Add latest changes from gitlab-org/gitlab@13-2-stable-ee

219 files changed, 7358 insertions, 964 deletions

diff --git a/spec/requests/api/access_requests_spec.rb b/spec/requests/api/access_requests_spec.rb
index 52bc81cff18..223d740a004 100644
--- a/spec/requests/api/access_requests_spec.rb
+++ b/spec/requests/api/access_requests_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::AccessRequests do
+RSpec.describe API::AccessRequests do
   let_it_be(:maintainer) { create(:user) }
   let_it_be(:developer) { create(:user) }
   let_it_be(:access_requester) { create(:user) }
diff --git a/spec/requests/api/admin/ci/variables_spec.rb b/spec/requests/api/admin/ci/variables_spec.rb
index 185fde17e1b..812ee93ad21 100644
--- a/spec/requests/api/admin/ci/variables_spec.rb
+++ b/spec/requests/api/admin/ci/variables_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe ::API::Admin::Ci::Variables do
+RSpec.describe ::API::Admin::Ci::Variables do
   let_it_be(:admin) { create(:admin) }
   let_it_be(:user) { create(:user) }
 
diff --git a/spec/requests/api/admin/instance_clusters_spec.rb b/spec/requests/api/admin/instance_clusters_spec.rb
new file mode 100644
index 00000000000..b68541b5d92
--- /dev/null
+++ b/spec/requests/api/admin/instance_clusters_spec.rb
@@ -0,0 +1,461 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe ::API::Admin::InstanceClusters do
+  include KubernetesHelpers
+
+  let_it_be(:regular_user) { create(:user) }
+  let_it_be(:admin_user) { create(:admin) }
+  let_it_be(:project) { create(:project) }
+  let_it_be(:project_cluster) do
+    create(:cluster, :project, :provided_by_gcp,
+           user: admin_user,
+           projects: [project])
+  end
+  let(:project_cluster_id) { project_cluster.id }
+
+  describe "GET /admin/clusters" do
+    let_it_be(:clusters) do
+      create_list(:cluster, 3, :provided_by_gcp, :instance, :production_environment)
+    end
+
+    context "when authenticated as a non-admin user" do
+      it 'returns 403' do
+        get api('/admin/clusters', regular_user)
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
+    context "when authenticated as admin" do
+      before do
+        get api("/admin/clusters", admin_user)
+      end
+
+      it 'returns 200' do
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'includes pagination headers' do
+        expect(response).to include_pagination_headers
+      end
+
+      it 'only returns the instance clusters' do
+        cluster_ids = json_response.map { |cluster| cluster['id'] }
+        expect(cluster_ids).to match_array(clusters.pluck(:id))
+        expect(cluster_ids).not_to include(project_cluster_id)
+      end
+    end
+  end
+
+  describe "GET /admin/clusters/:cluster_id" do
+    let_it_be(:platform_kubernetes) do
+      create(:cluster_platform_kubernetes, :configured)
+    end
+
+    let_it_be(:cluster) do
+      create(:cluster, :instance, :provided_by_gcp, :with_domain,
+             platform_kubernetes: platform_kubernetes,
+             user: admin_user)
+    end
+
+    let(:cluster_id) { cluster.id }
+
+    context "when authenticated as admin" do
+      before do
+        get api("/admin/clusters/#{cluster_id}", admin_user)
+      end
+
+      context "when no cluster associated to the ID" do
+        let(:cluster_id) { 1337 }
+
+        it 'returns 404' do
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context "when cluster with cluster_id exists" do
+        it 'returns 200' do
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        it 'returns the cluster with cluster_id' do
+          expect(json_response['id']).to eq(cluster.id)
+        end
+
+        it 'returns the cluster information' do
+          expect(json_response['provider_type']).to eq('gcp')
+          expect(json_response['platform_type']).to eq('kubernetes')
+          expect(json_response['environment_scope']).to eq('*')
+          expect(json_response['cluster_type']).to eq('instance_type')
+          expect(json_response['domain']).to eq('example.com')
+        end
+
+        it 'returns kubernetes platform information' do
+          platform = json_response['platform_kubernetes']
+
+          expect(platform['api_url']).to eq('https://kubernetes.example.com')
+          expect(platform['ca_cert']).to be_present
+        end
+
+        it 'returns user information' do
+          user = json_response['user']
+
+          expect(user['id']).to eq(admin_user.id)
+          expect(user['username']).to eq(admin_user.username)
+        end
+
+        it 'returns GCP provider information' do
+          gcp_provider = json_response['provider_gcp']
+
+          expect(gcp_provider['cluster_id']).to eq(cluster.id)
+          expect(gcp_provider['status_name']).to eq('created')
+          expect(gcp_provider['gcp_project_id']).to eq('test-gcp-project')
+          expect(gcp_provider['zone']).to eq('us-central1-a')
+          expect(gcp_provider['machine_type']).to eq('n1-standard-2')
+          expect(gcp_provider['num_nodes']).to eq(3)
+          expect(gcp_provider['endpoint']).to eq('111.111.111.111')
+        end
+
+        context 'when cluster has no provider' do
+          let(:cluster) do
+            create(:cluster, :instance, :provided_by_user, :production_environment)
+          end
+
+          it 'does not include GCP provider info' do
