Add latest changes from gitlab-org/gitlab@master

13 files changed, 172 insertions, 162 deletions

diff --git a/spec/controllers/jira_connect/app_descriptor_controller_spec.rb b/spec/controllers/jira_connect/app_descriptor_controller_spec.rb
index 3c9d495c33c..48b315646de 100644
--- a/spec/controllers/jira_connect/app_descriptor_controller_spec.rb
+++ b/spec/controllers/jira_connect/app_descriptor_controller_spec.rb
@@ -37,8 +37,7 @@ RSpec.describe JiraConnect::AppDescriptorController, feature_category: :integrat
           url: 'https://gitlab.com'
         },
         links: {
-          documentation: 'http://test.host/help/integration/jira_development_panel#gitlabcom-1',
-          feedback: 'https://gitlab.com/gitlab-org/gitlab/-/issues/413652'
+          documentation: 'http://test.host/help/integration/jira_development_panel#gitlabcom-1'
         },
         authentication: {
           type: 'jwt'
@@ -91,19 +90,5 @@ RSpec.describe JiraConnect::AppDescriptorController, feature_category: :integrat
         )
       )
     end
-
-    context 'when feature flag jira_for_cloud_app_feedback_link is disabled' do
-      before do
-        stub_feature_flags(jira_for_cloud_app_feedback_link: false)
-      end
-
-      it 'does not include the feedback link' do
-        get :show
-
-        expect(descriptor[:links]).not_to include(
-          feedback: 'https://gitlab.com/gitlab-org/gitlab/-/issues/413652'
-        )
-      end
-    end
   end
 end
diff --git a/spec/controllers/projects/pipeline_schedules_controller_spec.rb b/spec/controllers/projects/pipeline_schedules_controller_spec.rb
index 486062fe52b..6d810fdcd51 100644
--- a/spec/controllers/projects/pipeline_schedules_controller_spec.rb
+++ b/spec/controllers/projects/pipeline_schedules_controller_spec.rb
@@ -106,8 +106,7 @@ RSpec.describe Projects::PipelineSchedulesController, feature_category: :continu
     end
   end
 
-  # Move this from `shared_context` to `describe` when `ci_refactoring_pipeline_schedule_create_service` is removed.
-  shared_context 'POST #create' do # rubocop:disable RSpec/ContextWording
+  describe 'POST #create' do
     describe 'functionality' do
       before do
         project.add_developer(user)
@@ -185,16 +184,6 @@ RSpec.describe Projects::PipelineSchedulesController, feature_category: :continu
     end
   end
 
-  it_behaves_like 'POST #create'
-
-  context 'when the FF ci_refactoring_pipeline_schedule_create_service is disabled' do
-    before do
-      stub_feature_flags(ci_refactoring_pipeline_schedule_create_service: false)
-    end
-
-    it_behaves_like 'POST #create'
-  end
-
   describe 'PUT #update' do
     describe 'functionality' do
       let!(:pipeline_schedule) { create(:ci_pipeline_schedule, project: project, owner: user) }
diff --git a/spec/frontend/search/sidebar/components/confidentiality_filter_spec.js b/spec/frontend/search/sidebar/components/confidentiality_filter_spec.js
index 1f65884e959..ef7f3359bad 100644
--- a/spec/frontend/search/sidebar/components/confidentiality_filter_spec.js
+++ b/spec/frontend/search/sidebar/components/confidentiality_filter_spec.js
@@ -1,7 +1,7 @@
 import { shallowMount } from '@vue/test-utils';
 import Vue from 'vue';
 import Vuex from 'vuex';
-import ConfidentialityFilter from '~/search/sidebar/components/confidentiality_filter.vue';
+import ConfidentialityFilter from '~/search/sidebar/components/confidentiality_filter/index.vue';
 import RadioFilter from '~/search/sidebar/components/radio_filter.vue';
 
