Add latest changes from gitlab-org/gitlab@15-9-stable-eev15.9.0-rc42

13 files changed, 603 insertions, 26 deletions

diff --git a/spec/requests/api/graphql/mutations/achievements/create_spec.rb b/spec/requests/api/graphql/mutations/achievements/create_spec.rb
index 1713f050540..3082629d40f 100644
--- a/spec/requests/api/graphql/mutations/achievements/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/achievements/create_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Mutations::Achievements::Create, feature_category: :users do
+RSpec.describe Mutations::Achievements::Create, feature_category: :user_profile do
   include GraphqlHelpers
   include WorkhorseHelpers
 
@@ -13,15 +13,13 @@ RSpec.describe Mutations::Achievements::Create, feature_category: :users do
   let(:mutation) { graphql_mutation(:achievements_create, params) }
   let(:name) { 'Name' }
   let(:description) { 'Description' }
-  let(:revokeable) { false }
   let(:avatar) { fixture_file_upload("spec/fixtures/dk.png") }
   let(:params) do
     {
       namespace_id: group.to_global_id,
       name: name,
       avatar: avatar,
-      description: description,
-      revokeable: revokeable
+      description: description
     }
   end
 
@@ -70,8 +68,7 @@ RSpec.describe Mutations::Achievements::Create, feature_category: :users do
       expect(graphql_data_at(:achievements_create, :achievement)).to match a_hash_including(
         'name' => name,
         'namespace' => a_hash_including('id' => group.to_global_id.to_s),
-        'description' => description,
-        'revokeable' => revokeable
+        'description' => description
       )
     end
   end
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
index 490716ddbe2..55e728b2141 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/add_project_spec.rb
@@ -60,7 +60,7 @@ RSpec.describe 'CiJobTokenScopeAddProject', feature_category: :continuous_integr
         post_graphql_mutation(mutation, current_user: current_user)
         expect(response).to have_gitlab_http_status(:success)
         expect(mutation_response.dig('ciJobTokenScope', 'projects', 'nodes')).not_to be_empty
-      end.to change { Ci::JobToken::Scope.new(project).allows?(target_project) }.from(false).to(true)
+      end.to change { Ci::JobToken::ProjectScopeLink.outbound.count }.by(1)
     end
 
     context 'when invalid target project is provided' do
diff --git a/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb b/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
index 607c6bd85c2..f1296c054f9 100644
--- a/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_token_scope/remove_project_spec.rb
@@ -5,7 +5,13 @@ require 'spec_helper'
 RSpec.describe 'CiJobTokenScopeRemoveProject', feature_category: :continuous_integration do
   include GraphqlHelpers
 
-  let_it_be(:project) { create(:project, ci_outbound_job_token_scope_enabled: true).tap(&:save!) }
+  let_it_be(:project) do
+    create(:project,
+      ci_outbound_job_token_scope_enabled: true,
+      ci_inbound_job_token_scope_enabled: true
+    )
+  end
+
   let_it_be(:target_project) { create(:project) }
 
   let_it_be(:link) do
@@ -16,6 +22,7 @@ RSpec.describe 'CiJobTokenScopeRemoveProject', feature_category: :continuous_int
 
   let(:variables) do
     {
+      direction: 'OUTBOUND',
       project_path: project.full_path,
       target_project_path: target_project.full_path
     }
@@ -61,12 +68,21 @@ RSpec.describe 'CiJobTokenScopeRemoveProject', feature_category: :continuous_int
       target_project.add_guest(current_user)
     end
 
-    it 'removes the target project from the job token scope' do
+    it 'removes the target project from the job token outbound scope' do
       expect do
         post_graphql_mutation(mutation, current_user: current_user)
         expect(response).to have_gitlab_http_status(:success)
         expect(mutation_response.dig('ciJobTokenScope', 'projects', 'nodes')).not_to be_empty
-      end.to change { Ci::JobToken::Scope.new(project).allows?(target_project) }.from(true).to(false)
+      end.to change { Ci::JobToken::ProjectScopeLink.outbound.count }.by(-1)
+    end
+
+    it 'responds successfully' do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(graphql_errors).to be_nil
+      expect(graphql_data_at(:ciJobTokenScopeRemoveProject, :ciJobTokenScope, :projects, :nodes))
+        .to contain_exactly({ 'path' => project.path })
     end
 
