Add latest changes from gitlab-org/gitlab@15-1-stable-eev15.1.0-rc42

70 files changed, 2858 insertions, 552 deletions

diff --git a/spec/requests/api/bulk_imports_spec.rb b/spec/requests/api/bulk_imports_spec.rb
index 3b8136f265b..9f9907f4f00 100644
--- a/spec/requests/api/bulk_imports_spec.rb
+++ b/spec/requests/api/bulk_imports_spec.rb
@@ -62,7 +62,7 @@ RSpec.describe API::BulkImports do
         entities: [
           source_type: 'group_entity',
           source_full_path: 'full_path',
-          destination_name: 'destination_name',
+          destination_name: 'destination_slug',
           destination_namespace: 'destination_namespace'
         ]
       }
@@ -82,7 +82,7 @@ RSpec.describe API::BulkImports do
           entities: [
             source_type: 'group_entity',
             source_full_path: 'full_path',
-            destination_name: 'destination_name',
+            destination_name: 'destination_slug',
             destination_namespace: 'destination_namespace'
           ]
         }
diff --git a/spec/requests/api/ci/job_artifacts_spec.rb b/spec/requests/api/ci/job_artifacts_spec.rb
index 1dd1ca4e115..2fa1ffb4974 100644
--- a/spec/requests/api/ci/job_artifacts_spec.rb
+++ b/spec/requests/api/ci/job_artifacts_spec.rb
@@ -41,42 +41,58 @@ RSpec.describe API::Ci::JobArtifacts do
   describe 'DELETE /projects/:id/jobs/:job_id/artifacts' do
     let!(:job) { create(:ci_build, :artifacts, pipeline: pipeline, user: api_user) }
 
-    before do
-      delete api("/projects/#{project.id}/jobs/#{job.id}/artifacts", api_user)
-    end
+    context 'when project is not undergoing stats refresh' do
+      before do
+        delete api("/projects/#{project.id}/jobs/#{job.id}/artifacts", api_user)
+      end
 
-    context 'when user is anonymous' do
-      let(:api_user) { nil }
+      context 'when user is anonymous' do
+        let(:api_user) { nil }
 
-      it 'does not delete artifacts' do
-        expect(job.job_artifacts.size).to eq 2
-      end
+        it 'does not delete artifacts' do
+          expect(job.job_artifacts.size).to eq 2
+        end
 
-      it 'returns status 401 (unauthorized)' do
-        expect(response).to have_gitlab_http_status(:unauthorized)
+        it 'returns status 401 (unauthorized)' do
+          expect(response).to have_gitlab_http_status(:unauthorized)
+        end
       end
-    end
 
-    context 'with developer' do
-      it 'does not delete artifacts' do
-        expect(job.job_artifacts.size).to eq 2
+      context 'with developer' do
+        it 'does not delete artifacts' do
+          expect(job.job_artifacts.size).to eq 2
+        end
+
+        it 'returns status 403 (forbidden)' do
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
       end
 
-      it 'returns status 403 (forbidden)' do
-        expect(response).to have_gitlab_http_status(:forbidden)
+      context 'with authorized user' do
+        let(:maintainer) { create(:project_member, :maintainer, project: project).user }
+        let!(:api_user) { maintainer }
+
+        it 'deletes artifacts' do
+          expect(job.job_artifacts.size).to eq 0
+        end
+
+        it 'returns status 204 (no content)' do
+          expect(response).to have_gitlab_http_status(:no_content)
+        end
       end
     end
 
-    context 'with authorized user' do
-      let(:maintainer) { create(:project_member, :maintainer, project: project).user }
-      let!(:api_user) { maintainer }
+    context 'when project is undergoing stats refresh' do
+      it_behaves_like 'preventing request because of ongoing project stats refresh' do
+        let(:maintainer) { create(:project_member, :maintainer, project: project).user }
+        let(:api_user) { maintainer }
+        let(:make_request) { delete api("/projects/#{project.id}/jobs/#{job.id}/artifacts", api_user) }
 
-      it 'deletes artifacts' do
-        expect(job.job_artifacts.size).to eq 0
-      end
+        it 'does not delete artifacts' do
+          make_request
 
-      it 'returns status 204 (no content)' do
-        expect(response).to have_gitlab_http_status(:no_content)
+          expect(job.job_artifacts.size).to eq 2
+        end
       end
     end
   end
@@ -131,6 +147,22 @@ RSpec.describe API::Ci::JobArtifacts do
 
         expect(response).to have_gitlab_http_status(:accepted)
       end
+
+      context 'when project is undergoing stats refresh' do
+        let!(:job) { create(:ci_build, :artifacts, pipeline: pipeline, user: api_user) }
+
+        it_behaves_like 'preventing request because of ongoing project stats refresh' do
+          let(:maintainer) { create(:project_member, :maintainer, project: project).user }
+          let(:api_user) { maintainer }
+          let(:make_request) { delete api("/projects/#{project.id}/artifacts", api_user) }
+
+          it 'does not delete artifacts' do
+            make_request
+
+            expect(job.job_artifacts.size).to eq 2
+          end
+        end
+      end
     end
   end
 
diff --git a/spec/requests/api/ci/jobs_spec.rb b/spec/requests/api/ci/jobs_spec.rb
index 4bd9f81fd1d..84ef9f8db1b 100644
--- a/spec/requests/api/ci/jobs_spec.rb
+++ b/spec/requests/api/ci/jobs_spec.rb
@@ -239,6 +239,17 @@ RSpec.describe API::Ci::Jobs do
         end
       end
 
+      context 'when non-deployment environment action' do
+        let(:job) do
+          create(:environment, name: 'review', project_id: project.id)
+          create(:ci_build, :artifacts, :stop_review_app, environment: 'review', pipeline: pipeline, user: api_user, status: job_status)
+        end
+
+        it 'includes environment slug' do
+          expect(json_response.dig('environment', 'slug')).to eq('review')
+        end
+      end
+
       context 'when passing the token as params' do
         let(:headers) { {} }
         let(:params) { { job_token: job.token } }
@@ -655,62 +666,80 @@ RSpec.describe API::Ci::Jobs do
 
     before do
       project.add_role(user, role)
-
-      post api("/projects/#{project.id}/jobs/#{job.id}/erase", user)
     end
 
-    shared_examples_for 'erases job' do
-      it 'erases job content' do
-        expect(response).to have_gitlab_http_status(:created)
-        expect(job.job_artifacts.count).to eq(0)
-        expect(job.trace.exist?).to be_falsy
-        expect(job.artifacts_file.present?).to be_falsy
-        expect(job.artifacts_metadata.present?).to be_falsy
-        expect(job.has_job_artifacts?).to be_falsy
+    context 'when project is not undergoing stats refresh' do
+      before do
+        post api("/projects/#{project.id}/jobs/#{job.id}/erase", user)
       end
-    end
 
-    context 'job is erasable' do
-      let(:job) { create(:ci_build, :trace_artifact, :artifacts, :test_reports, :success, project: project, pipeline: pipeline) }
+      shared_examples_for 'erases job' do
+        it 'erases job content' do
+          expect(response).to have_gitlab_http_status(:created)
+          expect(job.job_artifacts.count).to eq(0)
+          expect(job.trace.exist?).to be_falsy
+          expect(job.artifacts_file.present?).to be_falsy
+          expect(job.artifacts_metadata.present?).to be_falsy
+          expect(job.has_job_artifacts?).to be_falsy
+        end
+      end
+
+      context 'job is erasable' do
+        let(:job) { create(:ci_build, :trace_artifact, :artifacts, :test_reports, :success, project: project, pipeline: pipeline) }
 
-      it_behaves_like 'erases job'
+        it_behaves_like 'erases job'
 
-      it 'updates job' do
-        job.reload
+        it 'updates job' do
+          job.reload
 
-        expect(job.erased_at).to be_truthy
-        expect(job.erased_by).to eq(user)
+          expect(job.erased_at).to be_truthy
+          expect(job.erased_by).to eq(user)
+        end
       end
-    end
 
-    context 'when job has an unarchived trace artifact' do
-      let(:job) { create(:ci_build, :success, :trace_live, :unarchived_trace_artifact, project: project, pipeline: pipeline) }
+      context 'when job has an unarchived trace artifact' do
+        let(:job) { create(:ci_build, :success, :trace_live, :unarchived_trace_artifact, project: project, pipeline: pipeline) }
 
-      it_behaves_like 'erases job'
-    end
+        it_behaves_like 'erases job'
+      end
 
-    context 'job is not erasable' do
-      let(:job) { create(:ci_build, :trace_live, project: project, pipeline: pipeline) }
+      context 'job is not erasable' do
+        let(:job) { create(:ci_build, :trace_live, project: project, pipeline: pipeline) }
 
-      it 'responds with forbidden' do
-        expect(response).to have_gitlab_http_status(:forbidden)
+        it 'responds with forbidden' do
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
       end
-    end
 
-    context 'when a developer erases a build' do
-      let(:role) { :developer }
-      let(:job) { create(:ci_build, :trace_artifact, :artifacts, :success, project: project, pipeline: pipeline, user: owner) }
+      context 'when a developer erases a build' do
+        let(:role) { :developer }
+        let(:job) { create(:ci_build, :trace_artifact, :artifacts, :success, project: project, pipeline: pipeline, user: owner) }
 
-      context 'when the build was created by the developer' do
-        let(:owner) { user }
+        context 'when the build was created by the developer' do
+          let(:owner) { user }
+
+          it { expect(response).to have_gitlab_http_status(:created) }
+        end
 
-        it { expect(response).to have_gitlab_http_status(:created) }
+        context 'when the build was created by another user' do
+          let(:owner) { create(:user) }
+
+          it { expect(response).to have_gitlab_http_status(:forbidden) }
+        end
       end
+    end
 
-      context 'when the build was created by the other' do
-        let(:owner) { create(:user) }
+    context 'when project is undergoing stats refresh' do
+      let(:job) { create(:ci_build, :trace_artifact, :artifacts, :test_reports, :success, project: project, pipeline: pipeline) }
 
-        it { expect(response).to have_gitlab_http_status(:forbidden) }
+      it_behaves_like 'preventing request because of ongoing project stats refresh' do
+        let(:make_request) { post api("/projects/#{project.id}/jobs/#{job.id}/erase", user) }
+
+        it 'does not delete artifacts' do
+          make_request
+
+          expect(job.reload.job_artifacts).not_to be_empty
+        end
       end
     end
   end
diff --git a/spec/requests/api/ci/pipelines_spec.rb b/spec/requests/api/ci/pipelines_spec.rb
index 12faeec94da..697fe16e222 100644
--- a/spec/requests/api/ci/pipelines_spec.rb
+++ b/spec/requests/api/ci/pipelines_spec.rb
@@ -1018,6 +1018,18 @@ RSpec.describe API::Ci::Pipelines do
           expect { build.reload }.to raise_error(ActiveRecord::RecordNotFound)
         end
       end
+
+      context 'when project is undergoing stats refresh' do
+        it_behaves_like 'preventing request because of ongoing project stats refresh' do
+          let(:make_request) { delete api("/projects/#{project.id}/pipelines/#{pipeline.id}", owner) }
+
+          it 'does not delete the pipeline' do
+            make_request
+
+            expect(pipeline.reload).to be_persisted
+          end
+        end
+      end
     end
 
     context 'unauthorized user' do
diff --git a/spec/requests/api/ci/runner/jobs_request_post_spec.rb b/spec/requests/api/ci/runner/jobs_request_post_spec.rb
index dbc5f0e74e2..3c6f9ac2816 100644
--- a/spec/requests/api/ci/runner/jobs_request_post_spec.rb
+++ b/spec/requests/api/ci/runner/jobs_request_post_spec.rb
@@ -216,7 +216,7 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
             expect(json_response['token']).to eq(job.token)
             expect(json_response['job_info']).to eq(expected_job_info)
             expect(json_response['git_info']).to eq(expected_git_info)
-            expect(json_response['image']).to eq({ 'name' => 'image:1.0', 'entrypoint' => '/bin/sh', 'ports' => [] })
+            expect(json_response['image']).to eq({ 'name' => 'image:1.0', 'entrypoint' => '/bin/sh', 'ports' => [], 'pull_policy' => nil })
             expect(json_response['services']).to eq([{ 'name' => 'postgres', 'entrypoint' => nil,
                                                        'alias' => nil, 'command' => nil, 'ports' => [], 'variables' => nil },
                                                      { 'name' => 'docker:stable-dind', 'entrypoint' => '/bin/sh',
@@ -810,6 +810,45 @@ RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
           end
         end
 
+        context 'when image has pull_policy' do
+          let(:job) { create(:ci_build, :pending, :queued, pipeline: pipeline, options: options) }
+
+          let(:options) do
+            {
+              image: {
+                name: 'ruby',
+                pull_policy: ['if-not-present']
+              }
+            }
+          end
+
+          it 'returns the image with pull policy' do
+            request_job
+
+            expect(response).to have_gitlab_http_status(:created)
+            expect(json_response).to include(
+              'id' => job.id,
+              'image' => { 'name' => 'ruby', 'pull_policy' => ['if-not-present'], 'entrypoint' => nil, 'ports' => [] }
+            )
+          end
+
+          context 'when the FF ci_docker_image_pull_policy is disabled' do
+            before do
+              stub_feature_flags(ci_docker_image_pull_policy: false)
+            end
+
+            it 'returns the image without pull policy' do
+              request_job
+
+              expect(response).to have_gitlab_http_status(:created)
+              expect(json_response).to include(
+                'id' => job.id,
+                'image' => { 'name' => 'ruby', 'entrypoint' => nil, 'ports' => [] }
+              )
+            end
+          end
+        end
+
         describe 'a job with excluded artifacts' do
           context 'when excluded paths are defined' do
             let(:job) do
diff --git a/spec/requests/api/clusters/agent_tokens_spec.rb b/spec/requests/api/clusters/agent_tokens_spec.rb
index ba26faa45a3..2dca21ca6f1 100644
--- a/spec/requests/api/clusters/agent_tokens_spec.rb
+++ b/spec/requests/api/clusters/agent_tokens_spec.rb
@@ -37,7 +37,7 @@ RSpec.describe API::Clusters::AgentTokens do
       it 'cannot access agent tokens' do
         get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens", unauthorized_user)
 
-        expect(response).to have_gitlab_http_status(:forbidden)
+        expect(response).to have_gitlab_http_status(:not_found)
       end
     end
 
@@ -85,7 +85,7 @@ RSpec.describe API::Clusters::AgentTokens do
       it 'cannot access single agent token' do
         get api("/projects/#{project.id}/cluster_agents/#{agent.id}/tokens/#{agent_token_one.id}", unauthorized_user)
 
-        expect(response).to have_gitlab_http_status(:forbidden)
+        expect(response).to have_gitlab_http_status(:not_found)
       end
 
       it 'cannot access token from agent of another project' do
diff --git a/spec/requests/api/clusters/agents_spec.rb b/spec/requests/api/clusters/agents_spec.rb
index e29be255289..72d4266b9e3 100644
--- a/spec/requests/api/clusters/agents_spec.rb
+++ b/spec/requests/api/clusters/agents_spec.rb
@@ -11,6 +11,7 @@ RSpec.describe API::Clusters::Agents do
 
   before do
     project.add_maintainer(user)
+    project.add_guest(unauthorized_user)
   end
 
   describe 'GET /projects/:id/cluster_agents' do
@@ -26,6 +27,19 @@ RSpec.describe API::Clusters::Agents do
           expect(json_response.first['name']).to eq(agent.name)
         end
       end
+
+      it 'returns empty list when no agents registered' do
+        no_agents_project = create(:project, namespace: user.namespace)
+
+        get api("/projects/#{no_agents_project.id}/cluster_agents", user)
+
+        aggregate_failures "testing response" do
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(response).to match_response_schema('public_api/v4/agents')
+          expect(json_response.count).to eq(0)
+        end
+      end
     end
 
     context 'unauthorized user' do
@@ -140,10 +154,10 @@ RSpec.describe API::Clusters::Agents do
       expect(response).to have_gitlab_http_status(:not_found)
     end
 
-    it 'returns a 404 if the user is unauthorized to delete' do
+    it 'returns a 403 if the user is unauthorized to delete' do
       delete api("/projects/#{project.id}/cluster_agents/#{agent.id}", unauthorized_user)
 
-      expect(response).to have_gitlab_http_status(:not_found)
+      expect(response).to have_gitlab_http_status(:forbidden)
     end
 
     it_behaves_like '412 response' do
diff --git a/spec/requests/api/environments_spec.rb b/spec/requests/api/environments_spec.rb
index 8328b454122..93f21c880a4 100644
--- a/spec/requests/api/environments_spec.rb
+++ b/spec/requests/api/environments_spec.rb
@@ -113,7 +113,7 @@ RSpec.describe API::Environments do
       end
 
       context 'when filtering' do
-        let_it_be(:environment2) { create(:environment, project: project) }
+        let_it_be(:stopped_environment) { create(:environment, :stopped, project: project) }
 
         it 'returns environment by name' do
           get api("/projects/#{project.id}/environments?name=#{environment.name}", user)
@@ -152,11 +152,32 @@ RSpec.describe API::Environments do
           expect(json_response.size).to eq(0)
         end
 
-        it 'returns a 400 status code with invalid states' do
+        it 'returns environment by valid state' do
+          get api("/projects/#{project.id}/environments?states=available", user)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(json_response).to be_an Array
+          expect(json_response.size).to eq(1)
+          expect(json_response.first['name']).to eq(environment.name)
+        end
+
+        it 'returns all environments when state is not specified' do
+          get api("/projects/#{project.id}/environments", user)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(json_response).to be_an Array
+          expect(json_response.size).to eq(2)
+          expect(json_response.first['name']).to eq(environment.name)
+          expect(json_response.last['name']).to eq(stopped_environment.name)
+        end
+
+        it 'returns a 400 when filtering by invalid state' do
           get api("/projects/#{project.id}/environments?states=test", user)
 
           expect(response).to have_gitlab_http_status(:bad_request)
-          expect(json_response['message']).to include('Requested states are invalid')
+          expect(json_response['error']).to eq('states does not have a valid value')
         end
       end
     end
diff --git a/spec/requests/api/error_tracking/collector_spec.rb b/spec/requests/api/error_tracking/collector_spec.rb
index c0d7eb5460f..dfca994d1c3 100644
--- a/spec/requests/api/error_tracking/collector_spec.rb
+++ b/spec/requests/api/error_tracking/collector_spec.rb
@@ -106,17 +106,30 @@ RSpec.describe API::ErrorTracking::Collector do
     end
 
     context 'gzip body' do
-      let(:headers) do
+      let(:standard_headers) do
         {
           'X-Sentry-Auth' => "Sentry sentry_key=#{client_key.public_key}",
-          'HTTP_CONTENT_ENCODING' => 'gzip',
-          'CONTENT_TYPE' => 'application/x-sentry-envelope'
+          'HTTP_CONTENT_ENCODING' => 'gzip'
         }
       end
 
       let(:params) { ActiveSupport::Gzip.compress(raw_event) }
 
-      it_behaves_like 'successful request'
+      context 'with application/x-sentry-envelope Content-Type' do
+        let(:headers) { standard_headers.merge({ 'CONTENT_TYPE' => 'application/x-sentry-envelope' }) }
+
+        it_behaves_like 'successful request'
+      end
+
+      context 'with unexpected Content-Type' do
+        let(:headers) { standard_headers.merge({ 'CONTENT_TYPE' => 'application/gzip' }) }
+
+        it 'responds with 415' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:unsupported_media_type)
+        end
+      end
     end
   end
 
diff --git a/spec/requests/api/features_spec.rb b/spec/requests/api/features_spec.rb
index 4e75b0510d0..b54be4f5258 100644
--- a/spec/requests/api/features_spec.rb
+++ b/spec/requests/api/features_spec.rb
@@ -168,19 +168,15 @@ RSpec.describe API::Features, stub_feature_flags: false do
         end
       end
 
-      shared_examples 'does not enable the flag' do |actor_type, actor_path|
+      shared_examples 'does not enable the flag' do |actor_type|
+        let(:actor_path) { raise NotImplementedError }
+        let(:expected_inexistent_path) { actor_path }
+
         it 'returns the current state of the flag without changes' do
           post api("/features/#{feature_name}", admin), params: { value: 'true', actor_type => actor_path }
 
-          expect(response).to have_gitlab_http_status(:created)
-          expect(json_response).to match(
-            "name" => feature_name,
-            "state" => "off",
-            "gates" => [
-              { "key" => "boolean", "value" => false }
-            ],
-            'definition' => known_feature_flag_definition_hash
-          )
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']).to eq("400 Bad request - #{expected_inexistent_path} is not found!")
         end
       end
 
@@ -201,6 +197,19 @@ RSpec.describe API::Features, stub_feature_flags: false do
         end
       end
 
+      shared_examples 'creates an enabled feature for the specified entries' do
+        it do
+          post api("/features/#{feature_name}", admin), params: { value: 'true', **gate_params }
+
+          expect(response).to have_gitlab_http_status(:created)
+          expect(json_response['name']).to eq(feature_name)
+          expect(json_response['gates']).to contain_exactly(
+            { 'key' => 'boolean', 'value' => false },
+            { 'key' => 'actors', 'value' => array_including(expected_gate_params) }
+          )
+        end
+      end
+
       context 'when enabling for a project by path' do
         context 'when the project exists' do
           it_behaves_like 'enables the flag for the actor', :project do
@@ -209,7 +218,9 @@ RSpec.describe API::Features, stub_feature_flags: false do
         end
 
         context 'when the project does not exist' do
-          it_behaves_like 'does not enable the flag', :project, 'mep/to/the/mep/mep'
+          it_behaves_like 'does not enable the flag', :project do
+            let(:actor_path) { 'mep/to/the/mep/mep' }
+          end
         end
       end
 
