Add latest changes from gitlab-org/gitlab@15-2-stable-eev15.2.0-rc42

9 files changed, 174 insertions, 153 deletions

diff --git a/qa/qa/specs/features/browser_ui/1_manage/group/group_access_token_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/group/group_access_token_spec.rb
new file mode 100644
index 00000000000..9f39d376baf
--- /dev/null
+++ b/qa/qa/specs/features/browser_ui/1_manage/group/group_access_token_spec.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module QA
+  RSpec.describe 'Manage' do
+    describe 'Group access tokens' do
+      let(:group_access_token) { QA::Resource::GroupAccessToken.fabricate_via_browser_ui! }
+
+      it(
+        'can be created and revoked via the UI',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/367044'
+      ) do
+        expect(group_access_token.token).not_to be_nil
+
+        group_access_token.revoke_via_ui!
+        expect(page).to have_text("Revoked access token #{group_access_token.name}!")
+      end
+    end
+  end
+end
diff --git a/qa/qa/specs/features/browser_ui/1_manage/login/2fa_recovery_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/login/2fa_recovery_spec.rb
index c86a649f179..f459c0c71eb 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/login/2fa_recovery_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/login/2fa_recovery_spec.rb
@@ -1,10 +1,12 @@
 # frozen_string_literal: true
 
 module QA
-  RSpec.describe 'Manage', :requires_admin, :skip_live_env do
+  RSpec.describe 'Manage', :requires_admin, :skip_live_env, :reliable do
     describe '2FA' do
       let(:owner_user) do
-        Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_2fa_owner_username_1, Runtime::Env.gitlab_qa_2fa_owner_password_1)
+        Resource::User.fabricate_via_api! do |usr|
+          usr.api_client = admin_api_client
+        end
       end
 
       let(:developer_user) do
@@ -32,7 +34,10 @@ module QA
         group.add_member(developer_user, Resource::Members::AccessLevel::DEVELOPER)
       end
 
-      it 'allows using 2FA recovery code once only', testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347937' do
+      it(
+        'allows using 2FA recovery code once only',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347937'
+      ) do
         recovery_code = enable_2fa_for_user_and_fetch_recovery_code(developer_user)
 
         Flow::Login.sign_in(as: developer_user, skip_page_validation: true)
@@ -56,13 +61,6 @@ module QA
         expect(page).to have_text('Invalid two-factor code')
       end
 
-      after do
-        group.set_require_two_factor_authentication(value: 'false')
-        group.remove_via_api!
-        sandbox_group.remove_via_api!
-        developer_user.remove_via_api!
-      end
-
       def admin_api_client
         @admin_api_client ||= Runtime::API::Client.as_admin
       end
@@ -74,9 +72,9 @@ module QA
       def enable_2fa_for_user_and_fetch_recovery_code(user)
         Flow::Login.while_signed_in(as: user) do
           Page::Profile::TwoFactorAuth.perform do |two_fa_auth|
-            @otp = QA::Support::OTP.new(two_fa_auth.otp_secret_content)
+            otp = QA::Support::OTP.new(two_fa_auth.otp_secret_content)
 
-            two_fa_auth.set_pin_code(@otp.fresh_otp)
+            two_fa_auth.set_pin_code(otp.fresh_otp)
             two_fa_auth.set_current_password(user.password)
             two_fa_auth.click_register_2fa_app_button
 
diff --git a/qa/qa/specs/features/browser_ui/1_manage/login/log_in_with_2fa_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/login/log_in_with_2fa_spec.rb
index 64614ed654f..c5efa833f04 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/login/log_in_with_2fa_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/login/log_in_with_2fa_spec.rb
@@ -3,13 +3,15 @@
 module QA
   RSpec.describe 'Manage', :requires_admin, :skip_live_env do
     describe '2FA' do
-      let(:owner_user) do
-        Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_2fa_owner_username_1, Runtime::Env.gitlab_qa_2fa_owner_password_1)
+      let!(:owner_user) do
+        Resource::User.fabricate_via_api! do |usr|
+          usr.api_client = admin_api_client
+        end
       end
 