 Vue.use(Vuex);
@@ -20,7 +20,6 @@ describe('ConfidentialityFilter', () => {
   };
 
   const findRadioFilter = () => wrapper.findComponent(RadioFilter);
-  const findHR = () => wrapper.findComponent('hr');
 
   describe('old sidebar', () => {
     beforeEach(() => {
@@ -30,10 +29,6 @@ describe('ConfidentialityFilter', () => {
     it('renders the component', () => {
       expect(findRadioFilter().exists()).toBe(true);
     });
-
-    it('renders the divider', () => {
-      expect(findHR().exists()).toBe(true);
-    });
   });
 
   describe('new sidebar', () => {
@@ -44,9 +39,5 @@ describe('ConfidentialityFilter', () => {
     it('renders the component', () => {
       expect(findRadioFilter().exists()).toBe(true);
     });
-
-    it("doesn't render the divider", () => {
-      expect(findHR().exists()).toBe(false);
-    });
   });
 });
diff --git a/spec/frontend/search/sidebar/components/filters_spec.js b/spec/frontend/search/sidebar/components/filters_spec.js
index a92fafd3508..546a84ff040 100644
--- a/spec/frontend/search/sidebar/components/filters_spec.js
+++ b/spec/frontend/search/sidebar/components/filters_spec.js
@@ -4,8 +4,8 @@ import Vue from 'vue';
 import Vuex from 'vuex';
 import { MOCK_QUERY } from 'jest/search/mock_data';
 import IssuesFilters from '~/search/sidebar/components/issues_filters.vue';
-import ConfidentialityFilter from '~/search/sidebar/components/confidentiality_filter.vue';
-import StatusFilter from '~/search/sidebar/components/status_filter.vue';
+import ConfidentialityFilter from '~/search/sidebar/components/confidentiality_filter/index.vue';
+import StatusFilter from '~/search/sidebar/components/status_filter/index.vue';
 
 Vue.use(Vuex);
 
diff --git a/spec/frontend/search/sidebar/components/radio_filter_spec.js b/spec/frontend/search/sidebar/components/radio_filter_spec.js
index 47235b828c3..b5f2b9bb6dd 100644
--- a/spec/frontend/search/sidebar/components/radio_filter_spec.js
+++ b/spec/frontend/search/sidebar/components/radio_filter_spec.js
@@ -4,8 +4,8 @@ import Vue from 'vue';
 import Vuex from 'vuex';
 import { MOCK_QUERY } from 'jest/search/mock_data';
 import RadioFilter from '~/search/sidebar/components/radio_filter.vue';
-import { confidentialFilterData } from '~/search/sidebar/constants/confidential_filter_data';
-import { stateFilterData } from '~/search/sidebar/constants/state_filter_data';
+import { confidentialFilterData } from '~/search/sidebar/components/confidentiality_filter/data';
+import { statusFilterData } from '~/search/sidebar/components/status_filter/data';
 
 Vue.use(Vuex);
 
@@ -21,7 +21,7 @@ describe('RadioFilter', () => {
   };
 
   const defaultProps = {
-    filterData: stateFilterData,
+    filterData: statusFilterData,
   };
 
   const createComponent = (initialState, props = {}) => {
@@ -60,20 +60,20 @@ describe('RadioFilter', () => {
       describe('Status Filter', () => {
         it('renders a radio button for each filterOption', () => {
           expect(findGlRadioButtonsText()).toStrictEqual(
-            stateFilterData.filterByScope[stateFilterData.scopes.ISSUES].map((f) => {
-              return f.value === stateFilterData.filters.ANY.value
-                ? `Any ${stateFilterData.header.toLowerCase()}`
+            statusFilterData.filterByScope[statusFilterData.scopes.ISSUES].map((f) => {
+              return f.value === statusFilterData.filters.ANY.value
+                ? `Any ${statusFilterData.header.toLowerCase()}`
                 : f.label;
             }),
           );
         });
 
         it('clicking a radio button item calls setQuery', () => {
-          const filter = stateFilterData.filters[Object.keys(stateFilterData.filters)[0]].value;
+          const filter = statusFilterData.filters[Object.keys(statusFilterData.filters)[0]].value;
           findGlRadioButtonGroup().vm.$emit('input', filter);
 