@@ -221,7 +232,9 @@ RSpec.describe API::Features, stub_feature_flags: false do
         end
 
         context 'when the group does not exist' do
-          it_behaves_like 'does not enable the flag', :group, 'not/a/group'
+          it_behaves_like 'does not enable the flag', :group do
+            let(:actor_path) { 'not/a/group' }
+          end
         end
       end
 
@@ -239,7 +252,9 @@ RSpec.describe API::Features, stub_feature_flags: false do
         end
 
         context 'when the user namespace does not exist' do
-          it_behaves_like 'does not enable the flag', :namespace, 'not/a/group'
+          it_behaves_like 'does not enable the flag', :namespace do
+            let(:actor_path) { 'not/a/group' }
+          end
         end
 
         context 'when a project namespace exists' do
@@ -251,6 +266,98 @@ RSpec.describe API::Features, stub_feature_flags: false do
         end
       end
 
+      context 'with multiple users' do
+        let_it_be(:users) { create_list(:user, 3) }
+
+        it_behaves_like 'creates an enabled feature for the specified entries' do
+          let(:gate_params) { { user: users.map(&:username).join(',') } }
+          let(:expected_gate_params) { users.map(&:flipper_id) }
+        end
+
+        context 'when empty value exists between comma' do
+          it_behaves_like 'creates an enabled feature for the specified entries' do
+            let(:gate_params) { { user: "#{users.first.username},,,," } }
+            let(:expected_gate_params) { users.first.flipper_id }
+          end
+        end
+
+        context 'when one of the users does not exist' do
+          it_behaves_like 'does not enable the flag', :user do
+            let(:actor_path) { "#{users.first.username},inexistent-entry" }
+            let(:expected_inexistent_path) { "inexistent-entry" }
+          end
+        end
+      end
+
+      context 'with multiple projects' do
+        let_it_be(:projects) { create_list(:project, 3) }
+
+        it_behaves_like 'creates an enabled feature for the specified entries' do
+          let(:gate_params) { { project: projects.map(&:full_path).join(',') } }
+          let(:expected_gate_params) { projects.map(&:flipper_id) }
+        end
+
+        context 'when empty value exists between comma' do
+          it_behaves_like 'creates an enabled feature for the specified entries' do
+            let(:gate_params) { { project: "#{projects.first.full_path},,,," } }
+            let(:expected_gate_params) { projects.first.flipper_id }
+          end
+        end
+
+        context 'when one of the projects does not exist' do
+          it_behaves_like 'does not enable the flag', :project do
+            let(:actor_path) { "#{projects.first.full_path},inexistent-entry" }
+            let(:expected_inexistent_path) { "inexistent-entry" }
+          end
+        end
+      end
+
+      context 'with multiple groups' do
+        let_it_be(:groups) { create_list(:group, 3) }
+
+        it_behaves_like 'creates an enabled feature for the specified entries' do
+          let(:gate_params) { { group: groups.map(&:full_path).join(',') } }
+          let(:expected_gate_params) { groups.map(&:flipper_id) }
+        end
+
+        context 'when empty value exists between comma' do
+          it_behaves_like 'creates an enabled feature for the specified entries' do
+            let(:gate_params) { { group: "#{groups.first.full_path},,,," } }
+            let(:expected_gate_params) { groups.first.flipper_id }
+          end
+        end
+
+        context 'when one of the groups does not exist' do
+          it_behaves_like 'does not enable the flag', :group do
+            let(:actor_path) { "#{groups.first.full_path},inexistent-entry" }
+            let(:expected_inexistent_path) { "inexistent-entry" }
+          end
+        end
+      end
+
+      context 'with multiple namespaces' do
+        let_it_be(:namespaces) { create_list(:namespace, 3) }
+
+        it_behaves_like 'creates an enabled feature for the specified entries' do
+          let(:gate_params) { { namespace: namespaces.map(&:full_path).join(',') } }
+          let(:expected_gate_params) { namespaces.map(&:flipper_id) }
+        end
+
+        context 'when empty value exists between comma' do
+          it_behaves_like 'creates an enabled feature for the specified entries' do
+            let(:gate_params) { { namespace: "#{namespaces.first.full_path},,,," } }
+            let(:expected_gate_params) { namespaces.first.flipper_id }
+          end
+        end
+
+        context 'when one of the namespaces does not exist' do
+          it_behaves_like 'does not enable the flag', :namespace do
+            let(:actor_path) { "#{namespaces.first.full_path},inexistent-entry" }
+            let(:expected_inexistent_path) { "inexistent-entry" }
+          end
+        end
+      end
+
       it 'creates a feature with the given percentage of time if passed an integer' do
         post api("/features/#{feature_name}", admin), params: { value: '50' }
 
diff --git a/spec/requests/api/graphql/ci/jobs_spec.rb b/spec/requests/api/graphql/ci/jobs_spec.rb
index 2d1bb45390b..d1737fc22ae 100644
--- a/spec/requests/api/graphql/ci/jobs_spec.rb
+++ b/spec/requests/api/graphql/ci/jobs_spec.rb
@@ -258,4 +258,81 @@ RSpec.describe 'Query.project.pipeline' do
       end
     end
   end
+
+  describe '.jobs.count' do
+    let_it_be(:pipeline) { create(:ci_pipeline, project: project) }
+    let_it_be(:successful_job) { create(:ci_build, :success, pipeline: pipeline) }
+    let_it_be(:pending_job) { create(:ci_build, :pending, pipeline: pipeline) }
+    let_it_be(:failed_job) { create(:ci_build, :failed, pipeline: pipeline) }
+
+    let(:query) do
+      %(
+        query {
+          project(fullPath: "#{project.full_path}") {
+            pipeline(iid: "#{pipeline.iid}") {
+              jobs {
+                count
+              }
+            }
+          }
+        }
+      )
+    end
+
+    before do
+      post_graphql(query, current_user: user)
+    end
+
+    it 'returns the number of jobs' do
+      expect(graphql_data_at(:project, :pipeline, :jobs, :count)).to eq(3)
+    end
+
+    context 'with limit value' do
+      let(:limit) { 1 }
+
+      let(:query) do
+        %(
+          query {
+            project(fullPath: "#{project.full_path}") {
+              pipeline(iid: "#{pipeline.iid}") {
+                jobs {
+                  count(limit: #{limit})
+                }
+              }
+            }
+          }
+        )
+      end
+
+      it 'returns a limited number of jobs' do
+        expect(graphql_data_at(:project, :pipeline, :jobs, :count)).to eq(2)
+      end
+
+      context 'with invalid value' do
+        let(:limit) { 1500 }
+
+        it 'returns a validation error' do
+          expect(graphql_errors).to include(a_hash_including('message' => 'limit must be less than or equal to 1000'))
+        end
+      end
+    end
+
+    context 'with jobs filter' do
+      let(:query) do
+        %(
+          query {
+            project(fullPath: "#{project.full_path}") {
+              jobs(statuses: FAILED) {
+                count
+              }
+            }
+          }
+        )
+      end
+
+      it 'returns the number of failed jobs' do
+        expect(graphql_data_at(:project, :jobs, :count)).to eq(1)
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/ci/runner_spec.rb b/spec/requests/api/graphql/ci/runner_spec.rb
index 6fa455cbfca..446d1fb1bdb 100644
--- a/spec/requests/api/graphql/ci/runner_spec.rb
+++ b/spec/requests/api/graphql/ci/runner_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'Query.runner(id)' do
     create(:ci_runner, :instance, description: 'Runner 1', contacted_at: 2.hours.ago,
            active: true, version: 'adfe156', revision: 'a', locked: true, ip_address: '127.0.0.1', maximum_timeout: 600,
            access_level: 0, tag_list: %w[tag1 tag2], run_untagged: true, executor_type: :custom,
-           maintenance_note: 'Test maintenance note')
+           maintenance_note: '**Test maintenance note**')
   end
 
   let_it_be(:inactive_instance_runner) do
@@ -66,6 +66,8 @@ RSpec.describe 'Query.runner(id)' do
         'architectureName' => runner.architecture,
         'platformName' => runner.platform,
         'maintenanceNote' => runner.maintenance_note,
+        'maintenanceNoteHtml' =>
+          runner.maintainer_note.present? ? a_string_including('<strong>Test maintenance note</strong>') : '',
         'jobCount' => 0,
         'jobs' => a_hash_including("count" => 0, "nodes" => [], "pageInfo" => anything),
         'projectCount' => nil,
@@ -150,34 +152,72 @@ RSpec.describe 'Query.runner(id)' do
   end
 
   describe 'for project runner' do
-    using RSpec::Parameterized::TableSyntax
+    describe 'locked' do
+      using RSpec::Parameterized::TableSyntax
 
-    where(is_locked: [true, false])
+      where(is_locked: [true, false])
 
-    with_them do
-      let(:project_runner) do
-        create(:ci_runner, :project, description: 'Runner 3', contacted_at: 1.day.ago, active: false, locked: is_locked,
-               version: 'adfe157', revision: 'b', ip_address: '10.10.10.10', access_level: 1, run_untagged: true)
-      end
+      with_them do
+        let(:project_runner) do
+          create(:ci_runner, :project, description: 'Runner 3', contacted_at: 1.day.ago, active: false, locked: is_locked,
+                 version: 'adfe157', revision: 'b', ip_address: '10.10.10.10', access_level: 1, run_untagged: true)
+        end
 
-      let(:query) do
-        wrap_fields(query_graphql_path(query_path, all_graphql_fields_for('CiRunner')))
+        let(:query) do
+          wrap_fields(query_graphql_path(query_path, 'id locked'))
+        end
+
+        let(:query_path) do
+          [
+            [:runner, { id: project_runner.to_global_id.to_s }]
+          ]
+        end
+
+        it 'retrieves correct locked value' do
+          post_graphql(query, current_user: user)
+
+          runner_data = graphql_data_at(:runner)
+
+          expect(runner_data).to match a_hash_including(
+            'id' => project_runner.to_global_id.to_s,
+            'locked' => is_locked
+          )
+        end
       end
+    end
 
-      let(:query_path) do
-        [
-          [:runner, { id: project_runner.to_global_id.to_s }]
-        ]
+    describe 'ownerProject' do
+      let_it_be(:project1) { create(:project) }
+      let_it_be(:project2) { create(:project) }
+      let_it_be(:runner1) { create(:ci_runner, :project, projects: [project2, project1]) }
+      let_it_be(:runner2) { create(:ci_runner, :project, projects: [project1, project2]) }
+
+      let(:runner_query_fragment) { 'id ownerProject { id }' }
+      let(:query) do
+        %(
+          query {
+            runner1: runner(id: "#{runner1.to_global_id}") { #{runner_query_fragment} }
+            runner2: runner(id: "#{runner2.to_global_id}") { #{runner_query_fragment} }
+          }
+        )
       end
 
-      it 'retrieves correct locked value' do
+      it 'retrieves correct ownerProject.id values' do
         post_graphql(query, current_user: user)
 
-        runner_data = graphql_data_at(:runner)
-
-        expect(runner_data).to match a_hash_including(
-          'id' => project_runner.to_global_id.to_s,
-          'locked' => is_locked
+        expect(graphql_data).to match a_hash_including(
+          'runner1' => {
+            'id' => runner1.to_global_id.to_s,
+            'ownerProject' => {
+              'id' => project2.to_global_id.to_s
+            }
+          },
+          'runner2' => {
+            'id' => runner2.to_global_id.to_s,
+            'ownerProject' => {
+              'id' => project1.to_global_id.to_s
+            }
+          }
         )
       end
     end
@@ -405,17 +445,35 @@ RSpec.describe 'Query.runner(id)' do
       <<~SINGLE
         runner(id: "#{runner.to_global_id}") {
           #{all_graphql_fields_for('CiRunner', excluded: excluded_fields)}
+          groups {
+            nodes {
+              id
+            }
+          }
+          projects {
+            nodes {
+              id
+            }
+          }
+          ownerProject {
+            id
+          }
         }
       SINGLE
     end
 
-    # Currently excluding a known N+1 issue, see https://gitlab.com/gitlab-org/gitlab/-/issues/334759
-    let(:excluded_fields) { %w[jobCount] }
+    let(:active_project_runner2) { create(:ci_runner, :project) }
+    let(:active_group_runner2) { create(:ci_runner, :group) }
+
+    # Currently excluding known N+1 issues, see https://gitlab.com/gitlab-org/gitlab/-/issues/334759
+    let(:excluded_fields) { %w[jobCount groups projects ownerProject] }
 
     let(:single_query) do
       <<~QUERY
         {
-          active: #{runner_query(active_instance_runner)}
+          instance_runner1: #{runner_query(active_instance_runner)}
+          project_runner1: #{runner_query(active_project_runner)}
+          group_runner1: #{runner_query(active_group_runner)}
         }
       QUERY
     end
@@ -423,22 +481,51 @@ RSpec.describe 'Query.runner(id)' do
     let(:double_query) do
       <<~QUERY
         {
-          active: #{runner_query(active_instance_runner)}
-          inactive: #{runner_query(inactive_instance_runner)}
+          instance_runner1: #{runner_query(active_instance_runner)}
+          instance_runner2: #{runner_query(inactive_instance_runner)}
+          group_runner1: #{runner_query(active_group_runner)}
+          group_runner2: #{runner_query(active_group_runner2)}
+          project_runner1: #{runner_query(active_project_runner)}
+          project_runner2: #{runner_query(active_project_runner2)}
         }
       QUERY
     end
 
     it 'does not execute more queries per runner', :aggregate_failures do
       # warm-up license cache and so on:
-      post_graphql(single_query, current_user: user)
+      post_graphql(double_query, current_user: user)
 
       control = ActiveRecord::QueryRecorder.new { post_graphql(single_query, current_user: user) }
 
       expect { post_graphql(double_query, current_user: user) }
         .not_to exceed_query_limit(control)
-      expect(graphql_data_at(:active)).not_to be_nil
-      expect(graphql_data_at(:inactive)).not_to be_nil
+
+      expect(graphql_data.count).to eq 6
+      expect(graphql_data).to match(
+        a_hash_including(
+          'instance_runner1' => a_hash_including('id' => active_instance_runner.to_global_id.to_s),
+          'instance_runner2' => a_hash_including('id' => inactive_instance_runner.to_global_id.to_s),
+          'group_runner1' => a_hash_including(
+            'id' => active_group_runner.to_global_id.to_s,
+            'groups' => { 'nodes' => [a_hash_including('id' => group.to_global_id.to_s)] }
+          ),
+          'group_runner2' => a_hash_including(
+            'id' => active_group_runner2.to_global_id.to_s,
+            'groups' => { 'nodes' => [a_hash_including('id' => active_group_runner2.groups[0].to_global_id.to_s)] }
+          ),
+          'project_runner1' => a_hash_including(
+            'id' => active_project_runner.to_global_id.to_s,
+            'projects' => { 'nodes' => [a_hash_including('id' => active_project_runner.projects[0].to_global_id.to_s)] },
+            'ownerProject' => a_hash_including('id' => active_project_runner.projects[0].to_global_id.to_s)
+          ),
+          'project_runner2' => a_hash_including(
+            'id' => active_project_runner2.to_global_id.to_s,
+            'projects' => {
+              'nodes' => [a_hash_including('id' => active_project_runner2.projects[0].to_global_id.to_s)]
+            },
+            'ownerProject' => a_hash_including('id' => active_project_runner2.projects[0].to_global_id.to_s)
+          )
+        ))
     end
   end
 end
diff --git a/spec/requests/api/graphql/ci/runners_spec.rb b/spec/requests/api/graphql/ci/runners_spec.rb
index d3e94671724..a5b8115286e 100644
--- a/spec/requests/api/graphql/ci/runners_spec.rb
+++ b/spec/requests/api/graphql/ci/runners_spec.rb
@@ -18,7 +18,10 @@ RSpec.describe 'Query.runners' do
     let(:fields) do
       <<~QUERY
         nodes {
-          #{all_graphql_fields_for('CiRunner')}
+          #{all_graphql_fields_for('CiRunner', excluded: %w[ownerProject])}
+          ownerProject {
+            id
+          }
         }
       QUERY
     end
@@ -123,3 +126,47 @@ RSpec.describe 'Query.runners' do
     end
   end
 end
+
+RSpec.describe 'Group.runners' do
+  include GraphqlHelpers
+
+  let_it_be(:group) { create(:group) }
+  let_it_be(:group_owner) { create_default(:user) }
+
+  before do
+    group.add_owner(group_owner)
+  end
+
+  describe 'edges' do
+    let_it_be(:runner) do
+      create(:ci_runner, :group, active: false, version: 'def', revision: '456',
+             description: 'Project runner', groups: [group], ip_address: '127.0.0.1')
+    end
+
+    let(:query) do
+      %(
+        query($path: ID!) {
+          group(fullPath: $path) {
+            runners {
+              edges {
+                webUrl
+                editUrl
+                node { #{all_graphql_fields_for('CiRunner')} }
+              }
+            }
+          }
+        }
+      )
+    end
+
+    it 'contains custom edge information' do
+      r = GitlabSchema.execute(query,
+                               context: { current_user: group_owner },
+                               variables: { path: group.full_path })
+
+      edges = graphql_dig_at(r.to_h, :data, :group, :runners, :edges)
+
+      expect(edges).to contain_exactly(a_graphql_entity_for(web_url: be_present, edit_url: be_present))
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/gitlab_schema_spec.rb b/spec/requests/api/graphql/gitlab_schema_spec.rb
index e80f5e0e0ff..c1beadb6c45 100644
--- a/spec/requests/api/graphql/gitlab_schema_spec.rb
+++ b/spec/requests/api/graphql/gitlab_schema_spec.rb
@@ -190,7 +190,7 @@ RSpec.describe 'GitlabSchema configurations' do
     let(:query) { File.read(Rails.root.join('spec/fixtures/api/graphql/introspection.graphql')) }
 
     it 'logs the query complexity and depth' do
-      expect_any_instance_of(Gitlab::Graphql::QueryAnalyzers::LoggerAnalyzer).to receive(:duration).and_return(7)
+      expect_any_instance_of(Gitlab::Graphql::QueryAnalyzers::AST::LoggerAnalyzer).to receive(:duration).and_return(7)
 
       expect(Gitlab::GraphqlLogger).to receive(:info).with(
         hash_including(
diff --git a/spec/requests/api/graphql/issue/issue_spec.rb b/spec/requests/api/graphql/issue/issue_spec.rb
index 05fd6bf3022..6e2d736f244 100644
--- a/spec/requests/api/graphql/issue/issue_spec.rb
+++ b/spec/requests/api/graphql/issue/issue_spec.rb
@@ -129,6 +129,29 @@ RSpec.describe 'Query.issue(id)' do
         expect(graphql_errors.first['message']).to eq("\"#{gid}\" does not represent an instance of Issue")
       end
     end
+
+    context 'when selecting `closed_as_duplicate_of`' do
+      let(:issue_fields) { ['closedAsDuplicateOf { id }'] }
+      let(:duplicate_issue) { create(:issue, project: project) }
+
+      before do
+        issue.update!(duplicated_to_id: duplicate_issue.id)
+
+        post_graphql(query, current_user: current_user)
+      end
+
+      it 'returns the related issue' do
+        expect(issue_data['closedAsDuplicateOf']['id']).to eq(duplicate_issue.to_global_id.to_s)
+      end
+
+      context 'no permission to related issue' do
+        let(:duplicate_issue) { create(:issue) }
+
+        it 'does not return the related issue' do
+          expect(issue_data['closedAsDuplicateOf']).to eq(nil)
+        end
+      end
+    end
   end
 
   context 'when there is a confidential issue' do
diff --git a/spec/requests/api/graphql/milestone_spec.rb b/spec/requests/api/graphql/milestone_spec.rb
index 59de116fa2b..f6835936418 100644
--- a/spec/requests/api/graphql/milestone_spec.rb
+++ b/spec/requests/api/graphql/milestone_spec.rb
@@ -5,43 +5,125 @@ require 'spec_helper'
 RSpec.describe 'Querying a Milestone' do
   include GraphqlHelpers
 
-  let_it_be(:current_user) { create(:user) }
+  let_it_be(:guest) { create(:user) }
   let_it_be(:project) { create(:project) }
   let_it_be(:milestone) { create(:milestone, project: project) }
+  let_it_be(:release_a) { create(:release, project: project) }
+  let_it_be(:release_b) { create(:release, project: project) }
 
-  let(:query) do
-    graphql_query_for('milestone', { id: milestone.to_global_id.to_s }, 'title')
+  before_all do
+    milestone.releases << [release_a, release_b]
+    project.add_guest(guest)
   end
 
-  subject { graphql_data['milestone'] }
-
-  before do
-    post_graphql(query, current_user: current_user)
+  let(:expected_release_nodes) do
+    contain_exactly(a_graphql_entity_for(release_a), a_graphql_entity_for(release_b))
   end
 
-  context 'when the user has access to the milestone' do
-    before_all do
-      project.add_guest(current_user)
+  context 'when we post the query' do
+    let(:current_user) { nil }
+    let(:query) do
+      graphql_query_for('milestone', { id: milestone.to_global_id.to_s }, all_graphql_fields_for('Milestone'))
     end
 
-    it_behaves_like 'a working graphql query'
+    subject { graphql_data['milestone'] }
 
-    it { is_expected.to include('title' => milestone.name) }
-  end
+    before do
+      post_graphql(query, current_user: current_user)
+    end
 
-  context 'when the user does not have access to the milestone' do
-    it_behaves_like 'a working graphql query'
+    context 'when the user has access to the milestone' do
+      let(:current_user) { guest }
 
