Add latest changes from gitlab-org/gitlab@master

60 files changed, 484 insertions, 335 deletions

diff --git a/spec/features/admin/admin_abuse_reports_spec.rb b/spec/features/admin/admin_abuse_reports_spec.rb
index 5e98d2ffcf3..9c425f83508 100644
--- a/spec/features/admin/admin_abuse_reports_spec.rb
+++ b/spec/features/admin/admin_abuse_reports_spec.rb
@@ -17,7 +17,7 @@ RSpec.describe "Admin::AbuseReports", :js, feature_category: :insider_threat do
 
     before do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit admin_abuse_reports_path
     end
diff --git a/spec/features/admin/admin_appearance_spec.rb b/spec/features/admin/admin_appearance_spec.rb
index 2a9bff55dce..ec63e43d183 100644
--- a/spec/features/admin/admin_appearance_spec.rb
+++ b/spec/features/admin/admin_appearance_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'create new appearance' do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     visit admin_application_settings_appearances_path
 
     fill_in 'appearance_title', with: 'MyCompany'
@@ -39,7 +39,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'preview sign-in page appearance' do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
 
     visit admin_application_settings_appearances_path
     click_link "Sign-in page"
@@ -53,7 +53,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'preview new project page appearance', :js do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
 
     visit admin_application_settings_appearances_path
     click_link "New project page"
@@ -64,7 +64,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
   context 'Custom system header and footer' do
     before do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
     end
 
     context 'when system header and footer messages are empty' do
@@ -102,7 +102,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'custom new project page', :js do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     visit new_project_path
     click_link 'Create blank project'
 
@@ -112,7 +112,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
   context 'Profile page with custom profile image guidelines' do
     before do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
       visit admin_application_settings_appearances_path
       fill_in 'appearance_profile_image_guidelines', with: 'Custom profile image guidelines, please :smile:!'
       click_button 'Update appearance settings'
@@ -128,7 +128,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'appearance logo' do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     visit admin_application_settings_appearances_path
 
     attach_file(:appearance_logo, logo_fixture)
@@ -141,7 +141,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'appearance pwa icon' do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     visit admin_application_settings_appearances_path
 
     attach_file(:appearance_pwa_icon, logo_fixture)
@@ -154,7 +154,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'header logos' do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     visit admin_application_settings_appearances_path
 
     attach_file(:appearance_header_logo, logo_fixture)
@@ -167,7 +167,7 @@ RSpec.describe 'Admin Appearance', feature_category: :shared do
 
   it 'Favicon' do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     visit admin_application_settings_appearances_path
 
     attach_file(:appearance_favicon, logo_fixture)
diff --git a/spec/features/admin/admin_browse_spam_logs_spec.rb b/spec/features/admin/admin_browse_spam_logs_spec.rb
index f781e2adf07..1f89232759c 100644
--- a/spec/features/admin/admin_browse_spam_logs_spec.rb
+++ b/spec/features/admin/admin_browse_spam_logs_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'Admin browse spam logs', feature_category: :shared do
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   it 'browse spam logs' do
diff --git a/spec/features/admin/admin_deploy_keys_spec.rb b/spec/features/admin/admin_deploy_keys_spec.rb
index f9510ef296a..d6d021aeafc 100644
--- a/spec/features/admin/admin_deploy_keys_spec.rb
+++ b/spec/features/admin/admin_deploy_keys_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'admin deploy keys', :js, feature_category: :system_access do
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   it 'show all public deploy keys' do
diff --git a/spec/features/admin/admin_dev_ops_reports_spec.rb b/spec/features/admin/admin_dev_ops_reports_spec.rb
index 99d43e6b0da..e820ae866a1 100644
--- a/spec/features/admin/admin_dev_ops_reports_spec.rb
+++ b/spec/features/admin/admin_dev_ops_reports_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe 'DevOps Report page', :js, feature_category: :devops_reports do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   context 'without licensed feature devops adoption' do
diff --git a/spec/features/admin/admin_disables_git_access_protocol_spec.rb b/spec/features/admin/admin_disables_git_access_protocol_spec.rb
index 76620b93557..039968025a9 100644
--- a/spec/features/admin/admin_disables_git_access_protocol_spec.rb
+++ b/spec/features/admin/admin_disables_git_access_protocol_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'Admin disables Git access protocol', :js, feature_category: :sou
   before do
     stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   context 'with HTTP disabled' do
diff --git a/spec/features/admin/admin_disables_two_factor_spec.rb b/spec/features/admin/admin_disables_two_factor_spec.rb
index eed20d449cd..cb3c8973872 100644
--- a/spec/features/admin/admin_disables_two_factor_spec.rb
+++ b/spec/features/admin/admin_disables_two_factor_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'Admin disables 2FA for a user', feature_category: :system_access
   it 'successfully', :js do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     user = create(:user, :two_factor)
 
     edit_user(user)
@@ -27,7 +27,7 @@ RSpec.describe 'Admin disables 2FA for a user', feature_category: :system_access
   it 'for a user without 2FA enabled' do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     user = create(:user)
 
     edit_user(user)
diff --git a/spec/features/admin/admin_groups_spec.rb b/spec/features/admin/admin_groups_spec.rb
index f071da1835a..283caddab6a 100644
--- a/spec/features/admin/admin_groups_spec.rb
+++ b/spec/features/admin/admin_groups_spec.rb
@@ -15,7 +15,7 @@ RSpec.describe 'Admin Groups', feature_category: :groups_and_projects do
 
   before do
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user)
+    enable_admin_mode!(current_user)
     stub_application_setting(default_group_visibility: internal)
   end
 
diff --git a/spec/features/admin/admin_health_check_spec.rb b/spec/features/admin/admin_health_check_spec.rb
index 66014e676d5..fa91159c5f5 100644
--- a/spec/features/admin/admin_health_check_spec.rb
+++ b/spec/features/admin/admin_health_check_spec.rb
@@ -10,7 +10,7 @@ RSpec.describe "Admin Health Check", :js, feature_category: :error_budgets do
   before do
     stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   describe '#show' do
diff --git a/spec/features/admin/admin_hook_logs_spec.rb b/spec/features/admin/admin_hook_logs_spec.rb
index 0a537e65b99..146c83dbeee 100644
--- a/spec/features/admin/admin_hook_logs_spec.rb
+++ b/spec/features/admin/admin_hook_logs_spec.rb
@@ -9,7 +9,7 @@ RSpec.describe 'Admin::HookLogs', feature_category: :webhooks do
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   it 'show list of hook logs' do
diff --git a/spec/features/admin/admin_hooks_spec.rb b/spec/features/admin/admin_hooks_spec.rb
index 2aec5baf351..9bdb7ce000f 100644
--- a/spec/features/admin/admin_hooks_spec.rb
+++ b/spec/features/admin/admin_hooks_spec.rb
@@ -9,7 +9,7 @@ RSpec.describe 'Admin::Hooks', feature_category: :webhooks do
 
   before do
     sign_in(user)
-    gitlab_enable_admin_mode_sign_in(user)
+    enable_admin_mode!(user)
   end
 
