Merge remote-tracking branch 'origin/master' into object-storage-ee-to-ce-backportobject-storage-ee-to-ce-backport

15 files changed, 549 insertions, 123 deletions

diff --git a/spec/controllers/autocomplete_controller_spec.rb b/spec/controllers/autocomplete_controller_spec.rb
index 73fff6eb5ca..b7257fac608 100644
--- a/spec/controllers/autocomplete_controller_spec.rb
+++ b/spec/controllers/autocomplete_controller_spec.rb
@@ -109,15 +109,17 @@ describe AutocompleteController do
     end
 
     context 'limited users per page' do
-      let(:per_page) { 2 }
-
       before do
+        25.times do
+          create(:user)
+        end
+
         sign_in(user)
-        get(:users, per_page: per_page)
+        get(:users)
       end
 
       it { expect(json_response).to be_kind_of(Array) }
-      it { expect(json_response.size).to eq(per_page) }
+      it { expect(json_response.size).to eq(20) }
     end
 
     context 'unauthenticated user' do
diff --git a/spec/controllers/boards/issues_controller_spec.rb b/spec/controllers/boards/issues_controller_spec.rb
index 79bbc29e80d..4770e187db6 100644
--- a/spec/controllers/boards/issues_controller_spec.rb
+++ b/spec/controllers/boards/issues_controller_spec.rb
@@ -86,6 +86,7 @@ describe Boards::IssuesController do
 
     context 'with unauthorized user' do
       before do
+        allow(Ability).to receive(:allowed?).and_call_original
         allow(Ability).to receive(:allowed?).with(user, :read_project, project).and_return(true)
         allow(Ability).to receive(:allowed?).with(user, :read_issue, project).and_return(false)
       end
diff --git a/spec/controllers/concerns/controller_with_cross_project_access_check_spec.rb b/spec/controllers/concerns/controller_with_cross_project_access_check_spec.rb
new file mode 100644
index 00000000000..27f558e1b5d
--- /dev/null
+++ b/spec/controllers/concerns/controller_with_cross_project_access_check_spec.rb
@@ -0,0 +1,146 @@
+require 'spec_helper'
+
+describe ControllerWithCrossProjectAccessCheck do
+  let(:user) { create(:user) }
+
+  before do
+    sign_in user
+  end
+
+  render_views
+
+  context 'When reading cross project is not allowed' do
+    before do
+      allow(Ability).to receive(:allowed).and_call_original
+      allow(Ability).to receive(:allowed?)
+                          .with(user, :read_cross_project, :global)
+                          .and_return(false)
+    end
+
+    describe '#requires_cross_project_access' do
+      controller(ApplicationController) do
+        # `described_class` is not available in this context
+        include ControllerWithCrossProjectAccessCheck # rubocop:disable RSpec/DescribedClass
+
+        requires_cross_project_access :index, show: false,
+                                              unless: -> { unless_condition },
+                                              if: -> { if_condition }
+
+        def index
+          render nothing: true
+        end
+
+        def show
+          render nothing: true
+        end
+
+        def unless_condition
+          false
+        end
+
+        def if_condition
+          true
+        end
+      end
+
+      it 'renders a 404 with trying to access a cross project page' do
+        message = "This page is unavailable because you are not allowed to read "\
+                  "information across multiple projects."
+
+        get :index
+
+        expect(response).to have_gitlab_http_status(404)
+        expect(response.body).to match(/#{message}/)
+      end
+
+      it 'is skipped when the `if` condition returns false' do
+        expect(controller).to receive(:if_condition).and_return(false)
+
+        get :index
+
+        expect(response).to have_gitlab_http_status(200)
+      end
+
+      it 'is skipped when the `unless` condition returns true' do
+        expect(controller).to receive(:unless_condition).and_return(true)
+
+        get :index
+
+        expect(response).to have_gitlab_http_status(200)
+      end
+
+      it 'correctly renders an action that does not require cross project access' do
+        get :show, id: 'nothing'
+
+        expect(response).to have_gitlab_http_status(200)
+      end
+    end
+
+    describe '#skip_cross_project_access_check' do
+      controller(ApplicationController) do
+        # `described_class` is not available in this context
+        include ControllerWithCrossProjectAccessCheck # rubocop:disable RSpec/DescribedClass
+
+        requires_cross_project_access
+
+        skip_cross_project_access_check index: true, show: false,
+                                        unless: -> { unless_condition },
+                                        if: -> { if_condition }
+
+        def index
+          render nothing: true
+        end
+
+        def show
+          render nothing: true
+        end
+
+        def edit
+          render nothing: true
+        end
+
+        def unless_condition
+          false
+        end
+
+        def if_condition
+          true
+        end
+      end
+
+      it 'renders a success when the check is skipped' do
+        get :index
+
+        expect(response).to have_gitlab_http_status(200)
+      end
+
+      it 'is executed when the `if` condition returns false' do
+        expect(controller).to receive(:if_condition).and_return(false)
+
+        get :index
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+
+      it 'is executed when the `unless` condition returns true' do
+        expect(controller).to receive(:unless_condition).and_return(true)
+
+        get :index
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+
+      it 'does not skip the check on an action that is not skipped' do
+        get :show, id: 'hello'
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+
+      it 'does not skip the check on an action that was not defined to skip' do
+        get :edit, id: 'hello'
+
+        expect(response).to have_gitlab_http_status(404)
+      end
+    end
+  end
+end
diff --git a/spec/controllers/concerns/issuable_collections_spec.rb b/spec/controllers/concerns/issuable_collections_spec.rb
index d7825364ed5..c1f42bbb9d7 100644
--- a/spec/controllers/concerns/issuable_collections_spec.rb
+++ b/spec/controllers/concerns/issuable_collections_spec.rb
@@ -8,6 +8,10 @@ describe IssuableCollections do
       def self.helper_method(name); end
 
