1 files changed, 46 insertions, 23 deletions
diff --git a/spec/services/protected_branches/api_service_spec.rb b/spec/services/protected_branches/api_service_spec.rb
index 94484f5a7b9..c98e253267b 100644
--- a/spec/services/protected_branches/api_service_spec.rb
+++ b/spec/services/protected_branches/api_service_spec.rb
@@ -3,32 +3,55 @@
 require 'spec_helper'
 
 RSpec.describe ProtectedBranches::ApiService do
-  let_it_be(:project) { create(:project) }
-  let_it_be(:user) { create(:user, maintainer_projects: [project]) }
-
-  it 'creates a protected branch with prefilled defaults' do
-    expect(::ProtectedBranches::CreateService).to receive(:new).with(
-      project, user, hash_including(
-                       push_access_levels_attributes: [{ access_level: Gitlab::Access::MAINTAINER }],
-                       merge_access_levels_attributes: [{ access_level: Gitlab::Access::MAINTAINER }]
-                     )
-    ).and_call_original
-
-    expect(described_class.new(project, user, { name: 'new name' }).create).to be_valid
+  shared_examples 'execute with entity' do
+    it 'creates a protected branch with prefilled defaults' do
+      expect(::ProtectedBranches::CreateService).to receive(:new).with(
+        entity, user, hash_including(
+                        push_access_levels_attributes: [{ access_level: Gitlab::Access::MAINTAINER }],
+                        merge_access_levels_attributes: [{ access_level: Gitlab::Access::MAINTAINER }]
+                      )
+      ).and_call_original
+
+      expect(described_class.new(entity, user, { name: 'new name' }).create).to be_valid
+    end
+
+    it 'updates a protected branch without prefilled defaults' do
+      expect(::ProtectedBranches::UpdateService).to receive(:new).with(
+        entity, user, hash_including(
+                        push_access_levels_attributes: [],
+                        merge_access_levels_attributes: []
+                      )
+      ).and_call_original
+
+      expect do
+        expect(described_class.new(entity, user, { name: 'new name' }).update(protected_branch)).to be_valid
+      end.not_to change { protected_branch.reload.allow_force_push }
+    end
+  end
+
+  context 'with entity project' do
+    let_it_be_with_reload(:entity) { create(:project) }
+    let_it_be_with_reload(:protected_branch) { create(:protected_branch, project: entity, allow_force_push: true) }
+    let(:user) { entity.first_owner }
+
+    it_behaves_like 'execute with entity'
   end
 
-  it 'updates a protected branch without prefilled defaults' do
-    protected_branch = create(:protected_branch, project: project, allow_force_push: true)
+  context 'with entity group' do
+    let_it_be_with_reload(:entity) { create(:group) }
+    let_it_be_with_reload(:user) { create(:user) }
+    let_it_be_with_reload(:protected_branch) do
+      create(:protected_branch, group: entity, project: nil, allow_force_push: true)
+    end
 
-    expect(::ProtectedBranches::UpdateService).to receive(:new).with(
-      project, user, hash_including(
-                       push_access_levels_attributes: [],
-                       merge_access_levels_attributes: []
-                     )
-    ).and_call_original
+    before do
+      allow(Ability).to receive(:allowed?).with(user, :update_protected_branch, protected_branch).and_return(true)
+      allow(Ability)
+        .to receive(:allowed?)
+        .with(user, :create_protected_branch, instance_of(ProtectedBranch))
+        .and_return(true)
+    end
 
-    expect do
-      expect(described_class.new(project, user, { name: 'new name' }).update(protected_branch)).to be_valid
-    end.not_to change { protected_branch.reload.allow_force_push }
+    it_behaves_like 'execute with entity'
   end
 end