   describe 'GET /admin/hooks' do
diff --git a/spec/features/admin/admin_jobs_spec.rb b/spec/features/admin/admin_jobs_spec.rb
index b3e21d02354..fc775c180ff 100644
--- a/spec/features/admin/admin_jobs_spec.rb
+++ b/spec/features/admin/admin_jobs_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'Admin Jobs', :js, feature_category: :continuous_integration do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   describe 'GET /admin/jobs' do
diff --git a/spec/features/admin/admin_labels_spec.rb b/spec/features/admin/admin_labels_spec.rb
index 47dc8577037..2fe68363062 100644
--- a/spec/features/admin/admin_labels_spec.rb
+++ b/spec/features/admin/admin_labels_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe 'admin issues labels', feature_category: :team_planning do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   describe 'list' do
diff --git a/spec/features/admin/admin_manage_applications_spec.rb b/spec/features/admin/admin_manage_applications_spec.rb
index b4c77e802a8..3e351af6121 100644
--- a/spec/features/admin/admin_manage_applications_spec.rb
+++ b/spec/features/admin/admin_manage_applications_spec.rb
@@ -10,7 +10,7 @@ RSpec.describe 'admin manage applications', feature_category: :system_access do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   include_examples 'manage applications'
diff --git a/spec/features/admin/admin_mode/login_spec.rb b/spec/features/admin/admin_mode/login_spec.rb
index 5e4935ee4b1..5298407deb3 100644
--- a/spec/features/admin/admin_mode/login_spec.rb
+++ b/spec/features/admin/admin_mode/login_spec.rb
@@ -24,7 +24,7 @@ RSpec.describe 'Admin Mode Login', feature_category: :system_access do
 
           repeated_otp = user.current_otp
           enter_code(repeated_otp)
-          gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
+          enable_admin_mode!(user, use_ui: true)
 
           expect(page).to have_content(_('Enter verification code'))
 
@@ -41,7 +41,7 @@ RSpec.describe 'Admin Mode Login', feature_category: :system_access do
             expect(page).to have_content('Enter verification code')
 
             enter_code(user.current_otp)
-            gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
+            enable_admin_mode!(user, use_ui: true)
 
             expect(page).to have_content(_('Enter verification code'))
           end
diff --git a/spec/features/admin/admin_mode/logout_spec.rb b/spec/features/admin/admin_mode/logout_spec.rb
index 584151726a6..beac36e28c5 100644
--- a/spec/features/admin/admin_mode/logout_spec.rb
+++ b/spec/features/admin/admin_mode/logout_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'Admin Mode Logout', :js, feature_category: :system_access do
     # TODO: This used to use gitlab_sign_in, instead of sign_in, but that is buggy.  See
     #   this issue to look into why: https://gitlab.com/gitlab-org/gitlab/-/issues/331851
     sign_in(user)
-    gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: false)
+    enable_admin_mode!(user, use_ui: true)
     visit admin_root_path
   end
 
diff --git a/spec/features/admin/admin_mode/workers_spec.rb b/spec/features/admin/admin_mode/workers_spec.rb
index 124c43eef9d..f0cea425bb7 100644
--- a/spec/features/admin/admin_mode/workers_spec.rb
+++ b/spec/features/admin/admin_mode/workers_spec.rb
@@ -34,7 +34,7 @@ RSpec.describe 'Admin mode for workers', :request_store, feature_category: :syst
 
     context 'when admin mode enabled', :delete do
       before do
-        gitlab_enable_admin_mode_sign_in(user)
+        enable_admin_mode!(user)
       end
 
       it 'can delete user', :js do
@@ -67,6 +67,6 @@ RSpec.describe 'Admin mode for workers', :request_store, feature_category: :syst
     Sidekiq::Worker.drain_all
 
     sign_in(user)
-    gitlab_enable_admin_mode_sign_in(user)
+    enable_admin_mode!(user)
   end
 end
diff --git a/spec/features/admin/admin_mode_spec.rb b/spec/features/admin/admin_mode_spec.rb
index 2a655cdb1f4..29eb24fa9b8 100644
--- a/spec/features/admin/admin_mode_spec.rb
+++ b/spec/features/admin/admin_mode_spec.rb
@@ -69,7 +69,7 @@ RSpec.describe 'Admin mode', :js, feature_category: :shared do
 
     context 'when in admin_mode' do
       before do
-        gitlab_enable_admin_mode_sign_in(admin, use_mock_admin_mode: false)
+        enable_admin_mode!(admin, use_ui: true)
       end
 
       it 'contains link to leave admin mode' do
diff --git a/spec/features/admin/admin_projects_spec.rb b/spec/features/admin/admin_projects_spec.rb
index b793299e253..978b2176431 100644
--- a/spec/features/admin/admin_projects_spec.rb
+++ b/spec/features/admin/admin_projects_spec.rb
@@ -14,7 +14,7 @@ RSpec.describe "Admin::Projects", feature_category: :groups_and_projects do
 
   before do
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user)
+    enable_admin_mode!(current_user)
   end
 
   describe 'when membership is set to expire', :js do
diff --git a/spec/features/admin/admin_runners_spec.rb b/spec/features/admin/admin_runners_spec.rb
index 653458710e3..2b4ceb05f00 100644
--- a/spec/features/admin/admin_runners_spec.rb
+++ b/spec/features/admin/admin_runners_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe "Admin Runners", feature_category: :fleet_visibility do
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   describe "Admin Runners page", :js do
diff --git a/spec/features/admin/admin_search_settings_spec.rb b/spec/features/admin/admin_search_settings_spec.rb
index 3254bf75738..c20a50cf218 100644
--- a/spec/features/admin/admin_search_settings_spec.rb
+++ b/spec/features/admin/admin_search_settings_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'Admin searches application settings', :js, feature_category: :gl
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   context 'in appearances page' do
diff --git a/spec/features/admin/admin_sees_background_migrations_spec.rb b/spec/features/admin/admin_sees_background_migrations_spec.rb
index ae307b8038c..43b920c657c 100644
--- a/spec/features/admin/admin_sees_background_migrations_spec.rb
+++ b/spec/features/admin/admin_sees_background_migrations_spec.rb
@@ -18,7 +18,7 @@ RSpec.describe "Admin > Admin sees background migrations", feature_category: :da
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   it 'can navigate to background migrations', :js do
diff --git a/spec/features/admin/admin_sees_project_statistics_spec.rb b/spec/features/admin/admin_sees_project_statistics_spec.rb
index d977735daf8..07f90d247cd 100644
--- a/spec/features/admin/admin_sees_project_statistics_spec.rb
+++ b/spec/features/admin/admin_sees_project_statistics_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe "Admin > Admin sees project statistics", feature_category: :group
 
   before do
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user)
+    enable_admin_mode!(current_user)
 
     visit admin_project_path(project)
   end
diff --git a/spec/features/admin/admin_sees_projects_statistics_spec.rb b/spec/features/admin/admin_sees_projects_statistics_spec.rb
index 3363a67ea90..cc6ccbab0a0 100644
--- a/spec/features/admin/admin_sees_projects_statistics_spec.rb
+++ b/spec/features/admin/admin_sees_projects_statistics_spec.rb
@@ -10,7 +10,7 @@ RSpec.describe "Admin > Admin sees projects statistics", feature_category: :grou
     create(:project, :repository) { |project| project.statistics.destroy! }
 