           expect(actionSpies.setQuery).toHaveBeenCalledWith(expect.any(Object), {
-            key: stateFilterData.filterParam,
+            key: statusFilterData.filterParam,
             value: filter,
           });
         });
diff --git a/spec/frontend/search/sidebar/components/status_filter_spec.js b/spec/frontend/search/sidebar/components/status_filter_spec.js
index a332a43e624..2cf5ae2a70a 100644
--- a/spec/frontend/search/sidebar/components/status_filter_spec.js
+++ b/spec/frontend/search/sidebar/components/status_filter_spec.js
@@ -2,7 +2,7 @@ import { shallowMount } from '@vue/test-utils';
 import Vue from 'vue';
 import Vuex from 'vuex';
 import RadioFilter from '~/search/sidebar/components/radio_filter.vue';
-import StatusFilter from '~/search/sidebar/components/status_filter.vue';
+import StatusFilter from '~/search/sidebar/components/status_filter/index.vue';
 
 Vue.use(Vuex);
 
@@ -20,7 +20,6 @@ describe('StatusFilter', () => {
   };
 
   const findRadioFilter = () => wrapper.findComponent(RadioFilter);
-  const findHR = () => wrapper.findComponent('hr');
 
   describe('old sidebar', () => {
     beforeEach(() => {
@@ -30,10 +29,6 @@ describe('StatusFilter', () => {
     it('renders the component', () => {
       expect(findRadioFilter().exists()).toBe(true);
     });
-
-    it('renders the divider', () => {
-      expect(findHR().exists()).toBe(true);
-    });
   });
 
   describe('new sidebar', () => {
@@ -44,9 +39,5 @@ describe('StatusFilter', () => {
     it('renders the component', () => {
       expect(findRadioFilter().exists()).toBe(true);
     });
-
-    it("doesn't render the divider", () => {
-      expect(findHR().exists()).toBe(false);
-    });
   });
 });
diff --git a/spec/helpers/events_helper_spec.rb b/spec/helpers/events_helper_spec.rb
index 39901047b0f..6ffca876361 100644
--- a/spec/helpers/events_helper_spec.rb
+++ b/spec/helpers/events_helper_spec.rb
@@ -2,10 +2,20 @@
 
 require 'spec_helper'
 
-RSpec.describe EventsHelper do
+# Persisting records is required because Event#target's AR scope.
+# We are trying hard to minimize record creations by:
+# * Using `let_it_be`
+# * Factory defaults via `create_default` + `factory_default: :keep`
+#
+# rubocop:disable RSpec/FactoryBot/AvoidCreate
+RSpec.describe EventsHelper, factory_default: :keep, feature_category: :user_profile do
   include Gitlab::Routing
   include Banzai::Filter::OutputSafety
 
+  let_it_be(:project) { create_default(:project).freeze }
+  let_it_be(:project_with_repo) { create(:project, :public, :repository).freeze }
+  let_it_be(:user) { create_default(:user).freeze }
+
   describe '#link_to_author' do
     let(:user) { create(:user) }
     let(:event) { create(:event, author: user) }
@@ -40,9 +50,8 @@ RSpec.describe EventsHelper do
     end
 
     context 'when target is not a work item' do
-      let(:project) { create(:project) }
-      let(:issue) { create(:issue, project: project) }
-      let(:event) { create(:event, target: issue, project: project) }
+      let(:issue) { create(:issue) }
+      let(:event) { create(:event, target: issue) }
 
       it { is_expected.to eq([project, issue]) }
     end
@@ -51,7 +60,7 @@ RSpec.describe EventsHelper do
   describe '#localized_action_name' do
     it 'handles all valid design events' do
       created, updated, destroyed = %i[created updated destroyed].map do |trait|
-        event = build(:design_event, trait)
+        event = build_stubbed(:design_event, trait)
         helper.localized_action_name(event)
       end
 
@@ -60,44 +69,46 @@ RSpec.describe EventsHelper do
       expect(destroyed).to eq(_('removed'))
     end
 
-    context 'handles correct base actions' do
+    describe 'handles correct base actions' do
       using RSpec::Parameterized::TableSyntax
 
