Add latest changes from gitlab-org/gitlab@16-4-stable-eev16.4.0-rc42

11 files changed, 593 insertions, 233 deletions

diff --git a/spec/finders/abuse_reports_finder_spec.rb b/spec/finders/abuse_reports_finder_spec.rb
index 0b641d0cb08..c3cf84d082f 100644
--- a/spec/finders/abuse_reports_finder_spec.rb
+++ b/spec/finders/abuse_reports_finder_spec.rb
@@ -17,17 +17,21 @@ RSpec.describe AbuseReportsFinder, feature_category: :insider_threat do
     create(:abuse_report, :closed, category: 'phishing', user: user_2, reporter: reporter_2, id: 2)
   end
 
-  let(:params) { {} }
-
   subject(:finder) { described_class.new(params).execute }
 
   describe '#execute' do
-    context 'when params is empty' do
+    shared_examples 'returns all abuse reports' do
       it 'returns all abuse reports' do
         expect(finder).to match_array([abuse_report_1, abuse_report_2])
       end
     end
 
+    context 'when params is empty' do
+      let(:params) { {} }
+
+      it_behaves_like 'returns all abuse reports'
+    end
+
     shared_examples 'returns filtered reports' do |filter_field|
       it "returns abuse reports filtered by #{filter_field}_id" do
         expect(finder).to match_array(filtered_reports)
@@ -41,9 +45,7 @@ RSpec.describe AbuseReportsFinder, feature_category: :insider_threat do
             .and_return(nil)
         end
 
-        it 'returns all abuse reports' do
-          expect(finder).to match_array([abuse_report_1, abuse_report_2])
-        end
+        it_behaves_like 'returns all abuse reports'
       end
     end
 
@@ -169,39 +171,5 @@ RSpec.describe AbuseReportsFinder, feature_category: :insider_threat do
         end
       end
     end
-
-    context 'when legacy view is enabled' do
-      before do
-        stub_feature_flags(abuse_reports_list: false)
-      end
-
-      context 'when params is empty' do
-        it 'returns all abuse reports' do
-          expect(subject).to match_array([abuse_report_1, abuse_report_2])
-        end
-      end
-
-      context 'when params[:user_id] is present' do
-        let(:params) { { user_id: user_1 } }
-
-        it 'returns abuse reports for the specified user' do
-          expect(subject).to match_array([abuse_report_1])
-        end
-      end
-
-      context 'when sorting' do
-        it 'returns reports sorted by id in descending order' do
-          expect(subject).to match_array([abuse_report_2, abuse_report_1])
-        end
-      end
-
-      context 'when any of the new filters are present such as params[:status]' do
-        let(:params) { { status: 'open' } }
-
-        it 'returns all abuse reports' do
-          expect(subject).to match_array([abuse_report_1, abuse_report_2])
-        end
-      end
-    end
   end
 end
diff --git a/spec/finders/ci/jobs_finder_spec.rb b/spec/finders/ci/jobs_finder_spec.rb
index 0b3777a2fe8..57046baafab 100644
--- a/spec/finders/ci/jobs_finder_spec.rb
+++ b/spec/finders/ci/jobs_finder_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Ci::JobsFinder, '#execute' do
+RSpec.describe Ci::JobsFinder, '#execute', feature_category: :continuous_integration do
   let_it_be(:user) { create(:user) }
   let_it_be(:admin) { create(:user, :admin) }
   let_it_be(:project) { create(:project, :private, public_builds: false) }
@@ -13,8 +13,8 @@ RSpec.describe Ci::JobsFinder, '#execute' do
 
   let(:params) { {} }
 
-  context 'no project' do
-    subject { described_class.new(current_user: current_user, params: params).execute }
+  context 'when project, pipeline, and runner are blank' do
+    subject(:finder_execute) { described_class.new(current_user: current_user, params: params).execute }
 
     context 'with admin' do
       let(:current_user) { admin }
@@ -34,43 +34,139 @@ RSpec.describe Ci::JobsFinder, '#execute' do
       end
     end
 
-    context 'with normal user' do
-      let(:current_user) { user }
+    context 'with admin and admin mode enabled', :enable_admin_mode do
+      let(:current_user) { admin }
 
-      it { is_expected.to be_empty }
-    end
+      context 'with param `scope`' do
+        using RSpec::Parameterized::TableSyntax
 
-    context 'without user' do
-      let(:current_user) { nil }
+        where(:scope, :expected_jobs) do
+          'pending'           | lazy { [pending_job] }
+          'running'           | lazy { [running_job] }
+          'finished'          | lazy { [successful_job] }
+          %w[running success] | lazy { [running_job, successful_job] }
+        end
 
-      it { is_expected.to be_empty }
-    end
+        with_them do
+          let(:params) { { scope: scope } }
 