       include IssuableCollections
+
+      def finder_type
+        IssuesFinder
+      end
     end
 
     controller = klass.new
diff --git a/spec/controllers/import/bitbucket_controller_spec.rb b/spec/controllers/import/bitbucket_controller_spec.rb
index e8707760a5a..2be46049aab 100644
--- a/spec/controllers/import/bitbucket_controller_spec.rb
+++ b/spec/controllers/import/bitbucket_controller_spec.rb
@@ -84,20 +84,42 @@ describe Import::BitbucketController do
       double(slug: "vim", owner: bitbucket_username, name: 'vim')
     end
 
+    let(:project) { create(:project) }
+
     before do
       allow_any_instance_of(Bitbucket::Client).to receive(:repo).and_return(bitbucket_repo)
       allow_any_instance_of(Bitbucket::Client).to receive(:user).and_return(bitbucket_user)
       assign_session_tokens
     end
 
+    it 'returns 200 response when the project is imported successfully' do
+      allow(Gitlab::BitbucketImport::ProjectCreator)
+        .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
+        .and_return(double(execute: project))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'returns 422 response when the project could not be imported' do
+      allow(Gitlab::BitbucketImport::ProjectCreator)
+        .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
+        .and_return(double(execute: build(:project)))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(422)
+    end
+
     context "when the repository owner is the Bitbucket user" do
       context "when the Bitbucket user and GitLab user's usernames match" do
         it "takes the current user's namespace" do
           expect(Gitlab::BitbucketImport::ProjectCreator)
             .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -107,9 +129,9 @@ describe Import::BitbucketController do
         it "takes the current user's namespace" do
           expect(Gitlab::BitbucketImport::ProjectCreator)
             .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -120,7 +142,7 @@ describe Import::BitbucketController do
           allow(controller).to receive(:current_user).and_return(user)
           allow(user).to receive(:can?).and_return(false)
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
     end
@@ -143,9 +165,9 @@ describe Import::BitbucketController do
           it "takes the existing namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, existing_namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -154,7 +176,7 @@ describe Import::BitbucketController do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .not_to receive(:new)
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
@@ -163,17 +185,17 @@ describe Import::BitbucketController do
         context "when current user can create namespaces" do
           it "creates the namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.to change(Namespace, :count).by(1)
+            expect { post :create, format: :json }.to change(Namespace, :count).by(1)
           end
 
