Fix ordering of issue board lists

The backend was expecting the frontend to pass only one
of `position` or `collapsed`. This changes the service
so that it handles the case where both are provided

app/services/boards/lists/update_service.rb

@@ -4,10 +4,10 @@ module Boards
   module Lists
     class UpdateService < Boards::BaseService
       def execute(list)
-        return not_authorized if preferences? && !can_read?(list)
-        return not_authorized if position? && !can_admin?(list)
+        update_preferences_result = update_preferences(list) if can_read?(list)
+        update_position_result = update_position(list) if can_admin?(list)
 
-        if update_preferences(list) || update_position(list)
+        if update_preferences_result || update_position_result
           success(list: list)
         else
           error(list.errors.messages, 422)
@@ -32,10 +32,6 @@ module Boards
         { collapsed: Gitlab::Utils.to_boolean(params[:collapsed]) }
       end
 
-      def not_authorized
-        error("Not authorized", 403)
-      end
-
       def preferences?
         params.has_key?(:collapsed)
       end

changelogs/unreleased/32427-cannot-reorder-issue-boards.yml

+---
+title: Fix ordering of issue board lists not being persisted
+merge_request: 17356
+author:
+type: fixed

spec/services/boards/lists/update_service_spec.rb

@@ -10,9 +10,8 @@ describe Boards::Lists::UpdateService do
     context 'when user can admin list' do
       it 'calls Lists::MoveService to update list position' do
         board.parent.add_developer(user)
-        service = described_class.new(board.parent, user, position: 1)
 
-        expect(Boards::Lists::MoveService).to receive(:new).with(board.parent, user, { position: 1 }).and_call_original
+        expect(Boards::Lists::MoveService).to receive(:new).with(board.parent, user, params).and_call_original
         expect_any_instance_of(Boards::Lists::MoveService).to receive(:execute).with(list)
 
         service.execute(list)
@@ -21,8 +20,6 @@ describe Boards::Lists::UpdateService do
 
     context 'when user cannot admin list' do
       it 'does not call Lists::MoveService to update list position' do
-        service = described_class.new(board.parent, user, position: 1)
-
         expect(Boards::Lists::MoveService).not_to receive(:new)
 
         service.execute(list)
@@ -34,7 +31,6 @@ describe Boards::Lists::UpdateService do
     context 'when user can read list' do
       it 'updates list preference for user' do
         board.parent.add_guest(user)
-        service = described_class.new(board.parent, user, collapsed: true)
 
         service.execute(list)
 
@@ -44,8 +40,6 @@ describe Boards::Lists::UpdateService do
 
     context 'when user cannot read list' do
       it 'does not update list preference for user' do
-        service = described_class.new(board.parent, user, collapsed: true)
-
         service.execute(list)
 
         expect(list.preferences_for(user).collapsed).to be_nil
@@ -54,35 +48,61 @@ describe Boards::Lists::UpdateService do
   end
 
   describe '#execute' do
+    let(:service) { described_class.new(board.parent, user, params) }
+
     context 'when position parameter is present' do
+      let(:params) { { position: 1 } }
+
       context 'for projects' do
-        it_behaves_like 'moving list' do
-          let(:project) { create(:project, :private) }
-          let(:board) { create(:board, project: project) }
-        end
+        let(:project) { create(:project, :private) }
+        let(:board) { create(:board, project: project) }
+
+        it_behaves_like 'moving list'
       end
 
       context 'for groups' do
-        it_behaves_like 'moving list' do
-          let(:group) { create(:group, :private) }
-          let(:board) { create(:board, group: group) }
-        end
+        let(:group) { create(:group, :private) }
+        let(:board) { create(:board, group: group) }
+
+        it_behaves_like 'moving list'
       end
     end
 
     context 'when collapsed parameter is present' do
+      let(:params) { { collapsed: true } }
+
       context 'for projects' do
-        it_behaves_like 'updating list preferences' do
-          let(:project) { create(:project, :private) }
-          let(:board) { create(:board, project: project) }
-        end
+        let(:project) { create(:project, :private) }
+        let(:board) { create(:board, project: project) }
+
+        it_behaves_like 'updating list preferences'
       end
 
       context 'for groups' do
-        it_behaves_like 'updating list preferences' do
-          let(:group) { create(:group, :private) }
-          let(:board) { create(:board, group: group) }
-        end
+        let(:project) { create(:project, :private) }
+        let(:board) { create(:board, project: project) }
+
+        it_behaves_like 'updating list preferences'
+      end
+    end
+
+    context 'when position and collapsed are both present' do
+      let(:params) { { collapsed: true, position: 1 } }
+
+      context 'for projects' do
+        let(:project) { create(:project, :private) }
+        let(:board) { create(:board, project: project) }
+
+        it_behaves_like 'moving list'
+        it_behaves_like 'updating list preferences'
+      end
+
+      context 'for groups' do
+        let(:group) { create(:group, :private) }
+        let(:board) { create(:board, group: group) }
+
+        it_behaves_like 'moving list'
+        it_behaves_like 'updating list preferences'
       end
     end
   end