Add service policies spec

src/api/spec/factories/tokens.rb

@@ -4,10 +4,17 @@
 
     factory :service_token, class: 'Token::Service' do
       type { 'Token::Service' }
+      user
+      package
+      trait :with_package_from_association_or_param do
+        package_from_association_or_params { package }
+      end
     end
+
     factory :rss_token, class: 'Token::Rss' do
       type { 'Token::Rss' }
     end
+
     factory :rebuild_token, class: 'Token::Rebuild' do
       type { 'Token::Rebuild' }
       user
@@ -16,6 +23,7 @@
         package_from_association_or_params { package }
       end
     end
+
     factory :release_token, class: 'Token::Release' do
       type { 'Token::Release' }
       user

src/api/spec/policies/token/service_policy_spec.rb

@@ -0,0 +1,19 @@
+require 'rails_helper'
+
+RSpec.describe Token::ServicePolicy do
+  let!(:user) { create(:confirmed_user, login: 'foo') }
+  let!(:project) { create(:project, maintainer: user) }
+  let!(:package) { create(:package, project: project) }
+  let!(:other_user) { build(:confirmed_user, login: 'bar') }
+  let!(:service_token) { create(:release_token, :with_package_from_association_or_param, user: user, package: package) }
+  let!(:other_user_service_token) { create(:release_token, :with_package_from_association_or_param, user: other_user) }
+
+  subject { described_class }
+
+  describe '#create' do
+    permissions :create? do
+      it { expect(subject).to permit(user, service_token) }
+      it { expect(subject).not_to permit(other_user, other_user_service_token) }
+    end
+  end
+end