Fix specs

app/models/project.rb

@@ -198,7 +198,7 @@ class Project < ActiveRecord::Base
     if: ->(project) { project.avatar.present? && project.avatar_changed? }
   validates :avatar, file_size: { maximum: 200.kilobytes.to_i }
   validate :visibility_level_allowed_by_group
-  validate :visibility_level_allowed_as_fork
+  validate :visibility_level_allowed_as_fork, on: :update
   add_authentication_token_field :runners_token
   before_save :ensure_runners_token
@@ -974,7 +974,7 @@ class Project < ActiveRecord::Base
   def visibility_level_allowed_as_fork?(level = self.visibility_level)
     return true unless forked?
-    Gitlab::VisibilityLevel.allowed_fork_levels(forked_from_project.visibility_level).include?(level)
+    level <= forked_from_project.visibility_level
   end
   def visibility_level_allowed_by_group?(level = self.visibility_level)

app/services/groups/base_service.rb

 module Groups
-  class BaseService < BaseService
+  class BaseService < ::BaseService
     attr_accessor :group, :current_user, :params
     def initialize(group, user, params = {})

lib/gitlab/visibility_level.rb

@@ -56,10 +56,6 @@ module Gitlab
         options.has_value?(level)
       end
-      def allowed_fork_levels(origin_level)
-        [PRIVATE, INTERNAL, PUBLIC].select{ |level| level <= origin_level }
-      end
-
       def level_name(level)
         level_name = 'Unknown'
         options.each do |name, lvl|

spec/helpers/projects_helper_spec.rb

@@ -11,16 +11,8 @@ describe ProjectsHelper do
   describe "can_change_visibility_level?" do
     let(:project) { create(:project) }
-
-    let(:fork_project) do
-      fork_project = create(:forked_project_with_submodules)
-      fork_project.build_forked_project_link(forked_to_project_id: fork_project.id, forked_from_project_id: project.id)
-      fork_project.save
-
-      fork_project
-    end
-
     let(:user) { create(:user) }
+    let(:fork_project) { Projects::ForkService.new(project, user).execute }
     it "returns false if there are no appropriate permissions" do
       allow(helper).to receive(:can?) { false }

spec/models/group_spec.rb

@@ -67,9 +67,9 @@ describe Group, models: true do
     end
     describe 'public_and_internal_only' do
-      subject { described_class.public_and_internal_only.to_a }
-      it{ is_expected.to eq([group, internal_group]) }
+      subject { described_class.public_and_internal_only.to_a.sort }
+      it{ is_expected.to eq([group, internal_group].sort) }
     end
   end

spec/services/groups/update_service_spec.rb

@@ -16,8 +16,9 @@ describe Groups::UpdateService, services: true do
           create(:project, :public, group: public_group)
         end
-        it "cant downgrade permission level" do
-          expect(public_group.errors.count).to eq(2)
+        it "does not change permission level" do
+          service.execute
+          expect(public_group.errors.count).to eq(1)
         end
       end
@@ -29,8 +30,9 @@ describe Groups::UpdateService, services: true do
           create(:project, :internal, group: internal_group)
         end
-        it "cant downgrade permission level" do
-          expect(internal_group.errors.count).to eq(2)
+        it "does not change permission level" do
+          service.execute
+          expect(internal_group.errors.count).to eq(1)
         end
       end
     end
@@ -43,6 +45,7 @@ describe Groups::UpdateService, services: true do
     end
     it "does not change permission level" do
+      service.execute
       expect(internal_group.errors.count).to eq(1)
     end
   end