-    context 'with scope', :enable_admin_mode do
-      let(:current_user) { admin }
-      let(:jobs) { [pending_job, running_job, successful_job] }
+          it { is_expected.to match_array(expected_jobs) }
+        end
+      end
 
-      using RSpec::Parameterized::TableSyntax
+      context 'with param `runner_type`' do
+        let_it_be(:job_with_group_runner) { create(:ci_build, :success, runner: create(:ci_runner, :group)) }
+        let_it_be(:job_with_instance_runner) { create(:ci_build, :success, runner: create(:ci_runner, :instance)) }
+        let_it_be(:job_with_project_runner) { create(:ci_build, :success, runner: create(:ci_runner, :project)) }
+
+        context 'with feature flag :admin_jobs_filter_runner_type enabled' do
+          using RSpec::Parameterized::TableSyntax
+
+          where(:runner_type, :expected_jobs) do
+            'group_type'                   | lazy { [job_with_group_runner] }
+            'instance_type'                | lazy { [job_with_instance_runner] }
+            'project_type'                 | lazy { [job_with_project_runner] }
+            %w[instance_type project_type] | lazy { [job_with_instance_runner, job_with_project_runner] }
+          end
+
+          with_them do
+            let(:params) { { runner_type: runner_type } }
+            it { is_expected.to match_array(expected_jobs) }
+          end
+        end
 
-      where(:scope, :expected_jobs) do
-        'pending'           | lazy { [pending_job] }
-        'running'           | lazy { [running_job] }
-        'finished'          | lazy { [successful_job] }
-        %w[running success] | lazy { [running_job, successful_job] }
+        context 'with feature flag :admin_jobs_filter_runner_type disabled' do
+          let(:params) { { runner_type: 'instance_type' } }
+          let(:expected_jobs) do
+            [
+              job_with_group_runner,
+              job_with_instance_runner,
+              job_with_project_runner,
+              pending_job,
+              running_job,
+              successful_job
+            ]
+          end
+
+          before do
+            stub_feature_flags(admin_jobs_filter_runner_type: false)
+          end
+
+          it { is_expected.to match_array(expected_jobs) }
+        end
       end
 
-      with_them do
-        let(:params) { { scope: scope } }
+      context "with params" do
+        let_it_be(:job_with_running_status_and_group_runner) do
+          create(:ci_build, :running, runner: create(:ci_runner, :group))
+        end
+
+        let_it_be(:job_with_instance_runner) { create(:ci_build, :success, runner: create(:ci_runner, :instance)) }
+        let_it_be(:job_with_project_runner) { create(:ci_build, :success, runner: create(:ci_runner, :project)) }
+
+        context 'with feature flag :admin_jobs_filter_runner_type enabled' do
+          using RSpec::Parameterized::TableSyntax
+
+          where(:param_runner_type, :param_scope, :expected_jobs) do
+            'group_type'                   | 'running'  | lazy { [job_with_running_status_and_group_runner] }
+            %w[instance_type project_type] | 'finished' | lazy { [job_with_instance_runner, job_with_project_runner] }
+            %w[instance_type project_type] | 'pending'  | lazy { [] }
+          end
+
+          with_them do
+            let(:params) { { runner_type: param_runner_type, scope: param_scope } }
+
+            it { is_expected.to match_array(expected_jobs) }
+          end
+        end
 
-        it { is_expected.to match_array(expected_jobs) }
+        context 'with feature flag :admin_jobs_filter_runner_type disabled' do
+          before do
+            stub_feature_flags(admin_jobs_filter_runner_type: false)
+          end
+
+          using RSpec::Parameterized::TableSyntax
+
+          where(:param_runner_type, :param_scope, :expected_jobs) do
+            'group_type' | 'running' | lazy do
+              [job_with_running_status_and_group_runner, running_job]
+            end
+            %w[instance_type project_type] | 'finished' | lazy do
+              [
+                job_with_instance_runner,
+                job_with_project_runner,
+                successful_job
+              ]
+            end
+            %w[instance_type project_type] | 'pending' | lazy { [pending_job] }
+          end
+
+          with_them do
+            let(:params) { { runner_type: param_runner_type, scope: param_scope } }
+
+            it { is_expected.to match_array(expected_jobs) }
+          end
+        end
       end
     end
+
+    context 'with user not being project member' do
+      let(:current_user) { user }
+
+      it { is_expected.to be_empty }
+    end
+
+    context 'without user' do
+      let(:current_user) { nil }
+
+      it { is_expected.to be_empty }
+    end
   end
 
-  context 'a project is present' do
+  context 'when project is present' do
     subject { described_class.new(current_user: user, project: project, params: params).execute }
 