     context 'when invalid target project is provided' do
diff --git a/spec/requests/api/graphql/mutations/ci/pipeline_schedule_play_spec.rb b/spec/requests/api/graphql/mutations/ci/pipeline_schedule_play_spec.rb
index 0e43fa024f3..492c6946c99 100644
--- a/spec/requests/api/graphql/mutations/ci/pipeline_schedule_play_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/pipeline_schedule_play_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'PipelineSchedulePlay', feature_category: :continuious_integration do
+RSpec.describe 'PipelineSchedulePlay', feature_category: :continuous_integration do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
@@ -42,14 +42,18 @@ RSpec.describe 'PipelineSchedulePlay', feature_category: :continuious_integratio
     end
   end
 
-  context 'when authorized' do
+  context 'when authorized', :sidekiq_inline do
     before do
       project.add_maintainer(user)
       pipeline_schedule.update_columns(next_run_at: 2.hours.ago)
     end
 
     context 'when mutation succeeds' do
+      let(:service_response) { instance_double('ServiceResponse', payload: new_pipeline) }
+      let(:new_pipeline) { instance_double('Ci::Pipeline', persisted?: true) }
+
       it do
+        expect(Ci::CreatePipelineService).to receive_message_chain(:new, :execute).and_return(service_response)
         post_graphql_mutation(mutation, current_user: user)
 
         expect(mutation_response['pipelineSchedule']['id']).to include(pipeline_schedule.id.to_s)
@@ -61,14 +65,10 @@ RSpec.describe 'PipelineSchedulePlay', feature_category: :continuious_integratio
     end
 
     context 'when mutation fails' do
-      before do
-        allow(RunPipelineScheduleWorker).to receive(:perform_async).and_return(nil)
-      end
-
       it do
         expect(RunPipelineScheduleWorker)
           .to receive(:perform_async)
-          .with(pipeline_schedule.id, user.id)
+          .with(pipeline_schedule.id, user.id).and_return(nil)
 
         post_graphql_mutation(mutation, current_user: user)
 
