Add latest changes from gitlab-org/gitlab@master

21 files changed, 114 insertions, 82 deletions

diff --git a/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue b/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue
index 5dfa9c67852..f994cad6881 100644
--- a/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue
+++ b/app/assets/javascripts/users/profile/actions/components/user_actions_app.vue
@@ -83,7 +83,13 @@ export default {
 
 <template>
   <span>
-    <gl-disclosure-dropdown icon="ellipsis_v" category="tertiary" no-caret :items="dropdownItems" />
+    <gl-disclosure-dropdown
+      data-testid="user-profile-actions"
+      icon="ellipsis_v"
+      category="tertiary"
+      no-caret
+      :items="dropdownItems"
+    />
     <abuse-category-selector
       v-if="reportedUserId"
       :reported-user-id="reportedUserId"
diff --git a/app/controllers/projects/raw_controller.rb b/app/controllers/projects/raw_controller.rb
index 79b5990abba..d0a80c6aa07 100644
--- a/app/controllers/projects/raw_controller.rb
+++ b/app/controllers/projects/raw_controller.rb
@@ -19,7 +19,8 @@ class Projects::RawController < Projects::ApplicationController
   def show
     @blob = @repository.blob_at(@ref, @path, limit: Gitlab::Git::Blob::LFS_POINTER_MAX_SIZE)
 
-    send_blob(@repository, @blob, inline: (params[:inline] != 'false'), allow_caching: Guest.can?(:read_code, @project))
+    send_blob(@repository, @blob, inline: (params[:inline] != 'false'), allow_caching:
+::Users::Anonymous.can?(:read_code, @project))
   end
 
   private
diff --git a/app/controllers/projects/repositories_controller.rb b/app/controllers/projects/repositories_controller.rb
index 4a9282432fd..406e3bd62c2 100644
--- a/app/controllers/projects/repositories_controller.rb
+++ b/app/controllers/projects/repositories_controller.rb
@@ -48,7 +48,7 @@ class Projects::RepositoriesController < Projects::ApplicationController
 
     expires_in(
       cache_max_age(commit_id),
-      public: Guest.can?(:download_code, project),
+      public: ::Users::Anonymous.can?(:download_code, project),
       must_revalidate: true,
       stale_if_error: 5.minutes,
       stale_while_revalidate: 1.minute,
diff --git a/app/controllers/repositories/git_http_client_controller.rb b/app/controllers/repositories/git_http_client_controller.rb
index a5ca17db113..71d8ad829f6 100644
--- a/app/controllers/repositories/git_http_client_controller.rb
+++ b/app/controllers/repositories/git_http_client_controller.rb
@@ -142,7 +142,7 @@ module Repositories
       Gitlab::ProtocolAccess.allowed?('http') &&
       download_request? &&
       container &&
-      Guest.can?(repo_type.guest_read_ability, container)
+      ::Users::Anonymous.can?(repo_type.guest_read_ability, container)
     end
 
     def bypass_admin_mode!(&block)
diff --git a/app/controllers/repositories/lfs_api_controller.rb b/app/controllers/repositories/lfs_api_controller.rb
index d9ca216b168..d9d3753a2ff 100644
--- a/app/controllers/repositories/lfs_api_controller.rb
+++ b/app/controllers/repositories/lfs_api_controller.rb
@@ -60,7 +60,7 @@ module Repositories
         .for_oids(objects_oids)
         .index_by(&:oid)
 
-      guest_can_download = Guest.can?(:download_code, project)
+      guest_can_download = ::Users::Anonymous.can?(:download_code, project)
 
       objects.each do |object|
         if lfs_object = existing_oids[object[:oid]]
@@ -87,7 +87,7 @@ module Repositories
         if existing_oids.include?(object[:oid])
           object[:actions] = proxy_download_actions(object)
 