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user)
+    enable_admin_mode!(current_user)
 
     visit admin_projects_path
   end
diff --git a/spec/features/admin/admin_settings_spec.rb b/spec/features/admin/admin_settings_spec.rb
index 77707a67d58..d1fdbfc5329 100644
--- a/spec/features/admin/admin_settings_spec.rb
+++ b/spec/features/admin/admin_settings_spec.rb
@@ -13,7 +13,7 @@ RSpec.describe 'Admin updates settings', feature_category: :shared do
     before do
       stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin, use_mock_admin_mode: false)
+      enable_admin_mode!(admin, use_ui: true)
     end
 
     context 'General page' do
diff --git a/spec/features/admin/admin_system_info_spec.rb b/spec/features/admin/admin_system_info_spec.rb
index 71a0b829932..f285fefe6db 100644
--- a/spec/features/admin/admin_system_info_spec.rb
+++ b/spec/features/admin/admin_system_info_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe 'Admin System Info', feature_category: :shared do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   describe 'GET /admin/system_info' do
diff --git a/spec/features/admin/admin_users_impersonation_tokens_spec.rb b/spec/features/admin/admin_users_impersonation_tokens_spec.rb
index 543dc2cc2a6..7cfe0cdbc81 100644
--- a/spec/features/admin/admin_users_impersonation_tokens_spec.rb
+++ b/spec/features/admin/admin_users_impersonation_tokens_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe 'Admin > Users > Impersonation Tokens', :js, feature_category: :s
 
   before do
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   describe "token creation" do
diff --git a/spec/features/admin/admin_users_spec.rb b/spec/features/admin/admin_users_spec.rb
index 9ab5b1fd3bb..f09c1a59b0d 100644
--- a/spec/features/admin/admin_users_spec.rb
+++ b/spec/features/admin/admin_users_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe "Admin::Users", feature_category: :user_management do
 
   before do
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user)
+    enable_admin_mode!(current_user)
   end
 
   describe 'Tabs' do
diff --git a/spec/features/admin/admin_uses_repository_checks_spec.rb b/spec/features/admin/admin_uses_repository_checks_spec.rb
index 05232de35e5..a628344bfeb 100644
--- a/spec/features/admin/admin_uses_repository_checks_spec.rb
+++ b/spec/features/admin/admin_uses_repository_checks_spec.rb
@@ -25,7 +25,7 @@ RSpec.describe 'Admin uses repository checks', :request_store, feature_category:
 
   context 'when admin mode is enabled' do
     before do
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
     end
 
     it 'to trigger a single check', :js do
diff --git a/spec/features/admin/broadcast_messages_spec.rb b/spec/features/admin/broadcast_messages_spec.rb
index e4a2e31ee1c..16651ffa07e 100644
--- a/spec/features/admin/broadcast_messages_spec.rb
+++ b/spec/features/admin/broadcast_messages_spec.rb
@@ -7,7 +7,7 @@ RSpec.describe 'Admin Broadcast Messages', :js, feature_category: :onboarding do
     it 'previews, creates and edits a broadcast message' do
       admin = create(:admin)
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       # create
       visit admin_broadcast_messages_path
diff --git a/spec/features/admin/dashboard_spec.rb b/spec/features/admin/dashboard_spec.rb
index 06f9c531e74..9e8f5138815 100644
--- a/spec/features/admin/dashboard_spec.rb
+++ b/spec/features/admin/dashboard_spec.rb
@@ -8,7 +8,7 @@ RSpec.describe 'admin visits dashboard' do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
   end
 
   context 'counting forks', :js, feature_category: :source_code_management do
diff --git a/spec/features/admin/users/user_identities_spec.rb b/spec/features/admin/users/user_identities_spec.rb
new file mode 100644
index 00000000000..903ddbed399
--- /dev/null
+++ b/spec/features/admin/users/user_identities_spec.rb
@@ -0,0 +1,54 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Admin::Users::UserIdentities', feature_category: :user_management do
+  let_it_be(:user) { create(:omniauth_user, provider: 'twitter', extern_uid: '123456') }
+  let_it_be(:current_user) { create(:admin) }
+
+  before do
+    sign_in(current_user)
+    gitlab_enable_admin_mode_sign_in(current_user, use_mock_admin_mode: false)
+  end
+
+  describe 'GET /admin/users/:id' do
+    describe 'show user identities' do
+      it 'shows user identities', :aggregate_failures do
+        visit admin_user_identities_path(user)
+
+        expect(page).to have_content(user.name)
+        expect(page).to have_content('twitter')
+      end
+    end
+
+    describe 'update user identities' do
+      before do
+        allow(Gitlab::Auth::OAuth::Provider).to receive(:providers).and_return([:twitter, :twitter_updated])
+      end
+
+      it 'modifies twitter identity', :aggregate_failures do
+        visit admin_user_identities_path(user)
+
+        find('.table').find(:link, 'Edit').click
+        fill_in 'identity_extern_uid', with: '654321'
+        select 'twitter_updated', from: 'identity_provider'
+        click_button 'Save changes'
+
+        expect(page).to have_content(user.name)
+        expect(page).to have_content('twitter_updated')
+        expect(page).to have_content('654321')
+      end
+    end
+
+    describe 'remove user with identities' do
+      it 'removes user with twitter identity', :aggregate_failures do
+        visit admin_user_identities_path(user)
+
+        click_link 'Delete'
+
+        expect(page).to have_content(user.name)
+        expect(page).not_to have_content('twitter')
+      end
+    end
+  end
+end
diff --git a/spec/features/admin/users/user_impersonation_spec.rb b/spec/features/admin/users/user_impersonation_spec.rb
new file mode 100644
index 00000000000..81c1d0de115
--- /dev/null
+++ b/spec/features/admin/users/user_impersonation_spec.rb
@@ -0,0 +1,209 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Admin::Users::UserImpersonation', feature_category: :user_management do
+  let_it_be(:user) { create(:omniauth_user, provider: 'twitter', extern_uid: '123456') }
+  let_it_be(:current_user) { create(:admin) }
+
+  before do
+    sign_in(current_user)
+    gitlab_enable_admin_mode_sign_in(current_user, use_mock_admin_mode: false)
+  end
+
+  describe 'GET /admin/users/:id' do
+    describe 'Impersonation' do
+      let_it_be(:another_user) { create(:user) }
+
+      context 'before impersonating' do
+        subject { visit admin_user_path(user_to_visit) }
+
+        let_it_be(:user_to_visit) { another_user }
+
+        shared_examples "user that cannot be impersonated" do
+          it 'disables impersonate button' do
+            subject
+
+            impersonate_btn = find_by_testid('impersonate-user-link')
+
+            expect(impersonate_btn).not_to be_nil
+            expect(impersonate_btn['disabled']).not_to be_nil
+          end
+
+          it "shows tooltip with correct error message" do
+            subject
+
+            expect(find("span[title='#{impersonation_error_msg}']")).not_to be_nil
+          end
+        end
+
+        context 'for other users' do
+          it 'shows impersonate button for other users' do
+            subject
+
+            expect(page).to have_content('Impersonate')
+            impersonate_btn = find_by_testid('impersonate-user-link')
+            expect(impersonate_btn['disabled']).to be_nil
+          end
+        end
+
+        context 'for admin itself' do
+          let(:user_to_visit) { current_user }
+
+          it 'does not show impersonate button for admin itself' do
+            subject
+
+            expect(page).not_to have_content('Impersonate')
+          end
+        end
+
+        context 'for blocked user' do
+          let_it_be(:blocked_user) { create(:user, :blocked) }
+          let(:user_to_visit) { blocked_user }
+          let(:impersonation_error_msg) { _('You cannot impersonate a blocked user') }
+
+          it_behaves_like "user that cannot be impersonated"
+        end
+
+        context 'for user with expired password' do
+          let(:user_to_visit) do
+            another_user.update!(password_expires_at: Time.zone.now - 5.minutes)
+            another_user
+          end
+
+          let(:impersonation_error_msg) { _("You cannot impersonate a user with an expired password") }
+
+          it_behaves_like "user that cannot be impersonated"
+        end
+
+        context 'for internal user' do
+          let_it_be(:internal_user) { create(:user, :bot) }
+          let(:user_to_visit) { internal_user }
+          let(:impersonation_error_msg) { _("You cannot impersonate an internal user") }
+
+          it_behaves_like "user that cannot be impersonated"
+        end
+
+        context 'for locked user' do
+          let_it_be(:locked_user) { create(:user, :locked) }
+          let(:user_to_visit) { locked_user }
+          let(:impersonation_error_msg) { _("You cannot impersonate a user who cannot log in") }
+
+          it_behaves_like "user that cannot be impersonated"
+        end
+
+        context 'when already impersonating another user' do
+          let_it_be(:admin_user) { create(:user, :admin) }
+          let(:impersonation_error_msg) { _("You are already impersonating another user") }
+
+          subject do
+            visit admin_user_path(admin_user)
+            click_link 'Impersonate'
+            visit admin_user_path(another_user)
+          end
+
+          it_behaves_like "user that cannot be impersonated"
+        end
+
+        context 'when impersonation is disabled' do
+          before do
+            stub_config_setting(impersonation_enabled: false)
+          end
+
+          it 'does not show impersonate button' do
+            subject
+
+            expect(page).not_to have_content('Impersonate')
+          end
+        end
+      end
+
+      context 'when impersonating' do
+        subject { click_link 'Impersonate' }
+
+        before do
+          visit admin_user_path(another_user)
+        end
+
+        it 'logs in as the user when impersonate is clicked', :js do
+          subject
+
+          expect(page).to have_button("#{another_user.name} user’s menu")
+        end
+
+        it 'sees impersonation log out icon', :js do
+          subject
+
+          icon = first('[data-testid="incognito-icon"]')
+          expect(icon).not_to be nil
+        end
+
+        context 'when viewing the confirm email warning', :js do
+          before do
+            stub_application_setting_enum('email_confirmation_setting', 'soft')
+          end
+
+          let_it_be(:another_user) { create(:user, :unconfirmed) }
+          let(:warning_alert) { page.find(:css, '[data-testid="alert-warning"]') }
+          let(:expected_styling) { { 'pointer-events' => 'none', 'cursor' => 'default' } }
+
+          context 'with an email that does not contain HTML' do
+            before do
+              subject
+            end
+
+            it 'displays the warning alert including the email' do
+              expect(warning_alert.text).to include("Please check your email (#{another_user.email}) to verify")
+            end
+          end
+
+          context 'with an email that contains HTML' do
+            let(:malicious_email) { "malicious@test.com<form><input/title='<script>alert(document.domain)</script>'>" }
+            let(:another_user) { create(:user, confirmed_at: nil, unconfirmed_email: malicious_email) }
+
+            before do
+              subject
+            end
+
+            it 'displays the impersonation alert, excludes email, and disables links' do
+              expect(warning_alert.text).to include("check your email (#{another_user.unconfirmed_email}) to verify")
+            end
+          end
+        end
+      end
+
+      context 'ending impersonation', :js do
+        subject { click_on 'Stop impersonating' }
+
+        before do
+          visit admin_user_path(another_user)
+          click_link 'Impersonate'
+        end
+
+        it 'logs out of impersonated user back to original user' do
+          subject
+
+          expect(page).to have_button("#{current_user.name} user’s menu")
+        end
+
+        it 'is redirected back to the impersonated users page in the admin after stopping' do
+          subject
+
+          expect(page).to have_current_path("/admin/users/#{another_user.username}", ignore_query: true)
+        end
+
+        context 'a user with an expired password' do
+          before do
+            another_user.update!(password_expires_at: Time.zone.now - 5.minutes)
+          end
+
+          it 'is redirected back to the impersonated users page in the admin after stopping' do
+            subject
+
+            expect(page).to have_current_path("/admin/users/#{another_user.username}", ignore_query: true)
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/features/admin/users/user_spec.rb b/spec/features/admin/users/user_spec.rb
index d0110b3e013..b7e7a037ffc 100644
--- a/spec/features/admin/users/user_spec.rb
+++ b/spec/features/admin/users/user_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe 'Admin::Users::User', feature_category: :user_management do
 
