call_original
+            end
+
+            expected_attributes = mutation_params.except(:id, :associated_projects)
+
+            response
+
+            expect(response[:errors]).to be_empty
+            expect(response[:runner]).to be_an_instance_of(Ci::Runner)
+            expect(response[:runner]).to have_attributes(expected_attributes)
+            expect(runner.reload).to have_attributes(expected_attributes)
+            expect(runner.projects).to match_array([project1, project2])
+          end
+
+          context 'with user not allowed to assign runner' do
+            before do
+              allow(admin_user).to receive(:can?).with(:assign_runner, runner).and_return(false)
+            end
+
+            it 'does not update runner', :aggregate_failures do
+              expect_next_instance_of(
+                ::Ci::Runners::SetRunnerAssociatedProjectsService,
+                {
+                  runner: runner,
+                  current_user: admin_user,
+                  project_ids: [project2.id]
+                }
+              ) do |service|
+                expect(service).to receive(:execute).and_call_original
+              end
+
+              expected_attributes = mutation_params.except(:id, :associated_projects)
+
+              response
+
+              expect(response[:errors]).to match_array(['user not allowed to assign runner'])
+              expect(response[:runner]).to be_an_instance_of(Ci::Runner)
+              expect(response[:runner]).not_to have_attributes(expected_attributes)
+              expect(runner.reload).not_to have_attributes(expected_attributes)
+              expect(runner.projects).to match_array([project1])
+            end
+          end
+        end
+
+        context 'with id set to instance runner' do
+          let(:instance_runner) { create(:ci_runner, :instance) }
+          let(:mutation_params) do
+            {
+              id: instance_runner.to_global_id,
+              description: 'updated description',
+              associated_projects: [project2.to_global_id.to_s]
+            }
+          end
+
+          it 'raises error', :aggregate_failures do
+            expect_graphql_error_to_be_created(Gitlab::Graphql::Errors::ArgumentError) do
+              response
+            end
+          end
+        end
+      end
+
+      context 'with non-existing project ID in associatedProjects argument' do
+        let(:mutation_params) do
+          {
+            id: runner.to_global_id,
+            associated_projects: ['gid://gitlab/Project/-1']
+          }
+        end
+
+        it 'does not change associated projects' do
+          expected_attributes = mutation_params.except(:id, :associated_projects)
+
+          response
+
+          expect(response[:errors]).to be_empty
+          expect(response[:runner]).to be_an_instance_of(Ci::Runner)
+          expect(response[:runner]).to have_attributes(expected_attributes)
+          expect(runner.reload).to have_attributes(expected_attributes)
+          expect(runner.projects).to match_array([project1])
+        end
+      end
+
       context 'with out-of-range maximum_timeout and missing tag_list' do
-        it 'returns a descriptive error' do
-          mutation_params[:maximum_timeout] = 100
-          mutation_params.delete(:tag_list)
+        let(:mutation_params) do
+          {
+            id: runner.to_global_id,
+            maximum_timeout: 100,
+            run_untagged: false
+          }
+        end
 
-          expect(subject[:errors]).to contain_exactly(
+        it 'returns a descriptive error' do
+          expect(response[:errors]).to contain_exactly(
             'Maximum timeout needs to be at least 10 minutes',
             'Tags list can not be empty when runner is not allowed to pick untagged jobs'
           )
@@ -90,7 +202,7 @@ RSpec.describe Mutations::Ci::Runner::Update do
         it 'returns a descriptive error' do
           mutation_params[:maintenance_note] = '1' * 1025
 
-          expect(subject[:errors]).to contain_exactly(
+          expect(response[:errors]).to contain_exactly(
             'Maintenance note is too long (maximum is 1024 characters)'
           )
         end
diff --git a/spec/graphql/mutations/commits/create_spec.rb b/spec/graphql/mutations/commits/create_spec.rb
index 9fc9c731b96..fd0c2c46b2e 100644
--- a/spec/graphql/mutations/commits/create_spec.rb
+++ b/spec/graphql/mutations/commits/create_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe Mutations::Commits::Create do
 