-      where(:trait, :localized_action_name) do
-        :created   | s_('Event|created')
-        :updated   | s_('Event|opened')
-        :closed    | s_('Event|closed')
-        :reopened  | s_('Event|opened')
-        :commented | s_('Event|commented on')
-        :merged    | s_('Event|accepted')
-        :joined    | s_('Event|joined')
-        :left      | s_('Event|left')
-        :destroyed | s_('Event|destroyed')
-        :expired | s_('Event|removed due to membership expiration from')
-        :approved | s_('Event|approved')
+      where(:trait, :localized_action_key) do
+        :created   | 'Event|created'
+        :updated   | 'Event|opened'
+        :closed    | 'Event|closed'
+        :reopened  | 'Event|opened'
+        :commented | 'Event|commented on'
+        :merged    | 'Event|accepted'
+        :joined    | 'Event|joined'
+        :left      | 'Event|left'
+        :destroyed | 'Event|destroyed'
+        :expired   | 'Event|removed due to membership expiration from'
+        :approved  | 'Event|approved'
       end
 
       with_them do
         it 'with correct name and method' do
-          event = build(:event, trait)
+          Gitlab::I18n.with_locale(:de) do
+            event = build_stubbed(:event, trait)
 
-          expect(helper.localized_action_name(event)).to eq(localized_action_name)
+            expect(helper.localized_action_name(event)).to eq(s_(localized_action_key))
+          end
         end
       end
     end
   end
 
   describe '#event_commit_title' do
-    let(:message) { 'foo & bar ' + 'A' * 70 + '\n' + 'B' * 80 }
+    let(:message) { "foo & bar #{'A' * 70}\\n#{'B' * 80}" }
 
     subject { helper.event_commit_title(message) }
 
     it 'returns the first line, truncated to 70 chars' do
-      is_expected.to eq(message[0..66] + "...")
+      is_expected.to eq("#{message[0..66]}...")
     end
 
     it 'is not html-safe' do
-      is_expected.not_to be_a(ActiveSupport::SafeBuffer)
+      is_expected.not_to be_html_safe
     end
 
     it 'handles empty strings' do
@@ -115,9 +126,8 @@ RSpec.describe EventsHelper do
 
   describe '#event_feed_url' do
     let(:event) { create(:event).present }
-    let(:project) { create(:project, :public, :repository) }
 
-    context 'issue' do
+    context 'for issue' do
       before do
         event.target = create(:issue)
       end
@@ -131,9 +141,9 @@ RSpec.describe EventsHelper do
       end
     end
 
-    context 'merge request' do
+    context 'for merge request' do
       before do
-        event.target = create(:merge_request)
+        event.target = create(:merge_request, source_project: project_with_repo)
       end
 
       it 'returns the project merge request url' do
@@ -146,7 +156,7 @@ RSpec.describe EventsHelper do
     end
 
     it 'returns project commit url' do
-      event.target = create(:note_on_commit, project: project)
+      event.target = create(:note_on_commit, project: project_with_repo)
 
       expect(helper.event_feed_url(event)).to eq(project_commit_url(event.project, event.note_target))
     end
@@ -158,7 +168,6 @@ RSpec.describe EventsHelper do
     end
 
     it 'returns project url' do
-      event.project = project
       event.action = 1
 
       expect(helper.event_feed_url(event)).to eq(project_url(event.project))
@@ -173,7 +182,8 @@ RSpec.describe EventsHelper do
 
     it 'returns nil for push event with multiple refs' do
       event = create(:push_event)
-      create(:push_event_payload, event: event, ref_count: 2, ref: nil, ref_type: :tag, commit_count: 0, action: :pushed)
+      create(:push_event_payload, event: event, ref_count: 2, ref: nil, ref_type: :tag, commit_count: 0,
+        action: :pushed)
 
       expect(helper.event_feed_url(event)).to eq(nil)
     end
@@ -229,8 +239,8 @@ RSpec.describe EventsHelper do
     end
   end
 
-  describe 'event_wiki_page_target_url' do
-    let(:project) { create(:project) }
+  describe '#event_wiki_page_target_url' do
+    let_it_be_with_reload(:project) { create(:project) }
     let(:wiki_page) { create(:wiki_page, wiki: create(:project_wiki, project: project)) }
     let(:event) { create(:wiki_page_event, project: project, wiki_page: wiki_page) }
 