   before do
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user, use_mock_admin_mode: false)
+    enable_admin_mode!(current_user, use_ui: true)
   end
 
   describe 'GET /admin/users/:id' do
@@ -144,200 +144,6 @@ RSpec.describe 'Admin::Users::User', feature_category: :user_management do
       end
     end
 
-    describe 'Impersonation' do
-      let_it_be(:another_user) { create(:user) }
-
-      context 'before impersonating' do
-        subject { visit admin_user_path(user_to_visit) }
-
-        let_it_be(:user_to_visit) { another_user }
-
-        shared_examples "user that cannot be impersonated" do
-          it 'disables impersonate button' do
-            subject
-
-            impersonate_btn = find_by_testid('impersonate-user-link')
-
-            expect(impersonate_btn).not_to be_nil
-            expect(impersonate_btn['disabled']).not_to be_nil
-          end
-
-          it "shows tooltip with correct error message" do
-            subject
-
-            expect(find("span[title='#{impersonation_error_msg}']")).not_to be_nil
-          end
-        end
-
-        context 'for other users' do
-          it 'shows impersonate button for other users' do
-            subject
-
-            expect(page).to have_content('Impersonate')
-            impersonate_btn = find_by_testid('impersonate-user-link')
-            expect(impersonate_btn['disabled']).to be_nil
-          end
-        end
-
-        context 'for admin itself' do
-          let(:user_to_visit) { current_user }
-
-          it 'does not show impersonate button for admin itself' do
-            subject
-
-            expect(page).not_to have_content('Impersonate')
-          end
-        end
-
-        context 'for blocked user' do
-          let_it_be(:blocked_user) { create(:user, :blocked) }
-          let(:user_to_visit) { blocked_user }
-          let(:impersonation_error_msg) { _('You cannot impersonate a blocked user') }
-
-          it_behaves_like "user that cannot be impersonated"
-        end
-
-        context 'for user with expired password' do
-          let(:user_to_visit) do
-            another_user.update!(password_expires_at: Time.zone.now - 5.minutes)
-            another_user
-          end
-
-          let(:impersonation_error_msg) { _("You cannot impersonate a user with an expired password") }
-
-          it_behaves_like "user that cannot be impersonated"
-        end
-
-        context 'for internal user' do
-          let_it_be(:internal_user) { create(:user, :bot) }
-          let(:user_to_visit) { internal_user }
-          let(:impersonation_error_msg) { _("You cannot impersonate an internal user") }
-
-          it_behaves_like "user that cannot be impersonated"
-        end
-
-        context 'for locked user' do
-          let_it_be(:locked_user) { create(:user, :locked) }
-          let(:user_to_visit) { locked_user }
-          let(:impersonation_error_msg) { _("You cannot impersonate a user who cannot log in") }
-
-          it_behaves_like "user that cannot be impersonated"
-        end
-
-        context 'when already impersonating another user' do
-          let_it_be(:admin_user) { create(:user, :admin) }
-          let(:impersonation_error_msg) { _("You are already impersonating another user") }
-
-          subject do
-            visit admin_user_path(admin_user)
-            click_link 'Impersonate'
-            visit admin_user_path(another_user)
-          end
-
-          it_behaves_like "user that cannot be impersonated"
-        end
-
-        context 'when impersonation is disabled' do
-          before do
-            stub_config_setting(impersonation_enabled: false)
-          end
-
-          it 'does not show impersonate button' do
-            subject
-
-            expect(page).not_to have_content('Impersonate')
-          end
-        end
-      end
-
-      context 'when impersonating' do
-        subject { click_link 'Impersonate' }
-
-        before do
-          visit admin_user_path(another_user)
-        end
-
-        it 'logs in as the user when impersonate is clicked', :js do
-          subject
-
-          expect(page).to have_button("#{another_user.name} user’s menu")
-        end
-
-        it 'sees impersonation log out icon', :js do
-          subject
-
-          icon = first('[data-testid="incognito-icon"]')
-          expect(icon).not_to be nil
-        end
-
-        context 'when viewing the confirm email warning', :js do
-          before do
-            stub_application_setting_enum('email_confirmation_setting', 'soft')
-          end
-
-          let_it_be(:another_user) { create(:user, :unconfirmed) }
-          let(:warning_alert) { page.find(:css, '[data-testid="alert-warning"]') }
-          let(:expected_styling) { { 'pointer-events' => 'none', 'cursor' => 'default' } }
-
-          context 'with an email that does not contain HTML' do
-            before do
-              subject
-            end
-
-            it 'displays the warning alert including the email' do
-              expect(warning_alert.text).to include("Please check your email (#{another_user.email}) to verify")
-            end
-          end
-
-          context 'with an email that contains HTML' do
-            let(:malicious_email) { "malicious@test.com<form><input/title='<script>alert(document.domain)</script>'>" }
-            let(:another_user) { create(:user, confirmed_at: nil, unconfirmed_email: malicious_email) }
-
-            before do
-              subject
-            end
-
-            it 'displays the impersonation alert, excludes email, and disables links' do
-              expect(warning_alert.text).to include("check your email (#{another_user.unconfirmed_email}) to verify")
-            end
-          end
-        end
-      end
-
-      context 'ending impersonation', :js do
-        subject { click_on 'Stop impersonating' }
-
-        before do
-          visit admin_user_path(another_user)
-          click_link 'Impersonate'
-        end
-
-        it 'logs out of impersonated user back to original user' do
-          subject
-
-          expect(page).to have_button("#{current_user.name} user’s menu")
-        end
-
-        it 'is redirected back to the impersonated users page in the admin after stopping' do
-          subject
-
-          expect(page).to have_current_path("/admin/users/#{another_user.username}", ignore_query: true)
-        end
-
-        context 'a user with an expired password' do
-          before do
-            another_user.update!(password_expires_at: Time.zone.now - 5.minutes)
-          end
-
-          it 'is redirected back to the impersonated users page in the admin after stopping' do
-            subject
-
-            expect(page).to have_current_path("/admin/users/#{another_user.username}", ignore_query: true)
-          end
-        end
-      end
-    end
-
     describe 'Two-factor Authentication status' do
       it 'shows when enabled' do
         user.update!(otp_required_for_login: true)
@@ -479,26 +285,6 @@ RSpec.describe 'Admin::Users::User', feature_category: :user_management do
     end
   end
 