+            expect(json_response['provider_gcp']).not_to be_present
+          end
+        end
+
+        context 'when trying to get a project cluster via the instance cluster endpoint' do
+          it 'returns 404' do
+            get api("/admin/clusters/#{project_cluster_id}", admin_user)
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+      end
+
+      context "when authenticated as a non-admin user" do
+        it 'returns 403' do
+          get api("/admin/clusters/#{cluster_id}", regular_user)
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+    end
+  end
+
+  describe "POST /admin/clusters/add" do
+    let(:api_url) { 'https://example.com' }
+    let(:authorization_type) { 'rbac' }
+    let(:clusterable) { Clusters::Instance.new }
+
+    let(:platform_kubernetes_attributes) do
+      {
+        api_url: api_url,
+        token: 'sample-token',
+        authorization_type: authorization_type
+      }
+    end
+
+    let(:cluster_params) do
+      {
+        name: 'test-instance-cluster',
+        domain: 'domain.example.com',
+        managed: false,
+        platform_kubernetes_attributes: platform_kubernetes_attributes,
+        clusterable: clusterable
+      }
+    end
+
+    let(:multiple_cluster_params) do
+      {
+        name: 'multiple-instance-cluster',
+        environment_scope: 'staging/*',
+        platform_kubernetes_attributes: platform_kubernetes_attributes
+      }
+    end
+
+    let(:invalid_cluster_params) do
+      {
+        environment_scope: 'production/*',
+        domain: 'domain.example.com',
+        platform_kubernetes_attributes: platform_kubernetes_attributes
+      }
+    end
+
+    context 'authorized user' do
+      before do
+        post api('/admin/clusters/add', admin_user), params: cluster_params
+      end
+
+      context 'with valid params' do
+        it 'responds with 201' do
+          expect(response).to have_gitlab_http_status(:created)
+        end
+
+        it 'creates a new Clusters::Cluster', :aggregate_failures do
+          cluster_result = Clusters::Cluster.find(json_response["id"])
+          platform_kubernetes = cluster_result.platform
+          expect(cluster_result).to be_user
+          expect(cluster_result).to be_kubernetes
+          expect(cluster_result.clusterable).to be_a Clusters::Instance
+          expect(cluster_result.cluster_type).to eq('instance_type')
+          expect(cluster_result.name).to eq('test-instance-cluster')
+          expect(cluster_result.domain).to eq('domain.example.com')
+          expect(cluster_result.environment_scope).to eq('*')
+          expect(cluster_result.enabled).to eq(true)
+          expect(platform_kubernetes.authorization_type).to eq('rbac')
+          expect(cluster_result.managed).to be_falsy
+          expect(platform_kubernetes.api_url).to eq("https://example.com")
+          expect(platform_kubernetes.token).to eq('sample-token')
+        end
+
+        context 'when user does not indicate authorization type' do
+          let(:platform_kubernetes_attributes) do
+            {
+              api_url: api_url,
+              token: 'sample-token'
+            }
+          end
+
+          it 'defaults to RBAC' do
+            cluster_result = Clusters::Cluster.find(json_response['id'])
+
+            expect(cluster_result.platform_kubernetes.rbac?).to be_truthy
+          end
+        end
+
+        context 'when user sets authorization type as ABAC' do
+          let(:authorization_type) { 'abac' }
+
+          it 'creates an ABAC cluster' do
+            cluster_result = Clusters::Cluster.find(json_response['id'])
+
+            expect(cluster_result.platform.abac?).to be_truthy
+          end
+        end
+
+        context 'when an instance cluster already exists' do
+          it 'allows user to add multiple clusters' do
+            post api('/admin/clusters/add', admin_user), params: multiple_cluster_params
+
+            expect(Clusters::Instance.new.clusters.count).to eq(2)
+          end
+        end
+      end
+
+      context 'with invalid params' do
+        context 'when missing a required parameter' do
+          it 'responds with 400' do
+            post api('/admin/clusters/add', admin_user), params: invalid_cluster_params
+            expect(response).to have_gitlab_http_status(:bad_request)
+            expect(json_response['error']).to eql('name is missing')
+          end
+        end
+
+        context 'with a malformed api url' do
+          let(:api_url) { 'invalid_api_url' }
+
+          it 'responds with 400' do
+            expect(response).to have_gitlab_http_status(:bad_request)
+          end
+
+          it 'returns validation errors' do
+            expect(json_response['message']['platform_kubernetes.api_url'].first).to be_present
+          end
+        end
+      end
+    end
+
+    context 'non-authorized user' do
+      it 'responds with 403' do
+        post api('/admin/clusters/add', regular_user), params: cluster_params
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+  end
+
+  describe 'PUT /admin/clusters/:cluster_id' do
+    let(:api_url) { 'https://example.com' }
+
+    let(:update_params) do
+      {
+        domain: domain,
+        platform_kubernetes_attributes: platform_kubernetes_attributes
+      }
+    end
+
+    let(:domain) { 'new-domain.com' }
