Add latest changes from gitlab-org/gitlab@master

25 files changed, 205 insertions, 129 deletions

diff --git a/app/helpers/routing/pseudonymization_helper.rb b/app/helpers/routing/pseudonymization_helper.rb
index 1d9320f0106..e8202a4fb82 100644
--- a/app/helpers/routing/pseudonymization_helper.rb
+++ b/app/helpers/routing/pseudonymization_helper.rb
@@ -6,7 +6,8 @@ module Routing
       return unless Feature.enabled?(:mask_page_urls, type: :ops)
 
       mask_params(Rails.application.routes.recognize_path(request.original_fullpath))
-    rescue ActionController::RoutingError, URI::InvalidURIError
+    rescue ActionController::RoutingError, URI::InvalidURIError => e
+      Gitlab::ErrorTracking.track_exception(e, url: request.original_fullpath)
       nil
     end
 
diff --git a/app/models/award_emoji.rb b/app/models/award_emoji.rb
index d251b0adbd3..c8f6b9aaedb 100644
--- a/app/models/award_emoji.rb
+++ b/app/models/award_emoji.rb
@@ -66,5 +66,3 @@ class AwardEmoji < ApplicationRecord
     awardable.try(:update_upvotes_count) if upvote?
   end
 end
-
-AwardEmoji.prepend_mod_with('AwardEmoji')
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index db49ec6f412..a24bb0b6bf9 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -1918,20 +1918,6 @@ class MergeRequest < ApplicationRecord
     end
   end
 
-  def lazy_upvotes_count
-    BatchLoader.for(id).batch(default_value: 0) do |ids, loader|
-      counts = AwardEmoji
-        .where(awardable_id: ids)
-        .upvotes
-        .group(:awardable_id)
-        .count
-
-      counts.each do |id, count|
-        loader.call(id, count)
-      end
-    end
-  end
-
   private
 
   def set_draft_status
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index 61f7aa2c267..b7895f6cbf3 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -77,7 +77,7 @@ class Namespace < ApplicationRecord
 
   validates :max_artifacts_size, numericality: { only_integer: true, greater_than: 0, allow_nil: true }
 