           it "takes the new namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, an_instance_of(Group), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -184,23 +206,23 @@ describe Import::BitbucketController do
 
           it "doesn't create the namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.not_to change(Namespace, :count)
+            expect { post :create, format: :json }.not_to change(Namespace, :count)
           end
 
           it "takes the current user's namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
     end
 
-    context 'user has chosen an existing nested namespace and name for the project' do
+    context 'user has chosen an existing nested namespace and name for the project', :postgresql do
       let(:parent_namespace) { create(:group, name: 'foo', owner: user) }
       let(:nested_namespace) { create(:group, name: 'bar', parent: parent_namespace) }
       let(:test_name) { 'test_name' }
@@ -212,63 +234,77 @@ describe Import::BitbucketController do
       it 'takes the selected namespace and name' do
         expect(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, nested_namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: nested_namespace.full_path, new_name: test_name, format: :js }
+        post :create, { target_namespace: nested_namespace.full_path, new_name: test_name, format: :json }
       end
     end
 
-    context 'user has chosen a non-existent nested namespaces and name for the project' do
+    context 'user has chosen a non-existent nested namespaces and name for the project', :postgresql do
       let(:test_name) { 'test_name' }
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json }
       end
 
       it 'creates the namespaces' do
         allow(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        expect { post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js } }
+        expect { post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json } }
           .to change { Namespace.count }.by(2)
       end
 
       it 'new namespace has the right parent' do
         allow(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json }
 
         expect(Namespace.find_by_path_or_name('bar').parent.path).to eq('foo')
       end
     end
 
-    context 'user has chosen existent and non-existent nested namespaces and name for the project' do
+    context 'user has chosen existent and non-existent nested namespaces and name for the project', :postgresql do
       let(:test_name) { 'test_name' }
       let!(:parent_namespace) { create(:group, name: 'foo', owner: user) }
 
+      before do
+        parent_namespace.add_owner(user)
+      end
+
       it 'takes the selected namespace and name' do
         expect(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :json }
       end
 
       it 'creates the namespaces' do
         allow(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js } }
+        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :json } }
           .to change { Namespace.count }.by(2)
       end
     end
+
+    context 'when user can not create projects in the chosen namespace' do
+      it 'returns 422 response' do
+        other_namespace = create(:group, name: 'other_namespace')
+
+        post :create, { target_namespace: other_namespace.name, format: :json }
+
+        expect(response).to have_gitlab_http_status(422)
+      end
+    end
   end
 end
diff --git a/spec/controllers/import/gitlab_controller_spec.rb b/spec/controllers/import/gitlab_controller_spec.rb
index faf1e6f63ea..e958be077c2 100644
--- a/spec/controllers/import/gitlab_controller_spec.rb
+++ b/spec/controllers/import/gitlab_controller_spec.rb
@@ -57,6 +57,7 @@ describe Import::GitlabController do
   end
 
   describe "POST create" do
+    let(:project) { create(:project) }
     let(:gitlab_username) { user.username }
     let(:gitlab_user) do
       { username: gitlab_username }.with_indifferent_access
@@ -75,14 +76,34 @@ describe Import::GitlabController do
       assign_session_token
     end
 
