Add GraphQL mutation to lock a Terraform State

https://gitlab.com/gitlab-org/gitlab/-/merge_requests/43955

app/graphql/mutations/terraform/state/lock.rb

+# frozen_string_literal: true
+
+module Mutations
+  module Terraform
+    module State
+      class Lock < Base
+        graphql_name 'TerraformStateLock'
+
+        def resolve(id:)
+          state = authorized_find!(id: id)
+          state.update(lock_xid: lock_xid, locked_by_user: current_user, locked_at: Time.current)
+
+          { errors: errors_on_object(state) }
+        end
+
+        private
+
+        def lock_xid
+          SecureRandom.uuid
+        end
+      end
+    end
+  end
+end

app/graphql/types/mutation_type.rb

@@ -55,6 +55,7 @@ module Types
                                 'destroyed during the update, and no Note will be returned'
     mount_mutation Mutations::Notes::Destroy
     mount_mutation Mutations::Terraform::State::Delete
+    mount_mutation Mutations::Terraform::State::Lock
     mount_mutation Mutations::Todos::MarkDone
     mount_mutation Mutations::Todos::Restore
     mount_mutation Mutations::Todos::MarkAllDone

spec/graphql/mutations/terraform/state/lock_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Mutations::Terraform::State::Lock do
+  let_it_be(:user) { create(:user) }
+
+  let(:state) { create(:terraform_state) }
+  let(:mutation) do
+    described_class.new(
+      object: double,
+      context: { current_user: user },
+      field: double
+    )
+  end
+
+  it { expect(described_class.graphql_name).to eq('TerraformStateLock') }
+  it { expect(described_class).to require_graphql_authorizations(:admin_terraform_state) }
+
+  describe '#resolve' do
+    let(:global_id) { state.to_global_id }
+
+    subject { mutation.resolve(id: global_id) }
+
+    context 'user does not have permission' do
+      it 'raises an error', :aggregate_failures do
+        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+        expect(state.reload).not_to be_locked
+      end
+    end
+
+    context 'user has permission' do
+      before do
+        state.project.add_maintainer(user)
+      end
+
+      it 'locks the state', :aggregate_failures do
+        expect(subject).to eq(errors: [])
+
+        expect(state.reload).to be_locked
+        expect(state.locked_by_user).to eq(user)
+        expect(state.lock_xid).to be_present
+        expect(state.locked_at).to be_present
+      end
+    end
+
+    context 'with invalid params' do
+      let(:global_id) { user.to_global_id }
+
+      it 'raises an error', :aggregate_failures do
+        expect { subject }.to raise_error(Gitlab::Graphql::Errors::ResourceNotAvailable)
+        expect(state.reload).not_to be_locked
+      end
+    end
+  end
+end

spec/requests/api/graphql/terraform/state/lock_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'lock a terraform state' do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:user) { create(:user, maintainer_projects: [project]) }
+
+  let(:state) { create(:terraform_state, project: project) }
+  let(:mutation) { graphql_mutation(:terraform_state_lock, id: state.to_global_id.to_s) }
+
+  before do
+    expect(state).not_to be_locked
+    post_graphql_mutation(mutation, current_user: user)
+  end
+
+  include_examples 'a working graphql query'
+
+  it 'unlocks the state' do
+    expect(state.reload).to be_locked
+    expect(state.locked_by_user).to eq(user)
+  end
+end