-    context 'user has access to the project' do
+    context 'with user being project maintainer' do
       before do
         project.add_maintainer(user)
       end
@@ -78,9 +174,47 @@ RSpec.describe Ci::JobsFinder, '#execute' do
       it 'returns jobs for the specified project' do
         expect(subject).to match_array([successful_job])
       end
+
+      context 'when artifacts are present for some jobs' do
+        let_it_be(:job_with_artifacts) { create(:ci_build, :success, pipeline: pipeline, name: 'test') }
+        let_it_be(:artifact) { create(:ci_job_artifact, job: job_with_artifacts) }
+
+        context 'when with_artifacts is true' do
+          let(:params) { { with_artifacts: true } }
+
+          it 'returns only jobs with artifacts' do
+            expect(subject).to match_array([job_with_artifacts])
+          end
+        end
+
+        context 'when with_artifacts is false' do
+          let(:params) { { with_artifacts: false } }
+
+          it 'returns all jobs' do
+            expect(subject).to match_array([successful_job, job_with_artifacts])
+          end
+        end
+
+        context "with param `scope" do
+          using RSpec::Parameterized::TableSyntax
+
+          where(:param_scope, :expected_jobs) do
+            'success'           | lazy { [successful_job, job_with_artifacts] }
+            '[success pending]' | lazy { [successful_job, job_with_artifacts] }
+            'pending'           | lazy { [] }
+            nil                 | lazy { [successful_job, job_with_artifacts] }
+          end
+
+          with_them do
+            let(:params) { { with_artifacts: false, scope: param_scope } }
+
+            it { is_expected.to match_array(expected_jobs) }
+          end
+        end
+      end
     end
 
-    context 'user has no access to project builds' do
+    context 'with user being project guest' do
       before do
         project.add_guest(user)
       end
@@ -99,79 +233,80 @@ RSpec.describe Ci::JobsFinder, '#execute' do
     end
   end
 
-  context 'when artifacts are present for some jobs' do
-    let_it_be(:job_with_artifacts) { create(:ci_build, :success, pipeline: pipeline, name: 'test') }
-    let_it_be(:artifact) { create(:ci_job_artifact, job: job_with_artifacts) }
-
-    subject { described_class.new(current_user: user, project: project, params: params).execute }
-
-    before do
-      project.add_maintainer(user)
-    end
-
-    context 'when with_artifacts is true' do
-      let(:params) { { with_artifacts: true } }
+  context 'when pipeline is present' do
+    subject { described_class.new(current_user: user, pipeline: pipeline, params: params).execute }
 
-      it 'returns only jobs with artifacts' do
-        expect(subject).to match_array([job_with_artifacts])
+    context 'with user being project maintainer' do
+      before_all do
+        project.add_maintainer(user)
+        successful_job.update!(retried: true)
       end
-    end
 
-    context 'when with_artifacts is false' do
-      let(:params) { { with_artifacts: false } }
+      let_it_be(:job_4) { create(:ci_build, :success, pipeline: pipeline, name: 'build') }
 
-      it 'returns all jobs' do
-        expect(subject).to match_array([successful_job, job_with_artifacts])
+      it 'does not return retried jobs by default' do
+        expect(subject).to match_array([job_4])
       end
-    end
-  end
-
-  context 'when pipeline is present' do
-    before_all do
-      project.add_maintainer(user)
-      successful_job.update!(retried: true)
-    end
-
-    let_it_be(:job_4) { create(:ci_build, :success, pipeline: pipeline, name: 'build') }
 
-    subject { described_class.new(current_user: user, pipeline: pipeline, params: params).execute }
+      context 'when include_retried is false' do
+        let(:params) { { include_retried: false } }
 
-    it 'does not return retried jobs by default' do
-      expect(subject).to match_array([job_4])
-    end
+        it 'does not return retried jobs' do
+          expect(subject).to match_array([job_4])
+        end
+      end
 
-    context 'when include_retried is false' do
-      let(:params) { { include_retried: false } }
+      context 'when include_retried is true' do
+        let(:params) { { include_retried: true } }
 
-      it 'does not return retried jobs' do
-        expect(subject).to match_array([job_4])
+        it 'returns retried jobs' do
+          expect(subject).to match_array([successful_job, job_4])
+        end
       end
     end
 
-    context 'when include_retried is true' do
-      let(:params) { { include_retried: true } }
+    context 'without user' do
+      let(:user) { nil }
 
-      it 'returns retried jobs' do
-        expect(subject).to match_array([successful_job, job_4])
+      it 'returns no jobs' do
+        expect(subject).to be_empty
       end
     end
   end
 
-  context 'a runner is present' do
+  context 'when runner is present' do
     let_it_be(:runner) { create(:ci_runner, :project, projects: [project]) }
     let_it_be(:job_4) { create(:ci_build, :success, runner: runner) }
 
-    subject { described_class.new(current_user: user, runner: runner, params: params).execute }
+    subject(:execute) { described_class.new(current_user: user, runner: runner, params: params).execute }
 
-    context 'user has access to the runner', :enable_admin_mode do
+    context 'when current user is an admin' do
       let(:user) { admin }
 
