Merge branch 'fix_vulnerabilities_controller_specs' into 'master'

Fix VulnerabilitiesController authorization for new action spec

See merge request gitlab-org/gitlab!74787

ee/spec/controllers/projects/security/vulnerabilities_controller_spec.rb

@@ -18,27 +18,39 @@ RSpec.describe Projects::Security::VulnerabilitiesController do
   describe 'GET #new' do
     let(:request_new_vulnerability_page) { get :new, params: { namespace_id: project.namespace, project_id: project } }
 
+    before do
+      allow(controller).to receive(:can?).and_call_original
+      allow(controller).to receive(:can?).with(controller.current_user, :create_vulnerability, project).and_return(can_create_vulnerability)
+    end
+
     include_context '"Security & Compliance" permissions' do
       let(:valid_request) { request_new_vulnerability_page }
+      let(:can_create_vulnerability) { true }
     end
 
+    it 'checks if the user can create a vulnerability' do
+      request_new_vulnerability_page
+
+      expect(controller).to have_received(:can?).with(controller.current_user, :create_vulnerability, project)
+    end
+
+    context 'when user can create vulnerability' do
+      let(:can_create_vulnerability) { true }
+
       it 'renders the add new finding page' do
         request_new_vulnerability_page
 
         expect(response).to have_gitlab_http_status(:ok)
       end
+    end
 
     context 'when user can not create vulnerability' do
-      before do
-        guest = create(:user)
-        project.add_guest(guest)
-        sign_in(guest)
-      end
+      let(:can_create_vulnerability) { false }
 
-      it 'renders a 403' do
+      it 'renders 404 page not found' do
         request_new_vulnerability_page
 
-        expect(response).to have_gitlab_http_status(:forbidden)
+        expect(response).to have_gitlab_http_status(:not_found)
       end
     end
   end