Add latest changes from gitlab-org/gitlab@master

18 files changed, 386 insertions, 52 deletions

diff --git a/spec/db/schema_spec.rb b/spec/db/schema_spec.rb
index 0895e13c3c3..17a9b8dc69c 100644
--- a/spec/db/schema_spec.rb
+++ b/spec/db/schema_spec.rb
@@ -259,14 +259,6 @@ RSpec.describe 'Database schema' do
   end
 
   context 'primary keys' do
-    let(:exceptions) do
-      %i(
-        elasticsearch_indexed_namespaces
-        elasticsearch_indexed_projects
-        merge_request_context_commit_diff_files
-      )
-    end
-
     it 'expects every table to have a primary key defined' do
       connection = ActiveRecord::Base.connection
 
@@ -274,7 +266,7 @@ RSpec.describe 'Database schema' do
         !connection.primary_key(table).present?
       end.map(&:to_sym)
 
-      expect(problematic_tables - exceptions).to be_empty
+      expect(problematic_tables).to be_empty
     end
   end
 
diff --git a/spec/factories/clusters/cluster_enabled_grant.rb b/spec/factories/clusters/cluster_enabled_grant.rb
new file mode 100644
index 00000000000..f995bc876f3
--- /dev/null
+++ b/spec/factories/clusters/cluster_enabled_grant.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :cluster_enabled_grant, class: 'Clusters::ClusterEnabledGrant' do
+    namespace
+  end
+end
diff --git a/spec/features/issues/incident_issue_spec.rb b/spec/features/issues/incident_issue_spec.rb
index a2519a44604..9e9a85203ee 100644
--- a/spec/features/issues/incident_issue_spec.rb
+++ b/spec/features/issues/incident_issue_spec.rb
@@ -72,6 +72,12 @@ RSpec.describe 'Incident Detail', :js do
           expect(hidden_items).to all(be_visible)
         end
       end
+
+      it 'shows the edit title and description button' do
+        edit_button = find_all('[aria-label="Edit title and description"]')
+
+        expect(edit_button).to all(be_visible)
+      end
     end
 
     context 'when on alert details tab' do
@@ -87,6 +93,12 @@ RSpec.describe 'Incident Detail', :js do
           expect(hidden_items.count).to eq(0)
         end
       end
+
+      it 'does not show the edit title and description button' do
+        edit_button = find_all('[aria-label="Edit title and description"]')
+
+        expect(edit_button.count).to eq(0)
+      end
     end
   end
 end
diff --git a/spec/features/merge_request/user_posts_diff_notes_spec.rb b/spec/features/merge_request/user_posts_diff_notes_spec.rb
index 64715f9234a..54eba13da49 100644
--- a/spec/features/merge_request/user_posts_diff_notes_spec.rb
+++ b/spec/features/merge_request/user_posts_diff_notes_spec.rb
@@ -20,6 +20,7 @@ RSpec.describe 'Merge request > User posts diff notes', :js do
     project.add_developer(user)
     sign_in(user)
     stub_feature_flags(bootstrap_confirmation_modals: false)
+    stub_const('Gitlab::QueryLimiting::Transaction::THRESHOLD', 104)
   end
 
   context 'when hovering over a parallel view diff file' do
diff --git a/spec/features/merge_request/user_sees_deployment_widget_spec.rb b/spec/features/merge_request/user_sees_deployment_widget_spec.rb
index 01cc58777ba..9f1f0d97b09 100644
--- a/spec/features/merge_request/user_sees_deployment_widget_spec.rb
+++ b/spec/features/merge_request/user_sees_deployment_widget_spec.rb
@@ -109,7 +109,10 @@ RSpec.describe 'Merge request > User sees deployment widget', :js do
     end
 
     context 'with stop action' do
-      let(:manual) { create(:ci_build, :manual, pipeline: pipeline, name: 'close_app') }
+      let(:manual) do
+        create(:ci_build, :manual, pipeline: pipeline,
+               name: 'close_app', environment: environment.name)
+      end
 
       before do
         stub_feature_flags(bootstrap_confirmation_modals: false)
diff --git a/spec/features/projects/environments/environment_spec.rb b/spec/features/projects/environments/environment_spec.rb
index bfd54b9c6da..124fc1e2086 100644
--- a/spec/features/projects/environments/environment_spec.rb
+++ b/spec/features/projects/environments/environment_spec.rb
@@ -157,7 +157,7 @@ RSpec.describe 'Environment' do
 