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :public, :repository) }
+  let_it_be(:group) { create(:group, :public) }
 
   let(:context) do
     GraphQL::Query::Context.new(
@@ -39,174 +40,208 @@ RSpec.describe Mutations::Commits::Create do
 
     let(:mutated_commit) { subject[:commit] }
 
-    it 'raises an error if the resource is not accessible to the user' do
-      expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-    end
-
-    context 'when user does not have enough permissions' do
-      before do
-        project.add_guest(user)
-      end
-
+    context 'when user is not a project member' do
       it 'raises an error' do
         expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
       end
     end
 
-    context 'when user is a maintainer of a different project' do
-      before do
-        create(:project_empty_repo).add_maintainer(user)
-      end
+    context 'when user is a direct project member' do
+      context 'and user is a guest' do
+        before do
+          project.add_guest(user)
+        end
 
-      it 'raises an error' do
-        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+        it 'raises an error' do
+          expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+        end
       end
-    end
 
-    context 'when the user can create a commit' do
-      let(:deltas) { mutated_commit.raw_deltas }
+      context 'and user is a developer' do
+        let(:deltas) { mutated_commit.raw_deltas }
 
-      before_all do
-        project.add_developer(user)
-      end
-
-      context 'when service successfully creates a new commit' do
-        it "returns the ETag path for the commit's pipeline" do
-          commit_pipeline_path = subject[:commit_pipeline_path]
-          expect(commit_pipeline_path).to match(%r(pipelines/sha/\w+))
+        before_all do
+          project.add_developer(user)
         end
 
-        it 'returns the content of the commit' do
-          expect(subject[:content]).to eq(actions.pluck(:content))
-        end
+        context 'when service successfully creates a new commit' do
+          it "returns the ETag path for the commit's pipeline" do
+            commit_pipeline_path = subject[:commit_pipeline_path]
+            expect(commit_pipeline_path).to match(%r(pipelines/sha/\w+))
+          end
 
-        it 'returns a new commit' do
-          expect(mutated_commit).to have_attributes(message: message, project: project)
-          expect(subject[:errors]).to be_empty
+          it 'returns the content of the commit' do
+            expect(subject[:content]).to eq(actions.pluck(:content))
+          end
 
-          expect_to_contain_deltas([
-            a_hash_including(a_mode: '0', b_mode: '100644', new_file: true, new_path: file_path)
-          ])
+          it 'returns a new commit' do
+            expect(mutated_commit).to have_attributes(message: message, project: project)
+            expect(subject[:errors]).to be_empty
+
+            expect_to_contain_deltas([
+                                       a_hash_including(a_mode: '0', b_mode: '100644', new_file: true, new_path: file_path)
+                                     ])
+          end
         end
-      end
 