+    it 'returns 200 response when the project is imported successfully' do
+      allow(Gitlab::GitlabImport::ProjectCreator)
+        .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
+        .and_return(double(execute: project))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'returns 422 response when the project could not be imported' do
+      allow(Gitlab::GitlabImport::ProjectCreator)
+        .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
+        .and_return(double(execute: build(:project)))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(422)
+    end
+
     context "when the repository owner is the GitLab.com user" do
       context "when the GitLab.com user and GitLab server user's usernames match" do
         it "takes the current user's namespace" do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -92,9 +113,9 @@ describe Import::GitlabController do
         it "takes the current user's namespace" do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
     end
@@ -118,9 +139,9 @@ describe Import::GitlabController do
           it "takes the existing namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .to receive(:new).with(gitlab_repo, existing_namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -129,7 +150,7 @@ describe Import::GitlabController do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .not_to receive(:new)
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
@@ -138,17 +159,17 @@ describe Import::GitlabController do
         context "when current user can create namespaces" do
           it "creates the namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.to change(Namespace, :count).by(1)
+            expect { post :create, format: :json }.to change(Namespace, :count).by(1)
           end
 
           it "takes the new namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .to receive(:new).with(gitlab_repo, an_instance_of(Group), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -159,22 +180,22 @@ describe Import::GitlabController do
 
           it "doesn't create the namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.not_to change(Namespace, :count)
+            expect { post :create, format: :json }.not_to change(Namespace, :count)
           end
 
           it "takes the current user's namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
 
-      context 'user has chosen an existing nested namespace for the project' do
+      context 'user has chosen an existing nested namespace for the project', :postgresql do
         let(:parent_namespace) { create(:group, name: 'foo', owner: user) }
         let(:nested_namespace) { create(:group, name: 'bar', parent: parent_namespace) }
 
@@ -185,64 +206,78 @@ describe Import::GitlabController do
         it 'takes the selected namespace and name' do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, nested_namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: nested_namespace.full_path, format: :js }
+          post :create, { target_namespace: nested_namespace.full_path, format: :json }
         end
       end
 
-      context 'user has chosen a non-existent nested namespaces for the project' do
+      context 'user has chosen a non-existent nested namespaces for the project', :postgresql do
         let(:test_name) { 'test_name' }
 
         it 'takes the selected namespace and name' do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: 'foo/bar', format: :js }
+          post :create, { target_namespace: 'foo/bar', format: :json }
         end
 
         it 'creates the namespaces' do
           allow(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          expect { post :create, { target_namespace: 'foo/bar', format: :js } }
+          expect { post :create, { target_namespace: 'foo/bar', format: :json } }
             .to change { Namespace.count }.by(2)
         end
 
         it 'new namespace has the right parent' do
           allow(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: 'foo/bar', format: :js }
+          post :create, { target_namespace: 'foo/bar', format: :json }
 
           expect(Namespace.find_by_path_or_name('bar').parent.path).to eq('foo')
         end
       end
 
-      context 'user has chosen existent and non-existent nested namespaces and name for the project' do
+      context 'user has chosen existent and non-existent nested namespaces and name for the project', :postgresql do
         let(:test_name) { 'test_name' }
         let!(:parent_namespace) { create(:group, name: 'foo', owner: user) }
 
+        before do
+          parent_namespace.add_owner(user)
+        end
+
         it 'takes the selected namespace and name' do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: 'foo/foobar/bar', format: :js }
+          post :create, { target_namespace: 'foo/foobar/bar', format: :json }
         end
 
         it 'creates the namespaces' do
           allow(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          expect { post :create, { target_namespace: 'foo/foobar/bar', format: :js } }
+          expect { post :create, { target_namespace: 'foo/foobar/bar', format: :json } }
             .to change { Namespace.count }.by(2)
         end
       end
+
+      context 'when user can not create projects in the chosen namespace' do
+        it 'returns 422 response' do
+          other_namespace = create(:group, name: 'other_namespace')
+
+          post :create, { target_namespace: other_namespace.name, format: :json }
+
+          expect(response).to have_gitlab_http_status(422)
+        end
+      end
     end
   end
 end
diff --git a/spec/controllers/profiles_controller_spec.rb b/spec/controllers/profiles_controller_spec.rb
index d380978b86e..03cbbb21e62 100644
--- a/spec/controllers/profiles_controller_spec.rb
+++ b/spec/controllers/profiles_controller_spec.rb
@@ -69,9 +69,8 @@ describe ProfilesController, :request_store do
 