-    it { is_expected.to be_nil }
+      it_behaves_like 'a working graphql query'
+
+      it { is_expected.to include('title' => milestone.name) }
+
+      it 'contains release information' do
+        is_expected.to include('releases' => include('nodes' => expected_release_nodes))
+      end
+    end
+
+    context 'when the user does not have access to the milestone' do
+      it_behaves_like 'a working graphql query'
+
+      it { is_expected.to be_nil }
+    end
+
+    context 'when ID argument is missing' do
+      let(:query) do
+        graphql_query_for('milestone', {}, 'title')
+      end
+
+      it 'raises an exception' do
+        expect(graphql_errors).to include(a_hash_including('message' => "Field 'milestone' is missing required arguments: id"))
+      end
+    end
   end
 
-  context 'when ID argument is missing' do
-    let(:query) do
-      graphql_query_for('milestone', {}, 'title')
+  context 'when there are two milestones' do
+    let_it_be(:milestone_b) { create(:milestone, project: project) }
+
+    let(:current_user) { guest }
+    let(:milestone_fields) do
+      <<~GQL
+      fragment milestoneFields on Milestone {
+        #{all_graphql_fields_for('Milestone', max_depth: 1)}
+        releases { nodes { #{all_graphql_fields_for('Release', max_depth: 1)} } }
+      }
+      GQL
+    end
+
+    let(:single_query) do
+      <<~GQL
+      query ($id_a: MilestoneID!) {
+        a: milestone(id: $id_a) { ...milestoneFields }
+      }
+
+      #{milestone_fields}
+      GQL
+    end
+
+    let(:multi_query) do
+      <<~GQL
+      query ($id_a: MilestoneID!, $id_b: MilestoneID!) {
+        a: milestone(id: $id_a) { ...milestoneFields }
+        b: milestone(id: $id_b) { ...milestoneFields }
+      }
+      #{milestone_fields}
+      GQL
+    end
+
+    it 'produces correct results' do
+      r = run_with_clean_state(multi_query,
+                           context: { current_user: current_user },
+                           variables: {
+                             id_a: global_id_of(milestone).to_s,
+                             id_b: milestone_b.to_global_id.to_s
+                           })
+
+      expect(r.to_h['errors']).to be_blank
+      expect(graphql_dig_at(r.to_h, :data, :a, :releases, :nodes)).to match expected_release_nodes
+      expect(graphql_dig_at(r.to_h, :data, :b, :releases, :nodes)).to be_empty
     end
 
-    it 'raises an exception' do
-      expect(graphql_errors).to include(a_hash_including('message' => "Field 'milestone' is missing required arguments: id"))
+    it 'does not suffer from N+1 performance issues' do
+      baseline = ActiveRecord::QueryRecorder.new do
+        run_with_clean_state(single_query,
+                             context: { current_user: current_user },
+                             variables: { id_a: milestone.to_global_id.to_s })
+      end
+
+      multi = ActiveRecord::QueryRecorder.new do
+        run_with_clean_state(multi_query,
+                             context: { current_user: current_user },
+                             variables: {
+                               id_a: milestone.to_global_id.to_s,
+                               id_b: milestone_b.to_global_id.to_s
+                             })
+      end
+
+      expect(multi).not_to exceed_query_limit(baseline)
     end
   end
 end
diff --git a/spec/requests/api/graphql/mutations/ci/pipeline_destroy_spec.rb b/spec/requests/api/graphql/mutations/ci/pipeline_destroy_spec.rb
index 37656ab4eea..7abd5ca8772 100644
--- a/spec/requests/api/graphql/mutations/ci/pipeline_destroy_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/pipeline_destroy_spec.rb
@@ -28,4 +28,21 @@ RSpec.describe 'PipelineDestroy' do
     expect(response).to have_gitlab_http_status(:success)
     expect { pipeline.reload }.to raise_error(ActiveRecord::RecordNotFound)
   end
+
+  context 'when project is undergoing stats refresh' do
+    before do
+      create(:project_build_artifacts_size_refresh, :pending, project: pipeline.project)
+    end
+
+    it 'returns an error and does not destroy the pipeline' do
+      expect(Gitlab::ProjectStatsRefreshConflictsLogger)
+        .to receive(:warn_request_rejected_during_stats_refresh)
+        .with(pipeline.project.id)
+
+      post_graphql_mutation(mutation, current_user: user)
+
+      expect(graphql_mutation_response(:pipeline_destroy)['errors']).not_to be_empty
+      expect(pipeline.reload).to be_persisted
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb b/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb
index decb2e7bccc..ef00f45ef18 100644
--- a/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb
+++ b/spec/requests/api/graphql/mutations/container_repository/destroy_tags_spec.rb
@@ -91,7 +91,7 @@ RSpec.describe 'Destroying a container repository tags' do
       it 'returns too many tags error' do
         expect { subject }.not_to change { ::Packages::Event.count }
 
-        explanation = graphql_errors.dig(0, 'extensions', 'problems', 0, 'explanation')
+        explanation = graphql_errors.dig(0, 'message')
         expect(explanation).to eq(Mutations::ContainerRepositories::DestroyTags::TOO_MANY_TAGS_ERROR_MESSAGE)
       end
     end
diff --git a/spec/requests/api/graphql/mutations/design_management/delete_spec.rb b/spec/requests/api/graphql/mutations/design_management/delete_spec.rb
index 1f43f113e65..e2ab08b301b 100644
--- a/spec/requests/api/graphql/mutations/design_management/delete_spec.rb
+++ b/spec/requests/api/graphql/mutations/design_management/delete_spec.rb
@@ -47,7 +47,7 @@ RSpec.describe "deleting designs" do
   context 'the designs list is empty' do
     it_behaves_like 'a failed request' do
       let(:designs) { [] }
-      let(:the_error) { a_string_matching %r/was provided invalid value/ }
+      let(:the_error) { a_string_matching %r/no filenames/ }
     end
   end
 
diff --git a/spec/requests/api/graphql/mutations/incident_management/timeline_event/create_spec.rb b/spec/requests/api/graphql/mutations/incident_management/timeline_event/create_spec.rb
index 3ea8b38e20f..923e12a3c06 100644
--- a/spec/requests/api/graphql/mutations/incident_management/timeline_event/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/incident_management/timeline_event/create_spec.rb
@@ -53,7 +53,7 @@ RSpec.describe 'Creating an incident timeline event' do
       },
       'note' => note,
       'action' => 'comment',
-      'editable' => false,
+      'editable' => true,
       'occurredAt' => event_occurred_at.iso8601
     )
   end
diff --git a/spec/requests/api/graphql/mutations/incident_management/timeline_event/destroy_spec.rb b/spec/requests/api/graphql/mutations/incident_management/timeline_event/destroy_spec.rb
index faff3bfe23a..85208869ad9 100644
--- a/spec/requests/api/graphql/mutations/incident_management/timeline_event/destroy_spec.rb
+++ b/spec/requests/api/graphql/mutations/incident_management/timeline_event/destroy_spec.rb
@@ -56,7 +56,7 @@ RSpec.describe 'Removing an incident timeline event' do
       },
       'note' => timeline_event.note,
       'noteHtml' => timeline_event.note_html,
-      'editable' => false,
+      'editable' => true,
       'action' => timeline_event.action,
       'occurredAt' => timeline_event.occurred_at.iso8601,
       'createdAt' => timeline_event.created_at.iso8601,
diff --git a/spec/requests/api/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb b/spec/requests/api/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb
index b92f6af1d3d..9272e218172 100644
--- a/spec/requests/api/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb
+++ b/spec/requests/api/graphql/mutations/incident_management/timeline_event/promote_from_note_spec.rb
@@ -55,7 +55,7 @@ RSpec.describe 'Promote an incident timeline event from a comment' do
       },
       'note' => comment.note,
       'action' => 'comment',
-      'editable' => false,
+      'editable' => true,
       'occurredAt' => comment.created_at.iso8601
     )
   end
diff --git a/spec/requests/api/graphql/mutations/issues/set_crm_contacts_spec.rb b/spec/requests/api/graphql/mutations/issues/set_crm_contacts_spec.rb
index 715507c3cc5..395a490bfc3 100644
--- a/spec/requests/api/graphql/mutations/issues/set_crm_contacts_spec.rb
+++ b/spec/requests/api/graphql/mutations/issues/set_crm_contacts_spec.rb
@@ -102,18 +102,6 @@ RSpec.describe 'Setting issues crm contacts' do
       group.add_reporter(user)
     end
 
-    context 'when the feature is disabled' do
-      before do
-        stub_feature_flags(customer_relations: false)
-      end
-
-      it 'raises expected error' do
-        post_graphql_mutation(mutation, current_user: user)
-
-        expect(graphql_errors).to include(a_hash_including('message' => 'Feature disabled'))
-      end
-    end
-
     it_behaves_like 'successful mutation'
 
     context 'when the contact does not exist' do
diff --git a/spec/requests/api/graphql/mutations/issues/set_escalation_status_spec.rb b/spec/requests/api/graphql/mutations/issues/set_escalation_status_spec.rb
index 0166871502b..a81364d37b2 100644
--- a/spec/requests/api/graphql/mutations/issues/set_escalation_status_spec.rb
+++ b/spec/requests/api/graphql/mutations/issues/set_escalation_status_spec.rb
@@ -49,14 +49,6 @@ RSpec.describe 'Setting the escalation status of an incident' do
     it_behaves_like 'a mutation that returns top-level errors', errors: ['Feature unavailable for provided issue']
   end
 
-  context 'with feature disabled' do
-    before do
-      stub_feature_flags(incident_escalations: false)
-    end
-
-    it_behaves_like 'a mutation that returns top-level errors', errors: ['Feature unavailable for provided issue']
-  end
-
   it 'sets given escalation_policy to the escalation status for the issue' do
     post_graphql_mutation(mutation, current_user: current_user)
 
diff --git a/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb b/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb
index 45cc70f09fd..b438e1ba881 100644
--- a/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb
+++ b/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe 'Importing Jira Users' do
-  include JiraServiceHelper
+  include JiraIntegrationHelpers
   include GraphqlHelpers
 
   let_it_be(:user)    { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/jira_import/start_spec.rb b/spec/requests/api/graphql/mutations/jira_import/start_spec.rb
index b14305281af..1508ba31e37 100644
--- a/spec/requests/api/graphql/mutations/jira_import/start_spec.rb
+++ b/spec/requests/api/graphql/mutations/jira_import/start_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe 'Starting a Jira Import' do
-  include JiraServiceHelper
+  include JiraIntegrationHelpers
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb b/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb
index 5bc3c68cf26..9ef443af76a 100644
--- a/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb
@@ -76,7 +76,6 @@ RSpec.describe Mutations::Metrics::Dashboard::Annotations::Create do
       context 'when environment_id is missing' do
         let(:mutation) do
           variables = {
-            environment_id: nil,
             starting_at: starting_at,
             ending_at: ending_at,
             dashboard_path: dashboard_path,
@@ -147,7 +146,6 @@ RSpec.describe Mutations::Metrics::Dashboard::Annotations::Create do
       context 'when cluster_id is missing' do
         let(:mutation) do
           variables = {
-            cluster_id: nil,
             starting_at: starting_at,
             ending_at: ending_at,
             dashboard_path: dashboard_path,
diff --git a/spec/requests/api/graphql/mutations/notes/reposition_image_diff_note_spec.rb b/spec/requests/api/graphql/mutations/notes/reposition_image_diff_note_spec.rb
index 0f7ccac3179..c4674155aa0 100644
--- a/spec/requests/api/graphql/mutations/notes/reposition_image_diff_note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/reposition_image_diff_note_spec.rb
@@ -68,15 +68,7 @@ RSpec.describe 'Repositioning an ImageDiffNote' do
     let(:new_position) { { x: nil } }
 
     it_behaves_like 'a mutation that returns top-level errors' do
-      let(:match_errors) { include(/RepositionImageDiffNoteInput! was provided invalid value/) }
-    end
-
-    it 'contains an explanation for the error' do
-      post_graphql_mutation(mutation, current_user: current_user)
-
-      explanation = graphql_errors.first['extensions']['problems'].first['explanation']
-
-      expect(explanation).to eq('At least one property of `UpdateDiffImagePositionInput` must be set')
+      let(:match_errors) { include(/At least one property of `UpdateDiffImagePositionInput` must be set/) }
     end
   end
 end
diff --git a/spec/requests/api/graphql/mutations/packages/cleanup/policy/update_spec.rb b/spec/requests/api/graphql/mutations/packages/cleanup/policy/update_spec.rb
new file mode 100644
index 00000000000..7e00f3ca53a
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/packages/cleanup/policy/update_spec.rb
@@ -0,0 +1,109 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Updating the packages cleanup policy' do
+  include GraphqlHelpers
+  using RSpec::Parameterized::TableSyntax
+
+  let_it_be(:project, reload: true) { create(:project) }
+  let_it_be(:user) { create(:user) }
+
+  let(:params) do
+    {
+      project_path: project.full_path,
+      keep_n_duplicated_package_files: 'TWENTY_PACKAGE_FILES'
+    }
+  end
+
+  let(:mutation) do
+    graphql_mutation(:update_packages_cleanup_policy, params,
+                     <<~QUERY
+                       packagesCleanupPolicy {
+                         keepNDuplicatedPackageFiles
+                         nextRunAt
+                       }
+                       errors
+                     QUERY
+    )
+  end
+
+  let(:mutation_response) { graphql_mutation_response(:update_packages_cleanup_policy) }
+  let(:packages_cleanup_policy_response) { mutation_response['packagesCleanupPolicy'] }
+
+  shared_examples 'accepting the mutation request and updates the existing policy' do
+    it 'returns the updated packages cleanup policy' do
+      expect { subject }.not_to change { ::Packages::Cleanup::Policy.count }
+
+      expect(project.packages_cleanup_policy.keep_n_duplicated_package_files).to eq('20')
+      expect_graphql_errors_to_be_empty
+      expect(packages_cleanup_policy_response['keepNDuplicatedPackageFiles'])
+        .to eq(params[:keep_n_duplicated_package_files])
+      expect(packages_cleanup_policy_response['nextRunAt']).not_to eq(nil)
+    end
+  end
+
+  shared_examples 'accepting the mutation request and creates a policy' do
+    it 'returns the created packages cleanup policy' do
+      expect { subject }.to change { ::Packages::Cleanup::Policy.count }.by(1)
+
+      expect(project.packages_cleanup_policy.keep_n_duplicated_package_files).to eq('20')
+      expect_graphql_errors_to_be_empty
+      expect(packages_cleanup_policy_response['keepNDuplicatedPackageFiles'])
+        .to eq(params[:keep_n_duplicated_package_files])
+      expect(packages_cleanup_policy_response['nextRunAt']).not_to eq(nil)
+    end
+  end
+
+  shared_examples 'denying the mutation request' do
+    it 'returns an error' do
+      expect { subject }.not_to change { ::Packages::Cleanup::Policy.count }
+
+      expect(project.packages_cleanup_policy.keep_n_duplicated_package_files).not_to eq('20')
+      expect(mutation_response).to be_nil
+      expect_graphql_errors_to_include(/you don't have permission to perform this action/)
+    end
+  end
+
+  describe 'post graphql mutation' do
+    subject { post_graphql_mutation(mutation, current_user: user) }
+
+    context 'with existing packages cleanup policy' do
+      let_it_be(:project_packages_cleanup_policy) { create(:packages_cleanup_policy, project: project) }
+
+      where(:user_role, :shared_examples_name) do
+        :maintainer | 'accepting the mutation request and updates the existing policy'
+        :developer  | 'denying the mutation request'
+        :reporter   | 'denying the mutation request'
+        :guest      | 'denying the mutation request'
+        :anonymous  | 'denying the mutation request'
+      end
+
+      with_them do
+        before do
+          project.send("add_#{user_role}", user) unless user_role == :anonymous
+        end
+
+        it_behaves_like params[:shared_examples_name]
+      end
+    end
+
+    context 'without existing packages cleanup policy' do
+      where(:user_role, :shared_examples_name) do
+        :maintainer | 'accepting the mutation request and creates a policy'
+        :developer  | 'denying the mutation request'
+        :reporter   | 'denying the mutation request'
+        :guest      | 'denying the mutation request'
+        :anonymous  | 'denying the mutation request'
+      end
+
+      with_them do
+        before do
+          project.send("add_#{user_role}", user) unless user_role == :anonymous
+        end
+
+        it_behaves_like params[:shared_examples_name]
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/packages/destroy_files_spec.rb b/spec/requests/api/graphql/mutations/packages/destroy_files_spec.rb
new file mode 100644
index 00000000000..002cd634ebd
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/packages/destroy_files_spec.rb
@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Destroying multiple package files' do
+  using RSpec::Parameterized::TableSyntax
+
+  include GraphqlHelpers
+
+  let_it_be_with_reload(:package) { create(:maven_package) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project) { package.project }
+
+  let(:ids) { package.package_files.first(2).map { |pf| pf.to_global_id.to_s } }
+
+  let(:query) do
+    <<~GQL
+      errors
+    GQL
+  end
+
+  let(:params) do
+    {
+      project_path: project.full_path,
+      ids: ids
+    }
+  end
+
+  let(:mutation) { graphql_mutation(:destroy_package_files, params, query) }
+
+  describe 'post graphql mutation' do
+    subject(:mutation_request) { post_graphql_mutation(mutation, current_user: user) }
+
+    shared_examples 'destroying the package files' do
+      it 'marks the package file as pending destruction' do
+        expect { mutation_request }.to change { ::Packages::PackageFile.pending_destruction.count }.by(2)
+      end
+
+      it_behaves_like 'returning response status', :success
+    end
+
+    shared_examples 'denying the mutation request' do |response = "you don't have permission to perform this action"|
+      it 'does not mark the package file as pending destruction' do
+        expect { mutation_request }.not_to change { ::Packages::PackageFile.pending_destruction.count }
+
+        expect_graphql_errors_to_include(response)
+      end
+
+      it_behaves_like 'returning response status', :success
+    end
+
+    context 'with valid params' do
+      where(:user_role, :shared_examples_name) do
+        :maintainer | 'destroying the package files'
+        :developer  | 'denying the mutation request'
+        :reporter   | 'denying the mutation request'
+        :guest      | 'denying the mutation request'
+        :anonymous  | 'denying the mutation request'
+      end
+
+      with_them do
+        before do
+          project.send("add_#{user_role}", user) unless user_role == :anonymous
+        end
+
+        it_behaves_like params[:shared_examples_name]
+      end
+
+      context 'with more than 100 files' do
+        let(:ids) { package.package_files.map { |pf| pf.to_global_id.to_s } }
+
+        before do
+          project.add_maintainer(user)
+          create_list(:package_file, 99, package: package)
+        end
+
+        it_behaves_like 'denying the mutation request', 'Cannot delete more than 100 files'
+      end
+
+      context 'with files outside of the project' do
+        let_it_be(:package2) { create(:maven_package) }
+
+        let(:ids) { super().push(package2.package_files.first.to_global_id.to_s) }
+
+        before do
+          project.add_maintainer(user)
+        end
+
+        it_behaves_like 'denying the mutation request', 'All files must be in the requested project'
+      end
+    end
+
+    context 'with invalid params' do
+      let(:params) { { id: 'foo' } }
+
+      before do
+        project.add_maintainer(user)
+      end
+
+      it_behaves_like 'denying the mutation request', 'invalid value for id'
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/releases/create_spec.rb b/spec/requests/api/graphql/mutations/releases/create_spec.rb
index 86995c10f10..1e62942c29d 100644
--- a/spec/requests/api/graphql/mutations/releases/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/releases/create_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe 'Creation of a new release' do
   let(:mutation_name) { :release_create }
 
   let(:tag_name) { 'v7.12.5'}
+  let(:tag_message) { nil }
   let(:ref) { 'master'}
   let(:name) { 'Version 7.12.5'}
   let(:description) { 'Release 7.12.5 :rocket:' }
@@ -29,6 +30,7 @@ RSpec.describe 'Creation of a new release' do
     {
       projectPath: project.full_path,
       tagName: tag_name,
+      tagMessage: tag_message,
       ref: ref,
       name: name,
       description: description,
@@ -191,10 +193,26 @@ RSpec.describe 'Creation of a new release' do
     context 'when the provided tag does not already exist' do
       let(:tag_name) { 'v7.12.5-alpha' }
 
+      after do
+        project.repository.rm_tag(developer, tag_name)
+      end
+
       it_behaves_like 'no errors'
 