-      context 'when request has multiple actions' do
-        let(:actions) do
-          [
-            {
-              action: 'create',
-              file_path: 'foo/foobar',
-              content: 'some content'
-            },
-            {
-              action: 'delete',
-              file_path: 'README.md'
-            },
-            {
-              action: 'move',
-              file_path: "LICENSE.md",
-              previous_path: "LICENSE",
-              content: "some content"
-            },
-            {
-              action: 'update',
-              file_path: 'VERSION',
-              content: 'new content'
-            },
-            {
-              action: 'chmod',
-              file_path: 'CHANGELOG',
-              execute_filemode: true
-            }
-          ]
+        context 'when request has multiple actions' do
+          let(:actions) do
+            [
+              {
+                action: 'create',
+                file_path: 'foo/foobar',
+                content: 'some content'
+              },
+              {
+                action: 'delete',
+                file_path: 'README.md'
+              },
+              {
+                action: 'move',
+                file_path: "LICENSE.md",
+                previous_path: "LICENSE",
+                content: "some content"
+              },
+              {
+                action: 'update',
+                file_path: 'VERSION',
+                content: 'new content'
+              },
+              {
+                action: 'chmod',
+                file_path: 'CHANGELOG',
+                execute_filemode: true
+              }
+            ]
+          end
+
+          it 'returns a new commit' do
+            expect(mutated_commit).to have_attributes(message: message, project: project)
+            expect(subject[:errors]).to be_empty
+
+            expect_to_contain_deltas([
+                                       a_hash_including(a_mode: '0', b_mode: '100644', new_path: 'foo/foobar'),
+                                       a_hash_including(deleted_file: true, new_path: 'README.md'),
+                                       a_hash_including(deleted_file: true, new_path: 'LICENSE'),
+                                       a_hash_including(new_file: true, new_path: 'LICENSE.md'),
+                                       a_hash_including(new_file: false, new_path: 'VERSION'),
+                                       a_hash_including(a_mode: '100644', b_mode: '100755', new_path: 'CHANGELOG')
+                                     ])
+          end
         end
 
-        it 'returns a new commit' do
-          expect(mutated_commit).to have_attributes(message: message, project: project)
-          expect(subject[:errors]).to be_empty
-
-          expect_to_contain_deltas([
-            a_hash_including(a_mode: '0', b_mode: '100644', new_path: 'foo/foobar'),
-            a_hash_including(deleted_file: true, new_path: 'README.md'),
-            a_hash_including(deleted_file: true, new_path: 'LICENSE'),
-            a_hash_including(new_file: true, new_path: 'LICENSE.md'),
-            a_hash_including(new_file: false, new_path: 'VERSION'),
-            a_hash_including(a_mode: '100644', b_mode: '100755', new_path: 'CHANGELOG')
-          ])
+        context 'when actions are not defined' do
+          let(:actions) { [] }
+
+          it 'returns a new commit' do
+            expect(mutated_commit).to have_attributes(message: message, project: project)
+            expect(subject[:errors]).to be_empty
+
+            expect_to_contain_deltas([])
+          end
         end
-      end
 
-      context 'when actions are not defined' do
-        let(:actions) { [] }
+        context 'when branch does not exist' do
+          let(:branch) { 'unknown' }
 
-        it 'returns a new commit' do
-          expect(mutated_commit).to have_attributes(message: message, project: project)
-          expect(subject[:errors]).to be_empty
+          it 'returns errors' do
+            expect(mutated_commit).to be_nil
+            expect(subject[:errors]).to match_array(['You can only create or edit files when you are on a branch'])
+          end
+        end
 
-          expect_to_contain_deltas([])
+        context 'when branch does not exist and a start branch is provided' do
+          let(:branch) { 'my-branch' }
+          let(:start_branch) { 'master' }
+          let(:actions) do
+            [
+              {
+                action: 'create',
+                file_path: 'ANOTHER_FILE.md',
+                content: 'Bye'
+              }
+            ]
+          end
+
+          it 'returns a new commit' do
+            expect(mutated_commit).to have_attributes(message: message, project: project)
+            expect(subject[:errors]).to be_empty
+            expect(subject[:content]).to eq(actions.pluck(:content))
+
+            expect_to_contain_deltas([
+                                       a_hash_including(a_mode: '0', b_mode: '100644', new_file: true, new_path: 'ANOTHER_FILE.md')
+                                     ])
+          end
         end
-      end
 
-      context 'when branch does not exist' do
-        let(:branch) { 'unknown' }
+        context 'when message is not set' do
+          let(:message) { nil }
 
-        it 'returns errors' do
-          expect(mutated_commit).to be_nil
-          expect(subject[:errors]).to eq(['You can only create or edit files when you are on a branch'])
+          it 'returns errors' do
+            expect(mutated_commit).to be_nil
+            expect(subject[:errors].to_s).to match(/3:UserCommitFiles: empty CommitMessage/)
+          end
         end
-      end
 