diff --git a/spec/requests/api/graphql/mutations/ci/pipeline_schedule_update_spec.rb b/spec/requests/api/graphql/mutations/ci/pipeline_schedule_update_spec.rb
new file mode 100644
index 00000000000..c1da231a4a6
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/ci/pipeline_schedule_update_spec.rb
@@ -0,0 +1,151 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'PipelineScheduleUpdate', feature_category: :continuous_integration do
+  include GraphqlHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project) { create(:project, :public, :repository) }
+  let_it_be(:pipeline_schedule) { create(:ci_pipeline_schedule, project: project, owner: user) }
+
+  let(:mutation) do
+    variables = {
+      id: pipeline_schedule.to_global_id.to_s,
+      **pipeline_schedule_parameters
+    }
+
+    graphql_mutation(
+      :pipeline_schedule_update,
+      variables,
+      <<-QL
+        pipelineSchedule {
+          id
+          description
+          cron
+          refForDisplay
+          active
+          cronTimezone
+          variables {
+            nodes {
+              key
+              value
+            }
+          }
+        }
+        errors
+      QL
+    )
+  end
+
+  let(:pipeline_schedule_parameters) { {} }
+  let(:mutation_response) { graphql_mutation_response(:pipeline_schedule_update) }
+
+  context 'when unauthorized' do
+    it 'returns an error' do
+      post_graphql_mutation(mutation, current_user: create(:user))
+
+      expect(graphql_errors).not_to be_empty
+      expect(graphql_errors[0]['message'])
+        .to eq(
+          "The resource that you are attempting to access does not exist " \
+          "or you don't have permission to perform this action"
+        )
+    end
+  end
+
+  context 'when authorized' do
+    before do
+      project.add_developer(user)
+    end
+
+    context 'when success' do
+      let(:pipeline_schedule_parameters) do
+        {
+          description: 'updated_desc',
+          cron: '0 1 * * *',
+          cronTimezone: 'UTC',
+          ref: 'patch-x',
+          active: true,
+          variables: [
+            { key: 'AAA', value: "AAA123", variableType: 'ENV_VAR' }
+          ]
+        }
+      end
+
+      it do
+        post_graphql_mutation(mutation, current_user: user)
+
+        expect(response).to have_gitlab_http_status(:success)
+
+        expect_graphql_errors_to_be_empty
+
+        expect(mutation_response['pipelineSchedule']['id']).to eq(pipeline_schedule.to_global_id.to_s)
+
+        %w[description cron cronTimezone active].each do |key|
+          expect(mutation_response['pipelineSchedule'][key]).to eq(pipeline_schedule_parameters[key.to_sym])
+        end
+
+        expect(mutation_response['pipelineSchedule']['refForDisplay']).to eq(pipeline_schedule_parameters[:ref])
+
+        expect(mutation_response['pipelineSchedule']['variables']['nodes'][0]['key']).to eq('AAA')
+        expect(mutation_response['pipelineSchedule']['variables']['nodes'][0]['value']).to eq('AAA123')
+      end
+    end
+
+    context 'when failure' do
+      context 'when params are invalid' do
+        let(:pipeline_schedule_parameters) do
+          {
+            description: '',
+            cron: 'abc',
+            cronTimezone: 'cCc',
+            ref: '',
+            active: true,
+            variables: []
+          }
+        end
+
+        it do
+          post_graphql_mutation(mutation, current_user: user)
+
+          expect(response).to have_gitlab_http_status(:success)
+
+          expect(mutation_response['errors'])
+            .to match_array(
+              [
+                "Cron  is invalid syntax",
+                "Cron timezone  is invalid syntax",
+                "Ref can't be blank",
+                "Description can't be blank"
+              ]
+            )
+        end
+      end
+
+      context 'when params have duplicate variables' do
+        let(:pipeline_schedule_parameters) do
+          {
+            variables: [
+              { key: 'AAA', value: "AAA123", variableType: 'ENV_VAR' },
+              { key: 'AAA', value: "AAA123", variableType: 'ENV_VAR' }
+            ]
+          }
+        end
+
+        it 'returns error' do
+          post_graphql_mutation(mutation, current_user: user)
+
+          expect(response).to have_gitlab_http_status(:success)
+
+          expect(mutation_response['errors'])
+            .to match_array(
+              [
+                "Variables have duplicate values (AAA)"
+              ]
+            )
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb b/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb
index 7a6ee7c2ecc..99e55c44773 100644
--- a/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/project_ci_cd_settings_update_spec.rb
@@ -18,7 +18,8 @@ RSpec.describe 'ProjectCiCdSettingsUpdate', feature_category: :continuous_integr
       full_path: project.full_path,
       keep_latest_artifact: false,
       job_token_scope_enabled: false,
-      inbound_job_token_scope_enabled: false
+      inbound_job_token_scope_enabled: false,
+      opt_in_jwt: true
     }
   end
 
@@ -117,6 +118,15 @@ RSpec.describe 'ProjectCiCdSettingsUpdate', feature_category: :continuous_integr
       end
     end
 
+    it 'updates ci_opt_in_jwt' do
+      post_graphql_mutation(mutation, current_user: user)
+
+      project.reload
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(project.ci_opt_in_jwt).to eq(true)
+    end
+
     context 'when bad arguments are provided' do
       let(:variables) { { full_path: '', keep_latest_artifact: false } }
 