-      it 'creates a new tag' do
+      it 'creates a new lightweight tag' do
         expect { create_release }.to change { Project.find_by_id(project.id).repository.tag_count }.by(1)
+        expect(project.repository.find_tag(tag_name).message).to be_blank
+      end
+
+      context 'and tag_message is provided' do
+        let(:tag_message) { 'Annotated tag message' }
+
+        it_behaves_like 'no errors'
+
+        it 'creates a new annotated tag with the message' do
+          expect { create_release }.to change { Project.find_by_id(project.id).repository.tag_count }.by(1)
+          expect(project.repository.find_tag(tag_name).message).to eq(tag_message)
+        end
       end
     end
 
diff --git a/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb b/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb
index 85194e6eb20..e1c7fd9d60d 100644
--- a/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb
@@ -28,17 +28,6 @@ RSpec.describe Mutations::UserPreferences::Update do
       expect(current_user.user_preference.persisted?).to eq(true)
       expect(current_user.user_preference.issues_sort).to eq(Types::IssueSortEnum.values[sort_value].value.to_s)
     end
-
-    context 'when incident_escalations feature flag is disabled' do
-      let(:sort_value) { 'ESCALATION_STATUS_ASC' }
-
-      before do
-        stub_feature_flags(incident_escalations: false)
-      end
-
-      it_behaves_like 'a mutation that returns top-level errors',
-        errors: ['Feature flag `incident_escalations` must be enabled to use this sort order.']
-    end
   end
 
   context 'when user has existing preference' do
@@ -56,16 +45,5 @@ RSpec.describe Mutations::UserPreferences::Update do
 
       expect(current_user.user_preference.issues_sort).to eq(Types::IssueSortEnum.values[sort_value].value.to_s)
     end
-
-    context 'when incident_escalations feature flag is disabled' do
-      let(:sort_value) { 'ESCALATION_STATUS_DESC' }
-
-      before do
-        stub_feature_flags(incident_escalations: false)
-      end
-
-      it_behaves_like 'a mutation that returns top-level errors',
-        errors: ['Feature flag `incident_escalations` must be enabled to use this sort order.']
-    end
   end
 end
diff --git a/spec/requests/api/graphql/mutations/work_items/update_task_spec.rb b/spec/requests/api/graphql/mutations/work_items/update_task_spec.rb
new file mode 100644
index 00000000000..32468a46ace
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/work_items/update_task_spec.rb
@@ -0,0 +1,101 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Update a work item task' do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:developer) { create(:user).tap { |user| project.add_developer(user) } }
+  let_it_be(:unauthorized_work_item) { create(:work_item) }
+  let_it_be(:referenced_work_item, refind: true) { create(:work_item, project: project, title: 'REFERENCED') }
+  let_it_be(:parent_work_item) do
+    create(:work_item, project: project, description: "- [ ] #{referenced_work_item.to_reference}+")
+  end
+
+  let(:task) { referenced_work_item }
+  let(:work_item) { parent_work_item }
+  let(:task_params) { { 'title' => 'UPDATED' } }
+  let(:task_input) { { 'id' => task.to_global_id.to_s }.merge(task_params) }
+  let(:input) { { 'id' => work_item.to_global_id.to_s, 'taskData' => task_input } }
+  let(:mutation) { graphql_mutation(:workItemUpdateTask, input) }
+  let(:mutation_response) { graphql_mutation_response(:work_item_update_task) }
+
+  context 'the user is not allowed to read a work item' do
+    let(:current_user) { create(:user) }
+
+    it_behaves_like 'a mutation that returns a top-level access error'
+  end
+
+  context 'when user has permissions to update a work item' do
+    let(:current_user) { developer }
+
+    it 'updates the work item and invalidates markdown cache on the original work item' do
+      expect do
+        post_graphql_mutation(mutation, current_user: current_user)
+        work_item.reload
+        referenced_work_item.reload
+      end.to change(referenced_work_item, :title).from(referenced_work_item.title).to('UPDATED')
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(mutation_response).to include(
+        'workItem' => hash_including(
+          'title' => work_item.title,
+          'descriptionHtml' => a_string_including('UPDATED')
+        ),
+        'task' => hash_including(
+          'title' => 'UPDATED'
+        )
+      )
+    end
+
+    context 'when providing invalid task params' do
+      let(:task_params) { { 'title' => '' } }
+
+      it 'makes no changes to the DB and returns an error message' do
+        expect do
+          post_graphql_mutation(mutation, current_user: current_user)
+          work_item.reload
+          task.reload
+        end.to not_change(task, :title).and(
+          not_change(work_item, :description_html)
+        )
+
+        expect(mutation_response['errors']).to contain_exactly("Title can't be blank")
+      end
+    end
+
+    context 'when user cannot update the task' do
+      let(:task) { unauthorized_work_item }
+
+      it_behaves_like 'a mutation that returns a top-level access error'
+    end
+
+    it_behaves_like 'has spam protection' do
+      let(:mutation_class) { ::Mutations::WorkItems::UpdateTask }
+    end
+
+    context 'when the work_items feature flag is disabled' do
+      before do
+        stub_feature_flags(work_items: false)
+      end
+
+      it 'does not update the task item and returns and error' do
+        expect do
+          post_graphql_mutation(mutation, current_user: current_user)
+          work_item.reload
+          task.reload
+        end.to not_change(task, :title)
+
+        expect(mutation_response['errors']).to contain_exactly('`work_items` feature flag disabled for this project')
+      end
+    end
+  end
+
+  context 'when user does not have permissions to update a work item' do
+    let(:current_user) { developer }
+    let(:work_item) { unauthorized_work_item }
+
+    it_behaves_like 'a mutation that returns a top-level access error'
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/work_items/update_widgets_spec.rb b/spec/requests/api/graphql/mutations/work_items/update_widgets_spec.rb
new file mode 100644
index 00000000000..595d8fe97ed
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/work_items/update_widgets_spec.rb
@@ -0,0 +1,78 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Update work item widgets' do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:developer) { create(:user).tap { |user| project.add_developer(user) } }
+  let_it_be(:work_item, refind: true) { create(:work_item, project: project) }
+
+  let(:input) do
+    {
+      'descriptionWidget' => { 'description' => 'updated description' }
+    }
+  end
+
+  let(:mutation) { graphql_mutation(:workItemUpdateWidgets, input.merge('id' => work_item.to_global_id.to_s)) }
+
+  let(:mutation_response) { graphql_mutation_response(:work_item_update_widgets) }
+
+  context 'the user is not allowed to update a work item' do
+    let(:current_user) { create(:user) }
+
+    it_behaves_like 'a mutation that returns a top-level access error'
+  end
+
+  context 'when user has permissions to update a work item', :aggregate_failures do
+    let(:current_user) { developer }
+
+    context 'when the updated work item is not valid' do
+      it 'returns validation errors without the work item' do
+        errors = ActiveModel::Errors.new(work_item).tap { |e| e.add(:description, 'error message') }
+
+        allow_next_found_instance_of(::WorkItem) do |instance|
+          allow(instance).to receive(:valid?).and_return(false)
+          allow(instance).to receive(:errors).and_return(errors)
+        end
+
+        post_graphql_mutation(mutation, current_user: current_user)
+
+        expect(mutation_response['workItem']).to be_nil
+        expect(mutation_response['errors']).to match_array(['Description error message'])
+      end
+    end
+
+    it 'updates the work item widgets' do
+      expect do
+        post_graphql_mutation(mutation, current_user: current_user)
+        work_item.reload
+      end.to change(work_item, :description).from(nil).to('updated description')
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(mutation_response['workItem']).to include(
+        'title' => work_item.title
+      )
+    end
+
+    it_behaves_like 'has spam protection' do
+      let(:mutation_class) { ::Mutations::WorkItems::UpdateWidgets }
+    end
+
+    context 'when the work_items feature flag is disabled' do
+      before do
+        stub_feature_flags(work_items: false)
+      end
+
+      it 'does not update the work item and returns and error' do
+        expect do
+          post_graphql_mutation(mutation, current_user: current_user)
+          work_item.reload
+        end.to not_change(work_item, :title)
+
+        expect(mutation_response['errors']).to contain_exactly('`work_items` feature flag disabled for this project')
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/project/incident_management/timeline_events_spec.rb b/spec/requests/api/graphql/project/incident_management/timeline_events_spec.rb
index 708fa96986c..31fef75f679 100644
--- a/spec/requests/api/graphql/project/incident_management/timeline_events_spec.rb
+++ b/spec/requests/api/graphql/project/incident_management/timeline_events_spec.rb
@@ -94,7 +94,7 @@ RSpec.describe 'getting incident timeline events' do
         'id' => promoted_from_note.to_global_id.to_s,
         'body' => promoted_from_note.note
       },
-      'editable' => false,
+      'editable' => true,
       'action' => timeline_event.action,
       'occurredAt' => timeline_event.occurred_at.iso8601,
       'createdAt' => timeline_event.created_at.iso8601,
diff --git a/spec/requests/api/graphql/project/issues_spec.rb b/spec/requests/api/graphql/project/issues_spec.rb
index f358ec3e53f..69e14eace66 100644
--- a/spec/requests/api/graphql/project/issues_spec.rb
+++ b/spec/requests/api/graphql/project/issues_spec.rb
@@ -635,6 +635,18 @@ RSpec.describe 'getting an issue list for a project' do
 
       include_examples 'N+1 query check'
     end
+    context 'when requesting `closed_as_duplicate_of`' do
+      let(:requested_fields) { 'closedAsDuplicateOf { id }' }
+      let(:issue_a_dup) { create(:issue, project: project) }
+      let(:issue_b_dup) { create(:issue, project: project) }
+
+      before do
+        issue_a.update!(duplicated_to_id: issue_a_dup)
+        issue_b.update!(duplicated_to_id: issue_a_dup)
+      end
+
+      include_examples 'N+1 query check'
+    end
   end
 
   def issues_ids
diff --git a/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb b/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb
index 820a5d818c7..4dc272b5c2e 100644
--- a/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request/pipelines_spec.rb
@@ -7,6 +7,7 @@ RSpec.describe 'Query.project.mergeRequests.pipelines' do
 
   let_it_be(:project) { create(:project, :public, :repository) }
   let_it_be(:author) { create(:user) }
+  let_it_be(:mr_nodes_path) { [:data, :project, :merge_requests, :nodes] }
   let_it_be(:merge_requests) do
     [
       create(:merge_request, author: author, source_project: project),
@@ -33,8 +34,49 @@ RSpec.describe 'Query.project.mergeRequests.pipelines' do
       GQL
     end
 
-    def run_query(first = nil)
-      post_graphql(query, current_user: author, variables: { path: project.full_path, first: first })
+    before do
+      merge_requests.first(2).each do |mr|
+        shas = mr.recent_diff_head_shas
+
+        shas.each do |sha|
+          create(:ci_pipeline, :success, project: project, ref: mr.source_branch, sha: sha)
+        end
+      end
+    end
+
+    it 'produces correct results' do
+      r = run_query(3)
+
+      nodes = graphql_dig_at(r, *mr_nodes_path)
+
+      expect(nodes).to all(match('iid' => be_present, 'pipelines' => include('count' => be_a(Integer))))
+      expect(graphql_dig_at(r, *mr_nodes_path, :pipelines, :count)).to contain_exactly(1, 1, 0)
+    end
+
+    it 'is scalable', :request_store, :use_clean_rails_memory_store_caching do
+      baseline = ActiveRecord::QueryRecorder.new { run_query(1) }
+
+      expect { run_query(2) }.not_to exceed_query_limit(baseline)
+    end
+  end
+
+  describe '.nodes' do
+    let(:query) do
+      <<~GQL
+      query($path: ID!, $first: Int) {
+        project(fullPath: $path) {
+          mergeRequests(first: $first) {
+            nodes {
+              iid
+              pipelines {
+                count
+                nodes { id }
+              }
+            }
+          }
+        }
+      }
+      GQL
     end
 
     before do
@@ -48,18 +90,27 @@ RSpec.describe 'Query.project.mergeRequests.pipelines' do
     end
 
     it 'produces correct results' do
-      run_query(2)
-
-      p_nodes = graphql_data_at(:project, :merge_requests, :nodes)
+      r = run_query
 
-      expect(p_nodes).to all(match('iid' => be_present, 'pipelines' => match('count' => 1)))
+      expect(graphql_dig_at(r, *mr_nodes_path, :pipelines, :nodes, :id).uniq.size).to eq 3
     end
 
     it 'is scalable', :request_store, :use_clean_rails_memory_store_caching do
-      # warm up
-      run_query
+      baseline = ActiveRecord::QueryRecorder.new { run_query(1) }
 
-      expect { run_query(2) }.to(issue_same_number_of_queries_as { run_query(1) }.ignoring_cached_queries)
+      expect { run_query(2) }.not_to exceed_query_limit(baseline)
     end
+
+    it 'requests merge_request_diffs at most once' do
+      r = ActiveRecord::QueryRecorder.new { run_query(2) }
+
+      expect(r.log.grep(/merge_request_diffs/)).to contain_exactly(a_string_including('SELECT'))
+    end
+  end
+
+  def run_query(first = nil)
+    run_with_clean_state(query,
+                         context: { current_user: author },
+                         variables: { path: project.full_path, first: first })
   end
 end
diff --git a/spec/requests/api/graphql/project/milestones_spec.rb b/spec/requests/api/graphql/project/milestones_spec.rb
index 3e8948d83b1..d1ee157fc74 100644
--- a/spec/requests/api/graphql/project/milestones_spec.rb
+++ b/spec/requests/api/graphql/project/milestones_spec.rb
@@ -59,6 +59,27 @@ RSpec.describe 'getting milestone listings nested in a project' do
     end
   end
 
+  context 'the user does not have access' do
+    let_it_be(:project) { create(:project) }
+    let_it_be(:milestones) { create_list(:milestone, 2, project: project) }
+
+    it 'is nil' do
+      post_graphql(query, current_user: current_user)
+
+      expect(graphql_data_at(:project)).to be_nil
+    end
+
+    context 'the user has access' do
+      let(:expected) { milestones }
+
+      before do
+        project.add_guest(current_user)
+      end
+
+      it_behaves_like 'searching with parameters'
+    end
+  end
+
   context 'there are no search params' do
     let(:search_params) { nil }
     let(:expected) { all_milestones }
diff --git a/spec/requests/api/graphql/project/packages_cleanup_policy_spec.rb b/spec/requests/api/graphql/project/packages_cleanup_policy_spec.rb
new file mode 100644
index 00000000000..a025c57d4b8
--- /dev/null
+++ b/spec/requests/api/graphql/project/packages_cleanup_policy_spec.rb
@@ -0,0 +1,79 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe 'getting the packages cleanup policy linked to a project' do
+  using RSpec::Parameterized::TableSyntax
+  include GraphqlHelpers
+
+  let_it_be_with_reload(:project) { create(:project) }
+  let_it_be(:current_user) { project.first_owner }
+
+  let(:fields) do
+    <<~QUERY
+      #{all_graphql_fields_for('packages_cleanup_policy'.classify)}
+    QUERY
+  end
+
+  let(:query) do
+    graphql_query_for(
+      'project',
+      { 'fullPath' => project.full_path },
+      query_graphql_field('packagesCleanupPolicy', {}, fields)
+    )
+  end
+
+  subject { post_graphql(query, current_user: current_user) }
+
+  it_behaves_like 'a working graphql query' do
+    before do
+      subject
+    end
+  end
+
+  context 'with an existing policy' do
+    let_it_be(:policy) { create(:packages_cleanup_policy, project: project) }
+
+    it_behaves_like 'a working graphql query' do
+      before do
+        subject
+      end
+    end
+  end
+
+  context 'with different permissions' do
+    let_it_be(:current_user) { create(:user) }
+
+    let(:packages_cleanup_policy_response) { graphql_data_at('project', 'packagesCleanupPolicy') }
+
+    where(:visibility, :role, :policy_visible) do
+      :private | :maintainer | true
+      :private | :developer  | false
+      :private | :reporter   | false
+      :private | :guest      | false
+      :private | :anonymous  | false
+      :public  | :maintainer | true
+      :public  | :developer  | false
+      :public  | :reporter   | false
+      :public  | :guest      | false
+      :public  | :anonymous  | false
+    end
+
+    with_them do
+      before do
+        project.update!(visibility: visibility.to_s)
+        project.add_user(current_user, role) unless role == :anonymous
+      end
+
+      it 'return the proper response' do
+        subject
+
+        if policy_visible
+          expect(packages_cleanup_policy_response)
+            .to eq('keepNDuplicatedPackageFiles' => 'ALL_PACKAGE_FILES', 'nextRunAt' => nil)
+        else
+          expect(packages_cleanup_policy_response).to be_blank
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/project/work_items_spec.rb b/spec/requests/api/graphql/project/work_items_spec.rb
new file mode 100644
index 00000000000..66742fcbeb6
--- /dev/null
+++ b/spec/requests/api/graphql/project/work_items_spec.rb
@@ -0,0 +1,121 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'getting an work item list for a project' do
+  include GraphqlHelpers
+
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project) { create(:project, :repository, :public, group: group) }
+  let_it_be(:current_user) { create(:user) }
+
+  let_it_be(:item1) { create(:work_item, project: project, discussion_locked: true, title: 'item1') }
+  let_it_be(:item2) { create(:work_item, project: project, title: 'item2') }
+  let_it_be(:confidential_item) { create(:work_item, confidential: true, project: project, title: 'item3') }
+  let_it_be(:other_item) { create(:work_item) }
+
+  let(:items_data) { graphql_data['project']['workItems']['edges'] }
+  let(:item_filter_params) { {} }
+
+  let(:fields) do
+    <<~QUERY
+    edges {
+      node {
+        #{all_graphql_fields_for('workItems'.classify)}
+      }
+    }
+    QUERY
+  end
+
+  let(:query) do
+    graphql_query_for(
+      'project',
+      { 'fullPath' => project.full_path },
+      query_graphql_field('workItems', item_filter_params, fields)
+    )
+  end
+
+  it_behaves_like 'a working graphql query' do
+    before do
+      post_graphql(query, current_user: current_user)
+    end
+  end
+
+  context 'when the user does not have access to the item' do
+    before do
+      project.project_feature.update!(issues_access_level: ProjectFeature::PRIVATE)
+    end
+
+    it 'returns an empty list' do
+      post_graphql(query)
+
+      expect(items_data).to eq([])
+    end
+  end
+
+  context 'when work_items flag is disabled' do
+    before do
+      stub_feature_flags(work_items: false)
+    end
+
+    it 'returns an empty list' do
+      post_graphql(query)
+
+      expect(items_data).to eq([])
+    end
+  end
+
+  it 'returns only items visible to user' do
+    post_graphql(query, current_user: current_user)
+
+    expect(item_ids).to eq([item2.to_global_id.to_s, item1.to_global_id.to_s])
+  end
+
+  context 'when the user can see confidential items' do
+    before do
+      project.add_developer(current_user)
+    end
+
+    it 'returns also confidential items' do
+      post_graphql(query, current_user: current_user)
+
+      expect(item_ids).to eq([confidential_item.to_global_id.to_s, item2.to_global_id.to_s, item1.to_global_id.to_s])
+    end
+  end
+
+  describe 'sorting and pagination' do
+    let(:data_path) { [:project, :work_items] }
+
+    def pagination_query(params)
+      graphql_query_for(
+        'project',
+        { 'fullPath' => project.full_path },
+        query_graphql_field('workItems', params, "#{page_info} nodes { id }")
+      )
+    end
+
+    before do
+      project.add_developer(current_user)
+    end
+
+    context 'when sorting by title ascending' do
+      it_behaves_like 'sorted paginated query' do
+        let(:sort_param) { :TITLE_ASC }
+        let(:first_param) { 2 }
+        let(:all_records) { [item1, item2, confidential_item].map { |item| item.to_global_id.to_s } }
+      end
+    end
+
+    context 'when sorting by title descending' do
+      it_behaves_like 'sorted paginated query' do
+        let(:sort_param) { :TITLE_DESC }
+        let(:first_param) { 2 }
+        let(:all_records) { [confidential_item, item2, item1].map { |item| item.to_global_id.to_s } }
+      end
+    end
+  end
+
+  def item_ids
+    graphql_dig_at(items_data, :node, :id)
+  end
+end
diff --git a/spec/requests/api/graphql/terraform/state/delete_spec.rb b/spec/requests/api/graphql/terraform/state/delete_spec.rb
index 35927d03b49..ba0619ea611 100644
--- a/spec/requests/api/graphql/terraform/state/delete_spec.rb
+++ b/spec/requests/api/graphql/terraform/state/delete_spec.rb
@@ -12,12 +12,12 @@ RSpec.describe 'delete a terraform state' do
   let(:mutation) { graphql_mutation(:terraform_state_delete, id: state.to_global_id.to_s) }
 
   before do
+    expect_next_instance_of(Terraform::States::TriggerDestroyService, state, current_user: user) do |service|
+      expect(service).to receive(:execute).once.and_return(ServiceResponse.success)
+    end
+
     post_graphql_mutation(mutation, current_user: user)
   end
 
   include_examples 'a working graphql query'
-
-  it 'deletes the state' do
-    expect { state.reload }.to raise_error(ActiveRecord::RecordNotFound)
-  end
 end
diff --git a/spec/requests/api/graphql/user/starred_projects_query_spec.rb b/spec/requests/api/graphql/user/starred_projects_query_spec.rb
index 37a85b98e5f..75a17ed34c4 100644
--- a/spec/requests/api/graphql/user/starred_projects_query_spec.rb
+++ b/spec/requests/api/graphql/user/starred_projects_query_spec.rb
@@ -17,7 +17,6 @@ RSpec.describe 'Getting starredProjects of the user' do
   let_it_be(:user, reload: true) { create(:user) }
 
   let(:user_fields) { 'starredProjects { nodes { id } }' }
-  let(:current_user) { nil }
 
   let(:starred_projects) do
     post_graphql(query, current_user: current_user)
@@ -34,21 +33,23 @@ RSpec.describe 'Getting starredProjects of the user' do
     user.toggle_star(project_c)
   end
 
-  it_behaves_like 'a working graphql query' do
-    before do
-      post_graphql(query)
-    end
-  end
+  context 'anonymous access' do
+    let(:current_user) { nil }
 
-  it 'found only public project' do
-    expect(starred_projects).to contain_exactly(
-      a_graphql_entity_for(project_a)
-    )
+    it 'returns nothing' do
+      expect(starred_projects).to be_nil
+    end
   end
 
   context 'the current user is the user' do
     let(:current_user) { user }
 
+    it_behaves_like 'a working graphql query' do
+      before do
+        post_graphql(query, current_user: current_user)
+      end
+    end
+
     it 'found all projects' do
       expect(starred_projects).to contain_exactly(
         a_graphql_entity_for(project_a),
diff --git a/spec/requests/api/graphql/work_item_spec.rb b/spec/requests/api/graphql/work_item_spec.rb
index 5b34c21989a..09bda8ee0d5 100644
--- a/spec/requests/api/graphql/work_item_spec.rb
+++ b/spec/requests/api/graphql/work_item_spec.rb
@@ -6,8 +6,13 @@ RSpec.describe 'Query.work_item(id)' do
   include GraphqlHelpers
 
   let_it_be(:developer) { create(:user) }
-  let_it_be(:project) { create(:project, :private).tap { |project| project.add_developer(developer) } }
-  let_it_be(:work_item) { create(:work_item, project: project) }
+  let_it_be(:guest) { create(:user) }
+  let_it_be(:project) { create(:project, :private) }
+  let_it_be(:work_item) { create(:work_item, project: project, description: '- List item') }
+  let_it_be(:child_item1) { create(:work_item, :task, project: project) }
+  let_it_be(:child_item2) { create(:work_item, :task, confidential: true, project: project) }
+  let_it_be(:child_link1) { create(:parent_link, work_item_parent: work_item, work_item: child_item1) }
+  let_it_be(:child_link2) { create(:parent_link, work_item_parent: work_item, work_item: child_item2) }
 
   let(:current_user) { developer }
   let(:work_item_data) { graphql_data['workItem'] }
@@ -20,6 +25,9 @@ RSpec.describe 'Query.work_item(id)' do
 
   context 'when the user can read the work item' do
     before do
+      project.add_developer(developer)
+      project.add_guest(guest)
+
       post_graphql(query, current_user: current_user)
     end
 
