def METHOD_NAME(staff_api_client, stock):
    # given
    assert not staff_api_client.user.has_perm(ProductPermissions.MANAGE_PRODUCTS)
    stock_id = graphene.Node.to_global_id("Stock", stock.pk)
    # when
    response = staff_api_client.post_graphql(QUERY_STOCK, variables={"id": stock_id})
    # then
    assert_no_permission(response)