Simplify API tests

ee/spec/requests/api/vulnerabilities_spec.rb

@@ -33,16 +33,16 @@ describe API::Vulnerabilities do
         expect(response).to have_gitlab_http_status(200)
         expect(json_response.map { |v| v['id'] }).to contain_exactly(project.vulnerabilities.second.id)
       end
-    end
 
-    it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
+      context 'when "first-class vulnerabilities" feature is disabled' do
+        before do
+          stub_feature_flags(first_class_vulnerabilities: false)
+        end
 
-    context 'when "first-class vulnerabilities" feature is disabled' do
-      before do
-        stub_feature_flags(first_class_vulnerabilities: false)
+        it_behaves_like 'getting list of vulnerability findings'
       end
-
-      it_behaves_like 'getting list of vulnerability findings'
     end
+
+    it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
   end
 end

ee/spec/requests/api/vulnerability_findings_spec.rb

@@ -10,16 +10,23 @@ describe API::VulnerabilityFindings do
     let(:project_vulnerabilities_path) { "/projects/#{project.id}/vulnerability_findings" }
 
     it_behaves_like 'getting list of vulnerability findings'
+    it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
 
-    context 'when "first-class vulnerabilities" feature is disabled' do
+    context 'with an authorized user with proper permissions' do
       before do
-        stub_feature_flags(first_class_vulnerabilities: false)
+        project.add_developer(user)
       end
 
-      it 'responds with "not found"' do
-        get api(project_vulnerabilities_path, user)
+      context 'when "first-class vulnerabilities" feature is disabled' do
+        before do
+          stub_feature_flags(first_class_vulnerabilities: false)
+        end
 
-        expect(response).to have_gitlab_http_status(404)
+        it 'responds with "not found"' do
+          get api(project_vulnerabilities_path, user)
+
+          expect(response).to have_gitlab_http_status(404)
+        end
       end
     end
   end

ee/spec/support/shared_examples/requests/api/vulnerabilities_shared_examples.rb

@@ -217,6 +217,4 @@ shared_examples 'getting list of vulnerability findings' do
       end
     end
   end
-
-  it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
 end