diff --git a/spec/requests/api/graphql/mutations/issues/bulk_update_spec.rb b/spec/requests/api/graphql/mutations/issues/bulk_update_spec.rb
new file mode 100644
index 00000000000..b9c83311908
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/issues/bulk_update_spec.rb
@@ -0,0 +1,177 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Bulk update issues', feature_category: :team_planning do
+  include GraphqlHelpers
+
+  let_it_be(:developer) { create(:user) }
+  let_it_be(:group) { create(:group).tap { |group| group.add_developer(developer) } }
+  let_it_be(:project) { create(:project, group: group) }
+  let_it_be(:updatable_issues, reload: true) { create_list(:issue, 2, project: project) }
+  let_it_be(:milestone) { create(:milestone, group: group) }
+
+  let(:parent) { project }
+  let(:max_issues) { Mutations::Issues::BulkUpdate::MAX_ISSUES }
+  let(:mutation) { graphql_mutation(:issues_bulk_update, base_arguments.merge(additional_arguments)) }
+  let(:mutation_response) { graphql_mutation_response(:issues_bulk_update) }
+  let(:current_user) { developer }
+  let(:base_arguments) { { parent_id: parent.to_gid.to_s, ids: updatable_issues.map { |i| i.to_gid.to_s } } }
+
+  let(:additional_arguments) do
+    {
+      assignee_ids: [current_user.to_gid.to_s],
+      milestone_id: milestone.to_gid.to_s
+    }
+  end
+
+  context 'when the `bulk_update_issues_mutation` feature flag is disabled' do
+    before do
+      stub_feature_flags(bulk_update_issues_mutation: false)
+    end
+
+    it 'returns a resource not available error' do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(graphql_errors).to contain_exactly(
+        hash_including(
+          'message' => '`bulk_update_issues_mutation` feature flag is disabled.'
+        )
+      )
+    end
+  end
+
+  context 'when user can not update all issues' do
+    let_it_be(:forbidden_issue) { create(:issue) }
+
+    it 'updates only issues that the user can update' do
+      expect do
+        post_graphql_mutation(mutation, current_user: current_user)
+
+        updatable_issues.each(&:reset)
+        forbidden_issue.reset
+      end.to change { updatable_issues.flat_map(&:assignee_ids) }.from([]).to([current_user.id] * 2).and(
+        not_change(forbidden_issue, :assignee_ids).from([])
+      )
+
+      expect(mutation_response).to include(
+        'updatedIssueCount' => updatable_issues.count
+      )
+    end
+  end
+
+  context 'when user can update all issues' do
+    it 'updates all issues' do
+      expect do
+        post_graphql_mutation(mutation, current_user: current_user)
+        updatable_issues.each(&:reload)
+      end.to change { updatable_issues.flat_map(&:assignee_ids) }.from([]).to([current_user.id] * 2)
+        .and(change { updatable_issues.map(&:milestone_id) }.from([nil] * 2).to([milestone.id] * 2))
+
+      expect(mutation_response).to include(
+        'updatedIssueCount' => updatable_issues.count
+      )
+    end
+
+    context 'when current user cannot read the specified project' do
+      let_it_be(:parent) { create(:project, :private) }
+
+      it 'returns a resource not found error' do
+        post_graphql_mutation(mutation, current_user: current_user)
+
+        expect(graphql_errors).to contain_exactly(
+          hash_including(
+            'message' => "The resource that you are attempting to access does not exist or you don't have " \
+                         'permission to perform this action'
+          )
+        )
+      end
+    end
+
+    context 'when scoping to a parent group' do
+      let(:parent) { group }
+
+      it 'updates all issues' do
+        expect do
+          post_graphql_mutation(mutation, current_user: current_user)
+          updatable_issues.each(&:reload)
+        end.to change { updatable_issues.flat_map(&:assignee_ids) }.from([]).to([current_user.id] * 2)
+          .and(change { updatable_issues.map(&:milestone_id) }.from([nil] * 2).to([milestone.id] * 2))
+
+        expect(mutation_response).to include(
+          'updatedIssueCount' => updatable_issues.count
+        )
+      end
+
+      context 'when current user cannot read the specified group' do
+        let(:parent) { create(:group, :private) }
+
+        it 'returns a resource not found error' do
+          post_graphql_mutation(mutation, current_user: current_user)
+
+          expect(graphql_errors).to contain_exactly(
+            hash_including(
+              'message' => "The resource that you are attempting to access does not exist or you don't have " \
+                           'permission to perform this action'
+            )
+          )
+        end
+      end
+    end
+
+    context 'when setting arguments to null or none' do
+      let(:additional_arguments) { { assignee_ids: [], milestone_id: nil } }
+
+      before do
+        updatable_issues.each do |issue|
+          issue.update!(assignees: [current_user], milestone: milestone)
+        end
+      end
+
+      it 'updates all issues' do
+        expect do
+          post_graphql_mutation(mutation, current_user: current_user)
+          updatable_issues.each(&:reload)
+        end.to change { updatable_issues.flat_map(&:assignee_ids) }.from([current_user.id] * 2).to([])
+          .and(change { updatable_issues.map(&:milestone_id) }.from([milestone.id] * 2).to([nil] * 2))
+
+        expect(mutation_response).to include(
+          'updatedIssueCount' => updatable_issues.count
+        )
+      end
+    end
+  end
+
+  context 'when update service returns an error' do
+    before do
+      allow_next_instance_of(Issuable::BulkUpdateService) do |update_service|
+        allow(update_service).to receive(:execute).and_return(
+          ServiceResponse.error(message: 'update error', http_status: 422) # rubocop:disable Gitlab/ServiceResponse
+        )
+      end
+    end
+
+    it 'returns an error message' do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(graphql_data.dig('issuesBulkUpdate', 'errors')).to contain_exactly('update error')
+    end
+  end
+
+  context 'when trying to update more than the max allowed' do
+    before do
+      stub_const('Mutations::Issues::BulkUpdate::MAX_ISSUES', updatable_issues.count - 1)
+    end
+
+    it "restricts updating more than #{Mutations::Issues::BulkUpdate::MAX_ISSUES} issues at the same time" do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(graphql_errors).to contain_exactly(
+        hash_including(
+          'message' =>
+            format(_('No more than %{max_issues} issues can be updated at the same time'), max_issues: max_issues)
+        )
+      )
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb
index 3907ebad9ce..1898ee5a62d 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb
@@ -63,4 +63,20 @@ RSpec.describe 'Setting milestone of a merge request', feature_category: :code_r
       expect(mutation_response['mergeRequest']['milestone']).to be_nil
     end
   end
+
+  context 'when passing an invalid milestone_id' do
+    let(:input) { { milestone_id: GitlabSchema.id_from_object(create(:milestone)).to_s } }
+
+    it 'does not set the milestone' do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(graphql_errors).to include(
+        a_hash_including(
+          'message' => "The resource that you are attempting to access does not exist " \
+                       "or you don't have permission to perform this action"
+        )
+      )
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/mutations/notes/create/note_spec.rb b/spec/requests/api/graphql/mutations/notes/create/note_spec.rb
index 00e25909746..a6253ba424b 100644
--- a/spec/requests/api/graphql/mutations/notes/create/note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/create/note_spec.rb
@@ -122,8 +122,8 @@ RSpec.describe 'Adding a Note', feature_category: :team_planning do
           let(:variables_extra) { {} }
 