-  validate :validate_parent_type, if: -> { Feature.enabled?(:validate_namespace_parent_type) }
+  validate :validate_parent_type, if: -> { Feature.enabled?(:validate_namespace_parent_type, default_enabled: :yaml) }
   validate :nesting_level_allowed
   validate :changing_shared_runners_enabled_is_allowed
   validate :changing_allow_descendants_override_disabled_shared_runners_is_allowed
diff --git a/app/models/preloaders/merge_requests_preloader.rb b/app/models/preloaders/merge_requests_preloader.rb
deleted file mode 100644
index cefe8408cab..00000000000
--- a/app/models/preloaders/merge_requests_preloader.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-module Preloaders
-  class MergeRequestsPreloader
-    attr_reader :merge_requests
-
-    def initialize(merge_requests)
-      @merge_requests = merge_requests
-    end
-
-    def execute
-      preloader = ActiveRecord::Associations::Preloader.new
-      preloader.preload(merge_requests, { target_project: [:project_feature] })
-      merge_requests.each do |merge_request|
-        merge_request.lazy_upvotes_count
-      end
-    end
-  end
-end
diff --git a/app/policies/namespaces/project_namespace_policy.rb b/app/policies/namespaces/project_namespace_policy.rb
new file mode 100644
index 00000000000..bc08a7a45ed
--- /dev/null
+++ b/app/policies/namespaces/project_namespace_policy.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+module Namespaces
+  class ProjectNamespacePolicy < BasePolicy
+    # For now users are not granted any permissions on project namespace
+    # as it's completely hidden to them. When we start using project
+    # namespaces in queries, we will have to extend this policy.
+  end
+end
diff --git a/config/feature_flags/development/validate_namespace_parent_type.yml b/config/feature_flags/development/validate_namespace_parent_type.yml
index dc89c462f17..5c2e0add243 100644
--- a/config/feature_flags/development/validate_namespace_parent_type.yml
+++ b/config/feature_flags/development/validate_namespace_parent_type.yml
@@ -5,4 +5,4 @@ rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/322101
 milestone: '13.10'
 type: development
 group: group::access
-default_enabled: false
+default_enabled: true
diff --git a/doc/.vale/gitlab/Acronyms.yml b/doc/.vale/gitlab/Acronyms.yml
index ab602671cdf..1a1de67b72e 100644
--- a/doc/.vale/gitlab/Acronyms.yml
+++ b/doc/.vale/gitlab/Acronyms.yml
@@ -116,6 +116,7 @@ exceptions:
   - PEM
   - PEP
   - PGP
+  - PKCS
   - PHP
   - PNG
   - POSIX
diff --git a/doc/.vale/vale-json.tmpl b/doc/.vale/vale-json.tmpl
new file mode 100644
index 00000000000..ed3c3259df3
--- /dev/null
+++ b/doc/.vale/vale-json.tmpl
@@ -0,0 +1,58 @@
+{{- /* Modify Vale's output https://docs.errata.ai/vale/cli#--output */ -}}
+
+{{- /* Keep track of our various counts */ -}}
+
+{{- $e := 0 -}}
+{{- $w := 0 -}}
+{{- $s := 0 -}}
+{{- $f := 0 -}}
+
+{{- /* Range over the linted files */ -}}
+
+{{- range .Files}}
+
+{{- $f = add1 $f -}}
+{{- $path := .Path -}}
+
+{{- /* Range over the file's alerts */ -}}
+[
+
+{{- range $idx, $a := .Alerts -}}
+
+{{- $error := "" -}}
+{{- if eq .Severity "error" -}}
+    {{- $error = .Severity -}}
+    {{- $e = add1 $e  -}}
+{{- else if eq .Severity "warning" -}}
+    {{- $error = .Severity -}}
+    {{- $w = add1 $w -}}
+{{- else -}}
+    {{- $error = .Severity -}}
+    {{- $s = add1 $s -}}
+{{- end}}
+
+{{- /* Variables setup */ -}}
+
+{{- $path = $path -}}
+{{- $loc := printf "%d" .Line -}}
+{{- $check := printf "%s" .Check -}}
+{{- $message := printf "%s" .Message -}}
+{{- $link := printf "%s" .Link -}}
+{{- if $idx -}},{{- end -}}
+
+{{- /* Output */ -}}
+
+  {
+    "description": "{{ $message }}",
+    "fingerprint": "{{ $path }}-{{ $loc }}",
+    "severity": "{{ $error }}",
+    "location": {
+      "path": "{{ $path }}",
+      "lines": {
+        "begin": {{ $loc }}
+      }
+    }
+  }
+{{end -}}
+{{end -}}
+]
diff --git a/doc/administration/geo/replication/troubleshooting.md b/doc/administration/geo/replication/troubleshooting.md
index 7b82d742bd5..cdb9f111454 100644
--- a/doc/administration/geo/replication/troubleshooting.md
+++ b/doc/administration/geo/replication/troubleshooting.md
@@ -430,7 +430,7 @@ their resync may take a long time and cause significant load on your Geo nodes,
 storage and network systems.
 
 If you get the error `Synchronization failed - Error syncing repository` along with the following log messages, this indicates that the expected `geo` remote is not present in the `.git/config` file
-of a repository on the secondary Geo node's filesystem:
+of a repository on the secondary Geo node's file system:
 
 ```json
 {
@@ -803,7 +803,7 @@ get_ctl_options': invalid option: --skip-preflight-checks (OptionParser::Invalid
 get_ctl_options': invalid option: --force (OptionParser::InvalidOption)
 ```
 
-This can happen with XFS or filesystems that list files in lexical order, because the
+This can happen with XFS or file systems that list files in lexical order, because the
 load order of the Omnibus command files can be different than expected, and a global function would get redefined.
 More details can be found in [the related issue](https://gitlab.com/gitlab-org/omnibus-gitlab/-/issues/6076).
 
diff --git a/doc/administration/package_information/defaults.md b/doc/administration/package_information/defaults.md
index 45bea065995..92923141c9b 100644
--- a/doc/administration/package_information/defaults.md
+++ b/doc/administration/package_information/defaults.md
@@ -59,7 +59,7 @@ Legend:
 - `Alternative` - If it is possible to configure the component to use different type of communication. The type is listed with default port used in that case.
 - `Connection port` - Port on which the component communicates.
 