-      it 'returns jobs for the specified project' do
-        expect(subject).to match_array([job_4])
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it 'returns jobs for the specified project' do
+          expect(subject).to contain_exactly job_4
+        end
+
+        context 'with params' do
+          using RSpec::Parameterized::TableSyntax
+
+          where(:param_runner_type, :param_scope, :expected_jobs) do
+            'project_type'  | 'success' | lazy { [job_4] }
+            'instance_type' | nil       | lazy { [] }
+            nil             | 'pending' | lazy { [] }
+          end
+
+          with_them do
+            let(:params) { { runner_type: param_runner_type, scope: param_scope } }
+
+            it { is_expected.to match_array(expected_jobs) }
+          end
+        end
       end
     end
 
-    context 'user has no access to project builds' do
+    context 'with user being project guest' do
       let_it_be(:guest) { create(:user) }
 
       let(:user) { guest }
diff --git a/spec/finders/ci/runners_finder_spec.rb b/spec/finders/ci/runners_finder_spec.rb
index e57ad5bc76d..5d249ddb391 100644
--- a/spec/finders/ci/runners_finder_spec.rb
+++ b/spec/finders/ci/runners_finder_spec.rb
@@ -222,12 +222,14 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
       end
 
       shared_examples 'executes as normal user' do
-        it 'returns no runners' do
+        it 'raises Gitlab::Access::AccessDeniedError' do
           user = create :user
           create :ci_runner, active: true
           create :ci_runner, active: false
 
-          expect(described_class.new(current_user: user, params: {}).execute).to be_empty
+          expect do
+            described_class.new(current_user: user, params: {}).execute
+          end.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
@@ -250,12 +252,14 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
       end
 
       context 'when user is nil' do
-        it 'returns no runners' do
+        it 'raises Gitlab::Access::AccessDeniedError' do
           user = nil
           create :ci_runner, active: true
           create :ci_runner, active: false
 
-          expect(described_class.new(current_user: user, params: {}).execute).to be_empty
+          expect do
+            described_class.new(current_user: user, params: {}).execute
+          end.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
     end
@@ -306,154 +310,162 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
 
       shared_examples 'membership equal to :descendants' do
         it 'returns all descendant runners' do
-          expect(subject).to eq([runner_project_7, runner_project_6, runner_project_5,
-                                 runner_project_4, runner_project_3, runner_project_2,
-                                 runner_project_1, runner_sub_group_4, runner_sub_group_3,
-                                 runner_sub_group_2, runner_sub_group_1, runner_group])
+          is_expected.to contain_exactly(
+            runner_project_7, runner_project_6, runner_project_5,
+            runner_project_4, runner_project_3, runner_project_2,
+            runner_project_1, runner_sub_group_4, runner_sub_group_3,
+            runner_sub_group_2, runner_sub_group_1, runner_group)
         end
       end
 
-      context 'with user as group owner' do
-        before do
-          group.add_owner(user)
+      context 'with user is group maintainer or owner' do
+        where(:user_role) do
+          [GroupMember::OWNER, GroupMember::MAINTAINER]
         end
 
-        context 'with :group as target group' do
-          let(:target_group) { group }
-
-          context 'passing no membership params' do
-            it_behaves_like 'membership equal to :descendants'
+        with_them do
+          before do
+            group.add_member(user, user_role)
           end
 
-          context 'with :descendants membership' do
-            let(:membership) { :descendants }
+          context 'with :group as target group' do
+            let(:target_group) { group }
 
-            it_behaves_like 'membership equal to :descendants'
-          end
+            context 'passing no membership params' do
+              it_behaves_like 'membership equal to :descendants'
+            end
 
-          context 'with :direct membership' do
-            let(:membership) { :direct }
+            context 'with :descendants membership' do
+              let(:membership) { :descendants }
 
-            it 'returns runners belonging to group' do
-              expect(subject).to eq([runner_group])
+              it_behaves_like 'membership equal to :descendants'
             end
-          end
 
-          context 'with :all_available membership' do
-            let(:membership) { :all_available }
+            context 'with :direct membership' do
+              let(:membership) { :direct }
 
-            it 'returns runners available to group' do
-              expect(subject).to match_array([runner_project_7, runner_project_6, runner_project_5,
-                                              runner_project_4, runner_project_3, runner_project_2,
-                                              runner_project_1, runner_sub_group_4, runner_sub_group_3,
-                                              runner_sub_group_2, runner_sub_group_1, runner_group, runner_instance])
+              it 'returns runners belonging to group' do
+                is_expected.to contain_exactly(runner_group)
+              end
             end
-          end
 
-          context 'with unknown membership' do
-            let(:membership) { :unsupported }
+            context 'with :all_available membership' do
+              let(:membership) { :all_available }
 