-          if Guest.can?(:download_code, project)
+          if ::Users::Anonymous.can?(:download_code, project)
             object[:authenticated] = true
           end
         else
diff --git a/app/models/guest.rb b/app/models/guest.rb
deleted file mode 100644
index 9c8097e1ac8..00000000000
--- a/app/models/guest.rb
+++ /dev/null
@@ -1,9 +0,0 @@
-# frozen_string_literal: true
-
-class Guest
-  class << self
-    def can?(action, subject = :global)
-      Ability.allowed?(nil, action, subject)
-    end
-  end
-end
diff --git a/app/models/users/anonymous.rb b/app/models/users/anonymous.rb
new file mode 100644
index 00000000000..b4a182ba203
--- /dev/null
+++ b/app/models/users/anonymous.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module Users
+  class Anonymous
+    class << self
+      def can?(action, subject = :global)
+        Ability.allowed?(nil, action, subject)
+      end
+    end
+  end
+end
diff --git a/doc/administration/audit_event_streaming/index.md b/doc/administration/audit_event_streaming/index.md
index 8f40dc6c34c..af2f122e0bc 100644
--- a/doc/administration/audit_event_streaming/index.md
+++ b/doc/administration/audit_event_streaming/index.md
@@ -206,7 +206,8 @@ To add Google Cloud Logging streaming destinations to a top-level group:
 1. Select **Secure > Audit events**.
 1. On the main area, select **Streams** tab.
 1. Select **Add streaming destination** and select **Google Cloud Logging** to show the section for adding destinations.
-1. Enter the Google project ID, Google client email, log ID, and Google private key to add.
+1. Enter the Google project ID, Google client email, and Google private key from previously-created Google Cloud service account key to add to the new destination.
+1. Enter a random string to use as a log ID for the new destination. You can use this later to filter log results in Google Cloud.
 1. Select **Add** to add the new streaming destination.
 
 #### List Google Cloud Logging destinations
@@ -236,7 +237,8 @@ To update Google Cloud Logging streaming destinations to a top-level group:
 1. Select **Secure > Audit events**.
 1. On the main area, select **Streams** tab.
 1. Select the Google Cloud Logging stream to expand.
-1. Enter the Google project ID, Google client email, and log ID to update.
+1. Enter the Google project ID and Google client email from previously-created Google Cloud service account key to update on the destination.
+1. Enter a random string to update the log ID for the destination. You can use this later to filter log results in Google Cloud.
 1. Select **Add a new private key** and enter a Google private key to update the private key.
 1. Select **Save** to update the streaming destination.
 
@@ -446,7 +448,8 @@ To add Google Cloud Logging streaming destinations to an instance:
 1. On the left sidebar, select **Monitoring > Audit Events**.
 1. On the main area, select **Streams** tab.
 1. Select **Add streaming destination** and select **Google Cloud Logging** to show the section for adding destinations.
-1. Enter the Google project ID, Google client email, log ID, and Google private key to add.
+1. Enter the Google project ID, Google client email, and Google private key from previously-created Google Cloud service account key to add to the new destination.
+1. Enter a random string to use as a log ID for the new destination. You can use this later to filter log results in Google Cloud.
 1. Select **Add** to add the new streaming destination.
 
 #### List Google Cloud Logging destinations
@@ -476,7 +479,8 @@ To update Google Cloud Logging streaming destinations to an instance:
 1. On the left sidebar, select **Monitoring > Audit Events**.
 1. On the main area, select **Streams** tab.
 1. Select the Google Cloud Logging stream to expand.
-1. Enter the Google project ID, Google client email, and log ID to update.
+1. Enter the Google project ID and Google client email from previously-created Google Cloud service account key to update on the destination.
+1. Enter a random string to update the log ID for the destination. You can use this later to filter log results in Google Cloud.
 1. Select **Add a new private key** and enter a Google private key to update the private key.
 1. Select **Save** to update the streaming destination.
 
diff --git a/doc/integration/advanced_search/elasticsearch.md b/doc/integration/advanced_search/elasticsearch.md
index 986bdb9a667..ef756be3ba4 100644
--- a/doc/integration/advanced_search/elasticsearch.md
+++ b/doc/integration/advanced_search/elasticsearch.md
@@ -972,6 +972,15 @@ For the steps below, consider the entry of `sidekiq['routing_rules']`:
 
 At least one process in `sidekiq['queue_groups']` has to include the `mailers` queue, otherwise mailers jobs are not processed at all.
 
