8 files changed, 69 insertions, 67 deletions

diff --git a/spec/frontend/invite_members/components/invite_members_modal_spec.js b/spec/frontend/invite_members/components/invite_members_modal_spec.js
index 95b1c55b82d..8c3c549a5eb 100644
--- a/spec/frontend/invite_members/components/invite_members_modal_spec.js
+++ b/spec/frontend/invite_members/components/invite_members_modal_spec.js
@@ -242,7 +242,7 @@ describe('InviteMembersModal', () => {
     };
 
     const expectedEmailRestrictedError =
-      "email 'email@example.com' does not match the allowed domains: example1.org";
+      "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups.";
     const expectedSyntaxError = 'email contains an invalid email address';
 
     it('calls the API with the expected focus data when an areas_of_focus checkbox is clicked', () => {
@@ -421,7 +421,7 @@ describe('InviteMembersModal', () => {
           await waitForPromises();
 
           expect(membersFormGroupInvalidFeedback()).toBe(
-            "root: User email 'admin@example.com' does not match the allowed domain of example2.com",
+            "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups.",
           );
           expect(findMembersSelect().props('validationState')).toBe(false);
         });
diff --git a/spec/frontend/invite_members/mock_data/api_responses.js b/spec/frontend/invite_members/mock_data/api_responses.js
index 79b56a33708..dd84b4fd78f 100644
--- a/spec/frontend/invite_members/mock_data/api_responses.js
+++ b/spec/frontend/invite_members/mock_data/api_responses.js
@@ -9,7 +9,7 @@ const INVITATIONS_API_ERROR_EMAIL_INVALID = {
 const INVITATIONS_API_EMAIL_RESTRICTED = {
   message: {
     'email@example.com':
-      "Invite email 'email@example.com' does not match the allowed domains: example1.org",
+      "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups.",
   },
   status: 'error',
 };
@@ -17,9 +17,9 @@ const INVITATIONS_API_EMAIL_RESTRICTED = {
 const INVITATIONS_API_MULTIPLE_EMAIL_RESTRICTED = {
   message: {
     'email@example.com':
-      "Invite email email 'email@example.com' does not match the allowed domains: example1.org",
+      "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups.",
     'email4@example.com':
-      "Invite email email 'email4@example.com' does not match the allowed domains: example1.org",
+      "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check the Domain denylist.",
   },
   status: 'error',
 };
@@ -36,7 +36,11 @@ const MEMBERS_API_MEMBER_ALREADY_EXISTS = {
 };
 
 const MEMBERS_API_SINGLE_USER_RESTRICTED = {
-  message: { user: ["email 'email@example.com' does not match the allowed domains: example1.org"] },
+  message: {
+    user: [
+      "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups.",
+    ],
+  },
 };
 
 const MEMBERS_API_SINGLE_USER_ACCESS_LEVEL = {
@@ -49,7 +53,7 @@ const MEMBERS_API_SINGLE_USER_ACCESS_LEVEL = {
 
 const MEMBERS_API_MULTIPLE_USERS_RESTRICTED = {
   message:
-    "root: User email 'admin@example.com' does not match the allowed domain of example2.com and user18: User email 'user18@example.org' does not match the allowed domain of example2.com",
+    "root: The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups. and user18: The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check the Domain denylist. and john_doe31: The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Email restrictions for sign-ups.",
   status: 'error',
 };
 
diff --git a/spec/frontend/invite_members/utils/response_message_parser_spec.js b/spec/frontend/invite_members/utils/response_message_parser_spec.js
index 3c88b5a2418..e2cc87c8547 100644
--- a/spec/frontend/invite_members/utils/response_message_parser_spec.js
+++ b/spec/frontend/invite_members/utils/response_message_parser_spec.js
@@ -2,18 +2,20 @@ import {
   responseMessageFromSuccess,
   responseMessageFromError,
 } from '~/invite_members/utils/response_message_parser';
+import { membersApiResponse, invitationsApiResponse } from '../mock_data/api_responses';
 