-  describe 'GET /admin/users', :js do
-    context 'user pending approval' do
-      it 'shows user info', :aggregate_failures do
-        user = create(:user, :blocked_pending_approval)
-
-        visit admin_users_path
-        click_link 'Pending approval'
-        click_link user.name
-
-        expect(page).to have_content(user.name)
-        expect(page).to have_content('Pending approval')
-
-        click_user_dropdown_toggle(user.id)
-
-        expect(page).to have_button('Approve')
-        expect(page).to have_button('Reject')
-      end
-    end
-  end
-
   context 'when user has an unconfirmed email', :js do
     # Email address contains HTML to ensure email address is displayed in an HTML safe way.
     let_it_be(:unconfirmed_email) { "#{generate(:email)}<h2>testing<img/src=http://localhost:8000/test.png>" }
diff --git a/spec/features/admin/users/users_spec.rb b/spec/features/admin/users/users_spec.rb
index 4e988674858..20cedda626b 100644
--- a/spec/features/admin/users/users_spec.rb
+++ b/spec/features/admin/users/users_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'Admin::Users', feature_category: :user_management do
 
   before do
     sign_in(current_user)
-    gitlab_enable_admin_mode_sign_in(current_user)
+    enable_admin_mode!(current_user)
   end
 
   describe 'GET /admin/users', :js do
@@ -381,6 +381,24 @@ RSpec.describe 'Admin::Users', feature_category: :user_management do
         expect(find_by_testid("user-group-count-#{current_user.id}").text).to eq("2")
       end
     end
+
+    context 'user pending approval' do
+      it 'shows user info', :aggregate_failures do
+        user = create(:user, :blocked_pending_approval)
+
+        visit admin_users_path
+        click_link 'Pending approval'
+        click_link user.name
+
+        expect(page).to have_content(user.name)
+        expect(page).to have_content('Pending approval')
+
+        click_user_dropdown_toggle(user.id)
+
+        expect(page).to have_button('Approve')
+        expect(page).to have_button('Reject')
+      end
+    end
   end
 
   describe 'GET /admin/users/new' do
diff --git a/spec/features/admin_variables_spec.rb b/spec/features/admin_variables_spec.rb
index caa94209e50..0fc0ae9e199 100644
--- a/spec/features/admin_variables_spec.rb
+++ b/spec/features/admin_variables_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe 'Instance variables', :js, feature_category: :secrets_management
   before do
     stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
 
     visit page_path
     wait_for_requests
diff --git a/spec/features/boards/keyboard_shortcut_spec.rb b/spec/features/boards/keyboard_shortcut_spec.rb
index 6f03f6db3ab..d4777fa671c 100644
--- a/spec/features/boards/keyboard_shortcut_spec.rb
+++ b/spec/features/boards/keyboard_shortcut_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe 'Issue Boards shortcut', :js, feature_category: :team_planning do
 
       admin = create(:admin)
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit project_path(project)
     end
@@ -30,7 +30,7 @@ RSpec.describe 'Issue Boards shortcut', :js, feature_category: :team_planning do
     before do
       admin = create(:admin)
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit project_path(project)
     end
diff --git a/spec/features/broadcast_messages_spec.rb b/spec/features/broadcast_messages_spec.rb
index f887242384c..867ed3c3acb 100644
--- a/spec/features/broadcast_messages_spec.rb
+++ b/spec/features/broadcast_messages_spec.rb
@@ -121,7 +121,7 @@ RSpec.describe 'Broadcast Messages', feature_category: :onboarding do
       stub_const('Gitlab::Cache::JsonCaches::JsonKeyed::STRATEGY_KEY_COMPONENTS', original_strategy_value)
       admin = create(:admin)
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit admin_broadcast_messages_path
 
diff --git a/spec/features/clusters/cluster_detail_page_spec.rb b/spec/features/clusters/cluster_detail_page_spec.rb
index 31dec5e38da..78ac752a375 100644
--- a/spec/features/clusters/cluster_detail_page_spec.rb
+++ b/spec/features/clusters/cluster_detail_page_spec.rb
@@ -145,7 +145,7 @@ RSpec.describe 'Clusterable > Show page', feature_category: :deployment_manageme
     let(:cluster) { create(:cluster, :provided_by_gcp, :instance) }
 
     before do
-      gitlab_enable_admin_mode_sign_in(current_user)
+      enable_admin_mode!(current_user)
     end
 
     it_behaves_like 'show page' do
diff --git a/spec/features/expand_collapse_diffs_spec.rb b/spec/features/expand_collapse_diffs_spec.rb
index 7fbd6c4e235..523ef8990bb 100644
--- a/spec/features/expand_collapse_diffs_spec.rb
+++ b/spec/features/expand_collapse_diffs_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe 'Expand and collapse diffs', :js, feature_category: :source_code_
     allow(Gitlab::CurrentSettings).to receive(:diff_max_patch_bytes).and_return(100.kilobytes)
 