@@ -240,7 +250,7 @@ RSpec.describe EventsHelper do
       expect(helper.event_wiki_page_target_url(event)).to eq(url)
     end
 
-    context 'there is no canonical slug' do
+    context 'without canonical slug' do
       let(:event) { create(:wiki_page_event, project: project) }
 
       before do
@@ -274,14 +284,13 @@ RSpec.describe EventsHelper do
   end
 
   describe '#event_note_target_url' do
-    let(:project) { create(:project, :public, :repository) }
-    let(:event) { create(:event, project: project) }
+    let_it_be(:event) { create(:event) }
     let(:project_base_url) { namespace_project_url(namespace_id: project.namespace, id: project) }
 
     subject { helper.event_note_target_url(event) }
 
     it 'returns a commit note url' do
-      event.target = create(:note_on_commit, note: '+1 from me')
+      event.target = create(:note_on_commit, project: project_with_repo, note: '+1 from me')
 
       expect(subject).to eq("#{project_base_url}/-/commit/#{event.target.commit_id}#note_#{event.target.id}")
     end
@@ -289,7 +298,8 @@ RSpec.describe EventsHelper do
     it 'returns a project snippet note url' do
       event.target = create(:note_on_project_snippet, note: 'keep going')
 
-      expect(subject).to eq("#{project_snippet_url(event.note_target.project, event.note_target)}#note_#{event.target.id}")
+      expect(subject).to eq("#{project_snippet_url(event.note_target.project,
+        event.note_target)}#note_#{event.target.id}")
     end
 
     it 'returns a personal snippet note url' do
@@ -311,7 +321,7 @@ RSpec.describe EventsHelper do
     end
 
     context 'for design note events' do
-      let(:event) { create(:event, :for_design, project: project) }
+      let(:event) { create(:event, :for_design) }
 
       it 'returns an appropriate URL' do
         iid = event.note_target.issue.iid
@@ -326,54 +336,62 @@ RSpec.describe EventsHelper do
   describe '#event_filter_visible' do
     include DesignManagementTestHelpers
 
-    let_it_be(:project) { create(:project) }
-    let_it_be(:current_user) { create(:user) }
-
     subject { helper.event_filter_visible(key) }
 
     before do
       enable_design_management
-      project.add_reporter(current_user)
-      allow(helper).to receive(:current_user).and_return(current_user)
+      allow(helper).to receive(:current_user).and_return(user)
     end
 
-    def disable_read_design_activity(object)
+    def can_read_design_activity(object, ability)
       allow(Ability).to receive(:allowed?)
-        .with(current_user, :read_design_activity, eq(object))
-        .and_return(false)
+        .with(user, :read_design_activity, eq(object))
+        .and_return(ability)
     end
 
     context 'for :designs' do
       let(:key) { :designs }
 
-      context 'there is no relevant instance variable' do
+      context 'without relevant instance variable' do
         it { is_expected.to be(true) }
       end
 
-      context 'a project has been assigned' do
+      context 'with assigned project' do
         before do
           assign(:project, project)
         end
 
-        it { is_expected.to be(true) }
+        context 'with permission' do
+          before do
+            can_read_design_activity(project, true)
+          end
+
+          it { is_expected.to be(true) }
+        end
 
-        context 'the current user cannot read design activity' do
+        context 'without permission' do
           before do
-            disable_read_design_activity(project)
+            can_read_design_activity(project, false)
           end
 
           it { is_expected.to be(false) }
         end
       end
 
-      context 'projects have been assigned' do
+      context 'with projects assigned' do
         before do
-          assign(:projects, Project.where(id: project.id))
+          assign(:projects, Project.id_in(project))
         end
 
-        it { is_expected.to be(true) }
+        context 'with permission' do
+          before do
+            can_read_design_activity(project, true)
+          end
+
+          it { is_expected.to be(true) }
+        end
 
-        context 'the collection is empty' do
+        context 'with empty collection' do
           before do
             assign(:projects, Project.none)
           end
@@ -381,36 +399,40 @@ RSpec.describe EventsHelper do
           it { is_expected.to be(false) }
         end
 
