1 files changed, 22 insertions, 32 deletions

diff --git a/spec/controllers/projects/protected_branches_controller_spec.rb b/spec/controllers/projects/protected_branches_controller_spec.rb
index dcfccc00347..4996bd90005 100644
--- a/spec/controllers/projects/protected_branches_controller_spec.rb
+++ b/spec/controllers/projects/protected_branches_controller_spec.rb
@@ -3,14 +3,20 @@
 require('spec_helper')
 
 RSpec.describe Projects::ProtectedBranchesController do
-  let(:project) { create(:project, :repository) }
+  let_it_be_with_reload(:project) { create(:project, :repository) }
+  let_it_be(:maintainer) { create(:user) }
+
   let(:protected_branch) { create(:protected_branch, project: project) }
   let(:project_params) { { namespace_id: project.namespace.to_param, project_id: project } }
   let(:base_params) { project_params.merge(id: protected_branch.id) }
-  let(:user) { create(:user) }
+  let(:user) { maintainer }
+
+  before_all do
+    project.add_maintainer(maintainer)
+  end
 
   before do
-    project.add_maintainer(user)
+    sign_in(user)
   end
 
   describe "GET #index" do
@@ -30,23 +36,16 @@ RSpec.describe Projects::ProtectedBranchesController do
 
     let(:create_params) { attributes_for(:protected_branch).merge(access_level_params) }
 
-    before do
-      sign_in(user)
-    end
-
     it 'creates the protected branch rule' do
       expect do
         post(:create, params: project_params.merge(protected_branch: create_params))
       end.to change(ProtectedBranch, :count).by(1)
     end
 
-    context 'when a policy restricts rule deletion' do
-      before do
-        policy = instance_double(ProtectedBranchPolicy, allowed?: false)
-        allow(ProtectedBranchPolicy).to receive(:new).and_return(policy)
-      end
-
+    context 'when a policy restricts rule creation' do
       it "prevents creation of the protected branch rule" do
+        disallow(:create_protected_branch, an_instance_of(ProtectedBranch))
+
         post(:create, params: project_params.merge(protected_branch: create_params))
 
         expect(ProtectedBranch.count).to eq 0
@@ -57,10 +56,6 @@ RSpec.describe Projects::ProtectedBranchesController do
   describe "PUT #update" do
     let(:update_params) { { name: 'new_name' } }
 
-    before do
-      sign_in(user)
-    end
-
     it 'updates the protected branch rule' do
       put(:update, params: base_params.merge(protected_branch: update_params))
 
@@ -68,13 +63,10 @@ RSpec.describe Projects::ProtectedBranchesController do
       expect(json_response["name"]).to eq('new_name')
     end
 
-    context 'when a policy restricts rule deletion' do
-      before do
-        policy = instance_double(ProtectedBranchPolicy, allowed?: false)
-        allow(ProtectedBranchPolicy).to receive(:new).and_return(policy)
-      end
-
+    context 'when a policy restricts rule update' do
       it "prevents update of the protected branch rule" do
+        disallow(:update_protected_branch, protected_branch)
+
         old_name = protected_branch.name
 
         put(:update, params: base_params.merge(protected_branch: update_params))
@@ -85,10 +77,6 @@ RSpec.describe Projects::ProtectedBranchesController do
   end
 
   describe "DELETE #destroy" do
-    before do
-      sign_in(user)
-    end
-
     it "deletes the protected branch rule" do
       delete(:destroy, params: base_params)
 
@@ -96,16 +84,18 @@ RSpec.describe Projects::ProtectedBranchesController do
     end
 
     context 'when a policy restricts rule deletion' do
-      before do
-        policy = instance_double(ProtectedBranchPolicy, allowed?: false)
-        allow(ProtectedBranchPolicy).to receive(:new).and_return(policy)
-      end
-
       it "prevents deletion of the protected branch rule" do
+        disallow(:destroy_protected_branch, protected_branch)
+
         delete(:destroy, params: base_params)
 
         expect(response).to have_gitlab_http_status(:forbidden)
       end
     end
   end
+
+  def disallow(ability, protected_branch)
+    allow(Ability).to receive(:allowed?).and_call_original
+    allow(Ability).to receive(:allowed?).with(user, ability, protected_branch).and_return(false)
+  end
 end