-GitLab also expects a filesystem to be ready for the storage of Git repositories
+GitLab also expects a file system to be ready for the storage of Git repositories
 and various other files.
 
 Note that if you are using NFS (Network File System), files will be carried
diff --git a/doc/administration/package_information/index.md b/doc/administration/package_information/index.md
index 25a1487bff4..12f3274ecab 100644
--- a/doc/administration/package_information/index.md
+++ b/doc/administration/package_information/index.md
@@ -39,7 +39,7 @@ libraries are located in `/opt/gitlab/version-manifest.txt`.
 
 If you don't have the package installed, you can always check the Omnibus GitLab
 [source repository](https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master), specifically the
-[config directory](https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master/config).
+[configuration directory](https://gitlab.com/gitlab-org/omnibus-gitlab/tree/master/config).
 
 For example, if you examine the `8-6-stable` branch, you can conclude that
 8.6 packages were running [Ruby 2.1.8](https://gitlab.com/gitlab-org/omnibus-gitlab/blob/8-6-stable/config/projects/gitlab.rb#L48).
diff --git a/doc/administration/reference_architectures/3k_users.md b/doc/administration/reference_architectures/3k_users.md
index da36968f053..2d8666d7a44 100644
--- a/doc/administration/reference_architectures/3k_users.md
+++ b/doc/administration/reference_architectures/3k_users.md
@@ -1230,7 +1230,7 @@ the details of each Gitaly node that makes up the cluster. Each storage is also
 and this name is used in several areas of the configuration. In this guide, the name of the storage will be
 `default`. Also, this guide is geared towards new installs, if upgrading an existing environment
 to use Gitaly Cluster, you may need to use a different name.
-Refer to the [Praefect documentation](../gitaly/praefect.md#praefect) for more info.
+Refer to the [Praefect documentation](../gitaly/praefect.md#praefect) for more information.
 
 The following IPs will be used as an example:
 
diff --git a/doc/administration/reference_architectures/50k_users.md b/doc/administration/reference_architectures/50k_users.md
index b071b48cbd9..a827f7d0b6e 100644
--- a/doc/administration/reference_architectures/50k_users.md
+++ b/doc/administration/reference_architectures/50k_users.md
@@ -1531,7 +1531,7 @@ the details of each Gitaly node that makes up the cluster. Each storage is also
 and this name is used in several areas of the configuration. In this guide, the name of the storage will be
 `default`. Also, this guide is geared towards new installs, if upgrading an existing environment
 to use Gitaly Cluster, you may need to use a different name.
-Refer to the [Praefect documentation](../gitaly/praefect.md#praefect) for more info.
+Refer to the [Praefect documentation](../gitaly/praefect.md#praefect) for more information.
 
 The following IPs will be used as an example:
 
diff --git a/doc/administration/reference_architectures/5k_users.md b/doc/administration/reference_architectures/5k_users.md
index 4dfe628039a..3e3776e6d1a 100644
--- a/doc/administration/reference_architectures/5k_users.md
+++ b/doc/administration/reference_architectures/5k_users.md
@@ -1222,7 +1222,7 @@ the details of each Gitaly node that makes up the cluster. Each storage is also
 and this name is used in several areas of the configuration. In this guide, the name of the storage will be
 `default`. Also, this guide is geared towards new installs, if upgrading an existing environment
 to use Gitaly Cluster, you may need to use a different name.
-Refer to the [Praefect documentation](../gitaly/praefect.md#praefect) for more info.
+Refer to the [Praefect documentation](../gitaly/praefect.md#praefect) for more information.
 
 The following IPs will be used as an example:
 
diff --git a/doc/administration/smime_signing_email.md b/doc/administration/smime_signing_email.md
index ebc1723076b..0a2f55ecf61 100644
--- a/doc/administration/smime_signing_email.md
+++ b/doc/administration/smime_signing_email.md
@@ -69,16 +69,16 @@ The key needs to be readable by the GitLab system user (`git` by default).
 