-        context 'the current user cannot read design activity' do
+        context 'without permission' do
           before do
-            disable_read_design_activity(project)
+            can_read_design_activity(project, false)
           end
 
           it { is_expected.to be(false) }
         end
       end
 
-      context 'a group has been assigned' do
+      context 'with group assigned' do
         let_it_be(:group) { create(:group) }
 
         before do
           assign(:group, group)
         end
 
-        context 'there are no projects in the group' do
+        context 'without projects in the group' do
           it { is_expected.to be(false) }
         end
 
-        context 'the group has at least one project' do
-          before do
-            create(:project_group_link, project: project, group: group)
-          end
+        context 'with at least one project in the project' do
+          let_it_be(:group_link) { create(:project_group_link, group: group) }
 
-          it { is_expected.to be(true) }
+          context 'with permission' do
+            before do
+              can_read_design_activity(group, true)
+            end
+
+            it { is_expected.to be(true) }
+          end
 
-          context 'the current user cannot read design activity' do
+          context 'without permission' do
             before do
-              disable_read_design_activity(group)
+              can_read_design_activity(group, false)
             end
 
             it { is_expected.to be(false) }
@@ -420,3 +442,4 @@ RSpec.describe EventsHelper do
     end
   end
 end
+# rubocop:enable RSpec/FactoryBot/AvoidCreate
diff --git a/spec/lib/gitlab/jwt_authenticatable_spec.rb b/spec/lib/gitlab/jwt_authenticatable_spec.rb
index 98c87ef627a..eea93c4e3fe 100644
--- a/spec/lib/gitlab/jwt_authenticatable_spec.rb
+++ b/spec/lib/gitlab/jwt_authenticatable_spec.rb
@@ -148,9 +148,9 @@ RSpec.describe Gitlab::JwtAuthenticatable, feature_category: :system_access do
 
       it 'returns decoded payload if issuer is correct' do
         encoded_message = JWT.encode(payload, test_class.secret, 'HS256')
-        payload = test_class.decode_jwt(encoded_message, issuer: 'test_issuer')
+        decoded_payload = test_class.decode_jwt(encoded_message, issuer: 'test_issuer')
 
-        expect(payload[0]).to match a_hash_including('iss' => 'test_issuer')
+        expect(decoded_payload[0]).to match a_hash_including('iss' => 'test_issuer')
       end
 
       it 'raises an error when the issuer is incorrect' do
@@ -159,6 +159,38 @@ RSpec.describe Gitlab::JwtAuthenticatable, feature_category: :system_access do
 
         expect { test_class.decode_jwt(encoded_message, issuer: 'test_issuer') }.to raise_error(JWT::DecodeError)
       end
+
+      it 'raises an error when the issuer is nil' do
+        payload['iss'] = nil
+        encoded_message = JWT.encode(payload, test_class.secret, 'HS256')
+
+        expect { test_class.decode_jwt(encoded_message, issuer: 'test_issuer') }.to raise_error(JWT::DecodeError)
+      end
+    end
+
+    context 'audience option' do
+      let(:payload) { { 'aud' => 'test_audience' } }
+
+      it 'returns decoded payload if audience is correct' do
+        encoded_message = JWT.encode(payload, test_class.secret, 'HS256')
+        decoded_payload = test_class.decode_jwt(encoded_message, audience: 'test_audience')
+
+        expect(decoded_payload[0]).to match a_hash_including('aud' => 'test_audience')
+      end
+
+      it 'raises an error when the audience is incorrect' do
+        payload['aud'] = 'somebody else'
+        encoded_message = JWT.encode(payload, test_class.secret, 'HS256')
+
+        expect { test_class.decode_jwt(encoded_message, audience: 'test_audience') }.to raise_error(JWT::DecodeError)
+      end
+
+      it 'raises an error when the audience is nil' do
+        payload['aud'] = nil
+        encoded_message = JWT.encode(payload, test_class.secret, 'HS256')
+
+        expect { test_class.decode_jwt(encoded_message, audience: 'test_audience') }.to raise_error(JWT::DecodeError)
+      end
     end
 