+    let(:platform_kubernetes_attributes) { {} }
+
+    let_it_be(:cluster) do
+      create(:cluster, :instance, :provided_by_gcp, domain: 'old-domain.com')
+    end
+
+    context 'authorized user' do
+      before do
+        put api("/admin/clusters/#{cluster.id}", admin_user), params: update_params
+
+        cluster.reload
+      end
+
+      context 'with valid params' do
+        it 'responds with 200' do
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        it 'updates cluster attributes' do
+          expect(cluster.domain).to eq('new-domain.com')
+        end
+      end
+
+      context 'with invalid params' do
+        let(:domain) { 'invalid domain' }
+
+        it 'responds with 400' do
+          expect(response).to have_gitlab_http_status(:bad_request)
+        end
+
+        it 'does not update cluster attributes' do
+          expect(cluster.domain).to eq('old-domain.com')
+        end
+
+        it 'returns validation errors' do
+          expect(json_response['message']['domain'].first).to match('contains invalid characters (valid characters: [a-z0-9\\-])')
+        end
+      end
+
+      context 'with a GCP cluster' do
+        context 'when user tries to change GCP specific fields' do
+          let(:platform_kubernetes_attributes) do
+            {
+              api_url: 'https://new-api-url.com',
+              token: 'new-sample-token'
+            }
+          end
+
+          it 'responds with 400' do
+            expect(response).to have_gitlab_http_status(:bad_request)
+          end
+
+          it 'returns validation error' do
+            expect(json_response['message']['platform_kubernetes.base'].first).to eq(_('Cannot modify managed Kubernetes cluster'))
+          end
+        end
+
+        context 'when user tries to change domain' do
+          let(:domain) { 'new-domain.com' }
+
+          it 'responds with 200' do
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+      end
+
+      context 'with an user cluster' do
+        let(:api_url) { 'https://new-api-url.com' }
+
+        let(:cluster) do
+          create(:cluster, :instance, :provided_by_user, :production_environment)
+        end
+
+        let(:platform_kubernetes_attributes) do
+          {
+            api_url: api_url,
+            token: 'new-sample-token'
+          }
+        end
+
+        let(:update_params) do
+          {
+            name: 'new-name',
+            platform_kubernetes_attributes: platform_kubernetes_attributes
+          }
+        end
+
+        it 'responds with 200' do
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        it 'updates platform kubernetes attributes' do
+          platform_kubernetes = cluster.platform_kubernetes
+
+          expect(cluster.name).to eq('new-name')
+          expect(platform_kubernetes.api_url).to eq('https://new-api-url.com')
+          expect(platform_kubernetes.token).to eq('new-sample-token')
+        end
+      end
+
+      context 'with a cluster that does not exist' do
+        let(:cluster_id) { 1337 }
+
+        it 'returns 404' do
+          put api("/admin/clusters/#{cluster_id}", admin_user), params: update_params
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context 'when trying to update a project cluster via the instance cluster endpoint' do
+        it 'returns 404' do
+          put api("/admin/clusters/#{project_cluster_id}", admin_user), params: update_params
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'non-authorized user' do
+      it 'responds with 403' do
+        put api("/admin/clusters/#{cluster.id}", regular_user), params: update_params
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+  end
+
+  describe 'DELETE /admin/clusters/:cluster_id' do
+    let(:cluster_params) { { cluster_id: cluster.id } }
+
+    let_it_be(:cluster) do
+      create(:cluster, :instance, :provided_by_gcp)
+    end
+
+    context 'authorized user' do
+      before do
+        delete api("/admin/clusters/#{cluster.id}", admin_user), params: cluster_params
+      end
+
+      it 'responds with 204' do
+        expect(response).to have_gitlab_http_status(:no_content)
+      end
+
+      it 'deletes the cluster' do
+        expect(Clusters::Cluster.exists?(id: cluster.id)).to be_falsy
+      end
+
+      context 'with a cluster that does not exist' do
+        let(:cluster_id) { 1337 }
+
+        it 'returns 404' do
+          delete api("/admin/clusters/#{cluster_id}", admin_user)
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context 'when trying to update a project cluster via the instance cluster endpoint' do
+        it 'returns 404' do
+          delete api("/admin/clusters/#{project_cluster_id}", admin_user)
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'non-authorized user' do
+      it 'responds with 403' do
+        delete api("/admin/clusters/#{cluster.id}", regular_user), params: cluster_params
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/admin/sidekiq_spec.rb b/spec/requests/api/admin/sidekiq_spec.rb
index 303b62f4436..3c488816bed 100644
--- a/spec/requests/api/admin/sidekiq_spec.rb
+++ b/spec/requests/api/admin/sidekiq_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Admin::Sidekiq, :clean_gitlab_redis_queues do
+RSpec.describe API::Admin::Sidekiq, :clean_gitlab_redis_queues do
   let_it_be(:admin) { create(:admin) }
 