       context 'with related deployable present' do
         let(:pipeline) { create(:ci_pipeline, project: project) }
-        let(:build) { create(:ci_build, pipeline: pipeline) }
+        let(:build) { create(:ci_build, pipeline: pipeline, environment: environment.name) }
 
         let(:deployment) do
           create(:deployment, :success, environment: environment, deployable: build)
@@ -263,7 +263,8 @@ RSpec.describe 'Environment' do
             context 'with stop action' do
               let(:action) do
                 create(:ci_build, :manual, pipeline: pipeline,
-                                           name: 'close_app')
+                       name: 'close_app',
+                       environment: environment.name)
               end
 
               let(:deployment) do
diff --git a/spec/lib/api/entities/wiki_page_spec.rb b/spec/lib/api/entities/wiki_page_spec.rb
index 238c8233a14..c75bba12484 100644
--- a/spec/lib/api/entities/wiki_page_spec.rb
+++ b/spec/lib/api/entities/wiki_page_spec.rb
@@ -43,6 +43,23 @@ RSpec.describe API::Entities::WikiPage do
           expect(subject[:content]).to eq("<div>&#x000A;<p><strong>Test</strong> <em>content</em></p>&#x000A;</div>")
         end
       end
+
+      context 'when content contains a reference' do
+        let(:user) { create(:user) }
+        let(:project) { create(:project) }
+        let(:issue) { create(:issue, project: project) }
+        let(:wiki_page) { create(:wiki_page, wiki: project.wiki, title: 'page_with_ref', content: issue.to_reference) }
+        let(:expected_content) { %r{<a href=".*#{issue.iid}".*>#{issue.to_reference}</a>} }
+
+        before do
+          params[:current_user] = user
+          project.add_developer(user)
+        end
+
+        it 'expands the reference in the content' do
+          expect(subject[:content]).to match(expected_content)
+        end
+      end
     end
 
     context 'when it is false' do
diff --git a/spec/lib/gitlab/sidekiq_middleware/duplicate_jobs/strategies/until_executed_spec.rb b/spec/lib/gitlab/sidekiq_middleware/duplicate_jobs/strategies/until_executed_spec.rb
index 963301bc001..ab9d14ad729 100644
--- a/spec/lib/gitlab/sidekiq_middleware/duplicate_jobs/strategies/until_executed_spec.rb
+++ b/spec/lib/gitlab/sidekiq_middleware/duplicate_jobs/strategies/until_executed_spec.rb
@@ -23,8 +23,15 @@ RSpec.describe Gitlab::SidekiqMiddleware::DuplicateJobs::Strategies::UntilExecut
         end
       end
 
+      it 'deletes the lock even if an error occurs' do
+        expect(fake_duplicate_job).not_to receive(:scheduled?)
+        expect(fake_duplicate_job).to receive(:delete!).once
+
+        perform_strategy_with_error
+      end
+
       it 'does not reschedule the job even if deduplication happened' do
-        expect(fake_duplicate_job).to receive(:delete!)
+        expect(fake_duplicate_job).to receive(:delete!).once
         expect(fake_duplicate_job).not_to receive(:reschedule)
 
         strategy.perform({}) do
@@ -33,16 +40,33 @@ RSpec.describe Gitlab::SidekiqMiddleware::DuplicateJobs::Strategies::UntilExecut
       end
 
       context 'when job is reschedulable' do
-        it 'reschedules the job if deduplication happened' do
+        before do
           allow(fake_duplicate_job).to receive(:should_reschedule?) { true }
+        end
 
-          expect(fake_duplicate_job).to receive(:delete!)
+        it 'reschedules the job if deduplication happened' do
+          expect(fake_duplicate_job).to receive(:delete!).once
           expect(fake_duplicate_job).to receive(:reschedule).once
 