 The key needs to be readable by the GitLab system user (`git` by default).
 
-### How to convert S/MIME PKCS#12 / PFX format to PEM encoding
+### How to convert S/MIME PKCS #12 / PFX format to PEM encoding
 
-Typically S/MIME certificates are handled in binary PKCS#12 format (`.pfx` or `.p12`
+Typically S/MIME certificates are handled in binary PKCS #12 format (`.pfx` or `.p12`
 extensions), which contain the following in a single encrypted file:
 
 - Public certificate
 - Intermediate certificates (if any)
 - Private key
 
-To export the required files in PEM encoding from the PKCS#12 file, the
+To export the required files in PEM encoding from the PKCS #12 file, the
 `openssl` command can be used:
 
 ```shell
diff --git a/doc/administration/timezone.md b/doc/administration/timezone.md
index b6076c8ed26..87bd999ddf1 100644
--- a/doc/administration/timezone.md
+++ b/doc/administration/timezone.md
@@ -14,22 +14,22 @@ The global time zone configuration parameter can be changed in `config/gitlab.ym
 
 Uncomment and customize if you want to change the default time zone of the GitLab application.
 
-## Viewing available timezones
+## Viewing available time zones
 
 To see all available time zones, run `bundle exec rake time:zones:all`.
 
 For Omnibus installations, run `gitlab-rake time:zones:all`.
 
 NOTE:
-This Rake task does not list timezones in TZInfo format required by Omnibus GitLab during a reconfigure: [#27209](https://gitlab.com/gitlab-org/gitlab/-/issues/27209).
+This Rake task does not list time zones in TZInfo format required by Omnibus GitLab during a reconfigure: [#27209](https://gitlab.com/gitlab-org/gitlab/-/issues/27209).
 
 ## Changing time zone in Omnibus installations
 
-GitLab defaults its time zone to UTC. It has a global timezone configuration parameter in `/etc/gitlab/gitlab.rb`.
+GitLab defaults its time zone to UTC. It has a global time zone configuration parameter in `/etc/gitlab/gitlab.rb`.
 
-To obtain a list of timezones, log in to your GitLab application server and run a command that generates a list of timezones in TZInfo format for the server. For example, install `timedatectl` and run `timedatectl list-timezones`.
+To obtain a list of time zones, log in to your GitLab application server and run a command that generates a list of time zones in TZInfo format for the server. For example, install `timedatectl` and run `timedatectl list-timezones`.
 
-To update, add the timezone that best applies to your location. For example:
+To update, add the time zone that best applies to your location. For example:
 
 ```ruby
 gitlab_rails['time_zone'] = 'America/New_York'
diff --git a/doc/development/elasticsearch.md b/doc/development/elasticsearch.md
index bba4e1cda23..6d3388d521f 100644
--- a/doc/development/elasticsearch.md
+++ b/doc/development/elasticsearch.md
@@ -233,11 +233,6 @@ Any data or index cleanup needed to support migration retries should be handled
 will re-enqueue itself with a delay which is set using the `throttle_delay` option described below. The batching
 must be handled within the `migrate` method, this setting controls the re-enqueuing only.
 
-- `batch_size` - Sets the number of documents modified during a `batched!` migration run. This size should be set to a value which allows the updates 
-  enough time to finish. This can be tuned in combination with the `throttle_delay` option described below. The batching
-  must be handled within a custom `migrate` method or by using the [`Elastic::MigrationBackfillHelper`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/workers/concerns/elastic/migration_backfill_helper.rb) 
-  `migrate` method which uses this setting. Default value is 1000 documents.
-  
 - `throttle_delay` - Sets the wait time in between batch runs. This time should be set high enough to allow each migration batch
 enough time to finish. Additionally, the time should be less than 30 minutes since that is how often the
 [`Elastic::MigrationWorker`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/ee/app/workers/elastic/migration_worker.rb)
diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index 1b1118aa2f3..93f729aeb92 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -794,3 +794,22 @@ If a user sees a 404 when they would normally expect access, and the problem is
 