-            it 'raises an error' do
-              expect { subject }.to raise_error(ArgumentError, 'Invalid membership filter')
+              it 'returns runners available to group' do
+                is_expected.to contain_exactly(
+                  runner_project_7, runner_project_6, runner_project_5,
+                  runner_project_4, runner_project_3, runner_project_2,
+                  runner_project_1, runner_sub_group_4, runner_sub_group_3,
+                  runner_sub_group_2, runner_sub_group_1, runner_group, runner_instance)
+              end
             end
-          end
 
-          context 'with nil group' do
-            let(:target_group) { nil }
+            context 'with unknown membership' do
+              let(:membership) { :unsupported }
 
-            it 'returns no runners' do
-              # Query should run against all runners, however since user is not admin, query returns no results
-              expect(subject).to eq([])
+              it 'raises an error' do
+                expect { subject }.to raise_error(ArgumentError, 'Invalid membership filter')
+              end
             end
-          end
 
-          context 'with sort param' do
-            let(:extra_params) { { sort: 'contacted_asc' } }
+            context 'with nil group' do
+              let(:target_group) { nil }
 
-            it 'sorts by specified attribute' do
-              expect(subject).to eq([runner_group, runner_sub_group_1, runner_sub_group_2,
-                                     runner_sub_group_3, runner_sub_group_4, runner_project_1,
-                                     runner_project_2, runner_project_3, runner_project_4,
-                                     runner_project_5, runner_project_6, runner_project_7])
+              it 'raises Gitlab::Access::AccessDeniedError' do
+                # Query should run against all runners, however since user is not admin, we raise an error
+                expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
+              end
             end
-          end
 
-          context 'filtering' do
-            context 'by search term' do
-              let(:extra_params) { { search: 'runner_project_search' } }
+            context 'with sort param' do
+              let(:extra_params) { { sort: 'contacted_asc' } }
 
-              it 'returns correct runner' do
-                expect(subject).to match_array([runner_project_3])
+              it 'sorts by specified attribute' do
+                expect(subject).to eq([runner_group, runner_sub_group_1, runner_sub_group_2,
+                                      runner_sub_group_3, runner_sub_group_4, runner_project_1,
+                                      runner_project_2, runner_project_3, runner_project_4,
+                                      runner_project_5, runner_project_6, runner_project_7])
               end
             end
 
-            context 'by active status' do
-              let(:extra_params) { { active: false } }
+            context 'filtering' do
+              context 'by search term' do
+                let(:extra_params) { { search: 'runner_project_search' } }
 
-              it 'returns correct runner' do
-                expect(subject).to match_array([runner_sub_group_1])
+                it 'returns correct runner' do
+                  expect(subject).to match_array([runner_project_3])
+                end
               end
-            end
 
-            context 'by status' do
-              let(:extra_params) { { status_status: 'paused' } }
+              context 'by active status' do
+                let(:extra_params) { { active: false } }
 
-              it 'returns correct runner' do
-                expect(subject).to match_array([runner_sub_group_1])
+                it 'returns correct runner' do
+                  expect(subject).to match_array([runner_sub_group_1])
+                end
               end
-            end
 
-            context 'by tag_name' do
-              let(:extra_params) { { tag_name: %w[runner_tag] } }
+              context 'by status' do
+                let(:extra_params) { { status_status: 'paused' } }
 
-              it 'returns correct runner' do
-                expect(subject).to match_array([runner_project_5])
+                it 'returns correct runner' do
+                  expect(subject).to match_array([runner_sub_group_1])
+                end
               end
-            end
 
-            context 'by runner type' do
-              let(:extra_params) { { type_type: 'project_type' } }
+              context 'by tag_name' do
+                let(:extra_params) { { tag_name: %w[runner_tag] } }
 
-              it 'returns correct runners' do
-                expect(subject).to eq([runner_project_7, runner_project_6,
-                                       runner_project_5, runner_project_4,
-                                       runner_project_3, runner_project_2, runner_project_1])
+                it 'returns correct runner' do
+                  expect(subject).to match_array([runner_project_5])
+                end
+              end
+
+              context 'by runner type' do
+                let(:extra_params) { { type_type: 'project_type' } }
+
+                it 'returns correct runners' do
+                  expect(subject).to eq([runner_project_7, runner_project_6,
+                                        runner_project_5, runner_project_4,
+                                        runner_project_3, runner_project_2, runner_project_1])
+                end
               end
             end
           end
         end
       end
 
-      context 'when user is not group owner' do
-        where(:user_permission) do
-          [:maintainer, :developer, :reporter, :guest]
+      context 'when user is group developer or below' do
+        where(:user_role) do
+          [GroupMember::DEVELOPER, GroupMember::REPORTER, GroupMember::GUEST]
         end
 
         with_them do
           before do
-            create(:group_member, user_permission, group: sub_group_1, user: user)
+            group.add_member(user, user_role)
           end
 
           context 'with :sub_group_1 as target group' do
             let(:target_group) { sub_group_1 }
 
