# frozen_string_literal: true

require 'spec_helper'

describe Projects::Security::VulnerabilityFindingsController do
  let(:project) { create(:project) }
  let(:params) { { project_id: project, namespace_id: project.creator } }

  # when new Vulnerability Findings API is enabled, this controller serves it

  it_behaves_like VulnerabilityFindingsActions do
    let(:vulnerable) { project }
    let(:vulnerable_params) { params }
  end

  it_behaves_like SecurityDashboardsPermissions do
    let(:vulnerable) { project }
    let(:security_dashboard_action) { get :index, params: params, format: :json }
  end

  context 'when new Vulnerability Findings API is disabled' do
    before do
      stub_feature_flags(first_class_vulnerabilities: false)
    end

    # new Vulnerability Findings API is disabled and we fall back to
    # Projects::Security::VulnerabilitiesController

    it_behaves_like 'VulnerabilityFindingsActions disabled' do
      let(:vulnerable) { project }
      let(:vulnerable_params) { params }
    end

    it_behaves_like 'SecurityDashboardsPermissions disabled' do
      let(:vulnerable) { project }
      let(:security_dashboard_action) { get :index, params: params, format: :json }
    end
  end
end