     context 'iat_after option' do
diff --git a/spec/lib/gitlab/kas_spec.rb b/spec/lib/gitlab/kas_spec.rb
index 34eb48a3221..1b42b031c42 100644
--- a/spec/lib/gitlab/kas_spec.rb
+++ b/spec/lib/gitlab/kas_spec.rb
@@ -10,20 +10,41 @@ RSpec.describe Gitlab::Kas do
   end
 
   describe '.verify_api_request' do
-    let(:payload) { { 'iss' => described_class::JWT_ISSUER } }
+    let(:payload) { { 'iss' => described_class::JWT_ISSUER, 'aud' => described_class::JWT_AUDIENCE } }
 
-    it 'returns nil if fails to validate the JWT' do
-      encoded_token = JWT.encode(payload, 'wrongsecret', 'HS256')
-      headers = { described_class::INTERNAL_API_REQUEST_HEADER => encoded_token }
+    context 'returns nil if fails to validate the JWT' do
+      it 'when secret is wrong' do
+        encoded_token = JWT.encode(payload, 'wrong secret', 'HS256')
+        headers = { described_class::INTERNAL_API_REQUEST_HEADER => encoded_token }
+
+        expect(described_class.verify_api_request(headers)).to be_nil
+      end
+
+      it 'when issuer is wrong' do
+        payload['iss'] = 'wrong issuer'
+        encoded_token = JWT.encode(payload, described_class.secret, 'HS256')
+        headers = { described_class::INTERNAL_API_REQUEST_HEADER => encoded_token }
 
-      expect(described_class.verify_api_request(headers)).to be_nil
+        expect(described_class.verify_api_request(headers)).to be_nil
+      end
+
+      it 'when audience is wrong' do
+        payload['aud'] = 'wrong audience'
+        encoded_token = JWT.encode(payload, described_class.secret, 'HS256')
+        headers = { described_class::INTERNAL_API_REQUEST_HEADER => encoded_token }
+
+        expect(described_class.verify_api_request(headers)).to be_nil
+      end
     end
 
     it 'returns the decoded JWT' do
       encoded_token = JWT.encode(payload, described_class.secret, 'HS256')
       headers = { described_class::INTERNAL_API_REQUEST_HEADER => encoded_token }
 
-      expect(described_class.verify_api_request(headers)).to eq([{ "iss" => described_class::JWT_ISSUER }, { "alg" => "HS256" }])
+      expect(described_class.verify_api_request(headers)).to eq([
+        { 'iss' => described_class::JWT_ISSUER, 'aud' => described_class::JWT_AUDIENCE },
+        { 'alg' => 'HS256' }
+      ])
     end
   end
 
diff --git a/spec/requests/api/ci/pipeline_schedules_spec.rb b/spec/requests/api/ci/pipeline_schedules_spec.rb
index d5f60e62b06..d760e4ddf28 100644
--- a/spec/requests/api/ci/pipeline_schedules_spec.rb
+++ b/spec/requests/api/ci/pipeline_schedules_spec.rb
@@ -311,8 +311,7 @@ RSpec.describe API::Ci::PipelineSchedules, feature_category: :continuous_integra
     end
   end
 
-  # Move this from `shared_context` to `describe` when `ci_refactoring_pipeline_schedule_create_service` is removed.
-  shared_context 'POST /projects/:id/pipeline_schedules' do # rubocop:disable RSpec/ContextWording
+  describe 'POST /projects/:id/pipeline_schedules' do
     let(:params) { attributes_for(:ci_pipeline_schedule) }
 
     context 'authenticated user with valid permissions' do
@@ -369,8 +368,7 @@ RSpec.describe API::Ci::PipelineSchedules, feature_category: :continuous_integra
     end
   end
 
-  # Move this from `shared_context` to `describe` when `ci_refactoring_pipeline_schedule_create_service` is removed.
-  shared_context 'PUT /projects/:id/pipeline_schedules/:pipeline_schedule_id' do
+  describe 'PUT /projects/:id/pipeline_schedules/:pipeline_schedule_id' do
     let(:pipeline_schedule) do
       create(:ci_pipeline_schedule, project: project, owner: developer)
     end
@@ -439,18 +437,6 @@ RSpec.describe API::Ci::PipelineSchedules, feature_category: :continuous_integra
     end
   end
 