   describe 'PUT update_username' do
     let(:namespace) { user.namespace }
-    let(:project) { create(:project_empty_repo, namespace: namespace) }
     let(:gitlab_shell) { Gitlab::Shell.new }
-    let(:new_username) { 'renamedtosomethingelse' }
+    let(:new_username) { generate(:username) }
 
     it 'allows username change' do
       sign_in(user)
@@ -85,16 +84,39 @@ describe ProfilesController, :request_store do
       expect(user.username).to eq(new_username)
     end
 
-    it 'moves dependent projects to new namespace' do
-      sign_in(user)
+    context 'with legacy storage' do
+      it 'moves dependent projects to new namespace' do
+        project = create(:project_empty_repo, :legacy_storage, namespace: namespace)
 
-      put :update_username,
-        user: { username: new_username }
+        sign_in(user)
 
-      user.reload
+        put :update_username,
+          user: { username: new_username }
 
-      expect(response.status).to eq(302)
-      expect(gitlab_shell.exists?(project.repository_storage_path, "#{new_username}/#{project.path}.git")).to be_truthy
+        user.reload
+
+        expect(response.status).to eq(302)
+        expect(gitlab_shell.exists?(project.repository_storage_path, "#{new_username}/#{project.path}.git")).to be_truthy
+      end
+    end
+
+    context 'with hashed storage' do
+      it 'keeps repository location unchanged on disk' do
+        project = create(:project_empty_repo, namespace: namespace)
+
+        before_disk_path = project.disk_path
+
+        sign_in(user)
+
+        put :update_username,
+          user: { username: new_username }
+
+        user.reload
+
+        expect(response.status).to eq(302)
+        expect(gitlab_shell.exists?(project.repository_storage_path, "#{project.disk_path}.git")).to be_truthy
+        expect(before_disk_path).to eq(project.disk_path)
+      end
     end
   end
 end
diff --git a/spec/controllers/projects/clusters/gcp_controller_spec.rb b/spec/controllers/projects/clusters/gcp_controller_spec.rb
index 775f9db1c6e..e14ba29fa70 100644
--- a/spec/controllers/projects/clusters/gcp_controller_spec.rb
+++ b/spec/controllers/projects/clusters/gcp_controller_spec.rb
@@ -161,7 +161,7 @@ describe Projects::Clusters::GcpController do
           it 'renders the cluster form with an error' do
             go
 
-            expect(response).to set_flash[:alert]
+            expect(response).to set_flash.now[:alert]
             expect(response).to render_template('new')
           end
         end
diff --git a/spec/controllers/projects/merge_requests/creations_controller_spec.rb b/spec/controllers/projects/merge_requests/creations_controller_spec.rb
index 92db7284e0e..24310b847e8 100644
--- a/spec/controllers/projects/merge_requests/creations_controller_spec.rb
+++ b/spec/controllers/projects/merge_requests/creations_controller_spec.rb
@@ -17,7 +17,7 @@ describe Projects::MergeRequests::CreationsController do
 
   before do
     fork_project.add_master(user)
-
+    Projects::ForkService.new(project, user).execute(fork_project)
     sign_in(user)
   end
 