@@ -38,6 +46,136 @@ RSpec.describe 'Query.work_item(id)' do
       )
     end
 
+    context 'when querying widgets' do
+      describe 'description widget' do
+        let(:work_item_fields) do
+          <<~GRAPHQL
+            id
+            widgets {
+              type
+              ... on WorkItemWidgetDescription {
+                description
+                descriptionHtml
+              }
+            }
+          GRAPHQL
+        end
+
+        it 'returns widget information' do
+          expect(work_item_data).to include(
+            'id' => work_item.to_gid.to_s,
+            'widgets' => match_array([
+              hash_including(
+                'type' => 'DESCRIPTION',
+                'description' => work_item.description,
+                'descriptionHtml' => ::MarkupHelper.markdown_field(work_item, :description, {})
+              ),
+              hash_including(
+                'type' => 'HIERARCHY'
+              )
+            ])
+          )
+        end
+      end
+
+      describe 'hierarchy widget' do
+        let(:work_item_fields) do
+          <<~GRAPHQL
+            id
+            widgets {
+              type
+              ... on WorkItemWidgetHierarchy {
+                parent {
+                  id
+                }
+                children {
+                  nodes {
+                    id
+                  }
+                }
+              }
+            }
+          GRAPHQL
+        end
+
+        it 'returns widget information' do
+          expect(work_item_data).to include(
+            'id' => work_item.to_gid.to_s,
+            'widgets' => match_array([
+              hash_including(
+                'type' => 'DESCRIPTION'
+              ),
+              hash_including(
+                'type' => 'HIERARCHY',
+                'parent' => nil,
+                'children' => { 'nodes' => match_array([
+                  hash_including('id' => child_link1.work_item.to_gid.to_s),
+                  hash_including('id' => child_link2.work_item.to_gid.to_s)
+                ]) }
+              )
+            ])
+          )
+        end
+
+        it 'avoids N+1 queries' do
+          post_graphql(query, current_user: current_user) # warm up
+
+          control_count = ActiveRecord::QueryRecorder.new(skip_cached: false) do
+            post_graphql(query, current_user: current_user)
+          end
+
+          create_list(:parent_link, 3, work_item_parent: work_item)
+
+          expect do
+            post_graphql(query, current_user: current_user)
+          end.not_to exceed_all_query_limit(control_count)
+        end
+
+        context 'when user is guest' do
+          let(:current_user) { guest }
+
+          it 'filters out not accessible children or parent' do
+            expect(work_item_data).to include(
+              'id' => work_item.to_gid.to_s,
+              'widgets' => match_array([
+                hash_including(
+                  'type' => 'DESCRIPTION'
+                ),
+                hash_including(
+                  'type' => 'HIERARCHY',
+                  'parent' => nil,
+                  'children' => { 'nodes' => match_array([
+                    hash_including('id' => child_link1.work_item.to_gid.to_s)
+                  ]) }
+                )
+              ])
+            )
+          end
+        end
+
+        context 'when requesting child item' do
+          let_it_be(:work_item) { create(:work_item, :task, project: project, description: '- List item') }
+          let_it_be(:parent_link) { create(:parent_link, work_item: work_item) }
+
+          it 'returns parent information' do
+            expect(work_item_data).to include(
+              'id' => work_item.to_gid.to_s,
+              'widgets' => match_array([
+                hash_including(
+                  'type' => 'DESCRIPTION'
+                ),
+                hash_including(
+                  'type' => 'HIERARCHY',
+                  'parent' => hash_including('id' => parent_link.work_item_parent.to_gid.to_s),
+                  'children' => { 'nodes' => match_array([]) }
+                )
+              ])
+            )
+          end
+        end
+      end
+    end
+
     context 'when an Issue Global ID is provided' do
       let(:global_id) { Issue.find(work_item.id).to_gid.to_s }
 
diff --git a/spec/requests/api/graphql_spec.rb b/spec/requests/api/graphql_spec.rb
index 3bd59450d49..d94257c61eb 100644
--- a/spec/requests/api/graphql_spec.rb
+++ b/spec/requests/api/graphql_spec.rb
@@ -67,10 +67,10 @@ RSpec.describe 'GraphQL' do
 
     context 'when there is an error in the logger' do
       before do
-        logger_analyzer = GitlabSchema.query_analyzers.find do |qa|
-          qa.is_a? Gitlab::Graphql::QueryAnalyzers::LoggerAnalyzer
-        end
-        allow(logger_analyzer).to receive(:process_variables)
+        allow(GraphQL::Analysis::AST).to receive(:analyze_query)
+          .and_call_original
+        allow(GraphQL::Analysis::AST).to receive(:analyze_query)
+          .with(anything, Gitlab::Graphql::QueryAnalyzers::AST::LoggerAnalyzer::ALL_ANALYZERS, anything)
           .and_raise(StandardError.new("oh noes!"))
       end
 
diff --git a/spec/requests/api/groups_spec.rb b/spec/requests/api/groups_spec.rb
index ffc5d353958..56f08249bdd 100644
--- a/spec/requests/api/groups_spec.rb
+++ b/spec/requests/api/groups_spec.rb
@@ -1177,7 +1177,6 @@ RSpec.describe API::Groups do
 
         it "only looks up root ancestor once and returns projects including those in subgroups" do
           expect(Namespace).to receive(:find_by).with(id: group1.id.to_s).once.and_call_original # For the group sent in the API call
-          expect(Namespace).to receive(:find_by).with(id: group1.traversal_ids.first).once.and_call_original # root_ancestor direct lookup
           expect(Namespace).to receive(:joins).with(start_with('INNER JOIN (SELECT id, traversal_ids[1]')).once.and_call_original # All-in-one root_ancestor query
 
           get api("/groups/#{group1.id}/projects", user1), params: { include_subgroups: true }
@@ -1187,25 +1186,6 @@ RSpec.describe API::Groups do
           expect(json_response).to be_an(Array)
           expect(json_response.length).to eq(6)
         end
-
-        context 'when group_projects_api_preload_groups feature is disabled' do
-          before do
-            stub_feature_flags(group_projects_api_preload_groups: false)
-          end
-
-          it 'looks up the root ancestor multiple times' do
-            expect(Namespace).to receive(:find_by).with(id: group1.id.to_s).once.and_call_original
-            expect(Namespace).to receive(:find_by).with(id: group1.traversal_ids.first).at_least(:twice).and_call_original
-            expect(Namespace).not_to receive(:joins).with(start_with('INNER JOIN (SELECT id, traversal_ids[1]'))
-
-            get api("/groups/#{group1.id}/projects", user1), params: { include_subgroups: true }
-
-            expect(response).to have_gitlab_http_status(:ok)
-            expect(response).to include_pagination_headers
-            expect(json_response).to be_an(Array)
-            expect(json_response.length).to eq(6)
-          end
-        end
       end
 
       context 'when include_ancestor_groups is true' do
diff --git a/spec/requests/api/integrations/jira_connect/subscriptions_spec.rb b/spec/requests/api/integrations/jira_connect/subscriptions_spec.rb
index 86f8992a624..8a222a99b34 100644
--- a/spec/requests/api/integrations/jira_connect/subscriptions_spec.rb
+++ b/spec/requests/api/integrations/jira_connect/subscriptions_spec.rb
@@ -41,6 +41,7 @@ RSpec.describe API::Integrations::JiraConnect::Subscriptions do
           post_subscriptions
 
           expect(response).to have_gitlab_http_status(:unauthorized)
+          expect(json_response).to eq('message' => '401 Unauthorized - JWT authentication failed')
         end
       end
 
diff --git a/spec/requests/api/integrations/slack/events_spec.rb b/spec/requests/api/integrations/slack/events_spec.rb
new file mode 100644
index 00000000000..176e9eded31
--- /dev/null
+++ b/spec/requests/api/integrations/slack/events_spec.rb
@@ -0,0 +1,112 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Integrations::Slack::Events do
+  describe 'POST /integrations/slack/events' do
+    let(:params) { {} }
+    let(:headers) do
+      {
+        ::API::Integrations::Slack::Request::VERIFICATION_TIMESTAMP_HEADER => Time.current.to_i.to_s,
+        ::API::Integrations::Slack::Request::VERIFICATION_SIGNATURE_HEADER => 'mock_verified_signature'
+      }
+    end
+
+    before do
+      allow(ActiveSupport::SecurityUtils).to receive(:secure_compare) do |signature|
+        signature == 'mock_verified_signature'
+      end
+
+      stub_application_setting(slack_app_signing_secret: 'mock_key')
+    end
+
+    subject { post api('/integrations/slack/events'), params: params, headers: headers }
+
+    shared_examples 'an unauthorized request' do
+      specify do
+        subject
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    shared_examples 'a successful request that generates a tracked error' do
+      specify do
+        expect(Gitlab::ErrorTracking).to receive(:track_exception).once
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:no_content)
+        expect(response.body).to be_empty
+      end
+    end
+
+    context 'when the slack_app_signing_secret setting is not set' do
+      before do
+        stub_application_setting(slack_app_signing_secret: nil)
+      end
+
+      it_behaves_like 'an unauthorized request'
+    end
+
+    context 'when the timestamp header has expired' do
+      before do
+        headers[::API::Integrations::Slack::Request::VERIFICATION_TIMESTAMP_HEADER] = 5.minutes.ago.to_i.to_s
+      end
+
+      it_behaves_like 'an unauthorized request'
+    end
+
+    context 'when the timestamp header is missing' do
+      before do
+        headers.delete(::API::Integrations::Slack::Request::VERIFICATION_TIMESTAMP_HEADER)
+      end
+
+      it_behaves_like 'an unauthorized request'
+    end
+
+    context 'when the signature header is missing' do
+      before do
+        headers.delete(::API::Integrations::Slack::Request::VERIFICATION_SIGNATURE_HEADER)
+      end
+
+      it_behaves_like 'an unauthorized request'
+    end
+
+    context 'when the signature is not verified' do
+      before do
+        headers[::API::Integrations::Slack::Request::VERIFICATION_SIGNATURE_HEADER] = 'unverified_signature'
+      end
+
+      it_behaves_like 'an unauthorized request'
+    end
+
+    context 'when type param is missing' do
+      it_behaves_like 'a successful request that generates a tracked error'
+    end
+
+    context 'when type param is unknown' do
+      let(:params) do
+        { type: 'unknown_type' }
+      end
+
+      it_behaves_like 'a successful request that generates a tracked error'
+    end
+
+    context 'when type param is url_verification' do
+      let(:params) do
+        {
+          type: 'url_verification',
+          challenge: '3eZbrw1aBm2rZgRNFdxV2595E9CY3gmdALWMmHkvFXO7tYXAYM8P'
+        }
+      end
+
+      it 'responds in-request with the challenge' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response).to eq({ 'challenge' => '3eZbrw1aBm2rZgRNFdxV2595E9CY3gmdALWMmHkvFXO7tYXAYM8P' })
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/integrations_spec.rb b/spec/requests/api/integrations_spec.rb
index 96cc101e73a..cd9a0746581 100644
--- a/spec/requests/api/integrations_spec.rb
+++ b/spec/requests/api/integrations_spec.rb
@@ -55,33 +55,49 @@ RSpec.describe API::Integrations do
       describe "PUT /projects/:id/#{endpoint}/#{integration.dasherize}" do
         include_context integration
 
+        # NOTE: Some attributes are not supported for PUT requests, even though in most cases they should be.
+        # For some of them the problem is somewhere else, i.e. most chat integrations don't support the `*_channel`
+        # fields but they're incorrectly included in `#fields`.
+        #
+        # We can fix these manually, or with a generic approach like https://gitlab.com/gitlab-org/gitlab/-/issues/348208
+        let(:missing_channel_attributes) { %i[push_channel issue_channel confidential_issue_channel merge_request_channel note_channel confidential_note_channel tag_push_channel pipeline_channel wiki_page_channel] }
+        let(:missing_attributes) do
+          {
+            datadog: %i[archive_trace_events],
+            discord: missing_channel_attributes + %i[branches_to_be_notified notify_only_broken_pipelines],
+            hangouts_chat: missing_channel_attributes + %i[notify_only_broken_pipelines],
+            jira: %i[issues_enabled project_key vulnerabilities_enabled vulnerabilities_issuetype],
+            mattermost: %i[deployment_channel labels_to_be_notified],
+            microsoft_teams: missing_channel_attributes,
+            mock_ci: %i[enable_ssl_verification],
+            prometheus: %i[manual_configuration],
+            slack: %i[alert_events alert_channel deployment_channel labels_to_be_notified],
+            unify_circuit: missing_channel_attributes + %i[branches_to_be_notified notify_only_broken_pipelines],
+            webex_teams: missing_channel_attributes + %i[branches_to_be_notified notify_only_broken_pipelines]
+          }
+        end
+
         it "updates #{integration} settings and returns the correct fields" do
-          put api("/projects/#{project.id}/#{endpoint}/#{dashed_integration}", user), params: integration_attrs
+          supported_attrs = integration_attrs.without(missing_attributes.fetch(integration.to_sym, []))
+
+          put api("/projects/#{project.id}/#{endpoint}/#{dashed_integration}", user), params: supported_attrs
 
           expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response['slug']).to eq(dashed_integration)
 
           current_integration = project.integrations.first
-          events = current_integration.event_names.empty? ? ["foo"].freeze : current_integration.event_names
-          query_strings = []
-          events.map(&:to_sym).each do |event|
-            event_value = !current_integration[event]
-            query_strings << "#{event}=#{event_value}"
-            integration_attrs[event] = event_value if integration_attrs[event].present?
+          expect(current_integration).to have_attributes(supported_attrs)
+          assert_correct_response_fields(json_response['properties'].keys, current_integration)
+
+          # Flip all booleans and verify that we can set these too
+          flipped_attrs = supported_attrs.transform_values do |value|
+            [true, false].include?(value) ? !value : value
           end
-          query_strings = query_strings.join('&')
 
-          put api("/projects/#{project.id}/#{endpoint}/#{dashed_integration}?#{query_strings}", user), params: integration_attrs
+          put api("/projects/#{project.id}/#{endpoint}/#{dashed_integration}", user), params: flipped_attrs
 
           expect(response).to have_gitlab_http_status(:ok)
-          expect(json_response['slug']).to eq(dashed_integration)
-          events.each do |event|
-            next if event == "foo"
-
-            expect(project.integrations.first[event]).not_to eq(current_integration[event]),
-                                                             "expected #{!current_integration[event]} for event #{event} for #{endpoint} #{current_integration.title}, got #{current_integration[event]}"
-          end
-
-          assert_correct_response_fields(json_response['properties'].keys, current_integration)
+          expect(project.integrations.first).to have_attributes(flipped_attrs)
         end
 
         it "returns if required fields missing" do
diff --git a/spec/requests/api/internal/base_spec.rb b/spec/requests/api/internal/base_spec.rb
index acfe476a864..93e4e72f78f 100644
--- a/spec/requests/api/internal/base_spec.rb
+++ b/spec/requests/api/internal/base_spec.rb
@@ -51,6 +51,64 @@ RSpec.describe API::Internal::Base do
     end
   end
 
+  describe 'GET /internal/error_tracking_allowed' do
+    let_it_be(:project) { create(:project) }
+
+    let(:params) { { project_id: project.id, public_key: 'key' } }
+
+    context 'when the secret header is missing' do
+      it 'responds with unauthorized entity' do
+        post api("/internal/error_tracking_allowed"), params: params
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    context 'when some params are missing' do
+      it 'responds with unprocessable entity' do
+        post api("/internal/error_tracking_allowed"), params: params.except(:public_key),
+          headers: { API::Helpers::GITLAB_SHARED_SECRET_HEADER => Base64.encode64(secret_token) }
+
+        expect(response).to have_gitlab_http_status(:unprocessable_entity)
+      end
+    end
+
+    context 'when the error tracking is disabled' do
+      it 'returns enabled: false' do
+        create(:error_tracking_client_key, project: project, active: false)
+
+        post api("/internal/error_tracking_allowed"), params: params,
+          headers: { API::Helpers::GITLAB_SHARED_SECRET_HEADER => Base64.encode64(secret_token) }
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response).to eq({ 'enabled' => false })
+      end
+
+      context 'when the error tracking record does not exist' do
+        it 'returns enabled: false' do
+          post api("/internal/error_tracking_allowed"), params: params,
+            headers: { API::Helpers::GITLAB_SHARED_SECRET_HEADER => Base64.encode64(secret_token) }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to eq({ 'enabled' => false })
+        end
+      end
+    end
+
+    context 'when the error tracking is enabled' do
+      it 'returns enabled: true' do
+        client_key = create(:error_tracking_client_key, project: project, active: true)
+        params[:public_key] = client_key.public_key
+
+        post api("/internal/error_tracking_allowed"), params: params,
+          headers: { API::Helpers::GITLAB_SHARED_SECRET_HEADER => Base64.encode64(secret_token) }
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response).to eq({ 'enabled' => true })
+      end
+    end
+  end
+
   describe 'GET /internal/two_factor_recovery_codes' do
     let(:key_id) { key.id }
 
diff --git a/spec/requests/api/internal/mail_room_spec.rb b/spec/requests/api/internal/mail_room_spec.rb
index 67ea617f90d..a0a9c1f9cb3 100644
--- a/spec/requests/api/internal/mail_room_spec.rb
+++ b/spec/requests/api/internal/mail_room_spec.rb
@@ -33,7 +33,7 @@ RSpec.describe API::Internal::MailRoom do
   let(:incoming_email_secret) { 'incoming_email_secret' }
   let(:service_desk_email_secret) { 'service_desk_email_secret' }
 
-  let(:email_content) { fixture_file("emails/commands_in_reply.eml") }
+  let(:email_content) { fixture_file("emails/service_desk_reply.eml") }
 
   before do
     allow(Gitlab::MailRoom::Authenticator).to receive(:secret).with(:incoming_email).and_return(incoming_email_secret)
@@ -117,7 +117,7 @@ RSpec.describe API::Internal::MailRoom do
 
         email = ActionMailer::Base.deliveries.last
         expect(email).not_to be_nil
-        expect(email.to).to match_array(["jake@adventuretime.ooo"])
+        expect(email.to).to match_array(["alan@adventuretime.ooo"])
         expect(email.subject).to include("Rejected")
         expect(email.body.parts.last.to_s).to include("We couldn't process your email")
       end
@@ -190,5 +190,54 @@ RSpec.describe API::Internal::MailRoom do
         expect(response).to have_gitlab_http_status(:unauthorized)
       end
     end
+
+    context 'handle invalid utf-8 email content' do
+      let(:email_content) do
+        File.open(expand_fixture_path("emails/service_desk_reply_illegal_utf8.eml"), "r:SHIFT_JIS") { |f| f.read }
+      end
+
+      let(:encoded_email_content) { Gitlab::EncodingHelper.encode_utf8(email_content) }
+      let(:auth_headers) do
+        jwt_token = JWT.encode(auth_payload, incoming_email_secret, 'HS256')
+        { Gitlab::MailRoom::INTERNAL_API_REQUEST_HEADER => jwt_token }
+      end
+
+      it 'schedules a EmailReceiverWorker job with email content encoded to utf-8 forcefully' do
+        Sidekiq::Testing.fake! do
+          expect do
+            post api("/internal/mail_room/incoming_email"), headers: auth_headers, params: email_content
+          end.to change { EmailReceiverWorker.jobs.size }.by(1)
+        end
+
+        expect(response).to have_gitlab_http_status(:ok)
+
+        job = EmailReceiverWorker.jobs.last
+        expect(job).to match a_hash_including('args' => [encoded_email_content])
+      end
+    end
+
+    context 'handle text/plain request content type' do
+      let(:auth_headers) do
+        jwt_token = JWT.encode(auth_payload, incoming_email_secret, 'HS256')
+        {
+          Gitlab::MailRoom::INTERNAL_API_REQUEST_HEADER => jwt_token,
+          'Content-Type' => 'text/plain'
+        }
+      end
+
+      it 'schedules a EmailReceiverWorker job with email content encoded to utf-8 forcefully' do
+        Sidekiq::Testing.fake! do
+          expect do
+            post api("/internal/mail_room/incoming_email"), headers: auth_headers, params: email_content
+          end.to change { EmailReceiverWorker.jobs.size }.by(1)
+        end
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.content_type).to eql('application/json')
+
+        job = EmailReceiverWorker.jobs.last
+        expect(job).to match a_hash_including('args' => [email_content])
+      end
+    end
   end
 end
diff --git a/spec/requests/api/internal/workhorse_spec.rb b/spec/requests/api/internal/workhorse_spec.rb
new file mode 100644
index 00000000000..d40c14cc0fd
--- /dev/null
+++ b/spec/requests/api/internal/workhorse_spec.rb
@@ -0,0 +1,42 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::Internal::Workhorse, :allow_forgery_protection do
+  include WorkhorseHelpers
+
+  context '/authorize_upload' do
+    let_it_be(:user) { create(:user) }
+
+    let(:headers) { {} }
+
+    subject { post(api('/internal/workhorse/authorize_upload'), headers: headers) }
+
+    def expect_status(status)
+      subject
+      expect(response).to have_gitlab_http_status(status)
+    end
+
+    context 'without workhorse internal header' do
+      it { expect_status(:forbidden) }
+    end
+
+    context 'with workhorse internal header' do
+      let(:headers) { workhorse_internal_api_request_header }
+
+      it { expect_status(:unauthorized) }
+
+      context 'as a logged in user' do
+        before do
+          login_as(user)
+        end
+
+        it { expect_status(:success) }
+        it 'returns the temp upload path' do
+          subject
+          expect(json_response['TempPath']).to eq(Rails.root.join('tmp/tests/public/uploads/tmp').to_s)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/invitations_spec.rb b/spec/requests/api/invitations_spec.rb
index d093894720e..64ad5733c1b 100644
--- a/spec/requests/api/invitations_spec.rb
+++ b/spec/requests/api/invitations_spec.rb
@@ -59,13 +59,13 @@ RSpec.describe API::Invitations do
 
       context 'when authenticated as a maintainer/owner' do
         context 'and new member is already a requester' do
-          it 'does not transform the requester into a proper member' do
+          it 'transforms the requester into a proper member' do
             expect do
               post invitations_url(source, maintainer),
                    params: { email: access_requester.email, access_level: Member::MAINTAINER }
 
               expect(response).to have_gitlab_http_status(:created)
-            end.not_to change { source.members.count }
+            end.to change { source.members.count }.by(1)
           end
         end
 