-      context 'when branch does not exist and a start branch is provided' do
-        let(:branch) { 'my-branch' }
-        let(:start_branch) { 'master' }
-        let(:actions) do
-          [
-            {
-              action: 'create',
-              file_path: 'ANOTHER_FILE.md',
-              content: 'Bye'
-            }
-          ]
+        context 'when actions are incorrect' do
+          let(:actions) { [{ action: 'unknown', file_path: 'test.md', content: '' }] }
+
+          it 'returns errors' do
+            expect(mutated_commit).to be_nil
+            expect(subject[:errors]).to match_array(['Unknown action \'unknown\''])
+          end
         end
 
-        it 'returns a new commit' do
-          expect(mutated_commit).to have_attributes(message: message, project: project)
-          expect(subject[:errors]).to be_empty
-          expect(subject[:content]).to eq(actions.pluck(:content))
+        context 'when branch is protected' do
+          before do
+            create(:protected_branch, project: project, name: branch)
+          end
 
-          expect_to_contain_deltas([
-            a_hash_including(a_mode: '0', b_mode: '100644', new_file: true, new_path: 'ANOTHER_FILE.md')
-          ])
+          it 'returns errors' do
+            expect(mutated_commit).to be_nil
+            expect(subject[:errors]).to match_array(['You are not allowed to push into this branch'])
+          end
         end
       end
+    end
 
-      context 'when message is not set' do
-        let(:message) { nil }
+    context 'when user is an inherited member from the group' do
+      context 'when project is public with private repository' do
+        let(:project) { create(:project, :public, :repository, :repository_private, group: group) }
 
-        it 'returns errors' do
-          expect(mutated_commit).to be_nil
-          expect(subject[:errors].to_s).to match(/3:UserCommitFiles: empty CommitMessage/)
+        context 'and user is a guest' do
+          before do
+            group.add_guest(user)
+          end
+
+          it 'raises an error' do
+            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+          end
         end
       end
 
-      context 'when actions are incorrect' do
-        let(:actions) { [{ action: 'unknown', file_path: 'test.md', content: '' }] }
+      context 'when project is private' do
+        let(:project) { create(:project, :private, :repository, group: group) }
+
+        context 'and user is a guest' do
+          before do
+            group.add_guest(user)
+          end
 
-        it 'returns errors' do
-          expect(mutated_commit).to be_nil
-          expect(subject[:errors]).to eq(['Unknown action \'unknown\''])
+          it 'raises an error' do
+            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+          end
         end
       end
+    end
 
-      context 'when branch is protected' do
-        before do
-          create(:protected_branch, project: project, name: branch)
-        end
+    context 'when user is a maintainer of a different project' do
+      before do
+        create(:project_empty_repo).add_maintainer(user)
+      end
 
-        it 'returns errors' do
-          expect(mutated_commit).to be_nil
-          expect(subject[:errors]).to eq(['You are not allowed to push into this branch'])
-        end
+      it 'raises an error' do
+        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
       end
     end
   end
diff --git a/spec/graphql/mutations/environments/canary_ingress/update_spec.rb b/spec/graphql/mutations/environments/canary_ingress/update_spec.rb
index b93fb36a8ff..2476431816e 100644
--- a/spec/graphql/mutations/environments/canary_ingress/update_spec.rb
+++ b/spec/graphql/mutations/environments/canary_ingress/update_spec.rb
@@ -43,11 +43,12 @@ RSpec.describe Mutations::Environments::CanaryIngress::Update do
         end
 