@@ -125,4 +125,66 @@ describe Projects::MergeRequests::CreationsController do
       end
     end
   end
+
+  describe 'GET #branch_to' do
+    before do
+      allow(Ability).to receive(:allowed?).and_call_original
+    end
+
+    it 'fetches the commit if a user has access' do
+      expect(Ability).to receive(:allowed?).with(user, :read_project, project) { true }
+
+      get :branch_to,
+          namespace_id: fork_project.namespace,
+          project_id: fork_project,
+          target_project_id: project.id,
+          ref: 'master'
+
+      expect(assigns(:commit)).not_to be_nil
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'does not load the commit when the user cannot read the project' do
+      expect(Ability).to receive(:allowed?).with(user, :read_project, project) { false }
+
+      get :branch_to,
+          namespace_id: fork_project.namespace,
+          project_id: fork_project,
+          target_project_id: project.id,
+          ref: 'master'
+
+      expect(assigns(:commit)).to be_nil
+      expect(response).to have_gitlab_http_status(200)
+    end
+  end
+
+  describe 'GET #update_branches' do
+    before do
+      allow(Ability).to receive(:allowed?).and_call_original
+    end
+
+    it 'lists the branches of another fork if the user has access' do
+      expect(Ability).to receive(:allowed?).with(user, :read_project, project) { true }
+
+      get :update_branches,
+          namespace_id: fork_project.namespace,
+          project_id: fork_project,
+          target_project_id: project.id
+
+      expect(assigns(:target_branches)).not_to be_empty
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'does not list branches when the user cannot read the project' do
+      expect(Ability).to receive(:allowed?).with(user, :read_project, project) { false }
+
+      get :update_branches,
+          namespace_id: fork_project.namespace,
+          project_id: fork_project,
+          target_project_id: project.id
+
+      expect(response).to have_gitlab_http_status(200)
+      expect(assigns(:target_branches)).to eq([])
+    end
+  end
 end
diff --git a/spec/controllers/projects/pages_domains_controller_spec.rb b/spec/controllers/projects/pages_domains_controller_spec.rb
index e9e7d357d9c..2192fd5cae2 100644
--- a/spec/controllers/projects/pages_domains_controller_spec.rb
+++ b/spec/controllers/projects/pages_domains_controller_spec.rb
@@ -46,7 +46,46 @@ describe Projects::PagesDomainsController do
         post(:create, request_params.merge(pages_domain: pages_domain_params))
       end.to change { PagesDomain.count }.by(1)
 
-      expect(response).to redirect_to(project_pages_path(project))
+      created_domain = PagesDomain.reorder(:id).last
+
+      expect(created_domain).to be_present
+      expect(response).to redirect_to(project_pages_domain_path(project, created_domain))
+    end
+  end
+
+  describe 'POST verify' do
+    let(:params) { request_params.merge(id: pages_domain.domain) }
+
+    def stub_service
+      service = double(:service)
+
+      expect(VerifyPagesDomainService).to receive(:new) { service }
+
+      service
+    end
+
+    it 'handles verification success' do
+      expect(stub_service).to receive(:execute).and_return(status: :success)
+
+      post :verify, params
+
+      expect(response).to redirect_to project_pages_domain_path(project, pages_domain)
+      expect(flash[:notice]).to eq('Successfully verified domain ownership')
+    end
+
+    it 'handles verification failure' do
+      expect(stub_service).to receive(:execute).and_return(status: :failed)
+
+      post :verify, params
+
+      expect(response).to redirect_to project_pages_domain_path(project, pages_domain)
+      expect(flash[:alert]).to eq('Failed to verify domain ownership')
+    end
+
+    it 'returns a 404 response for an unknown domain' do
+      post :verify, request_params.merge(id: 'unknown-domain')
+
+      expect(response).to have_gitlab_http_status(404)
     end
   end
 
diff --git a/spec/controllers/projects/prometheus_controller_spec.rb b/spec/controllers/projects/prometheus/metrics_controller_spec.rb
index bbfe78d305a..f17f819feee 100644
--- a/spec/controllers/projects/prometheus_controller_spec.rb
+++ b/spec/controllers/projects/prometheus/metrics_controller_spec.rb
@@ -1,20 +1,20 @@
-require('spec_helper')
+require 'spec_helper'
 
