def METHOD_NAME(user_api_client, checkout):
    # given
    checkout.user = user_api_client.user
    checkout.save(update_fields=["user"])
    variables = {"token": checkout.pk}
    # when
    response = user_api_client.post_graphql(QUERY_CHECKOUT_PRIVATE_META, variables)
    # then
    assert_no_permission(response)