 describe('Response message parser', () => {
-  const expectedMessage = 'expected display message';
+  const expectedMessage = 'expected display and message.';
 
   describe('parse message from successful response', () => {
     const exampleKeyedMsg = { 'email@example.com': expectedMessage };
+    const exampleFirstPartMultiple = 'username1: expected display and message.';
     const exampleUserMsgMultiple =
-      ' and username1: id not found and username2: email is restricted';
+      ' and username2: id not found and restricted email. and username3: email is restricted.';
 
     it.each([
       [[{ data: { message: expectedMessage } }]],
-      [[{ data: { message: expectedMessage + exampleUserMsgMultiple } }]],
+      [[{ data: { message: exampleFirstPartMultiple + exampleUserMsgMultiple } }]],
       [[{ data: { error: expectedMessage } }]],
       [[{ data: { message: [expectedMessage] } }]],
       [[{ data: { message: exampleKeyedMsg } }]],
@@ -33,4 +35,24 @@ describe('Response message parser', () => {
       expect(responseMessageFromError(errorResponse)).toBe(expectedMessage);
     });
   });
+
+  describe('displaying only the first error when a response has messages for multiple users', () => {
+    const expected =
+      "The member's email address is not allowed for this project. Go to the Admin area > Sign-up restrictions, and check Allowed domains for sign-ups.";
+
+    it.each([
+      [[{ data: membersApiResponse.MULTIPLE_USERS_RESTRICTED }]],
+      [[{ data: invitationsApiResponse.MULTIPLE_EMAIL_RESTRICTED }]],
+      [[{ data: invitationsApiResponse.EMAIL_RESTRICTED }]],
+    ])(`returns "${expectedMessage}" from success response: %j`, (restrictedResponse) => {
+      expect(responseMessageFromSuccess(restrictedResponse)).toBe(expected);
+    });
+
+    it.each([[{ response: { data: membersApiResponse.SINGLE_USER_RESTRICTED } }]])(
+      `returns "${expectedMessage}" from error response: %j`,
+      (singleRestrictedResponse) => {
+        expect(responseMessageFromError(singleRestrictedResponse)).toBe(expected);
+      },
+    );
+  });
 });
diff --git a/spec/models/member_spec.rb b/spec/models/member_spec.rb
index 7fcf246d091..0b546ce9b29 100644
--- a/spec/models/member_spec.rb
+++ b/spec/models/member_spec.rb
@@ -65,6 +65,8 @@ RSpec.describe Member do
     end
 
     context 'with admin signup restrictions' do
+      let(:expected_message) { _('is not allowed for this group. Check with your administrator.') }
+
       context 'when allowed domains for signup is enabled' do
         before do
           stub_application_setting(domain_allowlist: ['example.com'])
@@ -74,7 +76,7 @@ RSpec.describe Member do
           member = build(:group_member, :invited, invite_email: 'info@gitlab.com')
 
           expect(member).not_to be_valid
-          expect(member.errors.messages[:user].first).to eq(_('domain is not authorized for sign-up.'))
+          expect(member.errors.messages[:user].first).to eq(expected_message)
         end
       end
 
@@ -88,7 +90,7 @@ RSpec.describe Member do
           member = build(:group_member, :invited, invite_email: 'denylist@example.org')
 
           expect(member).not_to be_valid
-          expect(member.errors.messages[:user].first).to eq(_('is not from an allowed domain.'))
+          expect(member.errors.messages[:user].first).to eq(expected_message)
         end
       end
 
