Simplify API tests

ee/spec/requests/api/vulnerabilities_spec.rb

@@ -33,9 +33,6 @@ describe API::Vulnerabilities do
         expect(response).to have_gitlab_http_status(200)
         expect(json_response.map { |v| v['id'] }).to contain_exactly(project.vulnerabilities.second.id)
       end
-    end
-
-    it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
 
       context 'when "first-class vulnerabilities" feature is disabled' do
         before do
@@ -45,4 +42,7 @@ describe API::Vulnerabilities do
         it_behaves_like 'getting list of vulnerability findings'
       end
     end
+
+    it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
+  end
 end

ee/spec/requests/api/vulnerability_findings_spec.rb

@@ -10,6 +10,12 @@ describe API::VulnerabilityFindings do
     let(:project_vulnerabilities_path) { "/projects/#{project.id}/vulnerability_findings" }
 
     it_behaves_like 'getting list of vulnerability findings'
+    it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
+
+    context 'with an authorized user with proper permissions' do
+      before do
+        project.add_developer(user)
+      end
 
       context 'when "first-class vulnerabilities" feature is disabled' do
         before do
@@ -23,4 +29,5 @@ describe API::VulnerabilityFindings do
         end
       end
     end
+  end
 end

ee/spec/support/shared_examples/requests/api/vulnerabilities_shared_examples.rb

@@ -217,6 +217,4 @@ shared_examples 'getting list of vulnerability findings' do
       end
     end
   end
-
-  it_behaves_like 'forbids access to vulnerability-like endpoint in expected cases'
 end