+NOTE:
+Routing rules (`sidekiq['routing_rules']`) must be the same across all GitLab nodes (especially GitLab Rails and Sidekiq nodes).
+
+WARNING:
+When starting multiple processes, the number of processes cannot exceed the number of CPU
+cores you want to dedicate to Sidekiq. Each Sidekiq process can use only one CPU core, subject
+to the available workload and concurrency settings. For more details, see how to
+[run multiple Sidekiq processes](../../administration/sidekiq/extra_sidekiq_processes.md).
+
 ### Single node, two processes
 
 To create both an indexing and a non-indexing Sidekiq process in one node:
@@ -998,12 +1007,12 @@ To create both an indexing and a non-indexing Sidekiq process in one node:
 
 1. Save the file and [reconfigure GitLab](../../administration/restart_gitlab.md)
 for the changes to take effect.
+1. On all other Rails and Sidekiq nodes, ensure that `sidekiq['routing_rules']` is the same as above.
+1. Run the Rake task to [migrate existing jobs](../../administration/sidekiq/sidekiq_job_migration.md):
 
-WARNING:
-When starting multiple processes, the number of processes cannot exceed the number of CPU
-cores you want to dedicate to Sidekiq. Each Sidekiq process can use only one CPU core, subject
-to the available workload and concurrency settings. For more details, see how to
-[run multiple Sidekiq processes](../../administration/sidekiq/extra_sidekiq_processes.md).
+NOTE:
+It is important to run the Rake task immediately after reconfiguring GitLab.
+After reconfiguring GitLab, existing jobs are not processed until the Rake task starts to migrate the jobs.
 
 ### Two nodes, one process for each
 
@@ -1035,6 +1044,8 @@ for the changes to take effect.
 
    ```ruby
    sidekiq['enable'] = true
+   sidekiq['queue_selector'] = false
+
    sidekiq['routing_rules'] = [
       ["feature_category=global_search", "global_search"],
       ["*", "default"],
@@ -1048,10 +1059,18 @@ for the changes to take effect.
    sidekiq['max_concurrency'] = 20
    ```
 
-    to set up a non-indexing Sidekiq process.
-
+1. On all other Rails and Sidekiq nodes, ensure that `sidekiq['routing_rules']` is the same as above.
 1. Save the file and [reconfigure GitLab](../../administration/restart_gitlab.md)
 for the changes to take effect.
+1. Run the Rake task to [migrate existing jobs](../../administration/sidekiq/sidekiq_job_migration.md):
+
+   ```shell
+   sudo gitlab-rake gitlab:sidekiq:migrate_jobs:retry gitlab:sidekiq:migrate_jobs:schedule gitlab:sidekiq:migrate_jobs:queued
+   ```
+
+NOTE:
+It is important to run the Rake task immediately after reconfiguring GitLab.
+After reconfiguring GitLab, existing jobs are not processed until the Rake task starts to migrate the jobs.
 