           before do
-            stub_const('WorkItems::Type::BASE_TYPES', { issue: { name: 'NoNotesWidget', enum_value: 0 } })
-            stub_const('WorkItems::Type::WIDGETS_FOR_TYPE', { issue: [::WorkItems::Widgets::Description] })
+            WorkItems::Type.default_by_type(:issue).widget_definitions.find_by_widget_type(:notes)
+              .update!(disabled: true)
           end
 
           it_behaves_like 'a Note mutation that does not create a Note'
diff --git a/spec/requests/api/graphql/mutations/notes/destroy_spec.rb b/spec/requests/api/graphql/mutations/notes/destroy_spec.rb
index eb45e2aa033..f40518a574b 100644
--- a/spec/requests/api/graphql/mutations/notes/destroy_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/destroy_spec.rb
@@ -57,8 +57,7 @@ RSpec.describe 'Destroying a Note', feature_category: :team_planning do
 
     context 'without notes widget' do
       before do
-        stub_const('WorkItems::Type::BASE_TYPES', { issue: { name: 'NoNotesWidget', enum_value: 0 } })
-        stub_const('WorkItems::Type::WIDGETS_FOR_TYPE', { issue: [::WorkItems::Widgets::Description] })
+        WorkItems::Type.default_by_type(:issue).widget_definitions.find_by_widget_type(:notes).update!(disabled: true)
       end
 
       it 'does not update the Note' do
diff --git a/spec/requests/api/graphql/mutations/notes/update/note_spec.rb b/spec/requests/api/graphql/mutations/notes/update/note_spec.rb
index dff8a87314b..7918bc860fe 100644
--- a/spec/requests/api/graphql/mutations/notes/update/note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/update/note_spec.rb
@@ -50,8 +50,7 @@ RSpec.describe 'Updating a Note', feature_category: :team_planning do
 
       context 'without notes widget' do
         before do
-          stub_const('WorkItems::Type::BASE_TYPES', { issue: { name: 'NoNotesWidget', enum_value: 0 } })
-          stub_const('WorkItems::Type::WIDGETS_FOR_TYPE', { issue: [::WorkItems::Widgets::Description] })
+          WorkItems::Type.default_by_type(:issue).widget_definitions.find_by_widget_type(:notes).update!(disabled: true)
         end
 