-            it 'returns no runners' do
-              is_expected.to be_empty
+            it 'raises Gitlab::Access::AccessDeniedError' do
+              expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
             end
           end
 
           context 'with :group as target group' do
             let(:target_group) { group }
 
-            it 'returns no runners' do
-              is_expected.to be_empty
+            it 'raises Gitlab::Access::AccessDeniedError' do
+              expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
             end
 
             context 'with :all_available membership' do
               let(:membership) { :all_available }
 
-              it 'returns no runners' do
-                expect(subject).to be_empty
+              it 'raises Gitlab::Access::AccessDeniedError' do
+                expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
               end
             end
           end
@@ -461,35 +473,31 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
       end
 
       context 'when user has no access' do
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
       context 'when user is nil' do
-        let_it_be(:user) { nil }
+        let(:user) { nil }
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
     end
 
     describe '#sort_key' do
-      subject { described_class.new(current_user: user, params: params.merge(group: group)).sort_key }
+      subject(:sort_key) { described_class.new(current_user: user, params: params.merge(group: group)).sort_key }
 
       context 'without params' do
-        it 'returns created_at_desc' do
-          expect(subject).to eq('created_at_desc')
-        end
+        it { is_expected.to eq('created_at_desc') }
       end
 
       context 'with params' do
         let(:extra_params) { { sort: 'contacted_asc' } }
 
-        it 'returns contacted_asc' do
-          expect(subject).to eq('contacted_asc')
-        end
+        it { is_expected.to eq('contacted_asc') }
       end
     end
   end
@@ -504,7 +512,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
     let(:params) { { project: project }.merge(extra_params).reject { |_, v| v.nil? } }
 
     describe '#execute' do
-      subject { described_class.new(current_user: user, params: params).execute }
+      subject(:execute) { described_class.new(current_user: user, params: params).execute }
 
       context 'with user as project admin' do
         before do
@@ -515,7 +523,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           let_it_be(:runner_project) { create(:ci_runner, :project, contacted_at: 7.minutes.ago, projects: [project]) }
 
           it 'returns runners available to project' do
-            expect(subject).to match_array([runner_project])
+            is_expected.to match_array([runner_project])
           end
         end
 
@@ -524,7 +532,7 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           let_it_be(:runner_group) { create(:ci_runner, :group, contacted_at: 12.minutes.ago, groups: [group]) }
 
           it 'returns runners available to project' do
-            expect(subject).to match_array([runner_instance, runner_group])
+            is_expected.to match_array([runner_instance, runner_group])
           end
         end
 
@@ -610,24 +618,24 @@ RSpec.describe Ci::RunnersFinder, feature_category: :runner_fleet do
           project.add_developer(user)
         end
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
       context 'when user is nil' do
         let_it_be(:user) { nil }
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
 
       context 'with nil project_full_path' do
         let(:project_full_path) { nil }
 
-        it 'returns no runners' do
-          expect(subject).to be_empty
+        it 'raises Gitlab::Access::AccessDeniedError' do
+          expect { execute }.to raise_error(Gitlab::Access::AccessDeniedError)
         end
       end
     end
diff --git a/spec/finders/ci/triggers_finder_spec.rb b/spec/finders/ci/triggers_finder_spec.rb
new file mode 100644
index 00000000000..2df79e8f023
--- /dev/null
+++ b/spec/finders/ci/triggers_finder_spec.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Ci::TriggersFinder, feature_category: :continuous_integration do
+  let_it_be(:project) { create(:project) }
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:trigger) { create(:ci_trigger, project: project) }
+
+  subject { described_class.new(current_user, project).execute }
+
+  describe "#execute" do
+    context 'when the current user is authorized' do
+      before_all do
+        project.add_owner(current_user)
+      end
+
+      it 'returns list of trigger tokens' do
+        expect(subject).to contain_exactly(trigger)
+      end
+    end
+
+    context 'when the current user is not authorized' do
+      it 'does not return trigger tokens' do
+        expect(subject).to be_blank
+      end
+    end
+  end
+end
diff --git a/spec/finders/deployments_finder_spec.rb b/spec/finders/deployments_finder_spec.rb
index 5a803ee2a0d..807a7ca8e26 100644
--- a/spec/finders/deployments_finder_spec.rb
+++ b/spec/finders/deployments_finder_spec.rb
@@ -280,6 +280,22 @@ RSpec.describe DeploymentsFinder, feature_category: :deployment_management do
           it { is_expected.to match_array([deployment_2]) }
         end
       end
+
+      context 'with mixed deployable types' do
+        let!(:deployment_1) do
+          create(:deployment, :success, project: project, deployable: create(:ci_build))
+        end
+
+        let!(:deployment_2) do
+          create(:deployment, :success, project: project, deployable: create(:ci_bridge))
+        end
+
+        let(:params) { { **base_params, status: 'success' } }
+
+        it 'successfuly fetches deployments' do
+          is_expected.to contain_exactly(deployment_1, deployment_2)
+        end
+      end
     end
 
