1 files changed, 23 insertions, 2 deletions

diff --git a/spec/graphql/mutations/release_asset_links/delete_spec.rb b/spec/graphql/mutations/release_asset_links/delete_spec.rb
index 15d320b58ee..cda292f2ffa 100644
--- a/spec/graphql/mutations/release_asset_links/delete_spec.rb
+++ b/spec/graphql/mutations/release_asset_links/delete_spec.rb
@@ -7,6 +7,7 @@ RSpec.describe Mutations::ReleaseAssetLinks::Delete do
 
   let_it_be(:project) { create(:project, :private, :repository) }
   let_it_be_with_reload(:release) { create(:release, project: project) }
+  let_it_be(:reporter) { create(:user).tap { |u| project.add_reporter(u) } }
   let_it_be(:developer) { create(:user).tap { |u| project.add_developer(u) } }
   let_it_be(:maintainer) { create(:user).tap { |u| project.add_maintainer(u) } }
   let_it_be_with_reload(:release_link) { create(:release_link, release: release) }
@@ -22,7 +23,7 @@ RSpec.describe Mutations::ReleaseAssetLinks::Delete do
     let(:deleted_link) { subject[:link] }
 
     context 'when the current user has access to delete the link' do
-      let(:current_user) { maintainer }
+      let(:current_user) { developer }
 
       it 'deletes the link and returns it', :aggregate_failures do
         expect(deleted_link).to eq(release_link)
@@ -30,6 +31,26 @@ RSpec.describe Mutations::ReleaseAssetLinks::Delete do
         expect(release.links).to be_empty
       end
 
+      context 'with protected tag' do
+        context 'when user has access to the protected tag' do
+          let!(:protected_tag) { create(:protected_tag, :developers_can_create, name: '*', project: project) }
+
+          it 'does not have errors' do
+            subject
+
+            expect(resolve).to include(errors: [])
+          end
+        end
+
+        context 'when user does not have access to the protected tag' do
+          let!(:protected_tag) { create(:protected_tag, :maintainers_can_create, name: '*', project: project) }
+
+          it 'raises a resource access error' do
+            expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+          end
+        end
+      end
+
       context "when the link doesn't exist" do
         let(:mutation_arguments) { super().merge(id: "gid://gitlab/Releases::Link/#{non_existing_record_id}") }
 
@@ -48,7 +69,7 @@ RSpec.describe Mutations::ReleaseAssetLinks::Delete do
     end
 
     context 'when the current user does not have access to delete the link' do
-      let(:current_user) { developer }
+      let(:current_user) { reporter }
 
       it 'raises an error' do
         expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)