         it 'does not update the Note' do
diff --git a/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb b/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb
index 31d17401b9e..967ad75c906 100644
--- a/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/user_preferences/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Mutations::UserPreferences::Update, feature_category: :users do
+RSpec.describe Mutations::UserPreferences::Update, feature_category: :user_profile do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/work_items/update_spec.rb b/spec/requests/api/graphql/mutations/work_items/update_spec.rb
index b33a394d023..ddd294e8f82 100644
--- a/spec/requests/api/graphql/mutations/work_items/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/work_items/update_spec.rb
@@ -127,7 +127,9 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
       let(:fields) do
         <<~FIELDS
         workItem {
+          title
           description
+          state
           widgets {
             type
             ... on WorkItemWidgetDescription {
@@ -179,6 +181,9 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
                   nodes { id }
                 }
               }
+              ... on WorkItemWidgetDescription {
+                description
+              }
             }
           }
           errors
@@ -201,6 +206,12 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
         let(:expected_labels) { [] }
 
         it_behaves_like 'mutation updating work item labels'
+
+        context 'with quick action' do
+          let(:input) { { 'descriptionWidget' => { 'description' => "/remove_label ~\"#{existing_label.name}\"" } } }
+
+          it_behaves_like 'mutation updating work item labels'
+        end
       end
 
       context 'when only adding labels' do
@@ -208,6 +219,14 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
         let(:expected_labels) { [label1, label2, existing_label] }
 
         it_behaves_like 'mutation updating work item labels'
+
+        context 'with quick action' do
+          let(:input) do
+            { 'descriptionWidget' => { 'description' => "/labels ~\"#{label1.name}\" ~\"#{label2.name}\"" } }
+          end
+
+          it_behaves_like 'mutation updating work item labels'
+        end
       end
 
       context 'when adding and removing labels' do
@@ -216,10 +235,47 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
         let(:expected_labels) { [label1, label2] }
 
         it_behaves_like 'mutation updating work item labels'
+
+        context 'with quick action' do
+          let(:input) do
+            { 'descriptionWidget' => { 'description' =>
+                  "/label ~\"#{label1.name}\" ~\"#{label2.name}\"\n/remove_label ~\"#{existing_label.name}\"" } }
+          end
+
+          it_behaves_like 'mutation updating work item labels'
+        end
+      end
+
+      context 'when the work item type does not support labels widget' do
+        let_it_be(:work_item) { create(:work_item, :task, project: project) }
+
+        let(:input) { { 'descriptionWidget' => { 'description' => "Updating labels.\n/labels ~\"#{label1.name}\"" } } }
+
+        before do
+          WorkItems::Type.default_by_type(:task).widget_definitions
+            .find_by_widget_type(:labels).update!(disabled: true)
+        end
+
+        it 'ignores the quick action' do
+          expect do
+            post_graphql_mutation(mutation, current_user: current_user)
+            work_item.reload
+          end.not_to change(work_item.labels, :count)
+
+          expect(work_item.labels).to be_empty
+          expect(mutation_response['workItem']['widgets']).to include(
+            'description' => "Updating labels.",
+            'type' => 'DESCRIPTION'
+          )
+          expect(mutation_response['workItem']['widgets']).not_to include(
+            'labels',
+            'type' => 'LABELS'
+          )
+        end
       end
     end
 
-    context 'with due and start date widget input' do
+    context 'with due and start date widget input', :freeze_time do
       let(:start_date) { Date.today }
       let(:due_date) { 1.week.from_now.to_date }
       let(:fields) do
@@ -231,6 +287,9 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
                 startDate
                 dueDate
               }
+              ... on WorkItemWidgetDescription {
+                description
+              }
             }
           }
           errors
@@ -259,6 +318,81 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
         )
       end
 