 ## Reverting to Basic Search
 
diff --git a/lib/api/helpers/kubernetes/agent_helpers.rb b/lib/api/helpers/kubernetes/agent_helpers.rb
index 50a8c2a5aed..aa4f4310e1d 100644
--- a/lib/api/helpers/kubernetes/agent_helpers.rb
+++ b/lib/api/helpers/kubernetes/agent_helpers.rb
@@ -41,7 +41,7 @@ module API
         end
 
         def agent_has_access_to_project?(project)
-          Guest.can?(:download_code, project) || agent.has_access_to?(project)
+          ::Users::Anonymous.can?(:download_code, project) || agent.has_access_to?(project)
         end
 
         def increment_unique_events
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 45283d51b1b..72016aa1183 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -101,7 +101,7 @@ module Gitlab
     end
 
     def guest_can_download?
-      Guest.can?(download_ability, container)
+      ::Users::Anonymous.can?(download_ability, container)
     end
 
     def deploy_key_can_download_code?
@@ -395,7 +395,7 @@ module Gitlab
         user.can?(:read_project, project)
       elsif ci?
         false
-      end || Guest.can?(:read_project, project)
+      end || ::Users::Anonymous.can?(:read_project, project)
     end
 
     def http?
diff --git a/spec/features/abuse_report_spec.rb b/spec/features/abuse_report_spec.rb
index 50d64ce533c..eac29b0b741 100644
--- a/spec/features/abuse_report_spec.rb
+++ b/spec/features/abuse_report_spec.rb
@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 RSpec.describe 'Abuse reports', :js, feature_category: :insider_threat do
-  let_it_be(:abusive_user) { create(:user, :no_super_sidebar) }
+  let_it_be(:abusive_user) { create(:user) }
 
-  let_it_be(:reporter1) { create(:user, :no_super_sidebar) }
+  let_it_be(:reporter1) { create(:user) }
 
   let_it_be(:project) { create(:project, :public, :repository) }
   let_it_be(:issue) { create(:issue, project: project, author: abusive_user) }
@@ -56,11 +56,11 @@ RSpec.describe 'Abuse reports', :js, feature_category: :insider_threat do
     end
 
     context 'when reporting a user profile for abuse' do
-      let_it_be(:reporter2) { create(:user, :no_super_sidebar) }
+      let_it_be(:reporter2) { create(:user) }
 
       before do
         visit user_path(abusive_user)
-        find_by_testid('base-dropdown-toggle').click
+        find_by_testid('user-profile-actions').click
       end
 
       it_behaves_like 'reports the user with an abuse category'
@@ -68,7 +68,7 @@ RSpec.describe 'Abuse reports', :js, feature_category: :insider_threat do
       it 'allows the reporter to report the same user for different abuse categories' do
         visit user_path(abusive_user)
 
-        find_by_testid('base-dropdown-toggle').click
+        find_by_testid('user-profile-actions').click
         fill_and_submit_abuse_category_form
         fill_and_submit_report_abuse_form
 
@@ -76,14 +76,14 @@ RSpec.describe 'Abuse reports', :js, feature_category: :insider_threat do
 
         visit user_path(abusive_user)
 
-        find_by_testid('base-dropdown-toggle').click
+        find_by_testid('user-profile-actions').click
         fill_and_submit_abuse_category_form("They're being offensive or abusive.")
         fill_and_submit_report_abuse_form
 
         expect(page).to have_content 'Thank you for your report'
       end
 
-      it 'allows multiple users to report the same user' do
+      it 'allows multiple users to report the same user', :js do
         fill_and_submit_abuse_category_form
         fill_and_submit_report_abuse_form
 
@@ -94,7 +94,7 @@ RSpec.describe 'Abuse reports', :js, feature_category: :insider_threat do
 
         visit user_path(abusive_user)
 
-        find_by_testid('base-dropdown-toggle').click
+        find_by_testid('user-profile-actions').click
         fill_and_submit_abuse_category_form
         fill_and_submit_report_abuse_form
 
diff --git a/spec/features/task_lists_spec.rb b/spec/features/task_lists_spec.rb
index 24d63cadf00..c1be2b8e3c7 100644
--- a/spec/features/task_lists_spec.rb
+++ b/spec/features/task_lists_spec.rb
@@ -6,8 +6,8 @@ RSpec.describe 'Task Lists', :js, feature_category: :team_planning do
   include Warden::Test::Helpers
 