   describe 'DELETE /admin/sidekiq/queues/:queue_name' do
diff --git a/spec/requests/api/api_guard/admin_mode_middleware_spec.rb b/spec/requests/api/api_guard/admin_mode_middleware_spec.rb
index 7175076e56d..4b477f829a7 100644
--- a/spec/requests/api/api_guard/admin_mode_middleware_spec.rb
+++ b/spec/requests/api/api_guard/admin_mode_middleware_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::APIGuard::AdminModeMiddleware, :do_not_mock_admin_mode, :request_store do
+RSpec.describe API::APIGuard::AdminModeMiddleware, :do_not_mock_admin_mode, :request_store do
   let(:user) { create(:admin) }
 
   it 'is loaded' do
diff --git a/spec/requests/api/api_spec.rb b/spec/requests/api/api_spec.rb
index 201c0d1796c..bd0426601db 100644
--- a/spec/requests/api/api_spec.rb
+++ b/spec/requests/api/api_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::API do
+RSpec.describe API::API do
   include GroupAPIHelpers
 
   describe 'Record user last activity in after hook' do
@@ -36,6 +36,14 @@ describe API::API do
         expect(response).to have_gitlab_http_status(:ok)
       end
 
+      it 'does not authorize user for revoked token' do
+        revoked = create(:personal_access_token, :revoked, user: user, scopes: [:read_api])
+
+        get api('/groups', personal_access_token: revoked)
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+
       it 'does not authorize user for post request' do
         params = attributes_for_group_api
 
diff --git a/spec/requests/api/appearance_spec.rb b/spec/requests/api/appearance_spec.rb
index f8c3db70d16..69176e18d2e 100644
--- a/spec/requests/api/appearance_spec.rb
+++ b/spec/requests/api/appearance_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Appearance, 'Appearance' do
+RSpec.describe API::Appearance, 'Appearance' do
   let_it_be(:user) { create(:user) }
   let_it_be(:admin) { create(:admin) }
 