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
 
     wait_for_requests
 
diff --git a/spec/features/gitlab_experiments_spec.rb b/spec/features/gitlab_experiments_spec.rb
index facf4994c44..0d0afa801c8 100644
--- a/spec/features/gitlab_experiments_spec.rb
+++ b/spec/features/gitlab_experiments_spec.rb
@@ -12,7 +12,7 @@ RSpec.describe "Gitlab::Experiment", :js, feature_category: :activation do
   before do
     admin = create(:admin)
     sign_in(admin)
-    gitlab_enable_admin_mode_sign_in(admin)
+    enable_admin_mode!(admin)
     stub_experiments(null_hypothesis: :candidate)
   end
 
diff --git a/spec/features/groups/clusters/user_spec.rb b/spec/features/groups/clusters/user_spec.rb
index 9089fba1886..24552daa11b 100644
--- a/spec/features/groups/clusters/user_spec.rb
+++ b/spec/features/groups/clusters/user_spec.rb
@@ -130,7 +130,7 @@ RSpec.describe 'User Cluster', :js, feature_category: :environment_management do
         gitlab_sign_out
 
         gitlab_sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
+        enable_admin_mode!(admin)
 
         visit group_clusters_path(group)
       end
diff --git a/spec/features/groups/members/list_members_spec.rb b/spec/features/groups/members/list_members_spec.rb
index b16d61a5fe4..b6e0deb2e73 100644
--- a/spec/features/groups/members/list_members_spec.rb
+++ b/spec/features/groups/members/list_members_spec.rb
@@ -66,7 +66,7 @@ RSpec.describe 'Groups > Members > List members', :js, feature_category: :groups
 
     it 'shows 2FA badge to admins' do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit group_group_members_path(group)
 
diff --git a/spec/features/help_dropdown_spec.rb b/spec/features/help_dropdown_spec.rb
index 3e4c0bc55fe..89040ec9ab6 100644
--- a/spec/features/help_dropdown_spec.rb
+++ b/spec/features/help_dropdown_spec.rb
@@ -27,7 +27,7 @@ RSpec.describe "Help Dropdown", :js, feature_category: :shared do
     context "when severity is #{severity}" do
       before do
         sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
+        enable_admin_mode!(admin)
 
         allow_next_instance_of(VersionCheck) do |instance|
           allow(instance).to receive(:response).and_return({ "severity" => severity })
diff --git a/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb b/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
index 7e33946f713..f52520313b2 100644
--- a/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
+++ b/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe 'Admin views hidden merge requests', feature_category: :insider_t
 
     before do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
       visit(project_merge_requests_path(project))
     end
 
diff --git a/spec/features/projects/clusters/gcp_spec.rb b/spec/features/projects/clusters/gcp_spec.rb
index c223053606b..e7e419a4c60 100644
--- a/spec/features/projects/clusters/gcp_spec.rb
+++ b/spec/features/projects/clusters/gcp_spec.rb
@@ -110,7 +110,7 @@ RSpec.describe 'Gcp Cluster', :js, feature_category: :deployment_management do
 
     before do
       stub_env('IN_MEMORY_APPLICATION_SETTINGS', 'false')
-      gitlab_enable_admin_mode_sign_in(user)
+      enable_admin_mode!(user)
       visit general_admin_application_settings_path
     end
 
diff --git a/spec/features/projects/clusters/user_spec.rb b/spec/features/projects/clusters/user_spec.rb
index 067963e06e0..bc4d64dad21 100644
--- a/spec/features/projects/clusters/user_spec.rb
+++ b/spec/features/projects/clusters/user_spec.rb
@@ -120,7 +120,7 @@ RSpec.describe 'User Cluster', :js, feature_category: :deployment_management do
       gitlab_sign_out
 
       gitlab_sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit project_clusters_path(project)
     end
diff --git a/spec/features/projects/features_visibility_spec.rb b/spec/features/projects/features_visibility_spec.rb
index c6a770cee9e..5f1bc4f86c1 100644
--- a/spec/features/projects/features_visibility_spec.rb
+++ b/spec/features/projects/features_visibility_spec.rb
@@ -153,7 +153,7 @@ RSpec.describe 'Edit Project Settings', feature_category: :groups_and_projects d
       before do
         non_member.update_attribute(:admin, true)
         sign_in(non_member)
-        gitlab_enable_admin_mode_sign_in(non_member)
+        enable_admin_mode!(non_member)
       end
 
       it 'renders 404 if feature is disabled' do
diff --git a/spec/features/projects/members/manage_members_spec.rb b/spec/features/projects/members/manage_members_spec.rb
index 3423c636c2b..2ab0e63d840 100644
--- a/spec/features/projects/members/manage_members_spec.rb
+++ b/spec/features/projects/members/manage_members_spec.rb
@@ -265,7 +265,7 @@ RSpec.describe 'Projects > Members > Manage members', :js, feature_category: :on
 
     it 'shows 2FA badge to admins' do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
 
       visit_members_page
 
diff --git a/spec/features/projects/user_views_empty_project_spec.rb b/spec/features/projects/user_views_empty_project_spec.rb
index ed34b109d29..7dc3dd1da1e 100644
--- a/spec/features/projects/user_views_empty_project_spec.rb
+++ b/spec/features/projects/user_views_empty_project_spec.rb
@@ -43,7 +43,7 @@ RSpec.describe 'User views an empty project', feature_category: :groups_and_proj
     context 'when admin mode is enabled' do
       before do
         sign_in(user)
-        gitlab_enable_admin_mode_sign_in(user)
+        enable_admin_mode!(user)
       end
 
       it_behaves_like 'allowing push to default branch'
diff --git a/spec/features/protected_branches_spec.rb b/spec/features/protected_branches_spec.rb
index 41105630204..c29323cba27 100644
--- a/spec/features/protected_branches_spec.rb
+++ b/spec/features/protected_branches_spec.rb
@@ -82,7 +82,7 @@ RSpec.describe 'Protected Branches', :js, feature_category: :source_code_managem
   context 'logged in as admin' do
     before do
       sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
+      enable_admin_mode!(admin)
     end
 
     describe "explicit protected branches" do
diff --git a/spec/features/usage_stats_consent_spec.rb b/spec/features/usage_stats_consent_spec.rb
index ebf1cd9e143..5436018250d 100644
--- a/spec/features/usage_stats_consent_spec.rb
+++ b/spec/features/usage_stats_consent_spec.rb
@@ -19,7 +19,7 @@ RSpec.describe 'Usage stats consent', feature_category: :service_ping do
       end
 
       gitlab_sign_in(user)
-      gitlab_enable_admin_mode_sign_in(user)
+      enable_admin_mode!(user)
     end
 
     shared_examples 'dismissible banner' do |button_text|
diff --git a/spec/features/user_settings/active_sessions_spec.rb b/spec/features/user_settings/active_sessions_spec.rb
index 5d1d4bc6490..bc0693d79e1 100644
--- a/spec/features/user_settings/active_sessions_spec.rb
+++ b/spec/features/user_settings/active_sessions_spec.rb
@@ -47,7 +47,7 @@ RSpec.describe 'Profile > Active Sessions', :clean_gitlab_redis_shared_state, fe
         )
 
         gitlab_sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
+        enable_admin_mode!(admin)
 
         visit admin_user_path(user)
 