   let_it_be(:project) { create(:project, :public, :repository) }
-  let_it_be(:user)    { create(:user, :no_super_sidebar) }
-  let_it_be(:user2)   { create(:user, :no_super_sidebar) }
+  let_it_be(:user)    { create(:user) }
+  let_it_be(:user2)   { create(:user) }
 
   let(:markdown) do
     <<-MARKDOWN.strip_heredoc
@@ -44,7 +44,7 @@ RSpec.describe 'Task Lists', :js, feature_category: :team_planning do
   end
 
   before do
-    login_as(user)
+    sign_in(user)
   end
 
   def visit_issue(project, issue)
diff --git a/spec/features/users/active_sessions_spec.rb b/spec/features/users/active_sessions_spec.rb
index 663d2283dbd..8509a8d7356 100644
--- a/spec/features/users/active_sessions_spec.rb
+++ b/spec/features/users/active_sessions_spec.rb
@@ -3,10 +3,10 @@
 require 'spec_helper'
 
 RSpec.describe 'Active user sessions', :clean_gitlab_redis_sessions, feature_category: :system_access do
-  it 'successful login adds a new active user login' do
-    user = create(:user, :no_super_sidebar)
+  it 'successful login adds a new active user login', :js do
+    user = create(:user)
 
-    now = Time.zone.parse('2018-03-12 09:06')
+    now = Time.zone.now.change(usec: 0)
     travel_to(now) do
       gitlab_sign_in(user)
       expect(page).to have_current_path root_path, ignore_query: true
@@ -24,14 +24,14 @@ RSpec.describe 'Active user sessions', :clean_gitlab_redis_sessions, feature_cat
 
       sessions = ActiveSession.list(user)
       expect(sessions.first).to have_attributes(
-        created_at: Time.zone.parse('2018-03-12 09:06'),
-        updated_at: Time.zone.parse('2018-03-12 09:07')
+        created_at: now,
+        updated_at: now + 1.minute
       )
     end
   end
 
   it 'successful login cleans up obsolete entries' do
-    user = create(:user, :no_super_sidebar)
+    user = create(:user)
 
     Gitlab::Redis::Sessions.with do |redis|
       redis.sadd?("session:lookup:user:gitlab:#{user.id}", '59822c7d9fcdfa03725eff41782ad97d')
@@ -45,7 +45,7 @@ RSpec.describe 'Active user sessions', :clean_gitlab_redis_sessions, feature_cat
   end
 
   it 'sessionless login does not clean up obsolete entries' do
-    user = create(:user, :no_super_sidebar)
+    user = create(:user)
     personal_access_token = create(:personal_access_token, user: user)
 
     Gitlab::Redis::Sessions.with do |redis|
@@ -60,8 +60,8 @@ RSpec.describe 'Active user sessions', :clean_gitlab_redis_sessions, feature_cat
     end
   end
 
-  it 'logout deletes the active user login' do
-    user = create(:user, :no_super_sidebar)
+  it 'logout deletes the active user login', :js do
+    user = create(:user)
     gitlab_sign_in(user)
     expect(page).to have_current_path root_path, ignore_query: true
 
diff --git a/spec/features/users/email_verification_on_login_spec.rb b/spec/features/users/email_verification_on_login_spec.rb
index d83040efd72..ad62af6ec69 100644
--- a/spec/features/users/email_verification_on_login_spec.rb
+++ b/spec/features/users/email_verification_on_login_spec.rb
@@ -5,8 +5,8 @@ require 'spec_helper'
 RSpec.describe 'Email Verification On Login', :clean_gitlab_redis_rate_limiting, :js, feature_category: :system_access do
   include EmailHelpers
 