       let(:sandbox_group) do
         Resource::Sandbox.fabricate! do |sandbox_group|
-          sandbox_group.path = "gitlab-qa-2fa-sandbox-group"
+          sandbox_group.path = "gitlab-qa-2fa-sandbox-group-#{SecureRandom.hex(8)}"
           sandbox_group.api_client = owner_api_client
         end
       end
diff --git a/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb
index 5487ecff028..85ab466078a 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb
@@ -86,7 +86,10 @@ module QA
           end
 
           after do
-            @recreated_user&.remove_via_api!
+            if @recreated_user
+              @recreated_user.api_client = admin_api_client
+              @recreated_user.remove_via_api!
+            end
           end
 
           def admin_api_client
diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/dashboard_images_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/dashboard_images_spec.rb
index 44cae31f5d8..b1d59b90e9c 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/project/dashboard_images_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/project/dashboard_images_spec.rb
@@ -2,49 +2,45 @@
 
 module QA
   RSpec.describe 'Manage' do
-    describe 'Check for broken images', :requires_admin do
-      before(:context) do
-        @api_client = Runtime::API::Client.as_admin
-        @new_user = Resource::User.fabricate_via_api! do |user|
-          user.api_client = @api_client
-        end
-        @new_admin = Resource::User.fabricate_via_api! do |user|
-          user.admin = true
-          user.api_client = @api_client
-        end
+    shared_examples 'loads all images' do |admin|
+      let(:api_client) { Runtime::API::Client.as_admin }
 
-        Page::Main::Menu.perform(&:sign_out_if_signed_in)
+      let(:user) do
+        Resource::User.fabricate_via_api! do |resource|
+          resource.admin = admin
+          resource.api_client = api_client
+        end
       end
 
-      after(:context) do
-        @new_user.remove_via_api!
-        @new_admin.remove_via_api!
+      after do
+        user.remove_via_api!
       end
 
-      shared_examples 'loads all images' do
-        it 'loads all images' do
-          Runtime::Browser.visit(:gitlab, Page::Main::Login)
-          Page::Main::Login.perform { |login| login.sign_in_using_credentials(user: new_user) }
+      it 'loads all images' do
+        Flow::Login.sign_in(as: user)
 
-          Page::Dashboard::Welcome.perform do |welcome|
-            expect(welcome).to have_welcome_title("Welcome to GitLab")
+        Page::Dashboard::Welcome.perform do |welcome|
+          expect(welcome).to have_welcome_title("Welcome to GitLab")
 
-            # This would be better if it were a visual validation test
-            expect(welcome).to have_loaded_all_images
-          end
+          # This would be better if it were a visual validation test
+          expect(welcome).to have_loaded_all_images
         end
       end
+    end
 
-      context 'when logged in as a new user', testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347885' do
-        it_behaves_like 'loads all images' do
-          let(:new_user) { @new_user }
-        end
+    describe 'Check for broken images', :requires_admin, :reliable do
+      context(
+        'when logged in as a new user',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347885'
+      ) do
+        it_behaves_like 'loads all images', false
       end
 
-      context 'when logged in as a new admin', testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347884' do
-        it_behaves_like 'loads all images' do
-          let(:new_user) { @new_admin }
-        end
+      context(
+        'when logged in as a new admin',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347884'
+      ) do
+        it_behaves_like 'loads all images', true
       end
     end
   end
diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/invite_group_to_project_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/invite_group_to_project_spec.rb
index dd27e85af3c..8201e2772aa 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/project/invite_group_to_project_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/project/invite_group_to_project_spec.rb
@@ -1,8 +1,7 @@
 # frozen_string_literal: true
 
 module QA
-  # Tagging with issue for a transient invite group modal search bug, but does not require quarantine at this time
-  RSpec.describe 'Manage', :transient, issue: 'https://gitlab.com/gitlab-org/gitlab/-/issues/349379' do
+  RSpec.describe 'Manage' do
     describe 'Invite group' do
       shared_examples 'invites group to project' do
         it 'verifies group is added and members can access project with correct access level' do
@@ -13,7 +12,7 @@ module QA
             expect(project_members).to have_group(group.path)
           end
 