+      context 'when using quick action' do
+        let(:due_date) { Date.today }
+
+        context 'when removing due date' do
+          let(:input) { { 'descriptionWidget' => { 'description' => "/remove_due_date" } } }
+
+          before do
+            work_item.update!(due_date: due_date)
+          end
+
+          it 'updates start and due date' do
+            expect do
+              post_graphql_mutation(mutation, current_user: current_user)
+              work_item.reload
+            end.to not_change(work_item, :start_date).and(
+              change(work_item, :due_date).from(due_date).to(nil)
+            )
+
+            expect(response).to have_gitlab_http_status(:success)
+            expect(mutation_response['workItem']['widgets']).to include({
+              'startDate' => nil,
+              'dueDate' => nil,
+              'type' => 'START_AND_DUE_DATE'
+            })
+          end
+        end
+
+        context 'when setting due date' do
+          let(:input) { { 'descriptionWidget' => { 'description' => "/due today" } } }
+
+          it 'updates due date' do
+            expect do
+              post_graphql_mutation(mutation, current_user: current_user)
+              work_item.reload
+            end.to not_change(work_item, :start_date).and(
+              change(work_item, :due_date).from(nil).to(due_date)
+            )
+
+            expect(response).to have_gitlab_http_status(:success)
+            expect(mutation_response['workItem']['widgets']).to include({
+              'startDate' => nil,
+              'dueDate' => Date.today.to_s,
+              'type' => 'START_AND_DUE_DATE'
+            })
+          end
+        end
+
+        context 'when the work item type does not support start and due date widget' do
+          let_it_be(:work_item) { create(:work_item, :task, project: project) }
+
+          let(:input) { { 'descriptionWidget' => { 'description' => "Updating due date.\n/due today" } } }
+
+          before do
+            WorkItems::Type.default_by_type(:task).widget_definitions
+              .find_by_widget_type(:start_and_due_date).update!(disabled: true)
+          end
+
+          it 'ignores the quick action' do
+            expect do
+              post_graphql_mutation(mutation, current_user: current_user)
+              work_item.reload
+            end.not_to change(work_item, :due_date)
+
+            expect(mutation_response['workItem']['widgets']).to include(
+              'description' => "Updating due date.",
+              'type' => 'DESCRIPTION'
+            )
+            expect(mutation_response['workItem']['widgets']).not_to include({
+              'dueDate' => nil,
+              'type' => 'START_AND_DUE_DATE'
+            })
+          end
+        end
+      end
+
       context 'when provided input is invalid' do
         let(:due_date) { 1.week.ago.to_date }
 
@@ -516,6 +650,9 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
                 }
               }
             }
+            ... on WorkItemWidgetDescription {
+              description
+            }
           }
         }
         errors
@@ -544,6 +681,81 @@ RSpec.describe 'Update a work item', feature_category: :team_planning do
           }
         )
       end
+
+      context 'when using quick action' do
+        context 'when assigning a user' do
+          let(:input) { { 'descriptionWidget' => { 'description' => "/assign @#{developer.username}" } } }
+
+          it 'updates the work item assignee' do
+            expect do
+              post_graphql_mutation(mutation, current_user: current_user)
+              work_item.reload
+            end.to change(work_item, :assignee_ids).from([]).to([developer.id])
+
+            expect(response).to have_gitlab_http_status(:success)
+            expect(mutation_response['workItem']['widgets']).to include(
+              {
+                'type' => 'ASSIGNEES',
+                'assignees' => {
+                  'nodes' => [
+                    { 'id' => developer.to_global_id.to_s, 'username' => developer.username }
+                  ]
+                }
+              }
+            )
+          end
+        end
+
+        context 'when unassigning a user' do
+          let(:input) { { 'descriptionWidget' => { 'description' => "/unassign @#{developer.username}" } } }
+
+          before do
+            work_item.update!(assignee_ids: [developer.id])
+          end
+
+          it 'updates the work item assignee' do
+            expect do
+              post_graphql_mutation(mutation, current_user: current_user)
+              work_item.reload
+            end.to change(work_item, :assignee_ids).from([developer.id]).to([])
+
+            expect(response).to have_gitlab_http_status(:success)
+            expect(mutation_response['workItem']['widgets']).to include(
+              'type' => 'ASSIGNEES',
+              'assignees' => {
+                'nodes' => []
+              }
+            )
+          end
+        end
+      end
+
+      context 'when the work item type does not support the assignees widget' do
+        let_it_be(:work_item) { create(:work_item, :task, project: project) }
+
+        let(:input) do
+          { 'descriptionWidget' => { 'description' => "Updating assignee.\n/assign @#{developer.username}" } }
+        end
+
+        before do
+          WorkItems::Type.default_by_type(:task).widget_definitions
+            .find_by_widget_type(:assignees).update!(disabled: true)
+        end
+
+        it 'ignores the quick action' do
+          expect do
+            post_graphql_mutation(mutation, current_user: current_user)
+            work_item.reload
+          end.not_to change(work_item, :assignee_ids)
+
+          expect(mutation_response['workItem']['widgets']).to include({
+            'description' => "Updating assignee.",
+            'type' => 'DESCRIPTION'
+          }
+                                                                     )
+          expect(mutation_response['workItem']['widgets']).not_to include({ 'type' => 'ASSIGNEES' })
+        end
+      end
     end
 
     context 'when updating milestone' do