 In viewing the log entries, compare the `remote.ip` with the list of
 [allowed IPs](#restrict-group-access-by-ip-address) for the group.
+
+### Validation errors on namespaces and groups
+
+[GitLab 14.4 and later](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/70365) performs
+the following checks when creating or updating namespaces or groups:
+
+- Namespaces must not have parents.
+- Group parents must be groups and not namespaces.
+
+You can disable the validation if GitLab shows the following errors:
+
+- `A user namespace cannot have a parent`.
+- `A group cannot have a user namespace as its parent`.
+
+To disable the validation,
+[disable the `validate_namespace_parent_type` flag](../../administration/feature_flags.md).
+
+In the unlikely event that you had to disable this feature flag to prevent errors,
+[contact Support](https://about.gitlab.com/support/) so that we can improve this validation.
diff --git a/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md b/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md
index 51f1ec96c22..f701b8fc870 100644
--- a/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md
+++ b/doc/user/project/pages/custom_domains_ssl_tls_certification/index.md
@@ -26,7 +26,7 @@ and steps below.
 - A custom domain name `example.com` or subdomain `subdomain.example.com`.
 - Access to your domain's server control panel to set up DNS records:
   - A DNS A or CNAME record pointing your domain to GitLab Pages server.
-  - A DNS TXT record to verify your domain's ownership.
+  - A DNS `TXT` record to verify your domain's ownership.
 
 ### Steps
 
@@ -48,7 +48,7 @@ Click **Create New Domain**.
 #### 2. Get the verification code
 
 After you add a new domain to Pages, the verification code prompts you. Copy the values from GitLab
-and paste them in your domain's control panel as a TXT record on the next step.
+and paste them in your domain's control panel as a `TXT` record on the next step.
 
 ![Get the verification code](img/get_domain_verification_code_v12_0.png)
 
@@ -76,7 +76,7 @@ Root domains (`example.com`) require:
 | From                                          | DNS Record | To              |
 | --------------------------------------------- | ---------- | --------------- |
 | `example.com`                                 | A          | `35.185.44.232` |
-| `_gitlab-pages-verification-code.example.com` | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `_gitlab-pages-verification-code.example.com` | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 
 For projects on GitLab.com, this IP is `35.185.44.232`.
 For projects living in other GitLab instances (CE or EE), please contact
@@ -104,7 +104,7 @@ Subdomains (`subdomain.example.com`) require:
 | From                                                    | DNS Record | To                    |
 | ------------------------------------------------------- | ---------- | --------------------- |
 | `subdomain.example.com`                                 | CNAME      | `namespace.gitlab.io` |
-| `_gitlab-pages-verification-code.subdomain.example.com` | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `_gitlab-pages-verification-code.subdomain.example.com` | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 
 Note that, whether it's a user or a project website, the `CNAME`
 should point to your Pages domain (`namespace.gitlab.io`),
@@ -121,15 +121,15 @@ They require:
 
 - A DNS A record for the domain.
 - A DNS CNAME record for the subdomain.
-- A DNS TXT record for each.
+- A DNS `TXT` record for each.
 
 | From                                              | DNS Record | To                     |
 | ------------------------------------------------- | ---------- | ---------------------- |
 | `example.com`                                     | A          | `35.185.44.232`        |
-| `_gitlab-pages-verification-code.example.com`     | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `_gitlab-pages-verification-code.example.com`     | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 |---------------------------------------------------+------------+------------------------|
 | `www.example.com`                                 | CNAME      | `namespace.gitlab.io`  |
-| `_gitlab-pages-verification-code.www.example.com` | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `_gitlab-pages-verification-code.www.example.com` | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 
 If you're using Cloudflare, check
 [Redirecting `www.domain.com` to `domain.com` with Cloudflare](#redirecting-wwwdomaincom-to-domaincom-with-cloudflare).
@@ -196,15 +196,15 @@ For a root domain:
 
 | From                                              | DNS Record | To                     |
 | ------------------------------------------------- | ---------- | ---------------------- |
-| `example.com`                                     | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
-| `_gitlab-pages-verification-code.example.com`     | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `example.com`                                     | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `_gitlab-pages-verification-code.example.com`     | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 
 For a subdomain:
 
 | From                                              | DNS Record | To                     |
 | ------------------------------------------------- | ---------- | ---------------------- |
-| `www.example.com`                                 | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
-| `_gitlab-pages-verification-code.www.example.com` | TXT        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `www.example.com`                                 | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
+| `_gitlab-pages-verification-code.www.example.com` | `TXT`        | `gitlab-pages-verification-code=00112233445566778899aabbccddeeff` |
 
