Don't depend on update ACL to create a branch

Change-Id: I8067d5885c92798fde6af289e49f7b56bfe05ae0

src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java

diff --git a/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java b/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
index 839bd26..fe1d61b 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
@@ -17,6 +17,7 @@
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.gerrit.acceptance.testsuite.project.TestProjectUpdate.allow;
 import static com.google.gerrit.server.group.SystemGroupBackend.ANONYMOUS_USERS;
+import static com.google.gerrit.server.group.SystemGroupBackend.REGISTERED_USERS;
 
 import com.google.common.collect.ImmutableSet;
 import com.google.gerrit.acceptance.LightweightPluginDaemonTest;
@@ -74,10 +75,11 @@
     projectOperations
         .project(project)
         .forUpdate()
+        .add(allow(Permission.READ).ref("refs/heads/*").group(REGISTERED_USERS))
+        .add(allow(Permission.CREATE).ref("refs/heads/*").group(REGISTERED_USERS))
         .add(allow(Permission.READ).ref("refs/heads/visible").group(ANONYMOUS_USERS))
-        .add(allow(Permission.CREATE).ref("refs/*").group(ANONYMOUS_USERS))
-        .add(allow(Permission.PUSH).ref("refs/*").group(ANONYMOUS_USERS))
         .update();
+    requestScopeOperations.setApiUser(user.id());
     gApi.projects().name(project.get()).branch("refs/heads/visible").create(new BranchInput());
     gApi.projects().name(project.get()).branch("refs/heads/invisible").create(new BranchInput());
     requestScopeOperations.setApiUserAnonymous();

src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java

diff --git a/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java b/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java
index dc0e89d..c8c7fba 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/gitiles/RepositoryResolverAccessTest.java
@@ -17,6 +17,7 @@
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.gerrit.acceptance.testsuite.project.TestProjectUpdate.allow;
 import static com.google.gerrit.server.group.SystemGroupBackend.ANONYMOUS_USERS;
+import static com.google.gerrit.server.group.SystemGroupBackend.REGISTERED_USERS;
 import static com.google.gerrit.testing.GerritJUnit.assertThrows;
 
 import com.google.gerrit.acceptance.LightweightPluginDaemonTest;
@@ -59,12 +60,14 @@
     projectOperations
         .project(project)
         .forUpdate()
+        .add(allow(Permission.READ).ref("refs/heads/*").group(REGISTERED_USERS))
+        .add(allow(Permission.CREATE).ref("refs/heads/*").group(REGISTERED_USERS))
         .add(allow(Permission.READ).ref("refs/heads/visible").group(ANONYMOUS_USERS))
-        .add(allow(Permission.CREATE).ref("refs/*").group(ANONYMOUS_USERS))
-        .add(allow(Permission.PUSH).ref("refs/*").group(ANONYMOUS_USERS))
         .update();
+    requestScopeOperations.setApiUser(user.id());
     gApi.projects().name(project.get()).branch("refs/heads/visible").create(new BranchInput());
     gApi.projects().name(project.get()).branch("refs/heads/invisible").create(new BranchInput());
+    requestScopeOperations.setApiUserAnonymous();
 
     Repository repo = resolver().open(new FakeHttpServletRequest(), project.get());
     assertThat(repo.exactRef("refs/heads/visible")).isNotNull();