-  let_it_be_with_reload(:user) { create(:user, :no_super_sidebar) }
-  let_it_be(:another_user) { create(:user, :no_super_sidebar) }
+  let_it_be_with_reload(:user) { create(:user) }
+  let_it_be(:another_user) { create(:user) }
   let_it_be(:new_email) { build_stubbed(:user).email }
 
   let(:require_email_verification_enabled) { user }
@@ -220,7 +220,7 @@ RSpec.describe 'Email Verification On Login', :clean_gitlab_redis_rate_limiting,
 
   shared_examples 'no email verification required when 2fa enabled or ff disabled' do
     context 'when 2FA is enabled' do
-      let_it_be(:user) { create(:user, :no_super_sidebar, :two_factor) }
+      let_it_be(:user) { create(:user, :two_factor) }
 
       it_behaves_like 'no email verification required', two_factor_auth: true
     end
diff --git a/spec/features/users/login_spec.rb b/spec/features/users/login_spec.rb
index 87afcbd416b..0f086af227c 100644
--- a/spec/features/users/login_spec.rb
+++ b/spec/features/users/login_spec.rb
@@ -16,7 +16,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
       expect(authentication_metrics)
         .to increment(:user_authenticated_counter)
 
-      user = create(:user, :no_super_sidebar)
+      user = create(:user)
 
       expect(user.reset_password_token).to be_nil
 
@@ -43,7 +43,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
       # This behavior is dependent on there only being one user
       User.delete_all
 
-      user = create(:admin, :no_super_sidebar, password_automatically_set: true)
+      user = create(:admin, password_automatically_set: true)
 
       visit root_path
       expect(page).to have_current_path edit_user_password_path, ignore_query: true
@@ -77,7 +77,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
         .and increment(:user_unauthenticated_counter)
         .and increment(:user_session_destroyed_counter).twice
 
-      user = create(:user, :no_super_sidebar, :blocked)
+      user = create(:user, :blocked)
 
       gitlab_sign_in(user)
 
@@ -90,14 +90,14 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
         .and increment(:user_unauthenticated_counter)
         .and increment(:user_session_destroyed_counter).twice
 
-      user = create(:user, :no_super_sidebar, :blocked)
+      user = create(:user, :blocked)
 
       expect { gitlab_sign_in(user) }.not_to change { user.reload.sign_in_count }
     end
   end
 
   describe 'with an unconfirmed email address' do
-    let!(:user) { create(:user, :no_super_sidebar, confirmed_at: nil) }
+    let!(:user) { create(:user, confirmed_at: nil) }
     let(:grace_period) { 2.days }
     let(:alert_title) { 'Please confirm your email address' }
     let(:alert_message) { "To continue, you need to select the link in the confirmation email we sent to verify your email address. If you didn't get our email, select Resend confirmation email" }
@@ -141,7 +141,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
     end
 
     context 'when resending the confirmation email' do
-      let_it_be(:user) { create(:user, :no_super_sidebar) }
+      let_it_be(:user) { create(:user) }
 
       it 'redirects to the "almost there" page' do
         visit new_user_confirmation_path
@@ -154,7 +154,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
   end
 
   describe 'with a disallowed password' do
-    let(:user) { create(:user, :no_super_sidebar, :disallowed_password) }
+    let(:user) { create(:user, :disallowed_password) }
 
     before do
       expect(authentication_metrics)
@@ -295,7 +295,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
     # Freeze time to prevent failures when time between code being entered and
     # validated greater than otp_allowed_drift
     context 'with valid username/password', :freeze_time do
-      let(:user) { create(:user, :no_super_sidebar, :two_factor) }
+      let(:user) { create(:user, :two_factor) }
 
       before do
         gitlab_sign_in(user, remember: true)
@@ -372,13 +372,13 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
       end
 
       context 'when user with TOTP enabled' do
-        let(:user) { create(:user, :no_super_sidebar, :two_factor) }
+        let(:user) { create(:user, :two_factor) }
 
         include_examples 'can login with recovery codes'
       end
 
       context 'when user with only Webauthn enabled' do
-        let(:user) { create(:user, :no_super_sidebar, :two_factor_via_webauthn, registrations_count: 1) }
+        let(:user) { create(:user, :two_factor_via_webauthn, registrations_count: 1) }
 