 ### Adding more domain aliases
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 4e13720ad84..d95a5fa2aca 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -32543,9 +32543,6 @@ msgstr ""
 msgid "Subscriptions"
 msgstr ""
 
-msgid "Subscription|Renew your subscription"
-msgstr ""
-
 msgid "Subscription|Your subscription for %{strong}%{namespace_name}%{strong_close} has expired and you are now on %{pricing_link_start}the GitLab Free tier%{pricing_link_end}. Don't worry, your data is safe. Get in touch with our support team (%{support_email}). They'll gladly help with your subscription renewal."
 msgstr ""
 
diff --git a/qa/qa/resource/api_fabricator.rb b/qa/qa/resource/api_fabricator.rb
index c1533577657..b94fa543b48 100644
--- a/qa/qa/resource/api_fabricator.rb
+++ b/qa/qa/resource/api_fabricator.rb
@@ -96,31 +96,35 @@ module QA
       end
 
       def api_post
-        if api_post_path == "/graphql"
-          graphql_response = post(
-            Runtime::API::Request.new(api_client, api_post_path).url,
-            query: api_post_body)
+        process_api_response(api_post_to(api_post_path, api_post_body))
+      end
+
+      def api_post_to(post_path, post_body)
+        if post_path == "/graphql"
+          graphql_response = post(Runtime::API::Request.new(api_client, post_path).url, query: post_body)
 
-          flattened_response = flatten_hash(parse_body(graphql_response))
+          body = flatten_hash(parse_body(graphql_response))
 
-          unless graphql_response.code == HTTP_STATUS_OK && flattened_response[:errors].empty?
-            raise ResourceFabricationFailedError, "Fabrication of #{self.class.name} using the API failed (#{graphql_response.code}) with `#{graphql_response}`."
+          unless graphql_response.code == HTTP_STATUS_OK && (body[:errors].nil? || body[:errors].empty?)
+            raise(ResourceFabricationFailedError, <<~MSG)
+              Fabrication of #{self.class.name} using the API failed (#{graphql_response.code}) with `#{graphql_response}`.
+            MSG
           end
 
-          flattened_response[:web_url] = flattened_response.delete(:webUrl)
-          flattened_response[:id] = flattened_response.fetch(:id).split('/')[-1]
+          body[:id] = body.fetch(:id).split('/').last
 
-          process_api_response(flattened_response)
+          body.transform_keys { |key| key.to_s.underscore.to_sym }
         else
-          response = post(
-            Runtime::API::Request.new(api_client, api_post_path).url,
-            api_post_body)
+          response = post(Runtime::API::Request.new(api_client, post_path).url, post_body)
 
           unless response.code == HTTP_STATUS_CREATED
-            raise ResourceFabricationFailedError, "Fabrication of #{self.class.name} using the API failed (#{response.code}) with `#{response}`."
+            raise(
+              ResourceFabricationFailedError,
+              "Fabrication of #{self.class.name} using the API failed (#{response.code}) with `#{response}`."
+            )
           end
 
-          process_api_response(parse_body(response))
+          parse_body(response)
         end
       end
 
diff --git a/spec/helpers/routing/pseudonymization_helper_spec.rb b/spec/helpers/routing/pseudonymization_helper_spec.rb
index 10563502555..68c1ce5b625 100644
--- a/spec/helpers/routing/pseudonymization_helper_spec.rb
+++ b/spec/helpers/routing/pseudonymization_helper_spec.rb
@@ -129,6 +129,29 @@ RSpec.describe ::Routing::PseudonymizationHelper do
     end
   end
 