diff --git a/spec/requests/api/applications_spec.rb b/spec/requests/api/applications_spec.rb
index cd341ad134e..63fbf6e32dd 100644
--- a/spec/requests/api/applications_spec.rb
+++ b/spec/requests/api/applications_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Applications, :api do
+RSpec.describe API::Applications, :api do
   let(:admin_user) { create(:user, admin: true) }
   let(:user) { create(:user, admin: false) }
   let!(:application) { create(:application, name: 'another_application', redirect_uri: 'http://other_application.url', scopes: '') }
@@ -74,14 +74,15 @@ describe API::Applications, :api do
         expect(json_response['error']).to eq('scopes is missing')
       end
 
-      it 'does not allow creating an application with confidential set to nil' do
+      it 'defaults to creating an application with confidential' do
         expect do
           post api('/applications', admin_user), params: { name: 'application_name', redirect_uri: 'http://application.url', scopes: '', confidential: nil }
-        end.not_to change { Doorkeeper::Application.count }
+        end.to change { Doorkeeper::Application.count }.by(1)
 
-        expect(response).to have_gitlab_http_status(:bad_request)
+        expect(response).to have_gitlab_http_status(:created)
         expect(json_response).to be_a Hash
-        expect(json_response['message']['confidential'].first).to eq('is not included in the list')
+        expect(json_response['callback_url']).to eq('http://application.url')
+        expect(json_response['confidential']).to be true
       end
     end
 
diff --git a/spec/requests/api/avatar_spec.rb b/spec/requests/api/avatar_spec.rb
index 45e34b7894b..656a086e550 100644
--- a/spec/requests/api/avatar_spec.rb
+++ b/spec/requests/api/avatar_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Avatar do
+RSpec.describe API::Avatar do
   let(:gravatar_service) { double('GravatarService') }
 
   describe 'GET /avatar' do
diff --git a/spec/requests/api/award_emoji_spec.rb b/spec/requests/api/award_emoji_spec.rb
index 543fe970abd..1c825949ae8 100644
--- a/spec/requests/api/award_emoji_spec.rb
+++ b/spec/requests/api/award_emoji_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::AwardEmoji do
+RSpec.describe API::AwardEmoji do
   let_it_be(:user)        { create(:user) }
   let_it_be(:project)     { create(:project) }
   let_it_be(:issue)       { create(:issue, project: project) }
diff --git a/spec/requests/api/badges_spec.rb b/spec/requests/api/badges_spec.rb
index d7f9b7d010b..99d224cb8e9 100644
--- a/spec/requests/api/badges_spec.rb
+++ b/spec/requests/api/badges_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Badges do
+RSpec.describe API::Badges do
   let(:maintainer) { create(:user, username: 'maintainer_user') }
   let(:developer) { create(:user) }
   let(:access_requester) { create(:user) }
diff --git a/spec/requests/api/boards_spec.rb b/spec/requests/api/boards_spec.rb
index d761b371821..f0d3afd0af7 100644
--- a/spec/requests/api/boards_spec.rb
+++ b/spec/requests/api/boards_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Boards do
+RSpec.describe API::Boards do
   let_it_be(:user) { create(:user) }
   let_it_be(:non_member) { create(:user) }
   let_it_be(:guest) { create(:user) }
diff --git a/spec/requests/api/branches_spec.rb b/spec/requests/api/branches_spec.rb
index f2dc5b1c045..46acd92803f 100644
--- a/spec/requests/api/branches_spec.rb
+++ b/spec/requests/api/branches_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Branches do
+RSpec.describe API::Branches do
   let_it_be(:user) { create(:user) }
   let(:project) { create(:project, :repository, creator: user, path: 'my.project') }
   let(:guest) { create(:user).tap { |u| project.add_guest(u) } }
@@ -17,6 +17,7 @@ describe API::Branches do
   before do
     project.add_maintainer(user)
     project.repository.add_branch(user, 'ends-with.txt', branch_sha)
+    stub_feature_flags(branch_list_keyset_pagination: false)
   end
 
   describe "GET /projects/:id/repository/branches" do
@@ -29,16 +30,6 @@ describe API::Branches do
         end
       end
 