-describe Projects::PrometheusController do
+describe Projects::Prometheus::MetricsController do
   let(:user) { create(:user) }
-  let!(:project) { create(:project) }
+  let(:project) { create(:project) }
 
   let(:prometheus_service) { double('prometheus_service') }
 
   before do
     allow(controller).to receive(:project).and_return(project)
-    allow(project).to receive(:prometheus_service).and_return(prometheus_service)
+    allow(project).to receive(:find_or_initialize_service).with('prometheus').and_return(prometheus_service)
 
     project.add_master(user)
     sign_in(user)
   end
 
-  describe 'GET #active_metrics' do
+  describe 'GET #active_common' do
     context 'when prometheus metrics are enabled' do
       context 'when data is not present' do
         before do
@@ -22,7 +22,7 @@ describe Projects::PrometheusController do
         end
 
         it 'returns no content response' do
-          get :active_metrics, project_params(format: :json)
+          get :active_common, project_params(format: :json)
 
           expect(response).to have_gitlab_http_status(204)
         end
@@ -36,7 +36,7 @@ describe Projects::PrometheusController do
         end
 
         it 'returns no content response' do
-          get :active_metrics, project_params(format: :json)
+          get :active_common, project_params(format: :json)
 
           expect(response).to have_gitlab_http_status(200)
           expect(json_response).to eq(sample_response.deep_stringify_keys)
@@ -45,7 +45,7 @@ describe Projects::PrometheusController do
 
       context 'when requesting non json response' do
         it 'returns not found response' do
-          get :active_metrics, project_params
+          get :active_common, project_params
 
           expect(response).to have_gitlab_http_status(404)
         end
diff --git a/spec/controllers/projects/uploads_controller_spec.rb b/spec/controllers/projects/uploads_controller_spec.rb
index d572085661d..eca9baed9c9 100644
--- a/spec/controllers/projects/uploads_controller_spec.rb
+++ b/spec/controllers/projects/uploads_controller_spec.rb
@@ -7,4 +7,12 @@ describe Projects::UploadsController do
   end
 
   it_behaves_like 'handle uploads'
+
+  context 'when the URL the old style, without /-/system' do
+    it 'responds with a redirect to the login page' do
+      get :show, namespace_id: 'project', project_id: 'avatar', filename: 'foo.png', secret: 'bar'
+
+      expect(response).to redirect_to(new_user_session_path)
+    end
+  end
 end
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index 5202ffdd8bb..994da3cd159 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -288,62 +288,82 @@ describe ProjectsController do
     render_views
 
     let(:admin) { create(:admin) }
-    let(:project) { create(:project, :repository) }
 
     before do
       sign_in(admin)
     end
 
-    context 'when only renaming a project path' do
-      it "sets the repository to the right path after a rename" do
-        expect { update_project path: 'renamed_path' }
-          .to change { project.reload.path }
+    shared_examples_for 'updating a project' do
+      context 'when only renaming a project path' do
+        it "sets the repository to the right path after a rename" do
+          original_repository_path = project.repository.path
 
-        expect(project.path).to include 'renamed_path'
-        expect(assigns(:repository).path).to include project.path
-        expect(response).to have_gitlab_http_status(302)
-      end
-    end
+          expect { update_project path: 'renamed_path' }
+            .to change { project.reload.path }
+          expect(project.path).to include 'renamed_path'
 
-    context 'when project has container repositories with tags' do
-      before do
-        stub_container_registry_config(enabled: true)
-        stub_container_registry_tags(repository: /image/, tags: %w[rc1])
-        create(:container_repository, project: project, name: :image)
+          if project.hashed_storage?(:repository)
+            expect(assigns(:repository).path).to eq(original_repository_path)
+          else
+            expect(assigns(:repository).path).to include(project.path)
+          end
+
+          expect(response).to have_gitlab_http_status(302)
+        end
       end
 
-      it 'does not allow to rename the project' do
-        expect { update_project path: 'renamed_path' }
-          .not_to change { project.reload.path }
+      context 'when project has container repositories with tags' do
+        before do
+          stub_container_registry_config(enabled: true)
+          stub_container_registry_tags(repository: /image/, tags: %w[rc1])
+          create(:container_repository, project: project, name: :image)
+        end
 