           strategy.perform({}) do
             proc.call
           end
         end
+
+        it 'does not reschedule the job if an error occurs' do
+          expect(fake_duplicate_job).to receive(:delete!).once
+          expect(fake_duplicate_job).not_to receive(:reschedule)
+
+          perform_strategy_with_error
+        end
+      end
+
+      def perform_strategy_with_error
+        expect do
+          strategy.perform({}) do
+            raise 'expected error'
+          end
+        end.to raise_error(RuntimeError, 'expected error')
       end
     end
   end
diff --git a/spec/lib/gitlab/slash_commands/deploy_spec.rb b/spec/lib/gitlab/slash_commands/deploy_spec.rb
index 71fca1e1fc8..5167523ff58 100644
--- a/spec/lib/gitlab/slash_commands/deploy_spec.rb
+++ b/spec/lib/gitlab/slash_commands/deploy_spec.rb
@@ -32,7 +32,7 @@ RSpec.describe Gitlab::SlashCommands::Deploy do
     context 'with environment' do
       let!(:staging) { create(:environment, name: 'staging', project: project) }
       let!(:pipeline) { create(:ci_pipeline, project: project) }
-      let!(:build) { create(:ci_build, pipeline: pipeline) }
+      let!(:build) { create(:ci_build, pipeline: pipeline, environment: 'production') }
       let!(:deployment) { create(:deployment, :success, environment: staging, deployable: build) }
 
       context 'without actions' do
diff --git a/spec/lib/gitlab/usage/metrics/instrumentations/count_imported_projects_metric_spec.rb b/spec/lib/gitlab/usage/metrics/instrumentations/count_imported_projects_metric_spec.rb
index 4c86410d609..ac1d1f5d74d 100644
--- a/spec/lib/gitlab/usage/metrics/instrumentations/count_imported_projects_metric_spec.rb
+++ b/spec/lib/gitlab/usage/metrics/instrumentations/count_imported_projects_metric_spec.rb
@@ -53,7 +53,7 @@ RSpec.describe Gitlab::Usage::Metrics::Instrumentations::CountImportedProjectsMe
         options: { import_type: 'bitbucket' }
     end
 