-          Flow::Login.sign_in(as: @user)
+          Flow::Login.sign_in(as: user)
 
           Page::Dashboard::Projects.perform do |projects|
             projects.filter_by_name(project.name)
@@ -29,13 +28,11 @@ module QA
         end
       end
 
-      before(:context) do
-        @user = Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1)
-      end
+      let(:user) { Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1) }
 
       before do
         Flow::Login.sign_in
-        group.add_member(@user, Resource::Members::AccessLevel::MAINTAINER)
+        group.add_member(user, Resource::Members::AccessLevel::MAINTAINER)
         project.visit!
       end
 
@@ -75,11 +72,6 @@ module QA
 
         it_behaves_like 'invites group to project'
       end
-
-      after do
-        project&.remove_via_api!
-        group&.remove_via_api!
-      end
     end
   end
 end
diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/personal_project_permissions_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/personal_project_permissions_spec.rb
deleted file mode 100644
index fb486ab1532..00000000000
--- a/qa/qa/specs/features/browser_ui/1_manage/project/personal_project_permissions_spec.rb
+++ /dev/null
@@ -1,94 +0,0 @@
-# frozen_string_literal: true
-
-module QA
-  RSpec.describe 'Manage' do
-    describe 'Personal project permissions', :reliable do
-      let!(:owner) { Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1) }
-
-      let!(:owner_api_client) { Runtime::API::Client.new(:gitlab, user: owner) }
-
-      let!(:project) do
-        Resource::Project.fabricate_via_api! do |project|
-          project.api_client = owner_api_client
-          project.name = 'qa-owner-personal-project'
-          project.personal_namespace = owner.username
-        end
-      end
-
-      after do
-        project&.remove_via_api!
-      end
-
-      context 'when user is added as Owner' do
-        let(:issue) do
-          Resource::Issue.fabricate_via_api! do |issue|
-            issue.api_client = owner_api_client
-            issue.project = project
-            issue.title = 'Test Owner deletes issue'
-          end
-        end
-
-        before do
-          Flow::Login.sign_in(as: owner)
-        end
-
-        it "has Owner role with Owner permissions", testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/352542' do
-          Page::Dashboard::Projects.perform do |projects|
-            projects.filter_by_name(project.name)
-
-            expect(projects).to have_project_with_access_role(project.name, 'Owner')
-          end
-
-          expect_owner_permissions_allow_delete_issue
-        end
-      end
-
-      context 'when user is added as Maintainer' do
-        let(:maintainer) { Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_2, Runtime::Env.gitlab_qa_password_2) }
-
-        let(:issue) do
-          Resource::Issue.fabricate_via_api! do |issue|
-            issue.api_client = owner_api_client
-            issue.project = project
-            issue.title = 'Test Maintainer deletes issue'
-          end
-        end
-
-        before do
-          project.add_member(maintainer, Resource::Members::AccessLevel::MAINTAINER)
-          Flow::Login.sign_in(as: maintainer)
-        end
-
-        it "has Maintainer role without Owner permissions", testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/352607' do
-          Page::Dashboard::Projects.perform do |projects|
-            projects.filter_by_name(project.name)
-
-            expect(projects).to have_project_with_access_role(project.name, 'Maintainer')
-          end
-
-          expect_maintainer_permissions_do_not_allow_delete_issue
-        end
-      end
-
-      private
-
-      def expect_owner_permissions_allow_delete_issue
-        issue.visit!
-
-        Page::Project::Issue::Show.perform(&:delete_issue)
-
-        Page::Project::Issue::Index.perform do |index|
-          expect(index).not_to have_issue(issue)
-        end
-      end
-
-      def expect_maintainer_permissions_do_not_allow_delete_issue
-        issue.visit!
-
-        Page::Project::Issue::Show.perform do |issue|
-          expect(issue).not_to have_delete_issue_button
-        end
-      end
-    end
-  end
-end
diff --git a/qa/qa/specs/features/browser_ui/1_manage/project/project_owner_permissions_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/project/project_owner_permissions_spec.rb
new file mode 100644
index 00000000000..2f148c4051c
--- /dev/null