         include_examples 'can login with recovery codes', only_two_factor_webauthn_enabled: true
       end
@@ -494,7 +494,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
     end
 
     context 'with correct username and password' do
-      let(:user) { create(:user, :no_super_sidebar) }
+      let(:user) { create(:user) }
 
       it 'allows basic login' do
         expect(authentication_metrics)
@@ -584,7 +584,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
     end
 
     context 'with correct username and invalid password' do
-      let(:user) { create(:user, :no_super_sidebar) }
+      let(:user) { create(:user) }
 
       it 'blocks invalid login' do
         expect(authentication_metrics)
@@ -601,7 +601,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
   end
 
   describe 'with required two-factor authentication enabled' do
-    let(:user) { create(:user, :no_super_sidebar) }
+    let(:user) { create(:user) }
 
     #  TODO: otp_grace_period_started_at
 
@@ -639,7 +639,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
         end
 
         context 'after the grace period' do
-          let(:user) { create(:user, :no_super_sidebar, otp_grace_period_started_at: 9999.hours.ago) }
+          let(:user) { create(:user, otp_grace_period_started_at: 9999.hours.ago) }
 
           it 'redirects to two-factor configuration page' do
             expect(authentication_metrics)
@@ -728,7 +728,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
         end
 
         context 'after the grace period' do
-          let(:user) { create(:user, :no_super_sidebar, otp_grace_period_started_at: 9999.hours.ago) }
+          let(:user) { create(:user, otp_grace_period_started_at: 9999.hours.ago) }
 
           it 'redirects to two-factor configuration page' do
             expect(authentication_metrics)
@@ -919,7 +919,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
   end
 
   context 'when terms are enforced', :js do
-    let(:user) { create(:user, :no_super_sidebar) }
+    let(:user) { create(:user) }
 
     before do
       enforce_terms
@@ -1090,7 +1090,7 @@ RSpec.describe 'Login', :clean_gitlab_redis_sessions, feature_category: :system_
   end
 
   context 'when sending confirmation email and not yet confirmed' do
-    let!(:user) { create(:user, :no_super_sidebar, confirmed_at: nil) }
+    let!(:user) { create(:user, confirmed_at: nil) }
     let(:grace_period) { 2.days }
     let(:alert_title) { 'Please confirm your email address' }
     let(:alert_message) { "To continue, you need to select the link in the confirmation email we sent to verify your email address. If you didn't get our email, select Resend confirmation email" }
diff --git a/spec/features/users/logout_spec.rb b/spec/features/users/logout_spec.rb
index d0e5be8dca3..c9839247e7d 100644
--- a/spec/features/users/logout_spec.rb
+++ b/spec/features/users/logout_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe 'Logout/Sign out', :js, feature_category: :system_access do
-  let(:user) { create(:user, :no_super_sidebar) }
+  let(:user) { create(:user) }
 
   before do
     sign_in(user)
diff --git a/spec/features/webauthn_spec.rb b/spec/features/webauthn_spec.rb
index 52e2b375187..72463a0b9ab 100644
--- a/spec/features/webauthn_spec.rb
+++ b/spec/features/webauthn_spec.rb
@@ -15,7 +15,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
     # TODO: it_behaves_like 'hardware device for 2fa', 'WebAuthn'
 
     describe 'registration' do
-      let(:user) { create(:user, :no_super_sidebar) }
+      let(:user) { create(:user) }
 
       before do
         gitlab_sign_in(user)
@@ -58,7 +58,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
         gitlab_sign_out
 
         # Second user
-        user = create(:user, :no_super_sidebar)
+        user = create(:user)
         gitlab_sign_in(user)
         visit profile_account_path
         enable_two_factor_authentication
@@ -126,7 +126,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
     it_behaves_like 'hardware device for 2fa', 'WebAuthn'
 
     describe 'registration' do
-      let(:user) { create(:user, :no_super_sidebar) }
+      let(:user) { create(:user) }
 
       before do
         gitlab_sign_in(user)
@@ -161,7 +161,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
         gitlab_sign_out
 