         it 'returns notice about feature removal' do
-          expect(subject[:errors]).to match_array([
-            'This endpoint was deactivated as part of the certificate-based' \
-            'kubernetes integration removal. See Epic:' \
-            'https://gitlab.com/groups/gitlab-org/configure/-/epics/8'
-          ])
+          expect(subject[:errors]).to match_array(
+            [
+              'This endpoint was deactivated as part of the certificate-based' \
+              'kubernetes integration removal. See Epic:' \
+              'https://gitlab.com/groups/gitlab-org/configure/-/epics/8'
+            ])
         end
       end
     end
diff --git a/spec/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb b/spec/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb
index 4541f8af7d3..56514c985ff 100644
--- a/spec/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb
+++ b/spec/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb
@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 RSpec.describe Mutations::IncidentManagement::TimelineEvent::PromoteFromNote do
+  include NotesHelper
+
   let_it_be(:current_user) { create(:user) }
   let_it_be(:project) { create(:project) }
   let_it_be(:incident) { create(:incident, project: project) }
@@ -23,7 +25,7 @@ RSpec.describe Mutations::IncidentManagement::TimelineEvent::PromoteFromNote do
       let(:expected_timeline_event) do
         instance_double(
           'IncidentManagement::TimelineEvent',
-          note: comment.note,
+          note: "@#{comment.author.username} [commented](#{noteable_note_url(comment)}): '#{comment.note}'",
           occurred_at: comment.created_at.to_s,
           incident: incident,
           author: current_user,
diff --git a/spec/graphql/mutations/merge_requests/create_spec.rb b/spec/graphql/mutations/merge_requests/create_spec.rb
index e1edb60e4ff..6e593a5f4be 100644
--- a/spec/graphql/mutations/merge_requests/create_spec.rb
+++ b/spec/graphql/mutations/merge_requests/create_spec.rb
@@ -7,8 +7,7 @@ RSpec.describe Mutations::MergeRequests::Create do
 
   subject(:mutation) { described_class.new(object: nil, context: context, field: nil) }
 
-  let_it_be(:project) { create(:project, :public, :repository) }
-  let_it_be(:user) { create(:user) }
+  let(:user) { create(:user) }
 
   let(:context) do
     GraphQL::Query::Context.new(
@@ -38,62 +37,106 @@ RSpec.describe Mutations::MergeRequests::Create do
 
     let(:mutated_merge_request) { subject[:merge_request] }
 
-    it 'raises an error if the resource is not accessible to the user' do
-      expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+    shared_examples 'resource not available' do
+      it 'raises an error' do
+        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+      end
     end
 
-    context 'when user does not have enough permissions to create a merge request' do
-      before do
-        project.add_guest(user)
-      end
+    context 'when user is not a project member' do
+      let_it_be(:project) { create(:project, :public, :repository) }
 
-      it 'raises an error if the resource is not accessible to the user' do
-        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
-      end
+      it_behaves_like 'resource not available'
     end
 
-    context 'when the user can create a merge request' do
-      before_all do
-        project.add_developer(user)
-      end
+    context 'when user is a direct project member' do
+      let_it_be(:project) { create(:project, :public, :repository) }
 
-      it 'creates a new merge request' do
-        expect { mutated_merge_request }.to change(MergeRequest, :count).by(1)
-      end
+      context 'and user is a guest' do
+        before do
+          project.add_guest(user)
+        end
 
-      it 'returns a new merge request' do
-        expect(mutated_merge_request.title).to eq(title)
-        expect(subject[:errors]).to be_empty
+        it_behaves_like 'resource not available'
       end
 
-      context 'when optional description field is set' do
-        let(:description) { 'content' }
+      context 'and user is a developer' do
+        before do
+          project.add_developer(user)
+        end
+
+        it 'creates a new merge request' do
+          expect { mutated_merge_request }.to change(MergeRequest, :count).by(1)
+        end
 
-        it 'returns a new merge request with a description' do
-          expect(mutated_merge_request.description).to eq(description)
+        it 'returns a new merge request' do
+          expect(mutated_merge_request.title).to eq(title)
           expect(subject[:errors]).to be_empty
         end
-      end
 