+++ b/qa/qa/specs/features/browser_ui/1_manage/project/project_owner_permissions_spec.rb
@@ -0,0 +1,104 @@
+# frozen_string_literal: true
+
+module QA
+  RSpec.describe 'Manage' do
+    describe 'Project owner permissions' do
+      let!(:owner) do
+        Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_1, Runtime::Env.gitlab_qa_password_1)
+      end
+
+      let!(:owner_api_client) { Runtime::API::Client.new(:gitlab, user: owner) }
+
+      let!(:maintainer) do
+        Resource::User.fabricate_or_use(Runtime::Env.gitlab_qa_username_2, Runtime::Env.gitlab_qa_password_2)
+      end
+
+      shared_examples 'when user is added as owner' do |project_type, testcase|
+        let!(:issue) do
+          Resource::Issue.fabricate_via_api! do |issue|
+            issue.api_client = owner_api_client
+            issue.project = project
+            issue.title = 'Test Owner Deletes Issue'
+          end
+        end
+
+        before do
+          project.add_member(owner, Resource::Members::AccessLevel::OWNER) if project_type == :group_project
+          Flow::Login.sign_in(as: owner)
+        end
+
+        it "has owner role with owner permissions", testcase: testcase do
+          Page::Dashboard::Projects.perform do |projects|
+            projects.filter_by_name(project.name)
+
+            expect(projects).to have_project_with_access_role(project.name, 'Owner')
+          end
+
+          issue.visit!
+
+          Page::Project::Issue::Show.perform(&:delete_issue)
+
+          Page::Project::Issue::Index.perform do |index|
+            expect(index).not_to have_issue(issue)
+          end
+        end
+      end
+
+      shared_examples 'when user is added as maintainer' do |testcase|
+        let!(:issue) do
+          Resource::Issue.fabricate_via_api! do |issue|
+            issue.api_client = owner_api_client
+            issue.project = project
+            issue.title = 'Test Maintainer Deletes Issue'
+          end
+        end
+
+        before do
+          project.add_member(maintainer, Resource::Members::AccessLevel::MAINTAINER)
+          Flow::Login.sign_in(as: maintainer)
+        end
+
+        it "has maintainer role without owner permissions", testcase: testcase do
+          Page::Dashboard::Projects.perform do |projects|
+            projects.filter_by_name(project.name)
+
+            expect(projects).to have_project_with_access_role(project.name, 'Maintainer')
+          end
+
+          issue.visit!
+
+          Page::Project::Issue::Show.perform do |issue|
+            expect(issue).not_to have_delete_issue_button
+          end
+        end
+      end
+
+      context 'for personal projects' do
+        let!(:project) do
+          Resource::Project.fabricate_via_api! do |project|
+            project.api_client = owner_api_client
+            project.name = 'qa-owner-personal-project'
+            project.personal_namespace = owner.username
+          end
+        end
+
+        it_behaves_like 'when user is added as owner', :personal_project, 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/352542'
+        it_behaves_like 'when user is added as maintainer', 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/352607'
+      end
+
+      context 'for group projects' do
+        let!(:group) { Resource::Group.fabricate_via_api! }
+
+        let!(:project) do
+          Resource::Project.fabricate_via_api! do |project|
+            project.group = group
+            project.name = 'qa-owner-group-project'
+          end
+        end
+
+        it_behaves_like 'when user is added as owner', :group_project, 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/366436'
+        it_behaves_like 'when user is added as maintainer', 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/366435'
+      end
+    end
+  end
+end
diff --git a/qa/qa/specs/features/browser_ui/1_manage/user/follow_user_activity_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/user/follow_user_activity_spec.rb
index 11cf4f60a80..a384dc16064 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/user/follow_user_activity_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/user/follow_user_activity_spec.rb
@@ -24,6 +24,7 @@ module QA
       let(:group) do
         group = QA::Resource::Group.fabricate_via_api! do |group|
           group.path = "group_for_follow_user_activity_#{SecureRandom.hex(8)}"
+          group.api_client = admin_api_client
         end
         group.add_member(followed_user, Resource::Members::AccessLevel::MAINTAINER)
         group