-    context 'for 28d time frame' do
+    context 'for 28d time frame', quarantine: 'https://gitlab.com/gitlab-org/gitlab/-/issues/362591' do
       let(:expected_value) { 2 }
       let(:start) { 30.days.ago.to_s(:db) }
       let(:finish) { 2.days.ago.to_s(:db) }
diff --git a/spec/migrations/bulk_insert_cluster_enabled_grants_spec.rb b/spec/migrations/bulk_insert_cluster_enabled_grants_spec.rb
new file mode 100644
index 00000000000..a359a78ab45
--- /dev/null
+++ b/spec/migrations/bulk_insert_cluster_enabled_grants_spec.rb
@@ -0,0 +1,85 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require_migration!
+
+RSpec.describe BulkInsertClusterEnabledGrants, :migration do
+  let(:migration) { described_class.new }
+
+  let(:cluster_enabled_grants) { table(:cluster_enabled_grants) }
+  let(:namespaces) { table(:namespaces) }
+  let(:cluster_projects) { table(:cluster_projects) }
+  let(:cluster_groups) { table(:cluster_groups) }
+  let(:clusters) { table(:clusters) }
+  let(:projects) { table(:projects) }
+
+  context 'with namespaces, cluster_groups and cluster_projects' do
+    it 'creates unique cluster_enabled_grants for root_namespaces with clusters' do
+      # Does not create grants for namespaces without clusters
+      namespaces.create!(id: 1, path: 'eee', name: 'eee', traversal_ids: [1]) # not used
+
+      # Creates unique grant for a root namespace with its own cluster
+      root_ns_with_own_cluster = namespaces.create!(id: 2, path: 'ddd', name: 'ddd', traversal_ids: [2])
+      cluster_root_ns_with_own_cluster = clusters.create!(name: 'cluster_root_ns_with_own_cluster')
+      cluster_groups.create!(
+        cluster_id: cluster_root_ns_with_own_cluster.id,
+        group_id: root_ns_with_own_cluster.id)
+
+      # Creates unique grant for namespaces with multiple sub-group clusters
+      root_ns_with_sub_group_clusters = namespaces.create!(id: 3, path: 'aaa', name: 'aaa', traversal_ids: [3])
+
+      subgroup_1 = namespaces.create!(
+        id: 4,
+        path: 'bbb',
+        name: 'bbb',
+        parent_id: root_ns_with_sub_group_clusters.id,
+        traversal_ids: [root_ns_with_sub_group_clusters.id, 4])
+      cluster_subgroup_1 = clusters.create!(name: 'cluster_subgroup_1')
+      cluster_groups.create!(cluster_id: cluster_subgroup_1.id, group_id: subgroup_1.id)
+
+      subgroup_2 = namespaces.create!(
+        id: 5,
+        path: 'ccc',
+        name: 'ccc',
+        parent_id: subgroup_1.id,
+        traversal_ids: [root_ns_with_sub_group_clusters.id, subgroup_1.id, 5])
+      cluster_subgroup_2 = clusters.create!(name: 'cluster_subgroup_2')
+      cluster_groups.create!(cluster_id: cluster_subgroup_2.id, group_id: subgroup_2.id)
+
+      # Creates unique grant for a root namespace with multiple projects clusters
+      root_ns_with_project_group_clusters = namespaces.create!(id: 6, path: 'fff', name: 'fff', traversal_ids: [6])
+
+      project_namespace_1 = namespaces.create!(id: 7, path: 'ggg', name: 'ggg', traversal_ids: [7])
+      project_1 = projects.create!(
+        name: 'project_1',
+        namespace_id: root_ns_with_project_group_clusters.id,
+        project_namespace_id: project_namespace_1.id)
+      cluster_project_1 = clusters.create!(name: 'cluster_project_1')
+      cluster_projects.create!(cluster_id: cluster_project_1.id, project_id: project_1.id)
+
+      project_namespace_2 = namespaces.create!(id: 8, path: 'hhh', name: 'hhh', traversal_ids: [8])
+      project_2 = projects.create!(
+        name: 'project_2',
+        namespace_id: root_ns_with_project_group_clusters.id,
+        project_namespace_id: project_namespace_2.id)
+      cluster_project_2 = clusters.create!(name: 'cluster_project_2')
+      cluster_projects.create!(cluster_id: cluster_project_2.id, project_id: project_2.id)
+
+      migrate!
+
+      expected_cluster_enabled_grants = [
+        root_ns_with_sub_group_clusters.id,
+        root_ns_with_own_cluster.id,
+        root_ns_with_project_group_clusters.id
+      ]
+
+      expect(cluster_enabled_grants.pluck(:namespace_id)).to match_array(expected_cluster_enabled_grants)
+    end
+  end
+
+  context 'without namespaces, cluster_groups or cluster_projects' do
+    it 'does nothing' do
+      expect { migrate! }.not_to change { cluster_enabled_grants.count }
+    end
+  end
+end
diff --git a/spec/models/clusters/cluster_enabled_grant_spec.rb b/spec/models/clusters/cluster_enabled_grant_spec.rb
new file mode 100644
index 00000000000..1418d854b41
--- /dev/null
+++ b/spec/models/clusters/cluster_enabled_grant_spec.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Clusters::ClusterEnabledGrant do
+  it { is_expected.to belong_to :namespace }
+end
diff --git a/spec/models/deployment_spec.rb b/spec/models/deployment_spec.rb
index 8096604b965..ce6b59a5f95 100644
--- a/spec/models/deployment_spec.rb
+++ b/spec/models/deployment_spec.rb
@@ -17,7 +17,6 @@ RSpec.describe Deployment do
   it { is_expected.to delegate_method(:name).to(:environment).with_prefix }
   it { is_expected.to delegate_method(:commit).to(:project) }
   it { is_expected.to delegate_method(:commit_title).to(:commit).as(:try) }
-  it { is_expected.to delegate_method(:manual_actions).to(:deployable).as(:try) }
   it { is_expected.to delegate_method(:kubernetes_namespace).to(:deployment_cluster).as(:kubernetes_namespace) }
 
   it { is_expected.to validate_presence_of(:ref) }
@@ -25,20 +24,43 @@ RSpec.describe Deployment do
 
   it_behaves_like 'having unique enum values'
 
+  describe '#manual_actions' do
+    let(:deployment) { create(:deployment) }
+
+    it 'delegates to environment_manual_actions when deployment_environment_manual_actions ff is enabled' do
+      stub_feature_flags(deployment_environment_manual_actions: true)
+
+      expect(deployment.deployable).to receive(:environment_manual_actions).and_call_original
+
+      deployment.manual_actions
+    end
+
+    it 'delegates to other_manual_actions when deployment_environment_manual_actions ff is disabled' do
+      stub_feature_flags(deployment_environment_manual_actions: false)
+
+      expect(deployment.deployable).to receive(:other_manual_actions).and_call_original
+
+      deployment.manual_actions
+    end
+  end
+
   describe '#scheduled_actions' do
-    subject { deployment.scheduled_actions }
+    let(:deployment) { create(:deployment) }
 