     context 'at group scope' do
diff --git a/spec/finders/group_members_finder_spec.rb b/spec/finders/group_members_finder_spec.rb
index 18473a5e70b..b8a5be44241 100644
--- a/spec/finders/group_members_finder_spec.rb
+++ b/spec/finders/group_members_finder_spec.rb
@@ -288,4 +288,39 @@ RSpec.describe GroupMembersFinder, '#execute', feature_category: :groups_and_pro
       end
     end
   end
+
+  context 'filter by non-invite' do
+    let_it_be(:member) { group.add_maintainer(user1) }
+    let_it_be(:invited_member) do
+      create(:group_member, :invited, { user: user2, group: group })
+    end
+
+    context 'params is not passed in' do
+      subject { described_class.new(group, user1).execute }
+
+      it 'does not filter members by invite' do
+        expect(subject).to match_array([member, invited_member])
+      end
+    end
+
+    context 'params is passed in' do
+      subject { described_class.new(group, user1, params: { non_invite: non_invite_param }).execute }
+
+      context 'filtering is set to false' do
+        let(:non_invite_param) { false }
+
+        it 'does not filter members by invite' do
+          expect(subject).to match_array([member, invited_member])
+        end
+      end
+
+      context 'filtering is set to true' do
+        let(:non_invite_param) { true }
+
+        it 'filters members by invite' do
+          expect(subject).to match_array([member])
+        end
+      end
+    end
+  end
 end
diff --git a/spec/finders/groups/accepting_group_transfers_finder_spec.rb b/spec/finders/groups/accepting_group_transfers_finder_spec.rb
index 18407dd0196..5c78ec3124b 100644
--- a/spec/finders/groups/accepting_group_transfers_finder_spec.rb
+++ b/spec/finders/groups/accepting_group_transfers_finder_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Groups::AcceptingGroupTransfersFinder do
+RSpec.describe Groups::AcceptingGroupTransfersFinder, feature_category: :groups_and_projects do
   let_it_be(:current_user) { create(:user) }
 