@@ -258,12 +258,13 @@ RSpec.describe API::Invitations do
         end
       end
 
-      it "returns a message if member already exists" do
+      it "updates an already existing active member" do
         post invitations_url(source, maintainer),
              params: { email: developer.email, access_level: Member::MAINTAINER }
 
         expect(response).to have_gitlab_http_status(:created)
-        expect(json_response['message'][developer.email]).to eq("User already exists in source")
+        expect(json_response['status']).to eq("success")
+        expect(source.members.find_by(user: developer).access_level).to eq Member::MAINTAINER
       end
 
       it 'returns 400 when the invite params of email and user_id are not sent' do
@@ -328,7 +329,7 @@ RSpec.describe API::Invitations do
 
       emails = 'email3@example.com,email4@example.com,email5@example.com,email6@example.com,email7@example.com'
 
-      unresolved_n_plus_ones = 44 # old 48 with 12 per new email, currently there are 11 queries added per email
+      unresolved_n_plus_ones = 40 # currently there are 10 queries added per email
 
       expect do
         post invitations_url(project, maintainer), params: { email: emails, access_level: Member::DEVELOPER }
@@ -351,7 +352,7 @@ RSpec.describe API::Invitations do
 
       emails = 'email3@example.com,email4@example.com,email5@example.com,email6@example.com,email7@example.com'
 
-      unresolved_n_plus_ones = 67 # currently there are 11 queries added per email
+      unresolved_n_plus_ones = 59 # currently there are 10 queries added per email
 
       expect do
         post invitations_url(project, maintainer), params: { email: emails, access_level: Member::DEVELOPER }
@@ -373,7 +374,7 @@ RSpec.describe API::Invitations do
 
       emails = 'email3@example.com,email4@example.com,email5@example.com,email6@example.com,email7@example.com'
 
-      unresolved_n_plus_ones = 36 # old 40 with 10 per new email, currently there are 9 queries added per email
+      unresolved_n_plus_ones = 32 # currently there are 8 queries added per email
 
       expect do
         post invitations_url(group, maintainer), params: { email: emails, access_level: Member::DEVELOPER }
@@ -396,7 +397,7 @@ RSpec.describe API::Invitations do
 
       emails = 'email3@example.com,email4@example.com,email5@example.com,email6@example.com,email7@example.com'
 
-      unresolved_n_plus_ones = 62 # currently there are 9 queries added per email
+      unresolved_n_plus_ones = 56 # currently there are 8 queries added per email
 
       expect do
         post invitations_url(group, maintainer), params: { email: emails, access_level: Member::DEVELOPER }
diff --git a/spec/requests/api/issue_links_spec.rb b/spec/requests/api/issue_links_spec.rb
index 81dd4c3dfa0..90238c8bf76 100644
--- a/spec/requests/api/issue_links_spec.rb
+++ b/spec/requests/api/issue_links_spec.rb
@@ -156,6 +156,87 @@ RSpec.describe API::IssueLinks do
     end
   end
 
+  describe 'GET /links/:issue_link_id' do
+    def perform_request(issue_link_id, user = nil, params = {})
+      get api("/projects/#{project.id}/issues/#{issue.iid}/links/#{issue_link_id}", user), params: params
+    end
+
+    context 'when unauthenticated' do
+      it 'returns 401' do
+        issue_link = create(:issue_link)
+
+        perform_request(issue_link.id)
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    context 'when authenticated' do
+      context 'when issue link does not exist' do
+        it 'returns 404' do
+          perform_request(non_existing_record_id, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      let_it_be(:target_issue) { create(:issue, project: project) }
+
+      context 'when issue link does not belong to the specified issue' do
+        it 'returns 404' do
+          other_issue = create(:issue, project: project)
+          # source is different than the given API route issue
+          issue_link = create(:issue_link, source: other_issue, target: target_issue)
+
+          perform_request(issue_link.id, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context 'when user has ability to read the issue link' do
+        it 'returns 200' do
+          issue_link = create(:issue_link, source: issue, target: target_issue)
+
+          perform_request(issue_link.id, user)
+
+          aggregate_failures "testing response" do
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to match_response_schema('public_api/v4/issue_link')
+          end
+        end
+      end
+
+      context 'when user cannot read issue link' do
+        let(:private_project) { create(:project) }
+        let(:public_project) { create(:project, :public) }
+        let(:public_issue) { create(:issue, project: public_project) }
+
+        context 'when the issue link targets an issue in a non-accessible project' do
+          it 'returns 404' do
+            private_issue = create(:issue, project: private_project)
+            issue_link = create(:issue_link, source: public_issue, target: private_issue)
+
+            perform_request(issue_link.id, user)
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+
+        context 'when issue link targets a non-accessible issue' do
+          it 'returns 404' do
+            confidential_issue = create(:issue, :confidential, project: public_project)
+            issue_link = create(:issue_link, source: public_issue, target: confidential_issue)
+
+            perform_request(issue_link.id, user)
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+      end
+    end
+  end
+
   describe 'DELETE /links/:issue_link_id' do
     context 'when unauthenticated' do
       it 'returns 401' do
diff --git a/spec/requests/api/issues/issues_spec.rb b/spec/requests/api/issues/issues_spec.rb
index 1419d39981a..480baff6eed 100644
--- a/spec/requests/api/issues/issues_spec.rb
+++ b/spec/requests/api/issues/issues_spec.rb
@@ -575,6 +575,26 @@ RSpec.describe API::Issues do
         end
       end
 
+      context 'with issues closed as duplicates' do
+        let_it_be(:dup_issue_1) { create(:issue, :closed_as_duplicate, project: project) }
+
+        it 'avoids N+1 queries' do
+          get api('/issues', user) # warm up
+
+          control = ActiveRecord::QueryRecorder.new do
+            get api('/issues', user)
+          end
+
+          create(:issue, :closed_as_duplicate, project: project)
+
+          expect do
+            get api('/issues', user)
+          end.not_to exceed_query_limit(control)
+          # 2 pre-existed issues + 2 duplicated incidents (2 closed, 2 new)
+          expect(json_response.count).to eq(6)
+        end
+      end
+
       context 'filter by labels or label_name param' do
         context 'N+1' do
           let(:label_b) { create(:label, title: 'foo', project: project) }
@@ -1101,6 +1121,51 @@ RSpec.describe API::Issues do
       expect(json_response['references']['relative']).to eq("##{issue.iid}")
       expect(json_response['references']['full']).to eq("#{project.parent.path}/#{project.path}##{issue.iid}")
     end
+
+    context 'when issue is closed as duplicate' do
+      let(:new_issue) { create(:issue) }
+      let!(:issue_closed_as_dup) { create(:issue, project: project, duplicated_to: new_issue) }
+
+      before do
+        project.add_developer(user)
+      end
+
+      context 'user does not have permission to view new issue' do
+        it 'does not return the issue as closed_as_duplicate_of' do
+          get api("/projects/#{project.id}/issues/#{issue_closed_as_dup.iid}", user)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response.dig('_links', 'closed_as_duplicate_of')).to eq(nil)
+        end
+      end
+
+      context 'when user has access to new issue' do
+        before do
+          new_issue.project.add_guest(user)
+        end
+
+        it 'returns the issue as closed_as_duplicate_of' do
+          get api("/projects/#{project.id}/issues/#{issue_closed_as_dup.iid}", user)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expected_url = expose_url(api_v4_project_issue_path(id: new_issue.project_id, issue_iid: new_issue.iid))
+          expect(json_response.dig('_links', 'closed_as_duplicate_of')).to eq(expected_url)
+        end
+
+        context 'feature flag is disabled' do
+          before do
+            stub_feature_flags(closed_as_duplicate_of_issues_api: false)
+          end
+
+          it 'does not return the issue as closed_as_duplicate_of' do
+            get api("/projects/#{project.id}/issues/#{issue_closed_as_dup.iid}", user)
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.dig('_links', 'closed_as_duplicate_of')).to eq(nil)
+          end
+        end
+      end
+    end
   end
 
   describe "POST /projects/:id/issues" do
diff --git a/spec/requests/api/markdown_snapshot_spec.rb b/spec/requests/api/markdown_snapshot_spec.rb
new file mode 100644
index 00000000000..37607a4e866
--- /dev/null
+++ b/spec/requests/api/markdown_snapshot_spec.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+# See https://docs.gitlab.com/ee/development/gitlab_flavored_markdown/specification_guide/#markdown-snapshot-testing
+# for documentation on this spec.
+RSpec.describe API::Markdown, 'Snapshot' do
+  glfm_specification_dir = File.expand_path('../../../glfm_specification', __dir__)
+  glfm_example_snapshots_dir = File.expand_path('../../fixtures/glfm/example_snapshots', __dir__)
+  include_context 'with API::Markdown Snapshot shared context', glfm_specification_dir, glfm_example_snapshots_dir
+end
diff --git a/spec/requests/api/members_spec.rb b/spec/requests/api/members_spec.rb
index 63ef8643088..e4c2f17af47 100644
--- a/spec/requests/api/members_spec.rb
+++ b/spec/requests/api/members_spec.rb
@@ -4,13 +4,14 @@ require 'spec_helper'
 
 RSpec.describe API::Members do
   let(:maintainer) { create(:user, username: 'maintainer_user') }
+  let(:maintainer2) { create(:user, username: 'user-with-maintainer-role') }
   let(:developer) { create(:user) }
   let(:access_requester) { create(:user) }
   let(:stranger) { create(:user) }
   let(:user_with_minimal_access) { create(:user) }
 
   let(:project) do
-    create(:project, :public, creator_id: maintainer.id, namespace: maintainer.namespace) do |project|
+    create(:project, :public, creator_id: maintainer.id, group: create(:group, :public)) do |project|
       project.add_maintainer(maintainer)
       project.add_developer(developer, current_user: maintainer)
       project.request_access(access_requester)
@@ -253,21 +254,48 @@ RSpec.describe API::Members do
               expect(response).to have_gitlab_http_status(:forbidden)
             end
           end
+
+          context 'adding a member of higher access level' do
+            before do
+              # the other 'maintainer' is in fact an owner of the group!
+              source.add_maintainer(maintainer2)
+            end
+
+            context 'when an access requester' do
+              it 'is not successful' do
+                post api("/#{source_type.pluralize}/#{source.id}/members", maintainer2),
+                     params: { user_id: access_requester.id, access_level: Member::OWNER }
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+              end
+            end
+
+            context 'when a totally new user' do
+              it 'is not successful' do
+                post api("/#{source_type.pluralize}/#{source.id}/members", maintainer2),
+                     params: { user_id: stranger.id, access_level: Member::OWNER }
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+              end
+            end
+          end
         end
       end
 
-      context 'when authenticated as a maintainer/owner' do
+      context 'when authenticated as a member with membership management rights' do
         context 'and new member is already a requester' do
-          it 'transforms the requester into a proper member' do
-            expect do
-              post api("/#{source_type.pluralize}/#{source.id}/members", maintainer),
-                   params: { user_id: access_requester.id, access_level: Member::MAINTAINER }
-
-              expect(response).to have_gitlab_http_status(:created)
-            end.to change { source.members.count }.by(1)
-            expect(source.requesters.count).to eq(0)
-            expect(json_response['id']).to eq(access_requester.id)
-            expect(json_response['access_level']).to eq(Member::MAINTAINER)
+          context 'when the requester is of equal or lower access level' do
+            it 'transforms the requester into a proper member' do
+              expect do
+                post api("/#{source_type.pluralize}/#{source.id}/members", maintainer),
+                     params: { user_id: access_requester.id, access_level: Member::MAINTAINER }
+
+                expect(response).to have_gitlab_http_status(:created)
+              end.to change { source.members.count }.by(1)
+              expect(source.requesters.count).to eq(0)
+              expect(json_response['id']).to eq(access_requester.id)
+              expect(json_response['access_level']).to eq(Member::MAINTAINER)
+            end
           end
         end
 
@@ -445,7 +473,7 @@ RSpec.describe API::Members do
 
       it 'returns 404 when the user_id is not valid' do
         post api("/#{source_type.pluralize}/#{source.id}/members", maintainer),
-             params: { user_id: 0, access_level: Member::MAINTAINER }
+             params: { user_id: non_existing_record_id, access_level: Member::MAINTAINER }
 
         expect(response).to have_gitlab_http_status(:not_found)
         expect(json_response['message']).to eq('404 User Not Found')
@@ -515,16 +543,49 @@ RSpec.describe API::Members do
             end
           end
         end
+
+        context 'as a maintainer updating a member to one with higher access level than themselves' do
+          before do
+            # the other 'maintainer' is in fact an owner of the group!
+            source.add_maintainer(maintainer2)
+          end
+
+          it 'returns 403' do
+            put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", maintainer2),
+                params: { access_level: Member::OWNER }
+
+            expect(response).to have_gitlab_http_status(:forbidden)
+          end
+        end
       end
 
       context 'when authenticated as a maintainer/owner' do
-        it 'updates the member' do
-          put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", maintainer),
-              params: { access_level: Member::MAINTAINER }
+        context 'when updating a member with the same or lower access level' do
+          it 'updates the member' do
+            put api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", maintainer),
+                params: { access_level: Member::MAINTAINER }
 
-          expect(response).to have_gitlab_http_status(:ok)
-          expect(json_response['id']).to eq(developer.id)
-          expect(json_response['access_level']).to eq(Member::MAINTAINER)
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response['id']).to eq(developer.id)
+            expect(json_response['access_level']).to eq(Member::MAINTAINER)
+          end
+        end
+
+        context 'when updating a member with higher access level' do
+          let(:owner) { create(:user) }
+
+          before do
+            source.add_owner(owner)
+            # the other 'maintainer' is in fact an owner of the group!
+            source.add_maintainer(maintainer2)
+          end
+
+          it 'returns 403' do
+            put api("/#{source_type.pluralize}/#{source.id}/members/#{owner.id}", maintainer2),
+                params: { access_level: Member::DEVELOPER }
+
+            expect(response).to have_gitlab_http_status(:forbidden)
+          end
         end
       end
 
@@ -619,6 +680,23 @@ RSpec.describe API::Members do
           end
         end
 
+        context 'when attempting to delete a member with higher access level' do
+          let(:owner) { create(:user) }
+
+          before do
+            source.add_owner(owner)
+            # the other 'maintainer' is in fact an owner of the group!
+            source.add_maintainer(maintainer2)
+          end
+
+          it 'returns 403' do
+            delete api("/#{source_type.pluralize}/#{source.id}/members/#{owner.id}", maintainer2),
+                   params: { access_level: Member::DEVELOPER }
+
+            expect(response).to have_gitlab_http_status(:forbidden)
+          end
+        end
+
         it 'deletes the member' do
           expect do
             delete api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", maintainer)
@@ -694,13 +772,11 @@ RSpec.describe API::Members do
     end
 
     context 'adding owner to project' do
-      it 'returns created status' do
-        expect do
-          post api("/projects/#{project.id}/members", maintainer),
-               params: { user_id: stranger.id, access_level: Member::OWNER }
+      it 'returns 403' do
+        post api("/projects/#{project.id}/members", maintainer),
+             params: { user_id: stranger.id, access_level: Member::OWNER }
 
-          expect(response).to have_gitlab_http_status(:created)
-        end.to change { project.members.count }.by(1)
+        expect(response).to have_gitlab_http_status(:forbidden)
       end
     end
 
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index a7ede7f4150..695c0ed1749 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -2134,54 +2134,6 @@ RSpec.describe API::MergeRequests do
         expect(response).to have_gitlab_http_status(:created)
       end
     end
-
-    describe 'SSE counter' do
-      let(:headers) { {} }
-      let(:params) do
-        {
-          title: 'Test merge_request',
-          source_branch: 'feature_conflict',
-          target_branch: 'master',
-          author_id: user.id,
-          milestone_id: milestone.id,
-          squash: true
-        }
-      end
-
-      subject { post api("/projects/#{project.id}/merge_requests", user), params: params, headers: headers }
-
-      it 'does not increase the SSE counter by default' do
-        expect(Gitlab::UsageDataCounters::EditorUniqueCounter).not_to receive(:track_sse_edit_action)
-
-        subject
-
-        expect(response).to have_gitlab_http_status(:created)
-      end
-
-      context 'when referer is not the SSE' do
-        let(:headers) { { 'HTTP_REFERER' => 'https://gitlab.com' } }
-
-        it 'does not increase the SSE counter by default' do
-          expect(Gitlab::UsageDataCounters::EditorUniqueCounter).not_to receive(:track_sse_edit_action)
-
-          subject
-
-          expect(response).to have_gitlab_http_status(:created)
-        end
-      end
-
-      context 'when referer is the SSE' do
-        let(:headers) { { 'HTTP_REFERER' => project_show_sse_url(project, 'master/README.md') } }
-
-        it 'increases the SSE counter by default' do
-          expect(Gitlab::UsageDataCounters::EditorUniqueCounter).to receive(:track_sse_edit_action).with(author: user)
-
-          subject
-
-          expect(response).to have_gitlab_http_status(:created)
-        end
-      end
-    end
   end
 
   describe 'PUT /projects/:id/merge_requests/:merge_request_iid' do
@@ -2535,14 +2487,34 @@ RSpec.describe API::MergeRequests do
       expect(response).to have_gitlab_http_status(:ok)
     end
 
-    it "returns 406 if branch can't be merged" do
-      allow_any_instance_of(MergeRequest)
-        .to receive(:can_be_merged?).and_return(false)
+    context 'when change_response_code_merge_status is enabled' do
+      it "returns 422 if branch can't be merged" do
+        allow_next_found_instance_of(MergeRequest) do |merge_request|
+          allow(merge_request).to receive(:can_be_merged?).and_return(false)
+        end
 
-      put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/merge", user)
+        put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/merge", user)
+
+        expect(response).to have_gitlab_http_status(:unprocessable_entity)
+        expect(json_response['message']).to eq('Branch cannot be merged')
+      end
+    end
+
+    context 'when change_response_code_merge_status is disabled' do
+      before do
+        stub_feature_flags(change_response_code_merge_status: false)
+      end
 
-      expect(response).to have_gitlab_http_status(:not_acceptable)
-      expect(json_response['message']).to eq('Branch cannot be merged')
+      it "returns 406 if branch can't be merged" do
+        allow_next_found_instance_of(MergeRequest) do |merge_request|
+          allow(merge_request).to receive(:can_be_merged?).and_return(false)
+        end
+
+        put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/merge", user)
+
+        expect(response).to have_gitlab_http_status(:not_acceptable)
+        expect(json_response['message']).to eq('Branch cannot be merged')
+      end
     end
 
     it "returns 405 if merge_request is not open" do
@@ -2693,6 +2665,7 @@ RSpec.describe API::MergeRequests do
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(source_repository.branch_exists?(source_branch)).to be false
+        expect(merge_request.reload.should_remove_source_branch?).to be true
       end
     end
 
@@ -2711,6 +2684,7 @@ RSpec.describe API::MergeRequests do
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(source_repository.branch_exists?(source_branch)).to be false
+        expect(merge_request.reload.should_remove_source_branch?).to be nil
       end
 
       it 'does not remove the source branch' do
@@ -2721,6 +2695,7 @@ RSpec.describe API::MergeRequests do
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(source_repository.branch_exists?(source_branch)).to be_truthy
+        expect(merge_request.reload.should_remove_source_branch?).to be false
       end
     end
 
diff --git a/spec/requests/api/namespaces_spec.rb b/spec/requests/api/namespaces_spec.rb
index 01dbf523071..09b87f41b82 100644
--- a/spec/requests/api/namespaces_spec.rb
+++ b/spec/requests/api/namespaces_spec.rb
@@ -325,6 +325,24 @@ RSpec.describe API::Namespaces do
         expect(response.body).to eq(expected_json)
       end
 