-    let(:project) { create(:project, :repository) }
-    let(:pipeline) { create(:ci_pipeline, project: project) }
-    let(:build) { create(:ci_build, :success, pipeline: pipeline) }
-    let(:deployment) { create(:deployment, deployable: build) }
+    it 'delegates to environment_scheduled_actions when deployment_environment_manual_actions ff is enabled' do
+      stub_feature_flags(deployment_environment_manual_actions: true)
 
-    it 'delegates to other_scheduled_actions' do
-      expect_next_instance_of(Ci::Build) do |instance|
-        expect(instance).to receive(:other_scheduled_actions)
-      end
+      expect(deployment.deployable).to receive(:environment_scheduled_actions).and_call_original
 
-      subject
+      deployment.scheduled_actions
+    end
+
+    it 'delegates to other_scheduled_actions when deployment_environment_manual_actions ff is disabled' do
+      stub_feature_flags(deployment_environment_manual_actions: false)
+
+      expect(deployment.deployable).to receive(:other_scheduled_actions).and_call_original
+
+      deployment.scheduled_actions
     end
   end
 
diff --git a/spec/models/members/group_member_spec.rb b/spec/models/members/group_member_spec.rb
index 92f9099d04d..189951715c3 100644
--- a/spec/models/members/group_member_spec.rb
+++ b/spec/models/members/group_member_spec.rb
@@ -148,4 +148,135 @@ RSpec.describe GroupMember do
       end
     end
   end
+
+  context 'authorization refresh on addition/updation/deletion' do
+    let_it_be(:group) { create(:group) }
+    let_it_be(:project_a) { create(:project, group: group) }
+    let_it_be(:project_b) { create(:project, group: group) }
+    let_it_be(:project_c) { create(:project, group: group) }
+    let_it_be(:user) { create(:user) }
+    let_it_be(:affected_project_ids) { Project.id_in([project_a, project_b, project_c]).ids }
+
+    before do
+      stub_const(
+        "#{described_class.name}::THRESHOLD_FOR_REFRESHING_AUTHORIZATIONS_VIA_PROJECTS",
+        affected_project_ids.size - 1)
+    end
+
+    shared_examples_for 'calls UserProjectAccessChangedService to recalculate authorizations' do
+      it 'calls UserProjectAccessChangedService to recalculate authorizations' do
+        expect_next_instance_of(UserProjectAccessChangedService, user.id) do |service|
+          expect(service).to receive(:execute).with(blocking: blocking)
+        end
+
+        action
+      end
+    end
+
+    shared_examples_for 'tries to update permissions via refreshing authorizations for the affected projects' do
+      context 'when the number of affected projects exceeds the set threshold' do
+        it 'updates permissions via refreshing authorizations for the affected projects asynchronously' do
+          expect_next_instance_of(
+            AuthorizedProjectUpdate::ProjectAccessChangedService, affected_project_ids
+          ) do |service|
+            expect(service).to receive(:execute).with(blocking: false)
+          end
+
+          action
+        end
+
+        it 'calls AuthorizedProjectUpdate::UserRefreshFromReplicaWorker with a delay as a safety net' do
+          expect(AuthorizedProjectUpdate::UserRefreshFromReplicaWorker).to(
+            receive(:bulk_perform_in)
+              .with(1.hour,
+                    [[user.id]],
+                    batch_delay: 30.seconds, batch_size: 100)
+          )
+
+          action
+        end
+      end
+
+      context 'when the number of affected projects does not exceed the set threshold' do
+        before do
+          stub_const(
+            "#{described_class.name}::THRESHOLD_FOR_REFRESHING_AUTHORIZATIONS_VIA_PROJECTS",
+            affected_project_ids.size + 1)
+        end
+
+        it_behaves_like 'calls UserProjectAccessChangedService to recalculate authorizations'
+      end
+    end
+
+    context 'on create' do
+      let(:action) { group.add_user(user, Gitlab::Access::GUEST) }
+      let(:blocking) { true }
+
+      it 'changes access level', :sidekiq_inline do
+        expect { action }.to change { user.can?(:guest_access, project_a) }.from(false).to(true)
