Avoid enabling locked runners. Give 403 in this case

1 files changed, 14 insertions, 2 deletions

diff --git a/spec/requests/api/runners_spec.rb b/spec/requests/api/runners_spec.rb
index f4f9c417bbb..26dfa7bed05 100644
--- a/spec/requests/api/runners_spec.rb
+++ b/spec/requests/api/runners_spec.rb
@@ -362,11 +362,13 @@ describe API::Runners, api: true  do
 
   describe 'POST /projects/:id/runners' do
     context 'authorized user' do
-      it 'should enable specific runner' do
-        specific_runner2 = create(:ci_runner).tap do |runner|
+      let(:specific_runner2) do
+        create(:ci_runner).tap do |runner|
           create(:ci_runner_project, runner: runner, project: project2)
         end
+      end
 
+      it 'should enable specific runner' do
         expect do
           post api("/projects/#{project.id}/runners", user), runner_id: specific_runner2.id
         end.to change{ project.runners.count }.by(+1)
@@ -380,6 +382,16 @@ describe API::Runners, api: true  do
         expect(response.status).to eq(201)
       end
 
+      it 'should not enable locked runner' do
+        specific_runner2.update(locked: true)
+
+        expect do
+          post api("/projects/#{project.id}/runners", user), runner_id: specific_runner2.id
+        end.to change{ project.runners.count }.by(0)
+
+        expect(response.status).to eq(403)
+      end
+
       it 'should not enable shared runner' do
         post api("/projects/#{project.id}/runners", user), runner_id: shared_runner.id