-      context 'when optional labels field is set' do
-        let(:labels) { %w[label-1 label-2] }
+        context 'when optional description field is set' do
+          let(:description) { 'content' }
 
-        it 'returns a new merge request with labels' do
-          expect(mutated_merge_request.labels.map(&:title)).to eq(labels)
-          expect(subject[:errors]).to be_empty
+          it 'returns a new merge request with a description' do
+            expect(mutated_merge_request.description).to eq(description)
+            expect(subject[:errors]).to be_empty
+          end
+        end
+
+        context 'when optional labels field is set' do
+          let(:labels) { %w[label-1 label-2] }
+
+          it 'returns a new merge request with labels' do
+            expect(mutated_merge_request.labels.map(&:title)).to eq(labels)
+            expect(subject[:errors]).to be_empty
+          end
+        end
+
+        context 'when service cannot create a merge request' do
+          let(:title) { nil }
+
+          it 'does not create a new merge request' do
+            expect { mutated_merge_request }.not_to change(MergeRequest, :count)
+          end
+
+          it 'returns errors' do
+            expect(mutated_merge_request).to be_nil
+            expect(subject[:errors]).to match_array(['Title can\'t be blank'])
+          end
         end
       end
+    end
 
-      context 'when service cannot create a merge request' do
-        let(:title) { nil }
+    context 'when user is an inherited member from the group' do
+      let_it_be(:group) { create(:group, :public) }
 
-        it 'does not create a new merge request' do
-          expect { mutated_merge_request }.not_to change(MergeRequest, :count)
+      context 'when project is public with private merge requests' do
+        let_it_be(:project) do
+          create(:project,
+                 :public,
+                 :repository,
+                 group: group,
+                 merge_requests_access_level: ProjectFeature::DISABLED)
         end
 
-        it 'returns errors' do
-          expect(mutated_merge_request).to be_nil
-          expect(subject[:errors]).to eq(['Title can\'t be blank'])
+        context 'and user is a guest' do
+          before do
+            group.add_guest(user)
+          end
+
+          it_behaves_like 'resource not available'
+        end
+      end
+
+      context 'when project is private' do
+        let_it_be(:project) { create(:project, :private, :repository, group: group) }
+
+        context 'and user is a guest' do
+          before do
+            group.add_guest(user)
+          end
+
+          it_behaves_like 'resource not available'
         end
       end
     end
diff --git a/spec/graphql/mutations/releases/create_spec.rb b/spec/graphql/mutations/releases/create_spec.rb
index b6b9449aa39..e7c25a20bad 100644
--- a/spec/graphql/mutations/releases/create_spec.rb
+++ b/spec/graphql/mutations/releases/create_spec.rb
@@ -135,7 +135,7 @@ RSpec.describe Mutations::Releases::Create do
           it 'has an access error' do
             subject
 
-            expect(resolve).to include(errors: ['Access Denied'])
+            expect(resolve).to include(errors: ['You are not allowed to create this tag as it is protected.'])
           end
         end
       end
diff --git a/spec/graphql/mutations/releases/update_spec.rb b/spec/graphql/mutations/releases/update_spec.rb
index 15b10ea0648..0cf10e03fb1 100644
--- a/spec/graphql/mutations/releases/update_spec.rb
+++ b/spec/graphql/mutations/releases/update_spec.rb
@@ -18,8 +18,8 @@ RSpec.describe Mutations::Releases::Update do
 
   let_it_be(:release) do
     create(:release, project: project, tag: tag, name: name,
-           description: description, released_at: released_at,
-           created_at: created_at, milestones: [milestone_12_3, milestone_12_4])
+                     description: description, released_at: released_at,
+                     created_at: created_at, milestones: [milestone_12_3, milestone_12_4])
   end
 
   let(:mutation) { described_class.new(object: nil, context: { current_user: current_user }, field: nil) }