diff --git a/spec/lib/gitlab/database/partitioning_migration_helpers/uniqueness_helpers_spec.rb b/spec/lib/gitlab/database/partitioning_migration_helpers/uniqueness_helpers_spec.rb
new file mode 100644
index 00000000000..230847f6902
--- /dev/null
+++ b/spec/lib/gitlab/database/partitioning_migration_helpers/uniqueness_helpers_spec.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Database::PartitioningMigrationHelpers::UniquenessHelpers, feature_category: :database do
+  let(:migration) do
+    ActiveRecord::Migration.new.extend(described_class)
+  end
+
+  let(:connection) { ActiveRecord::Base.connection }
+  let(:table_not_partitioned) { '_test_not_partitioned_table' }
+  let(:table_partitioned) { '_test_partitioned_table' }
+
+  before do
+    connection.execute(<<~SQL)
+      CREATE TABLE _test_partitioned_table
+      (
+        id serial NOT NULL,
+        PARTITION bigint  NULL DEFAULT 1,
+        PRIMARY KEY (id, partition)
+      ) PARTITION BY list(partition);
+
+      CREATE TABLE _test_partitioned_table_1
+      PARTITION OF _test_partitioned_table FOR VALUES IN (1);
+    SQL
+  end
+
+  describe '#ensure_unique_id' do
+    subject(:ensure_unique_id) { migration.ensure_unique_id(table_name) }
+
+    context 'when table is partitioned' do
+      let(:table_name) { table_partitioned }
+      let(:trigger_name) { "assign_#{table_name}_id_trigger" }
+      let(:function_name) { "assign_#{table_name}_id_value" }
+
+      context 'when trigger already exists' do
+        before do
+          allow(migration).to receive(:trigger_exists?)
+            .with(table_name, trigger_name)
+            .and_return(true)
+        end
+
+        it 'does not modify existing trigger' do
+          expect(migration).not_to receive(:change_column_default)
+          expect(migration).not_to receive(:create_trigger_function)
+          expect(migration).not_to receive(:create_trigger)
+
+          expect do
+            ensure_unique_id
+          end.not_to raise_error
+        end
+      end
+
+      context 'when trigger is not defined' do
+        it 'creates trigger', :aggregate_failures do
+          expect(migration).to receive(:change_column_default).with(table_name, :id, nil).and_call_original
+          expect(migration).to receive(:create_trigger_function).with(function_name).and_call_original
+          expect(migration).to receive(:create_trigger)
+            .with(table_name, trigger_name, function_name, fires: 'BEFORE INSERT')
+            .and_call_original
+
+          expect do
+            ensure_unique_id
+          end.not_to raise_error
+
+          expect(migration.trigger_exists?(table_name, trigger_name)).to eq(true)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/policies/project_policy_spec.rb b/spec/policies/project_policy_spec.rb
index a9a4575d747..9f4bf4f6b36 100644
--- a/spec/policies/project_policy_spec.rb
+++ b/spec/policies/project_policy_spec.rb
@@ -472,12 +472,12 @@ RSpec.describe ProjectPolicy, feature_category: :system_access do
     end
   end
 
-  context 'reading usage quotas' do
+  context 'reading usage quotas and viewing the edit page' do
     %w[maintainer owner].each do |role|
       context "with #{role}" do
         let(:current_user) { send(role) }
 
-        it { is_expected.to be_allowed(:read_usage_quotas) }
+        it { is_expected.to be_allowed(:read_usage_quotas, :view_edit_page) }
       end
     end
 
@@ -485,7 +485,7 @@ RSpec.describe ProjectPolicy, feature_category: :system_access do
       context "with #{role}" do
         let(:current_user) { send(role) }
 
-        it { is_expected.to be_disallowed(:read_usage_quotas) }
+        it { is_expected.to be_disallowed(:read_usage_quotas, :view_edit_page) }
       end
     end
 
@@ -493,11 +493,11 @@ RSpec.describe ProjectPolicy, feature_category: :system_access do
       let(:current_user) { admin }
 
       context 'when admin mode is enabled', :enable_admin_mode do
-        it { expect_allowed(:read_usage_quotas) }
+        it { expect_allowed(:read_usage_quotas, :view_edit_page) }
       end
 
       context 'when admin mode is disabled' do
-        it { expect_disallowed(:read_usage_quotas) }
+        it { expect_disallowed(:read_usage_quotas, :view_edit_page) }
       end
     end
   end
diff --git a/spec/scripts/internal_events/cli_spec.rb b/spec/scripts/internal_events/cli_spec.rb
index d84a4498fe8..571517f005b 100644
--- a/spec/scripts/internal_events/cli_spec.rb
+++ b/spec/scripts/internal_events/cli_spec.rb
@@ -8,6 +8,11 @@ RSpec.describe Cli, feature_category: :service_ping do
   let(:prompt) { TTY::Prompt::Test.new }
   let(:files_to_cleanup) { [] }
 
+  let(:example_timeout) { 3 }
+  let(:example_error) { Class.new(Timeout::Error) }
+  let(:interaction_timeout) { 1 }
+  let(:interaction_error) { Class.new(Timeout::Error) }
+
   let(:event1_filepath) { 'config/events/internal_events_cli_used.yml' }
   let(:event1_content) { internal_event_fixture('events/event_with_identifiers.yml') }
   let(:event2_filepath) { 'ee/config/events/internal_events_cli_opened.yml' }
@@ -26,13 +31,29 @@ RSpec.describe Cli, feature_category: :service_ping do
     delete_files(files_to_cleanup)
   end
 
+  around do |example|
+    Timeout.timeout(example_timeout, example_error) { example.run }
+  rescue example_error => e
+    # Override error to include CLI output in error detail
+    raise e.class, timeout_error_message, e.backtrace
+  end
+
+  subject(:execute) do
+    Timeout.timeout(interaction_timeout, interaction_error) { described_class.new(prompt).run }
+  rescue interaction_error
+    # Rescue from timeout so we can make assertions on the CLI output
+  end
+
+  # Shared examples used for examples defined in new_events.yml & new_metrics.yml fixtures.
+  # Note: Expects CLI to be exited using the 'Exit' option or completing definition flow
   shared_examples 'creates the right defintion files' do |description, test_case = {}|
     # For expected keystroke mapping, see https://github.com/piotrmurach/tty-reader/blob/master/lib/tty/reader/keys.rb
     let(:keystrokes) { test_case.dig('inputs', 'keystrokes') || [] }
     let(:input_files) { test_case.dig('inputs', 'files') || [] }
     let(:output_files) { test_case.dig('outputs', 'files') || [] }
 
-    subject { run_with_verbose_timeout }
+    # Script execution should stop without a reduced timeout
+    let(:interaction_timeout) { example_timeout }
 
     it "in scenario: #{description}" do
       delete_old_ouputs # just in case
@@ -40,7 +61,7 @@ RSpec.describe Cli, feature_category: :service_ping do
       queue_cli_inputs(keystrokes)
       expect_file_creation
 
-      subject
+      execute
     end
 
     private
@@ -117,7 +138,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "\n" # Copy & continue
         ])
 
-        run_with_timeout
+        execute
 
         # Filter down to "dev" options
         expect(plain_last_lines(9)).to eq <<~TEXT.chomp
@@ -149,7 +170,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "\n" # Copy & continue
         ])
 
-        run_with_timeout
+        execute
 
         # Filter down to "dev:create" options
         expect(plain_last_lines(5)).to eq <<~TEXT.chomp
@@ -185,7 +206,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "2\n" # Modify attributes
         ])
 
-        run_with_timeout
+        execute
 
         # Filter down to "dev" options
         expect(plain_last_lines(50)).to include 'Select one: Which group owns the metric?'
@@ -262,7 +283,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "\n" # Select: config/events/internal_events_cli_used.yml
         ])
 
-        run_with_timeout
+        execute
       end
     end
 
@@ -279,7 +300,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "\n" # Select: config/events/internal_events_cli_opened.yml
         ])
 
-        run_with_timeout
+        execute
 
         expect(plain_last_lines(5)).to eq <<~TEXT.chomp
         ✘ Monthly/Weekly count of unique users [who triggered internal_events_cli_opened] (user unavailable)
@@ -318,7 +339,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "\n" # Select: config/events/00_event1.yml
         ])
 
-        run_with_timeout
+        execute
 
         expect(plain_last_lines(15)).to include 'Looks like the potential metrics for this event ' \
                                                 'either already exist or are unsupported.'
@@ -389,7 +410,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "8\n" # Exit
         ])
 
-        run_with_timeout
+        execute
 
         output = plain_last_lines(100)
 
@@ -556,7 +577,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "8\n" # Exit
         ])
 
-        run_with_timeout
+        execute
 
         output = plain_last_lines(1000)
 