@@ -102,7 +104,7 @@ RSpec.describe Member do
           member = build(:group_member, :invited, invite_email: 'info@gitlab.com')
 
           expect(member).not_to be_valid
-          expect(member.errors.messages[:user].first).to eq(_('is not allowed. Try again with a different email address, or contact your GitLab admin.'))
+          expect(member.errors.messages[:user].first).to eq(expected_message)
         end
       end
     end
diff --git a/spec/models/user_spec.rb b/spec/models/user_spec.rb
index 1ef0d67958c..3fab026ba79 100644
--- a/spec/models/user_spec.rb
+++ b/spec/models/user_spec.rb
@@ -494,6 +494,8 @@ RSpec.describe User do
     end
 
     describe 'email' do
+      let(:expected_error) { _('is not allowed for sign-up. Check with your administrator.') }
+
       context 'when no signup domains allowed' do
         before do
           stub_application_setting(domain_allowlist: [])
@@ -537,7 +539,7 @@ RSpec.describe User do
         it 'rejects example@test.com' do
           user = build(:user, email: "example@test.com")
           expect(user).to be_invalid
-          expect(user.errors.messages[:email].first).to eq(_('domain is not authorized for sign-up.'))
+          expect(user.errors.messages[:email].first).to eq(expected_error)
         end
       end
 
@@ -554,13 +556,13 @@ RSpec.describe User do
         it 'rejects info@test.example.com' do
           user = build(:user, email: "info@test.example.com")
           expect(user).to be_invalid
-          expect(user.errors.messages[:email].first).to eq(_('domain is not authorized for sign-up.'))
+          expect(user.errors.messages[:email].first).to eq(expected_error)
         end
 
         it 'rejects example@test.com' do
           user = build(:user, email: "example@test.com")
           expect(user).to be_invalid
-          expect(user.errors.messages[:email].first).to eq(_('domain is not authorized for sign-up.'))
+          expect(user.errors.messages[:email].first).to eq(expected_error)
         end
 
         it 'accepts example@test.com when added by another user' do
@@ -598,7 +600,7 @@ RSpec.describe User do
           it 'rejects info@example.com' do
             user = build(:user, email: 'info@example.com')
             expect(user).not_to be_valid
-            expect(user.errors.messages[:email].first).to eq(_('is not from an allowed domain.'))
+            expect(user.errors.messages[:email].first).to eq(expected_error)
           end
 
           it 'accepts info@example.com when added by another user' do
@@ -632,7 +634,7 @@ RSpec.describe User do
           it 'rejects info@example.com' do
             user = build(:user, email: 'info@example.com')
             expect(user).not_to be_valid
-            expect(user.errors.messages[:email].first).to eq(_('domain is not authorized for sign-up.'))
+            expect(user.errors.messages[:email].first).to eq(expected_error)
           end
         end
       end
@@ -673,7 +675,7 @@ RSpec.describe User do
             user = build(:user, email: 'info@gitlab.com')
 
             expect(user).not_to be_valid
-            expect(user.errors.messages[:email].first).to eq(_('is not allowed. Try again with a different email address, or contact your GitLab admin.'))
+            expect(user.errors.messages[:email].first).to eq(expected_error)
           end
 
           it 'does accept a valid email address' do
diff --git a/spec/services/members/create_service_spec.rb b/spec/services/members/create_service_spec.rb
index 15ed5c5a33f..2e6e6041fc3 100644
--- a/spec/services/members/create_service_spec.rb
+++ b/spec/services/members/create_service_spec.rb
@@ -80,7 +80,7 @@ RSpec.describe Members::CreateService, :aggregate_failures, :clean_gitlab_redis_
 
     it 'does not add a member' do
       expect(execute_service[:status]).to eq(:error)
-      expect(execute_service[:message]).to eq('Invite email has already been taken')
+      expect(execute_service[:message]).to eq("The member's email address has already been taken")
       expect(OnboardingProgress.completed?(source.namespace, :user_added)).to be(false)
     end
   end
diff --git a/spec/services/members/invite_service_spec.rb b/spec/services/members/invite_service_spec.rb
index dd82facaf14..478733e8aa0 100644
--- a/spec/services/members/invite_service_spec.rb
+++ b/spec/services/members/invite_service_spec.rb
@@ -150,7 +150,7 @@ RSpec.describe Members::InviteService, :aggregate_failures, :clean_gitlab_redis_
       expect_to_create_members(count: 1)
       expect(result[:status]).to eq(:error)
       expect(result[:message][invited_member.invite_email])
-        .to eq("Invite email has already been taken")
+        .to eq("The member's email address has already been taken")
       expect(project.users).to include project_user
     end
   end
diff --git a/spec/services/projects/transfer_service_spec.rb b/spec/services/projects/transfer_service_spec.rb
index 9c0f80e174a..5a52f4fad6f 100644
--- a/spec/services/projects/transfer_service_spec.rb
+++ b/spec/services/projects/transfer_service_spec.rb
@@ -518,58 +518,30 @@ RSpec.describe Projects::TransferService do
       group.add_owner(user)
     end
 