+  describe 'when it raises exception' do
+    context 'calls error tracking' do
+      before do
+        controller.request.path = '/dashboard/issues'
+        controller.request.query_string = 'assignee_username=root'
+        allow(Rails.application.routes).to receive(:recognize_path).and_return({
+          controller: 'dashboard',
+          action: 'issues'
+        })
+      end
+
+      it 'sends error to sentry and returns nil' do
+        allow(helper).to receive(:mask_params).with(anything).and_raise(ActionController::RoutingError, 'Some routing error')
+
+        expect(Gitlab::ErrorTracking).to receive(:track_exception).with(
+          ActionController::RoutingError,
+          url: '/dashboard/issues?assignee_username=root').and_call_original
+
+        expect(helper.masked_page_url).to be_nil
+      end
+    end
+  end
+
   describe 'when feature flag is disabled' do
     before do
       stub_feature_flags(mask_page_urls: false)
diff --git a/spec/models/preloaders/merge_requests_preloader_spec.rb b/spec/models/preloaders/merge_requests_preloader_spec.rb
deleted file mode 100644
index 7108de2e491..00000000000
--- a/spec/models/preloaders/merge_requests_preloader_spec.rb
+++ /dev/null
@@ -1,42 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Preloaders::MergeRequestsPreloader do
-  describe '#execute' do
-    let_it_be_with_refind(:merge_requests) { create_list(:merge_request, 3) }
-    let_it_be(:upvotes) { merge_requests.each { |m| create(:award_emoji, :upvote, awardable: m) } }
-
-    it 'does not make n+1 queries' do
-      described_class.new(merge_requests).execute
-
-      control = ActiveRecord::QueryRecorder.new(skip_cached: false) do
-        # expectations make sure the queries execute
-        merge_requests.each do |m|
-          expect(m.target_project.project_feature).not_to be_nil
-          expect(m.lazy_upvotes_count).to eq(1)
-        end
-      end
-
-      # 1 query for BatchLoader to load all upvotes at once
-      expect(control.count).to eq(1)
-    end
-
-    it 'runs extra queries without preloading' do
-      control = ActiveRecord::QueryRecorder.new(skip_cached: false) do
-        # expectations make sure the queries execute
-        merge_requests.each do |m|
-          expect(m.target_project.project_feature).not_to be_nil
-          expect(m.lazy_upvotes_count).to eq(1)
-        end
-      end
-
-      # 4 queries per merge request =
-      # 1 to load merge request
-      # 1 to load project
-      # 1 to load project_feature
-      # 1 to load upvotes count
-      expect(control.count).to eq(4 * merge_requests.size)
-    end
-  end
-end
diff --git a/spec/policies/namespaces/project_namespace_policy_spec.rb b/spec/policies/namespaces/project_namespace_policy_spec.rb
new file mode 100644
index 00000000000..22f3ccec1f8
--- /dev/null
+++ b/spec/policies/namespaces/project_namespace_policy_spec.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe NamespacePolicy do
+  let_it_be(:parent) { create(:namespace) }
+  let_it_be(:namespace) { create(:project_namespace, parent: parent) }
+
+  let(:permissions) do
+    [:owner_access, :create_projects, :admin_namespace, :read_namespace,
+     :read_statistics, :transfer_projects, :create_package_settings,
+     :read_package_settings, :create_jira_connect_subscription]
+  end
+
+  subject { described_class.new(current_user, namespace) }
+
+  context 'with no user' do
+    let_it_be(:current_user) { nil }
+
+    it { is_expected.to be_disallowed(*permissions) }
+  end
+
+  context 'regular user' do
+    let_it_be(:current_user) { create(:user) }
+
+    it { is_expected.to be_disallowed(*permissions) }
+  end
+
+  context 'parent owner' do
+    let_it_be(:current_user) { parent.owner }
+
+    it { is_expected.to be_disallowed(*permissions) }
+  end
+
+  context 'admin' do
+    let_it_be(:current_user) { create(:admin) }
+
+    context 'when admin mode is enabled', :enable_admin_mode do
+      it { is_expected.to be_allowed(*permissions) }
+    end
+
+    context 'when admin mode is disabled' do
+      it { is_expected.to be_disallowed(*permissions) }
+    end
+  end
+end