+      it 'ignores paths of groups present in other hierarchies when making suggestions' do
+        (1..2).to_a.each do |suffix|
+          create(:group, name: "mygroup#{suffix}", path: "mygroup#{suffix}", parent: namespace2)
+        end
+
+        create(:group, name: 'mygroup', path: 'mygroup', parent: namespace1)
+
+        get api("/namespaces/mygroup/exists", user), params: { parent_id: namespace1.id }
+
+        # if the paths of groups present in hierachies aren't ignored, the suggestion generated would have
+        # been `mygroup3`, just because groups with path `mygroup1` and `mygroup2` exists somewhere else.
+        # But there is no reason for those groups that exists elsewhere to cause a conflict because
+        # their hierarchies differ. Hence, the correct suggestion to be generated would be `mygroup1`
+        expected_json = { exists: true, suggests: ["mygroup1"] }.to_json
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.body).to eq(expected_json)
+      end
+
       it 'ignores top-level namespaces when checking with parent_id' do
         get api("/namespaces/#{namespace1.path}/exists", user), params: { parent_id: namespace1.id }
 
diff --git a/spec/requests/api/personal_access_tokens_spec.rb b/spec/requests/api/personal_access_tokens_spec.rb
index 01f69f0aae2..403c646ee32 100644
--- a/spec/requests/api/personal_access_tokens_spec.rb
+++ b/spec/requests/api/personal_access_tokens_spec.rb
@@ -73,6 +73,61 @@ RSpec.describe API::PersonalAccessTokens do
     end
   end
 
+  describe 'GET /personal_access_tokens/:id' do
+    let_it_be(:user_token) { create(:personal_access_token, user: current_user) }
+    let_it_be(:user_token_path) { "/personal_access_tokens/#{user_token.id}" }
+    let_it_be(:invalid_path) { "/personal_access_tokens/#{non_existing_record_id}" }
+
+    context 'when current_user is an administrator', :enable_admin_mode do
+      let_it_be(:admin_user) { create(:admin) }
+      let_it_be(:admin_token) { create(:personal_access_token, user: admin_user) }
+      let_it_be(:admin_path) { "/personal_access_tokens/#{admin_token.id}" }
+
+      it 'returns admins own PAT by id' do
+        get api(admin_path, admin_user)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response['id']).to eq(admin_token.id)
+      end
+
+      it 'returns a different users PAT by id' do
+        get api(user_token_path, admin_user)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response['id']).to eq(user_token.id)
+      end
+
+      it 'fails to return PAT because no PAT exists with this id' do
+        get api(invalid_path, admin_user)
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    context 'when current_user is not an administrator' do
+      let_it_be(:other_users_path) { "/personal_access_tokens/#{token1.id}" }
+
+      it 'returns users own PAT by id' do
+        get api(user_token_path, current_user)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response['id']).to eq(user_token.id)
+      end
+
+      it 'fails to return other users PAT by id' do
+        get api(other_users_path, current_user)
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+
+      it 'fails to return PAT because no PAT exists with this id' do
+        get api(invalid_path, current_user)
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+  end
+
   describe 'DELETE /personal_access_tokens/self' do
     let(:path) { '/personal_access_tokens/self' }
     let(:token) { create(:personal_access_token, user: current_user) }
diff --git a/spec/requests/api/project_attributes.yml b/spec/requests/api/project_attributes.yml
index eb6f81c2810..35844631287 100644
--- a/spec/requests/api/project_attributes.yml
+++ b/spec/requests/api/project_attributes.yml
@@ -122,6 +122,7 @@ project_feature:
     - id
     - created_at
     - metrics_dashboard_access_level
+    - package_registry_access_level
     - project_id
     - updated_at
   computed_attributes:
diff --git a/spec/requests/api/project_hooks_spec.rb b/spec/requests/api/project_hooks_spec.rb
index b5aedde2b2e..26e0adc11b3 100644
--- a/spec/requests/api/project_hooks_spec.rb
+++ b/spec/requests/api/project_hooks_spec.rb
@@ -44,6 +44,8 @@ RSpec.describe API::ProjectHooks, 'ProjectHooks' do
         expect(json_response.first['releases_events']).to eq(true)
         expect(json_response.first['enable_ssl_verification']).to eq(true)
         expect(json_response.first['push_events_branch_filter']).to eq('master')
+        expect(json_response.first['alert_status']).to eq('executable')
+        expect(json_response.first['disabled_until']).to be_nil
       end
     end
 
@@ -76,6 +78,8 @@ RSpec.describe API::ProjectHooks, 'ProjectHooks' do
         expect(json_response['releases_events']).to eq(hook.releases_events)
         expect(json_response['deployment_events']).to eq(true)
         expect(json_response['enable_ssl_verification']).to eq(hook.enable_ssl_verification)
+        expect(json_response['alert_status']).to eq(hook.alert_status.to_s)
+        expect(json_response['disabled_until']).to be_nil
       end
 
       it "returns a 404 error if hook id is not available" do
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index d2189ab02ea..431d2e56cb5 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -3106,6 +3106,13 @@ RSpec.describe API::Projects do
       expect(json_response['error']).to eq 'group_access does not have a valid value'
     end
 
+    it "returns a 400 error when the project-group share is created with an OWNER access level" do
+      post api("/projects/#{project.id}/share", user), params: { group_id: group.id, group_access: Gitlab::Access::OWNER }
+
+      expect(response).to have_gitlab_http_status(:bad_request)
+      expect(json_response['error']).to eq 'group_access does not have a valid value'
+    end
+
     it "returns a 409 error when link is not saved" do
       allow(::Projects::GroupLinks::CreateService).to receive_message_chain(:new, :execute)
         .and_return({ status: :error, http_status: 409, message: 'error' })
diff --git a/spec/requests/api/pypi_packages_spec.rb b/spec/requests/api/pypi_packages_spec.rb
index 8fa5f409298..a24b852cdac 100644
--- a/spec/requests/api/pypi_packages_spec.rb
+++ b/spec/requests/api/pypi_packages_spec.rb
@@ -17,7 +17,68 @@ RSpec.describe API::PypiPackages do
 
   let(:headers) { {} }
 
-  context 'simple API endpoint' do
+  context 'simple index API endpoint' do
+    let_it_be(:package) { create(:pypi_package, project: project) }
+    let_it_be(:package2) { create(:pypi_package, project: project) }
+
+    subject { get api(url), headers: headers }
+
+    describe 'GET /api/v4/groups/:id/-/packages/pypi/simple' do
+      let(:url) { "/groups/#{group.id}/-/packages/pypi/simple" }
+      let(:snowplow_gitlab_standard_context) { { project: project, namespace: project.namespace } }
+
+      it_behaves_like 'pypi simple index API endpoint'
+      it_behaves_like 'rejects PyPI access with unknown group id'
+
+      context 'deploy tokens' do
+        let_it_be(:group_deploy_token) { create(:group_deploy_token, deploy_token: deploy_token, group: group) }
+
+        before do
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel::PRIVATE)
+          group.update_column(:visibility_level, Gitlab::VisibilityLevel::PRIVATE)
+        end
+
+        it_behaves_like 'deploy token for package GET requests'
+
+        context 'with group path as id' do
+          let(:url) { "/groups/#{CGI.escape(group.full_path)}/-/packages/pypi/simple"}
+
+          it_behaves_like 'deploy token for package GET requests'
+        end
+      end
+
+      context 'job token' do
+        before do
+          project.update_column(:visibility_level, Gitlab::VisibilityLevel::PRIVATE)
+          group.update_column(:visibility_level, Gitlab::VisibilityLevel::PRIVATE)
+          group.add_developer(user)
+        end
+
+        it_behaves_like 'job token for package GET requests'
+      end
+
+      it_behaves_like 'a pypi user namespace endpoint'
+    end
+
+    describe 'GET /api/v4/projects/:id/packages/pypi/simple' do
+      let(:package_name) { package.name }
+      let(:url) { "/projects/#{project.id}/packages/pypi/simple" }
+      let(:snowplow_gitlab_standard_context) { { project: nil, namespace: group } }
+
+      it_behaves_like 'pypi simple index API endpoint'
+      it_behaves_like 'rejects PyPI access with unknown project id'
+      it_behaves_like 'deploy token for package GET requests'
+      it_behaves_like 'job token for package GET requests'
+
+      context 'with project path as id' do
+        let(:url) { "/projects/#{CGI.escape(project.full_path)}/packages/pypi/simple" }
+
+        it_behaves_like 'deploy token for package GET requests'
+      end
+    end
+  end
+
+  context 'simple package API endpoint' do
     let_it_be(:package) { create(:pypi_package, project: project) }
 
     subject { get api(url), headers: headers }
@@ -25,7 +86,7 @@ RSpec.describe API::PypiPackages do
     describe 'GET /api/v4/groups/:id/-/packages/pypi/simple/:package_name' do
       let(:package_name) { package.name }
       let(:url) { "/groups/#{group.id}/-/packages/pypi/simple/#{package_name}" }
-      let(:snowplow_gitlab_standard_context) { {} }
+      let(:snowplow_gitlab_standard_context) { { project: nil, namespace: group } }
 
       it_behaves_like 'pypi simple API endpoint'
       it_behaves_like 'rejects PyPI access with unknown group id'
diff --git a/spec/requests/api/release/links_spec.rb b/spec/requests/api/release/links_spec.rb
index 00326426af5..2345c0063dd 100644
--- a/spec/requests/api/release/links_spec.rb
+++ b/spec/requests/api/release/links_spec.rb
@@ -49,6 +49,20 @@ RSpec.describe API::Release::Links do
 
         expect(response).to match_response_schema('release/links')
       end
+
+      context 'when using JOB-TOKEN auth' do
+        let(:job) { create(:ci_build, :running, user: maintainer) }
+
+        it 'returns releases links' do
+          get api("/projects/#{project.id}/releases/v0.1/assets/links", job_token: job.token)
+
+          aggregate_failures "testing response" do
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to match_response_schema('release/links')
+            expect(json_response.count).to eq(2)
+          end
+        end
+      end
     end
 
     context 'when release does not exist' do
@@ -116,6 +130,20 @@ RSpec.describe API::Release::Links do
       expect(response).to match_response_schema('release/link')
     end
 
+    context 'when using JOB-TOKEN auth' do
+      let(:job) { create(:ci_build, :running, user: maintainer) }
+
+      it 'returns releases link' do
+        get api("/projects/#{project.id}/releases/v0.1/assets/links/#{release_link.id}", job_token: job.token)
+
+        aggregate_failures "testing response" do
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('release/link')
+          expect(json_response['name']).to eq(release_link.name)
+        end
+      end
+    end
+
     context 'when specified tag is not found in the project' do
       it_behaves_like '404 response' do
         let(:request) { get api("/projects/#{project.id}/releases/non_existing_tag/assets/links/#{release_link.id}", maintainer) }
@@ -198,6 +226,25 @@ RSpec.describe API::Release::Links do
       expect(response).to match_response_schema('release/link')
     end
 
+    context 'when using JOB-TOKEN auth' do
+      let(:job) { create(:ci_build, :running, user: maintainer) }
+
+      it 'creates a new release link' do
+        expect do
+          post api("/projects/#{project.id}/releases/v0.1/assets/links"), params: params.merge(job_token: job.token)
+        end.to change { Releases::Link.count }.by(1)
+
+        release.reload
+
+        aggregate_failures "testing response" do
+          expect(response).to have_gitlab_http_status(:created)
+          expect(last_release_link.name).to eq('awesome-app.dmg')
+          expect(last_release_link.filepath).to eq('/binaries/awesome-app.dmg')
+          expect(last_release_link.url).to eq('https://example.com/download/awesome-app.dmg')
+        end
+      end
+    end
+
     context 'with protected tag' do
       context 'when user has access to the protected tag' do
         let!(:protected_tag) { create(:protected_tag, :developers_can_create, name: '*', project: project) }
@@ -314,6 +361,20 @@ RSpec.describe API::Release::Links do
       expect(response).to match_response_schema('release/link')
     end
 
+    context 'when using JOB-TOKEN auth' do
+      let(:job) { create(:ci_build, :running, user: maintainer) }
+
+      it 'updates the release link' do
+        put api("/projects/#{project.id}/releases/v0.1/assets/links/#{release_link.id}"), params: params.merge(job_token: job.token)
+
+        aggregate_failures "testing response" do
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('release/link')
+          expect(json_response['name']).to eq('awesome-app.msi')
+        end
+      end
+    end
+
     context 'with protected tag' do
       context 'when user has access to the protected tag' do
         let!(:protected_tag) { create(:protected_tag, :developers_can_create, name: '*', project: project) }
@@ -411,6 +472,21 @@ RSpec.describe API::Release::Links do
       expect(response).to match_response_schema('release/link')
     end
 
+    context 'when using JOB-TOKEN auth' do
+      let(:job) { create(:ci_build, :running, user: maintainer) }
+
+      it 'deletes the release link' do
+        expect do
+          delete api("/projects/#{project.id}/releases/v0.1/assets/links/#{release_link.id}", job_token: job.token)
+        end.to change { Releases::Link.count }.by(-1)
+
+        aggregate_failures "testing response" do
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('release/link')
+        end
+      end
+    end
+
     context 'with protected tag' do
       context 'when user has access to the protected tag' do
         let!(:protected_tag) { create(:protected_tag, :developers_can_create, name: '*', project: project) }
diff --git a/spec/requests/api/releases_spec.rb b/spec/requests/api/releases_spec.rb
index 3c0f3a75f10..c050214ff50 100644
--- a/spec/requests/api/releases_spec.rb
+++ b/spec/requests/api/releases_spec.rb
@@ -227,6 +227,7 @@ RSpec.describe API::Releases do
         get api("/projects/#{project.id}/releases", maintainer)
 
         expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response[0]['tag_path']).to include('%2F') # properly escape the slash
       end
     end
 
@@ -928,6 +929,22 @@ RSpec.describe API::Releases do
           expect(json_response['message']).to eq('Tag name invalid')
         end
       end
+
+      context 'when tag_message is provided' do
+        let(:tag_message) { 'Annotated tag message created by Release API' }
+
+        before do
+          params.merge!(tag_message: tag_message)
+        end
+
+        it 'creates an annotated tag with the tag message' do
+          expect do
+            post api("/projects/#{project.id}/releases", maintainer), params: params
+          end.to change { Project.find_by_id(project.id).repository.tag_count }.by(1)
+
+          expect(project.repository.find_tag(tag_name).message).to eq(tag_message)
+        end
+      end
     end
 
     context 'when release already exists' do
diff --git a/spec/requests/api/system_hooks_spec.rb b/spec/requests/api/system_hooks_spec.rb
index d94b70ec0f9..2460a98129f 100644
--- a/spec/requests/api/system_hooks_spec.rb
+++ b/spec/requests/api/system_hooks_spec.rb
@@ -44,6 +44,8 @@ RSpec.describe API::SystemHooks do
         expect(json_response.first['merge_requests_events']).to be false
         expect(json_response.first['repository_update_events']).to be true
         expect(json_response.first['enable_ssl_verification']).to be true
+        expect(json_response.first['disabled_until']).to be nil
+        expect(json_response.first['alert_status']).to eq 'executable'
       end
     end
   end
@@ -79,10 +81,43 @@ RSpec.describe API::SystemHooks do
           'tag_push_events' => be(hook.tag_push_events),
           'merge_requests_events' => be(hook.merge_requests_events),
           'repository_update_events' => be(hook.repository_update_events),
-          'enable_ssl_verification' => be(hook.enable_ssl_verification)
+          'enable_ssl_verification' => be(hook.enable_ssl_verification),
+          'alert_status' => eq(hook.alert_status.to_s),
+          'disabled_until' => eq(hook.disabled_until&.iso8601(3))
         )
       end
 
+      context 'the hook is disabled' do
+        before do
+          hook.disable!
+        end
+
+        it "has the correct alert status", :aggregate_failures do
+          get api("/hooks/#{hook.id}", admin)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('public_api/v4/system_hook')
+          expect(json_response).to include('alert_status' => 'disabled')
+        end
+      end
+
+      context 'the hook is backed-off' do
+        before do
+          hook.backoff!
+        end
+
+        it "has the correct alert status", :aggregate_failures do
+          get api("/hooks/#{hook.id}", admin)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('public_api/v4/system_hook')
+          expect(json_response).to include(
+            'alert_status' => 'temporarily_disabled',
+            'disabled_until' => hook.disabled_until.iso8601(3)
+          )
+        end
+      end
+
       it 'returns 404 if the system hook does not exist' do
         get api("/hooks/#{non_existing_record_id}", admin)
 
diff --git a/spec/requests/api/terraform/modules/v1/packages_spec.rb b/spec/requests/api/terraform/modules/v1/packages_spec.rb
index 7d86244cb1b..12bce4da011 100644
--- a/spec/requests/api/terraform/modules/v1/packages_spec.rb
+++ b/spec/requests/api/terraform/modules/v1/packages_spec.rb
@@ -17,12 +17,14 @@ RSpec.describe API::Terraform::Modules::V1::Packages do
   let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
 
   let(:headers) { {} }
+  let(:token) { tokens[token_type] }
 
   let(:tokens) do
     {
       personal_access_token: personal_access_token.token,
       deploy_token: deploy_token.token,
-      job_token: job.token
+      job_token: job.token,
+      invalid: 'invalid-token123'
     }
   end
 
@@ -48,44 +50,43 @@ RSpec.describe API::Terraform::Modules::V1::Packages do
     end
 
     context 'with valid namespace' do
-      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
-        :public  | :developer  | true  | :personal_access_token | true  | 'returns terraform module packages'        | :success
-        :public  | :guest      | true  | :personal_access_token | true  | 'returns terraform module packages'        | :success
-        :public  | :developer  | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | false | :personal_access_token | true  | 'returns no terraform module packages'     | :success
-        :public  | :guest      | false | :personal_access_token | true  | 'returns no terraform module packages'     | :success
-        :public  | :developer  | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :anonymous  | false | :personal_access_token | true  | 'returns no terraform module packages'     | :success
-        :private | :developer  | true  | :personal_access_token | true  | 'returns terraform module packages'        | :success
-        :private | :guest      | true  | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | false | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :guest      | false | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :anonymous  | false | :personal_access_token | true  | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | true  | :job_token             | true  | 'returns terraform module packages'        | :success
-        :public  | :guest      | true  | :job_token             | true  | 'returns no terraform module packages'     | :success
-        :public  | :guest      | true  | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | false | :job_token             | true  | 'returns no terraform module packages'     | :success
-        :public  | :guest      | false | :job_token             | true  | 'returns no terraform module packages'     | :success
-        :public  | :developer  | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | true  | :job_token             | true  | 'returns terraform module packages'        | :success
-        :private | :guest      | true  | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | true  | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | true  | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | false | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :guest      | false | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
+      where(:visibility, :user_role, :member, :token_type, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | 'returns terraform module packages'        | :success
+        :public  | :guest      | true  | :personal_access_token | 'returns terraform module packages'        | :success
+        :public  | :developer  | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | :personal_access_token | 'returns no terraform module packages'     | :success
+        :public  | :guest      | false | :personal_access_token | 'returns no terraform module packages'     | :success
+        :public  | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :anonymous  | false | nil | 'returns no terraform module packages' | :success
+        :private | :developer  | true  | :personal_access_token | 'returns terraform module packages'        | :success
+        :private | :guest      | true  | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | false | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :guest      | false | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :anonymous  | false | nil | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | true  | :job_token | 'returns terraform module packages'        | :success
+        :public  | :guest      | true  | :job_token | 'returns no terraform module packages'     | :success
+        :public  | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | :job_token | 'returns no terraform module packages'     | :success
+        :public  | :guest      | false | :job_token | 'returns no terraform module packages'     | :success
+        :public  | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | :job_token | 'returns terraform module packages'        | :success
+        :private | :guest      | true  | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | false | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :guest      | false | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
       end
 
       with_them do
-        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
         let(:headers) { user_role == :anonymous ? {} : { 'Authorization' => "Bearer #{token}" } }
 
         before do
@@ -104,48 +105,48 @@ RSpec.describe API::Terraform::Modules::V1::Packages do
     subject { get(url, headers: headers) }
 
     context 'with valid namespace' do
-      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
-        :public  | :developer  | true  | :personal_access_token | true  | 'grants terraform module download'         | :success
-        :public  | :guest      | true  | :personal_access_token | true  | 'rejects terraform module packages access' | :not_found
-        :public  | :developer  | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | false | :personal_access_token | true  | 'rejects terraform module packages access' | :not_found
-        :public  | :guest      | false | :personal_access_token | true  | 'rejects terraform module packages access' | :not_found
-        :public  | :developer  | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :anonymous  | false | :personal_access_token | true  | 'rejects terraform module packages access' | :not_found
-        :private | :developer  | true  | :personal_access_token | true  | 'grants terraform module download'         | :success
-        :private | :guest      | true  | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | true  | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | false | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :guest      | false | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | false | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :anonymous  | false | :personal_access_token | true  | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | true  | :job_token             | true  | 'grants terraform module download'         | :success
-        :public  | :guest      | true  | :job_token             | true  | 'rejects terraform module packages access' | :not_found
-        :public  | :guest      | true  | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | false | :job_token             | true  | 'rejects terraform module packages access' | :not_found
-        :public  | :guest      | false | :job_token             | true  | 'rejects terraform module packages access' | :not_found
-        :public  | :developer  | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | true  | :job_token             | true  | 'grants terraform module download'         | :success
-        :private | :guest      | true  | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | true  | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | true  | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | false | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :guest      | false | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | false | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
+      where(:visibility, :user_role, :member, :token_type, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | 'grants terraform module download'         | :success
+        :public  | :guest      | true  | :personal_access_token | 'grants terraform module download'         | :success
+        :public  | :developer  | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | :personal_access_token | 'grants terraform module download'         | :success
+        :public  | :guest      | false | :personal_access_token | 'grants terraform module download'         | :success
+        :public  | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :anonymous  | false | nil | 'grants terraform module download' | :success
+        :private | :developer  | true  | :personal_access_token | 'grants terraform module download'         | :success
+        :private | :guest      | true  | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | false | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :guest      | false | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :anonymous  | false | nil | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | true  | :job_token | 'grants terraform module download'         | :success
+        :public  | :guest      | true  | :job_token | 'grants terraform module download'         | :success
+        :public  | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | :job_token | 'grants terraform module download'         | :success
+        :public  | :guest      | false | :job_token | 'grants terraform module download'         | :success
+        :public  | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | :job_token | 'grants terraform module download'         | :success
+        :private | :guest      | true  | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | false | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :guest      | false | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | false | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | false | :invalid | 'rejects terraform module packages access' | :unauthorized
       end
 