-        expect(controller).to set_flash[:alert].to(/container registry tags/)
-        expect(response).to have_gitlab_http_status(200)
+        it 'does not allow to rename the project' do
+          expect { update_project path: 'renamed_path' }
+            .not_to change { project.reload.path }
+
+          expect(controller).to set_flash[:alert].to(/container registry tags/)
+          expect(response).to have_gitlab_http_status(200)
+        end
       end
-    end
 
-    it 'updates Fast Forward Merge attributes' do
-      controller.instance_variable_set(:@project, project)
+      it 'updates Fast Forward Merge attributes' do
+        controller.instance_variable_set(:@project, project)
 
-      params = {
-        merge_method: :ff
-      }
+        params = {
+          merge_method: :ff
+        }
 
-      put :update,
-          namespace_id: project.namespace,
-          id: project.id,
-          project: params
+        put :update,
+            namespace_id: project.namespace,
+            id: project.id,
+            project: params
 
-      expect(response).to have_gitlab_http_status(302)
-      params.each do |param, value|
-        expect(project.public_send(param)).to eq(value)
+        expect(response).to have_gitlab_http_status(302)
+        params.each do |param, value|
+          expect(project.public_send(param)).to eq(value)
+        end
+      end
+
+      def update_project(**parameters)
+        put :update,
+            namespace_id: project.namespace.path,
+            id: project.path,
+            project: parameters
       end
     end
 
-    def update_project(**parameters)
-      put :update,
-          namespace_id: project.namespace.path,
-          id: project.path,
-          project: parameters
+    context 'hashed storage' do
+      let(:project) { create(:project, :repository) }
+
+      it_behaves_like 'updating a project'
+    end
+
+    context 'legacy storage' do
+      let(:project) { create(:project, :repository, :legacy_storage) }
+
+      it_behaves_like 'updating a project'
     end
   end
 
diff --git a/spec/controllers/search_controller_spec.rb b/spec/controllers/search_controller_spec.rb
index 37f961d0c94..30c06ddf744 100644
--- a/spec/controllers/search_controller_spec.rb
+++ b/spec/controllers/search_controller_spec.rb
@@ -16,6 +16,32 @@ describe SearchController do
     expect(assigns[:search_objects].first).to eq note
   end
 
+  context 'when the user cannot read cross project' do
+    before do
+      allow(Ability).to receive(:allowed?).and_call_original
+      allow(Ability).to receive(:allowed?)
+                          .with(user, :read_cross_project, :global) { false }
+    end
+
+    it 'still allows accessing the search page' do
+      get :show
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'still blocks searches without a project_id' do
+      get :show, search: 'hello'
+
+      expect(response).to have_gitlab_http_status(404)
+    end
+
+    it 'allows searches with a project_id' do
+      get :show, search: 'hello', project_id: create(:project, :public).id
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+  end
+
   context 'on restricted projects' do
     context 'when signed out' do
       before do
diff --git a/spec/controllers/users_controller_spec.rb b/spec/controllers/users_controller_spec.rb
index 2898c4b119e..b0acf4a49ac 100644
--- a/spec/controllers/users_controller_spec.rb
+++ b/spec/controllers/users_controller_spec.rb
@@ -74,6 +74,31 @@ describe UsersController do
         end
       end
     end
+
+    context 'json with events' do
+      let(:project) { create(:project) }
+      before do
+        project.add_developer(user)
+        Gitlab::DataBuilder::Push.build_sample(project, user)
+
+        sign_in(user)
+      end
+
+      it 'loads events' do
+        get :show, username: user, format: :json
+
+        expect(assigns(:events)).not_to be_empty
+      end
+
+      it 'hides events if the user cannot read cross project' do
+        allow(Ability).to receive(:allowed?).and_call_original
+        expect(Ability).to receive(:allowed?).with(user, :read_cross_project) { false }
+
+        get :show, username: user, format: :json
+
+        expect(assigns(:events)).to be_empty
+      end
+    end
   end
 
   describe 'GET #calendar' do