   let_it_be(:great_grandparent_group) do
@@ -119,6 +119,25 @@ RSpec.describe Groups::AcceptingGroupTransfersFinder do
           expect(result).to contain_exactly(great_grandparent_group)
         end
       end
+
+      context 'on searching with multiple matches' do
+        let(:params) { { search: 'great-grandparent-group' } }
+        let(:other_groups) { [] }
+
+        before do
+          2.times do
+            # app/finders/group/base.rb adds an ORDER BY path, so create a group with 1 in the front.
+            group = create(:group, parent: great_grandparent_group, path: "1-#{SecureRandom.hex}")
+            group.add_owner(current_user)
+            other_groups << group
+          end
+        end
+
+        it 'prioritizes exact matches first' do
+          expect(result.first).to eq(great_grandparent_group)
+          expect(result[1..]).to match_array(other_groups)
+        end
+      end
     end
   end
 end
diff --git a/spec/finders/organizations/groups_finder_spec.rb b/spec/finders/organizations/groups_finder_spec.rb
new file mode 100644
index 00000000000..08c5604149b
--- /dev/null
+++ b/spec/finders/organizations/groups_finder_spec.rb
@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Organizations::GroupsFinder, feature_category: :cell do
+  let_it_be(:organization_user) { create(:organization_user) }
+  let_it_be(:organization) { organization_user.organization }
+  let_it_be(:user) { organization_user.user }
+  let_it_be(:public_group) { create(:group, name: 'public-group', organization: organization) }
+  let_it_be(:other_group) { create(:group, name: 'other-group', organization: organization) }
+  let_it_be(:outside_organization_group) { create(:group) }
+  let_it_be(:private_group) do
+    create(:group, :private, name: 'private-group', organization: organization)
+  end
+
+  let_it_be(:no_access_group_in_org) do
+    create(:group, :private, name: 'no-access', organization: organization)
+  end
+
+  let(:current_user) { user }
+  let(:params) { {} }
+  let(:finder) { described_class.new(organization: organization, current_user: current_user, params: params) }
+
+  before_all do
+    private_group.add_developer(user)
+    public_group.add_developer(user)
+    other_group.add_developer(user)
+    outside_organization_group.add_developer(user)
+  end
+
+  subject(:result) { finder.execute.to_a }
+
+  describe '#execute' do
+    context 'when user is not authorized to read the organization' do
+      let(:current_user) { create(:user) }
+
+      it { is_expected.to be_empty }
+    end
+
+    context 'when organization is nil' do
+      let(:organization) { nil }
+
+      it { is_expected.to be_empty }
+    end
+
+    context 'when user is authorized to read the organization' do
+      it 'return all accessible groups' do
+        expect(result).to contain_exactly(public_group, private_group, other_group)
+      end
+
+      context 'when search param is passed' do
+        let(:params) { { search: 'the' } }
+
+        it 'filters the groups by search' do
+          expect(result).to contain_exactly(other_group)
+        end
+      end
+
+      context 'when sort param is not passed' do
+        it 'return groups sorted by name in ascending order by default' do
+          expect(result).to eq([other_group, private_group, public_group])
+        end
+      end
+
+      context 'when sort param is passed' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:field, :direction, :sorted_groups) do
+          'name' | 'asc'  | lazy { [other_group, private_group, public_group] }
+          'name' | 'desc' | lazy { [public_group, private_group, other_group] }
+          'path' | 'asc'  | lazy { [other_group, private_group, public_group] }
+          'path' | 'desc' | lazy { [public_group, private_group, other_group] }
+        end
+
+        with_them do
+          let(:params) { { sort: { field: field, direction: direction } } }
+          it 'sorts the groups' do
+            expect(result).to eq(sorted_groups)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/finders/organizations/organization_users_finder_spec.rb b/spec/finders/organizations/organization_users_finder_spec.rb
new file mode 100644
index 00000000000..d7fba372e40
--- /dev/null
+++ b/spec/finders/organizations/organization_users_finder_spec.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Organizations::OrganizationUsersFinder, feature_category: :cell do
+  let_it_be(:organization) { create(:organization) }
+  let_it_be(:organization_user_1) { create(:organization_user, organization: organization) }
+  let_it_be(:organization_user_2) { create(:organization_user, organization: organization) }
+  let_it_be(:other_organization_user) { create(:organization_user) }
+
+  let(:current_user) { organization_user_1.user }
+  let(:finder) { described_class.new(organization: organization, current_user: current_user) }
+
+  subject(:result) { finder.execute.to_a }
+
+  describe '#execute' do
+    context 'when user is not authorized to read the organization' do
+      let(:current_user) { create(:user) }
+
+      it { is_expected.to be_empty }
+    end
+
+    context 'when organization is nil' do
+      let(:organization) { nil }
+
+      it { is_expected.to be_empty }
+    end
+
+    context 'when user is authorized to read the organization' do
+      it 'returns all organization users' do
+        expect(result).to contain_exactly(organization_user_1, organization_user_2)
+      end
+    end
+  end
+end
diff --git a/spec/finders/packages/npm/packages_for_user_finder_spec.rb b/spec/finders/packages/npm/packages_for_user_finder_spec.rb
new file mode 100644
index 00000000000..e2dc21e1008
--- /dev/null
+++ b/spec/finders/packages/npm/packages_for_user_finder_spec.rb
@@ -0,0 +1,41 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ::Packages::Npm::PackagesForUserFinder, feature_category: :package_registry do
+  let_it_be(:user) { create(:user) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project) { create(:project, group: group) }
+  let_it_be(:project2) { create(:project, group: group) }
+  let_it_be(:package) { create(:npm_package, project: project) }
+  let_it_be(:package_name) { package.name }
+  let_it_be(:package_with_diff_name) { create(:npm_package, project: project) }
+  let_it_be(:package_with_diff_project) { create(:npm_package, name: package_name, project: project2) }
+  let_it_be(:maven_package) { create(:maven_package, name: package_name, project: project) }
+
+  let(:finder) { described_class.new(user, project_or_group, package_name: package_name) }
+
+  describe '#execute' do
+    subject { finder.execute }
+
+    shared_examples 'searches for packages' do
+      it { is_expected.to contain_exactly(package) }
+    end
+
+    context 'with a project' do
+      let(:project_or_group) { project }
+
+      it_behaves_like 'searches for packages'
+    end
+
+    context 'with a group' do
+      let(:project_or_group) { group }
+
+      before_all do
+        project.add_reporter(user)
+      end
+
+      it_behaves_like 'searches for packages'
+    end
+  end
+end
diff --git a/spec/finders/packages/nuget/package_finder_spec.rb b/spec/finders/packages/nuget/package_finder_spec.rb
index 792e543e424..8230d132d75 100644
--- a/spec/finders/packages/nuget/package_finder_spec.rb
+++ b/spec/finders/packages/nuget/package_finder_spec.rb
@@ -114,16 +114,6 @@ RSpec.describe Packages::Nuget::PackageFinder, feature_category: :package_regist
 
         it_behaves_like 'calling with_nuget_version_or_normalized_version scope', with_normalized: true
       end
-
-      context 'when nuget_normalized_version feature flag is disabled' do
-        let(:package_version) { '2.0.0+abc' }
-
-        before do
-          stub_feature_flags(nuget_normalized_version: false)
-        end
-
-        it_behaves_like 'calling with_nuget_version_or_normalized_version scope', with_normalized: false
-      end
     end
 
     context 'with a project' do