       with_them do
-        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
         let(:headers) { user_role == :anonymous ? {} : { 'Authorization' => "Bearer #{token}" } }
 
         before do
           group.update!(visibility: visibility.to_s)
+          project.update!(visibility: visibility.to_s)
         end
 
         it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
@@ -158,55 +159,62 @@ RSpec.describe API::Terraform::Modules::V1::Packages do
     let(:tokens) do
       {
         personal_access_token: ::Gitlab::JWTToken.new.tap { |jwt| jwt['token'] = personal_access_token.id }.encoded,
-        job_token: ::Gitlab::JWTToken.new.tap { |jwt| jwt['token'] = job.token }.encoded
+        job_token: ::Gitlab::JWTToken.new.tap { |jwt| jwt['token'] = job.token }.encoded,
+        invalid: 'invalid-token123'
       }
     end
 
     subject { get(url, headers: headers) }
 
     context 'with valid namespace' do
-      where(:visibility, :user_role, :member, :token_type, :valid_token, :shared_examples_name, :expected_status) do
-        :public  | :developer  | true  | :personal_access_token | true  | 'grants terraform module package file access' | :success
-        :public  | :guest      | true  | :personal_access_token | true  | 'rejects terraform module packages access'    | :not_found
-        :public  | :developer  | true  | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :public  | :guest      | true  | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :public  | :developer  | false | :personal_access_token | true  | 'rejects terraform module packages access'    | :not_found
-        :public  | :guest      | false | :personal_access_token | true  | 'rejects terraform module packages access'    | :not_found
-        :public  | :developer  | false | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :public  | :guest      | false | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :public  | :anonymous  | false | :personal_access_token | true  | 'rejects terraform module packages access'    | :not_found
-        :private | :developer  | true  | :personal_access_token | true  | 'grants terraform module package file access' | :success
-        :private | :guest      | true  | :personal_access_token | true  | 'rejects terraform module packages access'    | :forbidden
-        :private | :developer  | true  | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :guest      | true  | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :developer  | false | :personal_access_token | true  | 'rejects terraform module packages access'    | :forbidden
-        :private | :guest      | false | :personal_access_token | true  | 'rejects terraform module packages access'    | :forbidden
-        :private | :developer  | false | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :guest      | false | :personal_access_token | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :anonymous  | false | :personal_access_token | true  | 'rejects terraform module packages access'    | :forbidden
-        :public  | :developer  | true  | :job_token             | true  | 'grants terraform module package file access' | :success
-        :public  | :guest      | true  | :job_token             | true  | 'rejects terraform module packages access'    | :not_found
-        :public  | :guest      | true  | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
-        :public  | :developer  | false | :job_token             | true  | 'rejects terraform module packages access'    | :not_found
-        :public  | :guest      | false | :job_token             | true  | 'rejects terraform module packages access'    | :not_found
-        :public  | :developer  | false | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
-        :public  | :guest      | false | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :developer  | true  | :job_token             | true  | 'grants terraform module package file access' | :success
-        :private | :guest      | true  | :job_token             | true  | 'rejects terraform module packages access'    | :forbidden
-        :private | :developer  | true  | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :guest      | true  | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :developer  | false | :job_token             | true  | 'rejects terraform module packages access'    | :forbidden
-        :private | :guest      | false | :job_token             | true  | 'rejects terraform module packages access'    | :forbidden
-        :private | :developer  | false | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
-        :private | :guest      | false | :job_token             | false | 'rejects terraform module packages access'    | :unauthorized
+      where(:visibility, :user_role, :member, :token_type, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | :personal_access_token | 'grants terraform module package file access' | :success
+        :public  | :guest      | true  | :personal_access_token | 'grants terraform module package file access' | :success
+        :public  | :developer  | true  | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :public  | :guest      | true  | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :public  | :developer  | false | :personal_access_token | 'grants terraform module package file access'    | :success
+        :public  | :guest      | false | :personal_access_token | 'grants terraform module package file access'    | :success
+        :public  | :developer  | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :public  | :guest      | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :public  | :anonymous  | false | nil | 'grants terraform module package file access' | :success
+        :private | :developer  | true  | :personal_access_token | 'grants terraform module package file access' | :success
+        :private | :guest      | true  | :personal_access_token | 'rejects terraform module packages access'    | :forbidden
+        :private | :developer  | true  | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :guest      | true  | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :developer  | false | :personal_access_token | 'rejects terraform module packages access'    | :forbidden
+        :private | :guest      | false | :personal_access_token | 'rejects terraform module packages access'    | :forbidden
+        :private | :developer  | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :guest      | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :anonymous  | false | nil | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | true  | :job_token            | 'grants terraform module package file access' | :success
+        :public  | :guest      | true  | :job_token            | 'grants terraform module package file access' | :success
+        :public  | :guest      | true  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | :job_token            | 'grants terraform module package file access'    | :success
+        :public  | :guest      | false | :job_token            | 'grants terraform module package file access'    | :success
+        :public  | :developer  | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :public  | :guest      | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :developer  | true  | :job_token            | 'grants terraform module package file access' | :success
+        :private | :guest      | true  | :job_token            | 'rejects terraform module packages access'    | :forbidden
+        :private | :developer  | true  | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :guest      | true  | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :developer  | false | :job_token            | 'rejects terraform module packages access'    | :forbidden
+        :private | :guest      | false | :job_token            | 'rejects terraform module packages access'    | :forbidden
+        :private | :developer  | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
+        :private | :guest      | false | :invalid | 'rejects terraform module packages access'    | :unauthorized
       end
 
       with_them do
-        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
-        let(:snowplow_gitlab_standard_context) { { project: project, user: user, namespace: project.namespace } }
+        let(:snowplow_gitlab_standard_context) do
+          {
+            project: project,
+            user: user_role == :anonymous ? nil : user,
+            namespace: project.namespace
+          }
+        end
 
         before do
           group.update!(visibility: visibility.to_s)
+          project.update!(visibility: visibility.to_s)
         end
 
         it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
@@ -244,49 +252,48 @@ RSpec.describe API::Terraform::Modules::V1::Packages do
     subject { put(url, headers: headers) }
 
     context 'with valid project' do
-      where(:visibility, :user_role, :member, :token_header, :token_type, :valid_token, :shared_examples_name, :expected_status) do
-        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'process terraform module workhorse authorization' | :success
-        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :forbidden
-        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :forbidden
-        :public  | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :forbidden
-        :public  | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :anonymous  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :unauthorized
-        :private | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'process terraform module workhorse authorization' | :success
-        :private | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :forbidden
-        :private | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :not_found
-        :private | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :not_found
-        :private | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :anonymous  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :developer  | true  | 'JOB-TOKEN'     | :job_token             | true  | 'process terraform module workhorse authorization' | :success
-        :public  | :guest      | true  | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access'         | :forbidden
-        :public  | :developer  | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :guest      | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :developer  | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access'         | :forbidden
-        :public  | :guest      | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access'         | :forbidden
-        :public  | :developer  | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :guest      | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :developer  | true  | 'JOB-TOKEN'     | :job_token             | true  | 'process terraform module workhorse authorization' | :success
-        :private | :guest      | true  | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access'         | :forbidden
-        :private | :developer  | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :guest      | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :developer  | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access'         | :not_found
-        :private | :guest      | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access'         | :not_found
-        :private | :developer  | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :guest      | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access'         | :unauthorized
-        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | true  | 'process terraform module workhorse authorization' | :success
-        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | false | 'rejects terraform module packages access'         | :unauthorized
-        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | true  | 'process terraform module workhorse authorization' | :success
-        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | false | 'rejects terraform module packages access'         | :unauthorized
+      where(:visibility, :user_role, :member, :token_header, :token_type, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'process terraform module workhorse authorization' | :success
+        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access'         | :forbidden
+        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access'         | :forbidden
+        :public  | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access'         | :forbidden
+        :public  | :developer  | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :guest      | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :anonymous  | false | nil | nil | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'process terraform module workhorse authorization' | :success
+        :private | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access'         | :forbidden
+        :private | :developer  | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :guest      | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access'         | :not_found
+        :private | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access'         | :not_found
+        :private | :developer  | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :guest      | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :anonymous  | false | nil | nil | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | true  | 'JOB-TOKEN'     | :job_token | 'process terraform module workhorse authorization' | :success
+        :public  | :guest      | true  | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access'         | :forbidden
+        :public  | :developer  | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :guest      | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :developer  | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access'         | :forbidden
+        :public  | :guest      | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access'         | :forbidden
+        :public  | :developer  | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :guest      | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :developer  | true  | 'JOB-TOKEN'     | :job_token | 'process terraform module workhorse authorization' | :success
+        :private | :guest      | true  | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access'         | :forbidden
+        :private | :developer  | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :guest      | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :developer  | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access'         | :not_found
+        :private | :guest      | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access'         | :not_found
+        :private | :developer  | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :private | :guest      | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access'         | :unauthorized
+        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token | 'process terraform module workhorse authorization' | :success
+        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token | 'process terraform module workhorse authorization' | :success
+        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :invalid | 'rejects terraform module packages access' | :unauthorized
       end
 
       with_them do
-        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
         let(:headers) { user_headers.merge(workhorse_headers) }
         let(:user_headers) { user_role == :anonymous ? {} : { token_header => token } }
 
@@ -322,49 +329,48 @@ RSpec.describe API::Terraform::Modules::V1::Packages do
     end
 
     context 'with valid project' do
-      where(:visibility, :user_role, :member, :token_header, :token_type, :valid_token, :shared_examples_name, :expected_status) do
-        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'process terraform module upload'          | :created
-        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :public  | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :public  | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :anonymous  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'process terraform module upload'          | :created
-        :private | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :not_found
-        :private | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :not_found
-        :private | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :anonymous  | false | 'PRIVATE-TOKEN' | :personal_access_token | true  | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | true  | 'JOB-TOKEN'     | :job_token             | true  | 'process terraform module upload'          | :created
-        :public  | :guest      | true  | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :public  | :developer  | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :public  | :guest      | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :public  | :developer  | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :guest      | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | true  | 'JOB-TOKEN'     | :job_token             | true  | 'process terraform module upload'          | :created
-        :private | :guest      | true  | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access' | :forbidden
-        :private | :developer  | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | true  | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access' | :not_found
-        :private | :guest      | false | 'JOB-TOKEN'     | :job_token             | true  | 'rejects terraform module packages access' | :not_found
-        :private | :developer  | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :guest      | false | 'JOB-TOKEN'     | :job_token             | false | 'rejects terraform module packages access' | :unauthorized
-        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | true  | 'process terraform module upload'          | :created
-        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | false | 'rejects terraform module packages access' | :unauthorized
-        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | true  | 'process terraform module upload'          | :created
-        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token          | false | 'rejects terraform module packages access' | :unauthorized
+      where(:visibility, :user_role, :member, :token_header, :token_type, :shared_examples_name, :expected_status) do
+        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'process terraform module upload'          | :created
+        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :public  | :developer  | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :public  | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :public  | :developer  | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :anonymous  | false | nil | nil | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'process terraform module upload'          | :created
+        :private | :guest      | true  | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | true  | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access' | :not_found
+        :private | :guest      | false | 'PRIVATE-TOKEN' | :personal_access_token | 'rejects terraform module packages access' | :not_found
+        :private | :developer  | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | false | 'PRIVATE-TOKEN' | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :anonymous  | false | nil | nil | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | true  | 'JOB-TOKEN'     | :job_token | 'process terraform module upload'          | :created
+        :public  | :guest      | true  | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access' | :forbidden
+        :public  | :developer  | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access' | :forbidden
+        :public  | :guest      | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access' | :forbidden
+        :public  | :developer  | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :guest      | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | 'JOB-TOKEN'     | :job_token | 'process terraform module upload'          | :created
+        :private | :guest      | true  | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access' | :forbidden
+        :private | :developer  | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | true  | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access' | :not_found
+        :private | :guest      | false | 'JOB-TOKEN'     | :job_token | 'rejects terraform module packages access' | :not_found
+        :private | :developer  | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :guest      | false | 'JOB-TOKEN'     | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token | 'process terraform module upload' | :created
+        :public  | :developer  | true  | 'DEPLOY-TOKEN'  | :invalid | 'rejects terraform module packages access' | :unauthorized
+        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :deploy_token | 'process terraform module upload' | :created
+        :private | :developer  | true  | 'DEPLOY-TOKEN'  | :invalid | 'rejects terraform module packages access' | :unauthorized
       end
 
       with_them do
-        let(:token) { valid_token ? tokens[token_type] : 'invalid-token123' }
         let(:user_headers) { user_role == :anonymous ? {} : { token_header => token } }
         let(:headers) { user_headers.merge(workhorse_headers) }
         let(:snowplow_gitlab_standard_context) { { project: project, namespace: project.namespace, user: snowplow_user } }
diff --git a/spec/requests/api/terraform/state_spec.rb b/spec/requests/api/terraform/state_spec.rb
index ae1e461d433..e8458db4a4d 100644
--- a/spec/requests/api/terraform/state_spec.rb
+++ b/spec/requests/api/terraform/state_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe API::Terraform::State do
+RSpec.describe API::Terraform::State, :snowplow do
   include HttpBasicAuthHelpers
 
   let_it_be(:project) { create(:project) }
@@ -25,11 +25,17 @@ RSpec.describe API::Terraform::State do
     context 'without authentication' do
       let(:auth_header) { basic_auth_header('bad', 'token') }
 
-      it 'does not track unique event' do
+      it 'does not track unique hll event' do
         expect(Gitlab::UsageDataCounters::HLLRedisCounter).not_to receive(:track_event)
 
         request
       end
+
+      it 'does not track Snowplow event' do
+        request
+
+        expect_no_snowplow_event
+      end
     end
 
     context 'with maintainer permissions' do
@@ -39,6 +45,41 @@ RSpec.describe API::Terraform::State do
         let(:target_event) { 'p_terraform_state_api_unique_users' }
         let(:expected_value) { instance_of(Integer) }
       end
+
+      it 'tracks Snowplow event' do
+        request
+
+        expect_snowplow_event(
+          category: described_class.to_s,
+          action: 'p_terraform_state_api_unique_users',
+          namespace: project.namespace.reload,
+          user: current_user
+        )
+      end
+
+      context 'when route_hll_to_snowplow_phase2 FF is disabled' do
+        before do
+          stub_feature_flags(route_hll_to_snowplow_phase2: false)
+        end
+
+        it 'does not track Snowplow event' do
+          request
+
+          expect_no_snowplow_event
+        end
+      end
+    end
+  end
+
+  shared_context 'cannot access a state that is scheduled for deletion' do
+    before do
+      state.update!(deleted_at: Time.current)
+    end
+
+    it 'returns unprocessable entity' do
+      request
+
+      expect(response).to have_gitlab_http_status(:unprocessable_entity)
     end
   end
 
@@ -77,6 +118,8 @@ RSpec.describe API::Terraform::State do
             expect(response).to have_gitlab_http_status(:not_found)
           end
         end
+
+        it_behaves_like 'cannot access a state that is scheduled for deletion'
       end
 
       context 'with developer permissions' do
@@ -162,6 +205,8 @@ RSpec.describe API::Terraform::State do
             expect(response).to have_gitlab_http_status(:unprocessable_entity)
           end
         end
+
+        it_behaves_like 'cannot access a state that is scheduled for deletion'
       end
 
       context 'without body' do
@@ -240,13 +285,19 @@ RSpec.describe API::Terraform::State do
 
     context 'with maintainer permissions' do
       let(:current_user) { maintainer }
+      let(:deletion_service) { instance_double(Terraform::States::TriggerDestroyService) }
+
+      it 'schedules the state for deletion and returns empty body' do
+        expect(Terraform::States::TriggerDestroyService).to receive(:new).and_return(deletion_service)
+        expect(deletion_service).to receive(:execute).once
 
-      it 'deletes the state and returns empty body' do
-        expect { request }.to change { Terraform::State.count }.by(-1)
+        request
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(Gitlab::Json.parse(response.body)).to be_empty
       end
+
+      it_behaves_like 'cannot access a state that is scheduled for deletion'
     end
 
     context 'with developer permissions' do
@@ -276,6 +327,7 @@ RSpec.describe API::Terraform::State do
     subject(:request) { post api("#{state_path}/lock"), headers: auth_header, params: params }
 
     it_behaves_like 'endpoint with unique user tracking'
+    it_behaves_like 'cannot access a state that is scheduled for deletion'
 
     it 'locks the terraform state' do
       request
@@ -330,6 +382,10 @@ RSpec.describe API::Terraform::State do
       let(:lock_id) { 'irrelevant to this test, just needs to be present' }
     end
 
+    it_behaves_like 'cannot access a state that is scheduled for deletion' do
+      let(:lock_id) { 'irrelevant to this test, just needs to be present' }
+    end
+
     context 'with the correct lock id' do
       let(:lock_id) { '123-456' }
 
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 2c5a734a0e1..d4dc7375e9e 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -1694,6 +1694,111 @@ RSpec.describe API::Users do
     end
   end
 
+  describe 'GET /users/:id/project_deploy_keys' do
+    let(:project) { create(:project) }
+
+    before do
+      project.add_maintainer(user)
+
+      deploy_key = create(:deploy_key, user: user)
+      create(:deploy_keys_project, project: project, deploy_key_id: deploy_key.id)
+    end
+
+    it 'returns 404 for non-existing user' do
+      get api("/users/#{non_existing_record_id}/project_deploy_keys")
+
+      expect(response).to have_gitlab_http_status(:not_found)
+      expect(json_response['message']).to eq('404 User Not Found')
+    end
+
+    it 'returns array of project deploy keys with pagination' do
+      get api("/users/#{user.id}/project_deploy_keys", user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response).to include_pagination_headers
+      expect(json_response).to be_an Array
+      expect(json_response.first['title']).to eq(user.deploy_keys.first.title)
+    end
+
+    it 'forbids when a developer fetches maintainer keys' do
+      dev_user = create(:user)
+      project.add_developer(dev_user)
+
+      get api("/users/#{user.id}/project_deploy_keys", dev_user)
+
+      expect(response).to have_gitlab_http_status(:forbidden)
+      expect(json_response['message']).to eq('403 Forbidden - No common authorized project found')
+    end
+
+    context 'with multiple projects' do
+      let(:second_project) { create(:project) }
+      let(:second_user) { create(:user) }
+
+      before do
+        second_project.add_maintainer(second_user)
+
+        deploy_key = create(:deploy_key, user: second_user)
+        create(:deploy_keys_project, project: second_project, deploy_key_id: deploy_key.id)
+      end
+
+      context 'when no common projects for user and current_user' do
+        it 'forbids' do
+          get api("/users/#{user.id}/project_deploy_keys", second_user)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+          expect(json_response['message']).to eq('403 Forbidden - No common authorized project found')
+        end
+      end
+
+      context 'when there are common projects for user and current_user' do
+        before do
+          project.add_maintainer(second_user)
+        end
+
+        it 'lists only common project keys' do
+          expect(second_user.project_deploy_keys).to contain_exactly(
+            project.deploy_keys.first, second_project.deploy_keys.first)
+
+          get api("/users/#{second_user.id}/project_deploy_keys", user)
+
+          expect(json_response.count).to eq(1)
+          expect(json_response.first['key']).to eq(project.deploy_keys.first.key)
+        end
+
+        it 'lists only project_deploy_keys and not user deploy_keys' do
+          third_user = create(:user)
+
+          project.add_maintainer(third_user)
+          second_project.add_maintainer(third_user)
+
+          create(:deploy_key, user: second_user)
+          create(:deploy_key, user: third_user)
+
+          get api("/users/#{second_user.id}/project_deploy_keys", third_user)
+
+          expect(json_response.count).to eq(2)
+          expect([json_response.first['key'], json_response.second['key']]).to contain_exactly(
+            project.deploy_keys.first.key, second_project.deploy_keys.first.key)
+        end
+
+        it 'avoids N+1 queries' do
+          second_project.add_maintainer(user)
+
+          control_count = ActiveRecord::QueryRecorder.new do
+            get api("/users/#{second_user.id}/project_deploy_keys", user)
+          end.count
+
+          deploy_key = create(:deploy_key, user: second_user)
+          create(:deploy_keys_project, project: second_project, deploy_key_id: deploy_key.id)
+
+          expect do
+            get api("/users/#{second_user.id}/project_deploy_keys", user)
+          end.not_to exceed_query_limit(control_count)
+        end
+      end
+    end
+  end
+
   describe 'GET /user/:id/keys' do
     it 'returns 404 for non-existing user' do
       get api("/users/#{non_existing_record_id}/keys")
diff --git a/spec/requests/api/wikis_spec.rb b/spec/requests/api/wikis_spec.rb
index 06ae61ca5eb..f4096eef8d0 100644
--- a/spec/requests/api/wikis_spec.rb
+++ b/spec/requests/api/wikis_spec.rb
@@ -256,6 +256,24 @@ RSpec.describe API::Wikis do
           include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
+
+      context 'when content contains a reference' do
+        let(:issue) { create(:issue, project: project) }
+        let(:params) { { render_html: true } }
+        let(:page) { create(:wiki_page, wiki: project.wiki, title: 'page_with_ref', content: issue.to_reference) }
+        let(:expected_content) { %r{<a href=".*#{issue.iid}".*>#{issue.to_reference}</a>} }
+
+        before do
+          project.add_developer(user)
+
+          request
+        end
+
+        it 'expands the reference in the content' do
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response['content']).to match(expected_content)
+        end
+      end
     end
   end