1 files changed, 13 insertions, 0 deletions
diff --git a/spec/policies/merge_request_policy_spec.rb b/spec/policies/merge_request_policy_spec.rb
index 3a46d5b9226..744822f58d1 100644
--- a/spec/policies/merge_request_policy_spec.rb
+++ b/spec/policies/merge_request_policy_spec.rb
@@ -24,6 +24,7 @@ RSpec.describe MergeRequestPolicy do
   mr_perms = %i[create_merge_request_in
                 create_merge_request_from
                 read_merge_request
+                create_todo
                 approve_merge_request
                 create_note].freeze
 
@@ -47,6 +48,18 @@ RSpec.describe MergeRequestPolicy do
     end
   end
 
+  context 'when merge request is public' do
+    context 'and user is anonymous' do
+      let(:merge_request) { create(:merge_request, source_project: project, target_project: project, author: author) }
+
+      subject { permissions(nil, merge_request) }
+
+      it do
+        is_expected.to be_disallowed(:create_todo)
+      end
+    end
+  end
+
   context 'when merge requests have been disabled' do
     let!(:merge_request) { create(:merge_request, source_project: project, target_project: project, author: author) }