-  it_behaves_like 'POST /projects/:id/pipeline_schedules'
-  it_behaves_like 'PUT /projects/:id/pipeline_schedules/:pipeline_schedule_id'
-
-  context 'when the FF ci_refactoring_pipeline_schedule_create_service is disabled' do
-    before do
-      stub_feature_flags(ci_refactoring_pipeline_schedule_create_service: false)
-    end
-
-    it_behaves_like 'POST /projects/:id/pipeline_schedules'
-    it_behaves_like 'PUT /projects/:id/pipeline_schedules/:pipeline_schedule_id'
-  end
-
   describe 'POST /projects/:id/pipeline_schedules/:pipeline_schedule_id/take_ownership' do
     let(:pipeline_schedule) do
       create(:ci_pipeline_schedule, project: project, owner: developer)
diff --git a/spec/requests/api/graphql/mutations/ci/pipeline_schedule/create_spec.rb b/spec/requests/api/graphql/mutations/ci/pipeline_schedule/create_spec.rb
index 0d5e5f5d2fb..b2fe2754198 100644
--- a/spec/requests/api/graphql/mutations/ci/pipeline_schedule/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/pipeline_schedule/create_spec.rb
@@ -68,8 +68,7 @@ RSpec.describe 'PipelineSchedulecreate', feature_category: :continuous_integrati
     end
   end
 
-  # Move this from `shared_context` to `context` when `ci_refactoring_pipeline_schedule_create_service` is removed.
-  shared_context 'when authorized' do # rubocop:disable RSpec/ContextWording
+  context 'when authorized' do
     before_all do
       project.add_developer(user)
     end
@@ -149,14 +148,4 @@ RSpec.describe 'PipelineSchedulecreate', feature_category: :continuous_integrati
       end
     end
   end
-
-  it_behaves_like 'when authorized'
-
-  context 'when the FF ci_refactoring_pipeline_schedule_create_service is disabled' do
-    before do
-      stub_feature_flags(ci_refactoring_pipeline_schedule_create_service: false)
-    end
-
-    it_behaves_like 'when authorized'
-  end
 end
diff --git a/spec/requests/api/internal/kubernetes_spec.rb b/spec/requests/api/internal/kubernetes_spec.rb
index 09170ca952f..ec30840dfd8 100644
--- a/spec/requests/api/internal/kubernetes_spec.rb
+++ b/spec/requests/api/internal/kubernetes_spec.rb
@@ -4,7 +4,11 @@ require 'spec_helper'
 
 RSpec.describe API::Internal::Kubernetes, feature_category: :deployment_management do
   let(:jwt_auth_headers) do
-    jwt_token = JWT.encode({ 'iss' => Gitlab::Kas::JWT_ISSUER }, Gitlab::Kas.secret, 'HS256')
+    jwt_token = JWT.encode(
+      { 'iss' => Gitlab::Kas::JWT_ISSUER, 'aud' => Gitlab::Kas::JWT_AUDIENCE },
+      Gitlab::Kas.secret,
+      'HS256'
+    )
 
     { Gitlab::Kas::INTERNAL_API_REQUEST_HEADER => jwt_token }
   end
diff --git a/spec/support/rspec_order_todo.yml b/spec/support/rspec_order_todo.yml
index b9ddd4a7385..0e48845a1dd 100644
--- a/spec/support/rspec_order_todo.yml
+++ b/spec/support/rspec_order_todo.yml
@@ -5026,7 +5026,6 @@
 - './spec/helpers/enable_search_settings_helper_spec.rb'
 - './spec/helpers/environment_helper_spec.rb'
 - './spec/helpers/environments_helper_spec.rb'
-- './spec/helpers/events_helper_spec.rb'
 - './spec/helpers/explore_helper_spec.rb'
 - './spec/helpers/export_helper_spec.rb'
 - './spec/helpers/external_link_helper_spec.rb'