Test license blocking changes.

spec/features/security/project/internal_access_spec.rb

@@ -224,4 +224,32 @@ describe "Internal Project Access", feature: true  do
     it { is_expected.to be_denied_for :user }
     it { is_expected.to be_denied_for :visitor }
   end
+
+  context "when license blocks changes" do
+    before do
+      allow(License).to receive(:block_changes?).and_return(true)
+    end
+
+    describe "GET /:project_path/issues/new" do
+      subject { new_namespace_project_issue_path(project.namespace, project) }
+
+      it { is_expected.to be_denied_for master }
+      it { is_expected.to be_denied_for reporter }
+      it { is_expected.to be_denied_for :admin }
+      it { is_expected.to be_denied_for guest }
+      it { is_expected.to be_denied_for :user }
+      it { is_expected.to be_denied_for :visitor }
+    end
+
+    describe "GET /:project_path/merge_requests/new" do
+      subject { new_namespace_project_merge_request_path(project.namespace, project) }
+
+      it { is_expected.to be_denied_for master }
+      it { is_expected.to be_denied_for reporter }
+      it { is_expected.to be_denied_for :admin }
+      it { is_expected.to be_denied_for guest }
+      it { is_expected.to be_denied_for :user }
+      it { is_expected.to be_denied_for :visitor }
+    end
+  end
 end

spec/features/security/project/private_access_spec.rb

@@ -202,4 +202,32 @@ describe "Private Project Access", feature: true  do
     it { is_expected.to be_denied_for :user }
     it { is_expected.to be_denied_for :visitor }
   end
+
+  context "when license blocks changes" do
+    before do
+      allow(License).to receive(:block_changes?).and_return(true)
+    end
+
+    describe "GET /:project_path/issues/new" do
+      subject { new_namespace_project_issue_path(project.namespace, project) }
+
+      it { is_expected.to be_denied_for master }
+      it { is_expected.to be_denied_for reporter }
+      it { is_expected.to be_denied_for :admin }
+      it { is_expected.to be_denied_for guest }
+      it { is_expected.to be_denied_for :user }
+      it { is_expected.to be_denied_for :visitor }
+    end
+
+    describe "GET /:project_path/merge_requests/new" do
+      subject { new_namespace_project_merge_request_path(project.namespace, project) }
+
+      it { is_expected.to be_denied_for master }
+      it { is_expected.to be_denied_for reporter }
+      it { is_expected.to be_denied_for :admin }
+      it { is_expected.to be_denied_for guest }
+      it { is_expected.to be_denied_for :user }
+      it { is_expected.to be_denied_for :visitor }
+    end
+  end
 end

spec/features/security/project/public_access_spec.rb

@@ -229,4 +229,32 @@ describe "Public Project Access", feature: true  do
     it { is_expected.to be_denied_for :user }
     it { is_expected.to be_denied_for :visitor }
   end
+
+  context "when license blocks changes" do
+    before do
+      allow(License).to receive(:block_changes?).and_return(true)
+    end
+
+    describe "GET /:project_path/issues/new" do
+      subject { new_namespace_project_issue_path(project.namespace, project) }
+
+      it { is_expected.to be_denied_for master }
+      it { is_expected.to be_denied_for reporter }
+      it { is_expected.to be_denied_for :admin }
+      it { is_expected.to be_denied_for guest }
+      it { is_expected.to be_denied_for :user }
+      it { is_expected.to be_denied_for :visitor }
+    end
+
+    describe "GET /:project_path/merge_requests/new" do
+      subject { new_namespace_project_merge_request_path(project.namespace, project) }
+
+      it { is_expected.to be_denied_for master }
+      it { is_expected.to be_denied_for reporter }
+      it { is_expected.to be_denied_for :admin }
+      it { is_expected.to be_denied_for guest }
+      it { is_expected.to be_denied_for :user }
+      it { is_expected.to be_denied_for :visitor }
+    end
+  end
 end

spec/lib/gitlab/git_access_spec.rb

@@ -231,6 +231,27 @@ describe Gitlab::GitAccess do
         end
       end
     end
+
+    context "when license blocks changes" do
+      before do
+        allow(License).to receive(:block_changes?).and_return(true)
+      end
+
+      permissions_matrix.keys.each do |role|
+        describe "#{role} access" do
+          before { protect_feature_branch }
+          before { project.team << [user, role] }
+
+          permissions_matrix[role].each do |action, allowed|
+            context action do
+              subject { access.push_access_check(changes[action]) }
+
+              it { expect(subject.allowed?).to be_falsey }
+            end
+          end
+        end
+      end
+    end
   end
 
   describe "pass_git_hooks?" do