-    context 'when the feature flag `specialized_worker_for_project_transfer_auth_recalculation` is enabled' do
-      before do
-        stub_feature_flags(specialized_worker_for_project_transfer_auth_recalculation: true)
-      end
-
-      it 'calls AuthorizedProjectUpdate::ProjectRecalculateWorker to update project authorizations' do
-        expect(AuthorizedProjectUpdate::ProjectRecalculateWorker)
-          .to receive(:perform_async).with(project.id)
-
-        execute_transfer
-      end
+    it 'calls AuthorizedProjectUpdate::ProjectRecalculateWorker to update project authorizations' do
+      expect(AuthorizedProjectUpdate::ProjectRecalculateWorker)
+        .to receive(:perform_async).with(project.id)
 
-      it 'calls AuthorizedProjectUpdate::UserRefreshFromReplicaWorker with a delay to update project authorizations' do
-        user_ids = [user.id, member_of_old_group.id, member_of_new_group.id].map { |id| [id] }
-
-        expect(AuthorizedProjectUpdate::UserRefreshFromReplicaWorker).to(
-          receive(:bulk_perform_in)
-            .with(1.hour,
-                  user_ids,
-                  batch_delay: 30.seconds, batch_size: 100)
-        )
-
-        subject
-      end
-
-      it 'refreshes the permissions of the members of the old and new namespace', :sidekiq_inline do
-        expect { execute_transfer }
-          .to change { member_of_old_group.authorized_projects.include?(project) }.from(true).to(false)
-          .and change { member_of_new_group.authorized_projects.include?(project) }.from(false).to(true)
-      end
+      execute_transfer
     end
 
-    context 'when the feature flag `specialized_worker_for_project_transfer_auth_recalculation` is disabled' do
-      before do
-        stub_feature_flags(specialized_worker_for_project_transfer_auth_recalculation: false)
-      end
+    it 'calls AuthorizedProjectUpdate::UserRefreshFromReplicaWorker with a delay to update project authorizations' do
+      user_ids = [user.id, member_of_old_group.id, member_of_new_group.id].map { |id| [id] }
 
-      it 'calls UserProjectAccessChangedService to update project authorizations' do
-        user_ids = [user.id, member_of_old_group.id, member_of_new_group.id]
-
-        expect_next_instance_of(UserProjectAccessChangedService, user_ids) do |service|
-          expect(service).to receive(:execute)
-        end
+      expect(AuthorizedProjectUpdate::UserRefreshFromReplicaWorker).to(
+        receive(:bulk_perform_in)
+          .with(1.hour,
+                user_ids,
+                batch_delay: 30.seconds, batch_size: 100)
+      )
 
-        execute_transfer
-      end
+      subject
+    end
 
-      it 'refreshes the permissions of the members of the old and new namespace' do
-        expect { execute_transfer }
-          .to change { member_of_old_group.authorized_projects.include?(project) }.from(true).to(false)
-          .and change { member_of_new_group.authorized_projects.include?(project) }.from(false).to(true)
-      end
+    it 'refreshes the permissions of the members of the old and new namespace', :sidekiq_inline do
+      expect { execute_transfer }
+        .to change { member_of_old_group.authorized_projects.include?(project) }.from(true).to(false)
+        .and change { member_of_new_group.authorized_projects.include?(project) }.from(false).to(true)
     end
   end