         # Second user
-        user = create(:user, :no_super_sidebar)
+        user = create(:user)
         gitlab_sign_in(user)
         user.update_attribute(:otp_required_for_login, true)
         visit profile_account_path
@@ -227,7 +227,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
 
   describe 'authentication' do
     let(:otp_required_for_login) { true }
-    let(:user) { create(:user, :no_super_sidebar, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
+    let(:user) { create(:user, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
     let!(:webauthn_device) do
       add_webauthn_device(app_id, user)
     end
@@ -256,7 +256,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
 
     describe 'when a given WebAuthn device has already been registered by another user' do
       describe 'but not the current user' do
-        let(:other_user) { create(:user, :no_super_sidebar, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
+        let(:other_user) { create(:user, webauthn_xid: WebAuthn.generate_user_id, otp_required_for_login: otp_required_for_login) }
 
         it 'does not allow logging in with that particular device' do
           # Register other user with a different WebAuthn device
@@ -277,7 +277,7 @@ RSpec.describe 'Using WebAuthn Devices for Authentication', :js, feature_categor
         it "allows logging in with that particular device" do
           pending("support for passing credential options in FakeClient")
           # Register current user with the same WebAuthn device
-          current_user = create(:user, :no_super_sidebar)
+          current_user = create(:user)
           gitlab_sign_in(current_user)
           visit profile_account_path
           manage_two_factor_authentication
diff --git a/spec/models/guest_spec.rb b/spec/models/users/anonymous_spec.rb
index 975b64cb855..f6151be6184 100644
--- a/spec/models/guest_spec.rb
+++ b/spec/models/users/anonymous_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Guest do
+RSpec.describe Users::Anonymous, feature_category: :system_access do
   let_it_be(:public_project, reload: true) { create(:project, :public) }
   let_it_be(:private_project) { create(:project, :private) }
   let_it_be(:internal_project) { create(:project, :internal) }
diff --git a/spec/support/shared_examples/features/2fa_shared_examples.rb b/spec/support/shared_examples/features/2fa_shared_examples.rb
index f50874b6b05..8744259488f 100644
--- a/spec/support/shared_examples/features/2fa_shared_examples.rb
+++ b/spec/support/shared_examples/features/2fa_shared_examples.rb
@@ -14,7 +14,7 @@ RSpec.shared_examples 'hardware device for 2fa' do |device_type|
   end
 
   describe "registration" do
-    let(:user) { create(:user, :no_super_sidebar) }
+    let(:user) { create(:user) }
 
     before do
       gitlab_sign_in(user)
@@ -66,8 +66,8 @@ RSpec.shared_examples 'hardware device for 2fa' do |device_type|
     end
   end
 
-  describe 'fallback code authentication' do
-    let(:user) { create(:user, :no_super_sidebar) }
+  describe 'fallback code authentication', :js do
+    let(:user) { create(:user) }
 
     before do
       # Register and logout
diff --git a/spec/support/shared_examples/quick_actions/issuable/close_quick_action_shared_examples.rb b/spec/support/shared_examples/quick_actions/issuable/close_quick_action_shared_examples.rb
index 7cbaf40721a..71a8e2a15ce 100644
--- a/spec/support/shared_examples/quick_actions/issuable/close_quick_action_shared_examples.rb
+++ b/spec/support/shared_examples/quick_actions/issuable/close_quick_action_shared_examples.rb
@@ -54,7 +54,7 @@ RSpec.shared_examples 'close quick action' do |issuable_type|
       expect(issuable).to be_closed
     end
 
-    context "when current user cannot close #{issuable_type}" do
+    context "when current user cannot close #{issuable_type}", :js do
       before do
         guest = create(:user)
         project.add_guest(guest)