+          .and change { user.can?(:guest_access, project_b) }.from(false).to(true)
+          .and change { user.can?(:guest_access, project_c) }.from(false).to(true)
+      end
+
+      it_behaves_like 'tries to update permissions via refreshing authorizations for the affected projects'
+
+      context 'when the feature flag `refresh_authorizations_via_affected_projects_on_group_membership` is disabled' do
+        before do
+          stub_feature_flags(refresh_authorizations_via_affected_projects_on_group_membership: false)
+        end
+
+        it_behaves_like 'calls UserProjectAccessChangedService to recalculate authorizations'
+      end
+    end
+
+    context 'on update' do
+      before do
+        group.add_user(user, Gitlab::Access::GUEST)
+      end
+
+      let(:action) { group.members.find_by(user: user).update!(access_level: Gitlab::Access::DEVELOPER) }
+      let(:blocking) { true }
+
+      it 'changes access level', :sidekiq_inline do
+        expect { action }.to change { user.can?(:developer_access, project_a) }.from(false).to(true)
+          .and change { user.can?(:developer_access, project_b) }.from(false).to(true)
+          .and change { user.can?(:developer_access, project_c) }.from(false).to(true)
+      end
+
+      it_behaves_like 'tries to update permissions via refreshing authorizations for the affected projects'
+
+      context 'when the feature flag `refresh_authorizations_via_affected_projects_on_group_membership` is disabled' do
+        before do
+          stub_feature_flags(refresh_authorizations_via_affected_projects_on_group_membership: false)
+        end
+
+        it_behaves_like 'calls UserProjectAccessChangedService to recalculate authorizations'
+      end
+    end
+
+    context 'on destroy' do
+      before do
+        group.add_user(user, Gitlab::Access::GUEST)
+      end
+
+      let(:action) { group.members.find_by(user: user).destroy! }
+      let(:blocking) { false }
+
+      it 'changes access level', :sidekiq_inline do
+        expect { action }.to change { user.can?(:guest_access, project_a) }.from(true).to(false)
+          .and change { user.can?(:guest_access, project_b) }.from(true).to(false)
+          .and change { user.can?(:guest_access, project_c) }.from(true).to(false)
+      end
+
+      it_behaves_like 'tries to update permissions via refreshing authorizations for the affected projects'
+
+      context 'when the feature flag `refresh_authorizations_via_affected_projects_on_group_membership` is disabled' do
+        before do
+          stub_feature_flags(refresh_authorizations_via_affected_projects_on_group_membership: false)
+        end
+
+        it_behaves_like 'calls UserProjectAccessChangedService to recalculate authorizations'
+      end
+    end
+  end
 end
diff --git a/spec/models/namespace_spec.rb b/spec/models/namespace_spec.rb
index 1e8cdd77c4c..a077eb4da0b 100644
--- a/spec/models/namespace_spec.rb
+++ b/spec/models/namespace_spec.rb
@@ -31,6 +31,7 @@ RSpec.describe Namespace do
     it { is_expected.to have_many :pending_builds }
     it { is_expected.to have_one :namespace_route }
     it { is_expected.to have_many :namespace_members }
+    it { is_expected.to have_one :cluster_enabled_grant }
 
     it do
       is_expected.to have_one(:ci_cd_settings).class_name('NamespaceCiCdSetting').inverse_of(:namespace).autosave(true)
@@ -2329,27 +2330,23 @@ RSpec.describe Namespace do
   end
 
   describe '#certificate_based_clusters_enabled?' do
-    it 'does not call Feature.enabled? twice with request_store', :request_store do
-      expect(Feature).to receive(:enabled?).once
-
-      namespace.certificate_based_clusters_enabled?
-      namespace.certificate_based_clusters_enabled?
-    end
-
-    it 'call Feature.enabled? twice without request_store' do
-      expect(Feature).to receive(:enabled?).twice
-
-      namespace.certificate_based_clusters_enabled?
-      namespace.certificate_based_clusters_enabled?
-    end
-
     context 'with ff disabled' do
       before do
         stub_feature_flags(certificate_based_clusters: false)
       end
 