@@ -616,7 +637,7 @@ RSpec.describe Cli, feature_category: :service_ping do
           "8\n" # Exit
         ])
 
-        run_with_timeout
+        execute
 
         output = plain_last_lines(300)
 
@@ -735,7 +756,7 @@ RSpec.describe Cli, feature_category: :service_ping do
         "n\n" # No --> Are you trying to track customer usage of a GitLab feature?
       ])
 
-      run_with_timeout
+      execute
 
       expect(plain_last_lines(50)).to include("Oh no! This probably isn't the tool you need!")
     end
@@ -747,7 +768,7 @@ RSpec.describe Cli, feature_category: :service_ping do
         "n\n" # No --> Can usage for the feature be measured by tracking a specific user action?
       ])
 
-      run_with_timeout
+      execute
 
       expect(plain_last_lines(50)).to include("Oh no! This probably isn't the tool you need!")
     end
@@ -761,7 +782,7 @@ RSpec.describe Cli, feature_category: :service_ping do
         "n\n" # No --> Ready to start?
       ])
 
-      run_with_timeout
+      execute
 
       expect(plain_last_lines(30)).to include("Okay! The next step is adding a new event! (~5 min)")
     end
@@ -775,7 +796,7 @@ RSpec.describe Cli, feature_category: :service_ping do
         "n\n" # No --> Ready to start?
       ])
 
-      run_with_timeout
+      execute
 
       expect(plain_last_lines(30)).to include("Amazing! The next step is adding a new metric! (~8 min)")
     end
@@ -788,18 +809,8 @@ RSpec.describe Cli, feature_category: :service_ping do
     prompt.input.rewind
   end
 
-  def run_with_timeout(duration = 1)
-    Timeout.timeout(duration) { described_class.new(prompt).run }
-  rescue Timeout::Error
-    # Timeout is needed to break out of the CLI, but we may want
-    # to make assertions afterwards
-  end
-
-  def run_with_verbose_timeout(duration = 1)
-    Timeout.timeout(duration) { described_class.new(prompt).run }
-  rescue Timeout::Error => e
-    # Re-raise error so CLI output is printed with the error
-    message = <<~TEXT
+  def timeout_error_message
+    <<~TEXT
     Awaiting input too long. Entire CLI output:
 
     #{
@@ -811,8 +822,6 @@ RSpec.describe Cli, feature_category: :service_ping do
 
 
     TEXT
-
-    raise e.class, message, e.backtrace
   end
 
   def plain_last_lines(size)
@@ -820,7 +829,8 @@ RSpec.describe Cli, feature_category: :service_ping do
       .lines
       .last(size)
       .join('')
-      .gsub(/\e[^\sm]{2,4}[mh]/, '')
+      .gsub(/\e[^\sm]{2,4}[mh]/, '') # Ignore text colors
+      .gsub(/(\e\[(2K|1G|1A))+\z/, '') # Remove trailing characters if timeout occurs
   end
 
   def collect_file_writes(collector)
@@ -844,7 +854,7 @@ RSpec.describe Cli, feature_category: :service_ping do
 
   def stub_product_groups(body)
     allow(Net::HTTP).to receive(:get)
-      .with(URI('https://gitlab.com/gitlab-com/www-gitlab-com/-/raw/master/data/stages.yml'))
+      .with(URI(InternalEventsCli::Helpers::GroupOwnership::STAGES_YML))
       .and_return(body)
   end
 
diff --git a/spec/support/helpers/admin_mode_helpers.rb b/spec/support/helpers/admin_mode_helpers.rb
index a6e31791127..8b71552f928 100644
--- a/spec/support/helpers/admin_mode_helpers.rb
+++ b/spec/support/helpers/admin_mode_helpers.rb
@@ -5,17 +5,30 @@
 module AdminModeHelper
   # Administrators are logged in by default in user mode and have to switch to admin
   # mode for accessing any administrative functionality. This helper lets a user
-  # be in admin mode without requiring a second authentication step (provided
-  # the user is an admin)
+  # access the admin area in two different ways:
+  #
+  # * Fast (use_ui: false) and suitable form the most use cases: fakes calls and grants
+  # access to the admin area without requiring a second authentication step (provided the
+  # user is an admin)
+  # * Slow (use_ui: true): visits the admin UI and enters the users password. A second
+  # authentication step may be needed.
   #
   # See also tag :enable_admin_mode in spec/spec_helper.rb for a spec-wide
   # alternative
-  def enable_admin_mode!(user)
-    fake_user_mode = instance_double(Gitlab::Auth::CurrentUserMode)
+  def enable_admin_mode!(user, use_ui: false)
+    if use_ui
+      visit new_admin_session_path
+      fill_in 'user_password', with: user.password
+      click_button 'Enter admin mode'
+
+      wait_for_requests
+    else
+      fake_user_mode = instance_double(Gitlab::Auth::CurrentUserMode)
 
-    allow(Gitlab::Auth::CurrentUserMode).to receive(:new).and_call_original
+      allow(Gitlab::Auth::CurrentUserMode).to receive(:new).and_call_original
 
-    allow(Gitlab::Auth::CurrentUserMode).to receive(:new).with(user).and_return(fake_user_mode)
-    allow(fake_user_mode).to receive(:admin_mode?).and_return(user&.admin?)
+      allow(Gitlab::Auth::CurrentUserMode).to receive(:new).with(user).and_return(fake_user_mode)
+      allow(fake_user_mode).to receive(:admin_mode?).and_return(user&.admin?)
+    end
   end
 end
diff --git a/spec/support/helpers/login_helpers.rb b/spec/support/helpers/login_helpers.rb
index 0cdddeaa84a..ff1c528d94a 100644
--- a/spec/support/helpers/login_helpers.rb
+++ b/spec/support/helpers/login_helpers.rb
@@ -49,18 +49,6 @@ module LoginHelpers
     @current_user = user
   end
 
-  def gitlab_enable_admin_mode_sign_in(user, use_mock_admin_mode: true)
-    if use_mock_admin_mode
-      enable_admin_mode!(user)
-    else
-      visit new_admin_session_path
-      fill_in 'user_password', with: user.password
-      click_button 'Enter admin mode'
-
-      wait_for_requests
-    end
-  end
-
   def gitlab_sign_in_via(provider, user, uid, saml_response = nil)
     mock_auth_hash_with_saml_xml(provider, uid, user.email, saml_response)
     visit new_user_session_path
diff --git a/spec/support/shared_contexts/features/integrations/instance_integrations_shared_context.rb b/spec/support/shared_contexts/features/integrations/instance_integrations_shared_context.rb
index c740917cec4..678199a35ea 100644
--- a/spec/support/shared_contexts/features/integrations/instance_integrations_shared_context.rb
+++ b/spec/support/shared_contexts/features/integrations/instance_integrations_shared_context.rb
@@ -7,7 +7,7 @@ RSpec.shared_context 'instance integration activation' do
 
   before do
     sign_in(user)
-    gitlab_enable_admin_mode_sign_in(user)
+    enable_admin_mode!(user)
   end
 
   def visit_instance_integrations
diff --git a/spec/support/shared_examples/features/inviting_groups_shared_examples.rb b/spec/support/shared_examples/features/inviting_groups_shared_examples.rb
index 4921676a065..d21e69b72e1 100644
--- a/spec/support/shared_examples/features/inviting_groups_shared_examples.rb
+++ b/spec/support/shared_examples/features/inviting_groups_shared_examples.rb
@@ -9,7 +9,7 @@ RSpec.shared_examples 'inviting groups search results' do
 
       before do
         sign_in(admin)
-        gitlab_enable_admin_mode_sign_in(admin)
+        enable_admin_mode!(admin)
       end
 
       it 'shows groups where the admin has no direct membership' do