-      it 'is truthy' do
-        expect(namespace.certificate_based_clusters_enabled?).to be_falsy
+      context 'with a cluster_enabled_grant' do
+        it 'is truthy' do
+          create(:cluster_enabled_grant, namespace: namespace)
+
+          expect(namespace.certificate_based_clusters_enabled?).to be_truthy
+        end
+      end
+
+      context 'without a cluster_enabled_grant' do
+        it 'is falsy' do
+          expect(namespace.certificate_based_clusters_enabled?).to be_falsy
+        end
       end
     end
 
@@ -2358,8 +2355,18 @@ RSpec.describe Namespace do
         stub_feature_flags(certificate_based_clusters: true)
       end
 
-      it 'is truthy' do
-        expect(namespace.certificate_based_clusters_enabled?).to be_truthy
+      context 'with a cluster_enabled_grant' do
+        it 'is truthy' do
+          create(:cluster_enabled_grant, namespace: namespace)
+
+          expect(namespace.certificate_based_clusters_enabled?).to be_truthy
+        end
+      end
+
+      context 'without a cluster_enabled_grant' do
+        it 'is truthy' do
+          expect(namespace.certificate_based_clusters_enabled?).to be_truthy
+        end
       end
     end
   end
diff --git a/spec/requests/api/wikis_spec.rb b/spec/requests/api/wikis_spec.rb
index 06ae61ca5eb..f4096eef8d0 100644
--- a/spec/requests/api/wikis_spec.rb
+++ b/spec/requests/api/wikis_spec.rb
@@ -256,6 +256,24 @@ RSpec.describe API::Wikis do
           include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
+
+      context 'when content contains a reference' do
+        let(:issue) { create(:issue, project: project) }
+        let(:params) { { render_html: true } }
+        let(:page) { create(:wiki_page, wiki: project.wiki, title: 'page_with_ref', content: issue.to_reference) }
+        let(:expected_content) { %r{<a href=".*#{issue.iid}".*>#{issue.to_reference}</a>} }
+
+        before do
+          project.add_developer(user)
+
+          request
+        end
+
+        it 'expands the reference in the content' do
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response['content']).to match(expected_content)
+        end
+      end
     end
   end
 
diff --git a/spec/serializers/deployment_entity_spec.rb b/spec/serializers/deployment_entity_spec.rb
index 500d5718bf1..4452ccbcf07 100644
--- a/spec/serializers/deployment_entity_spec.rb
+++ b/spec/serializers/deployment_entity_spec.rb
@@ -60,12 +60,16 @@ RSpec.describe DeploymentEntity do
   end
 
   context 'when the pipeline has another manual action' do
-    let(:other_build) { create(:ci_build, :manual, name: 'another deploy', pipeline: pipeline) }
-    let!(:other_deployment) { create(:deployment, deployable: other_build) }
+    let!(:other_build) do
+      create(:ci_build, :manual, name: 'another deploy',
+             pipeline: pipeline, environment: build.environment)
+    end
+
+    let!(:other_deployment) { create(:deployment, deployable: build) }
 
     it 'returns another manual action' do
-      expect(subject[:manual_actions].count).to eq(1)
-      expect(subject[:manual_actions].first[:name]).to eq('another deploy')
+      expect(subject[:manual_actions].count).to eq(2)
+      expect(subject[:manual_actions].second[:name]).to eq('another deploy')
     end
 
     context 'when user is a reporter' do
diff --git a/spec/serializers/environment_serializer_spec.rb b/spec/serializers/environment_serializer_spec.rb
index fe6278084f9..47d2c8b3794 100644
--- a/spec/serializers/environment_serializer_spec.rb
+++ b/spec/serializers/environment_serializer_spec.rb
@@ -227,8 +227,11 @@ RSpec.describe EnvironmentSerializer do
 
   def create_environment_with_associations(project)
     create(:environment, project: project).tap do |environment|
-      create(:deployment, :success, environment: environment, project: project)
-      create(:deployment, :running, environment: environment, project: project)
+      pipeline = create(:ci_pipeline, project: project)
+      manual_build = create(:ci_build, :manual, project: project, pipeline: pipeline, environment: environment.name)
+      scheduled_build = create(:ci_build, :scheduled, project: project, pipeline: pipeline, environment: environment.name)
+      create(:deployment, :success, environment: environment, project: project, deployable: manual_build)
+      create(:deployment, :running, environment: environment, project: project, deployable: scheduled_build)
     end
   end
 end