-      it 'returns the repository branches' do
-        get api(route, current_user), params: { per_page: 100 }
-
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(response).to match_response_schema('public_api/v4/branches')
-        expect(response).to include_pagination_headers
-        branch_names = json_response.map { |x| x['name'] }
-        expect(branch_names).to match_array(project.repository.branch_names)
-      end
-
       def check_merge_status(json_response)
         merged, unmerged = json_response.partition { |branch| branch['merged'] }
         merged_branches = merged.map { |branch| branch['name'] }
@@ -47,22 +38,107 @@ describe API::Branches do
         expect(project.repository.merged_branch_names(unmerged_branches)).to be_empty
       end
 
-      it 'determines only a limited number of merged branch names' do
-        expect(API::Entities::Branch).to receive(:represent).with(anything, has_up_to_merged_branch_names_count(2)).and_call_original
+      context 'with branch_list_keyset_pagination feature off' do
+        context 'with legacy pagination params' do
+          it 'returns the repository branches' do
+            get api(route, current_user), params: { per_page: 100 }
 
-        get api(route, current_user), params: { per_page: 2 }
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to match_response_schema('public_api/v4/branches')
+            expect(response).to include_pagination_headers
+            branch_names = json_response.map { |x| x['name'] }
+            expect(branch_names).to match_array(project.repository.branch_names)
+          end
 
-        expect(response).to have_gitlab_http_status(:ok)
+          it 'determines only a limited number of merged branch names' do
+            expect(API::Entities::Branch).to receive(:represent).with(anything, has_up_to_merged_branch_names_count(2)).and_call_original
+
+            get api(route, current_user), params: { per_page: 2 }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.count).to eq 2
+
+            check_merge_status(json_response)
+          end
 
-        check_merge_status(json_response)
+          it 'merge status matches reality on paginated input' do
+            expected_first_branch_name = project.repository.branches_sorted_by('name')[20].name
+
+            get api(route, current_user), params: { per_page: 20, page: 2 }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.count).to eq 20
+            expect(json_response.first['name']).to eq(expected_first_branch_name)
+
+            check_merge_status(json_response)
+          end
+        end
+
+        context 'with gitaly pagination params ' do
+          it 'merge status matches reality on paginated input' do
+            expected_first_branch_name = project.repository.branches_sorted_by('name').first.name
+
+            get api(route, current_user), params: { per_page: 20, page_token: 'feature' }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.count).to eq 20
+            expect(json_response.first['name']).to eq(expected_first_branch_name)
+
+            check_merge_status(json_response)
+          end
+        end
       end
 
-      it 'merge status matches reality on paginated input' do
-        get api(route, current_user), params: { per_page: 20, page: 2 }
+      context 'with branch_list_keyset_pagination feature on' do
+        before do
+          stub_feature_flags(branch_list_keyset_pagination: true)
+        end
 
-        expect(response).to have_gitlab_http_status(:ok)
+        context 'with gitaly pagination params ' do
+          it 'returns the repository branches' do
+            get api(route, current_user), params: { per_page: 100 }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to match_response_schema('public_api/v4/branches')
+            branch_names = json_response.map { |x| x['name'] }
+            expect(branch_names).to match_array(project.repository.branch_names)
+          end
+
+          it 'determines only a limited number of merged branch names' do
+            expect(API::Entities::Branch).to receive(:represent).with(anything, has_up_to_merged_branch_names_count(2)).and_call_original
+
+            get api(route, current_user), params: { per_page: 2 }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.count).to eq 2
+
+            check_merge_status(json_response)
+          end
 
-        check_merge_status(json_response)
+          it 'merge status matches reality on paginated input' do
+            expected_first_branch_name = project.repository.branches_sorted_by('name').drop_while { |b| b.name <= 'feature' }.first.name
+
+            get api(route, current_user), params: { per_page: 20, page_token: 'feature' }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.count).to eq 20
+            expect(json_response.first['name']).to eq(expected_first_branch_name)
+
+            check_merge_status(json_response)
+          end
+        end
+
+        context 'with legacy pagination params' do
+          it 'ignores legacy pagination params' do
+            expected_first_branch_name = project.repository.branches_sorted_by('name').first.name
+            get api(route, current_user), params: { per_page: 20, page: 2 }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response.first['name']).to eq(expected_first_branch_name)
+
+            check_merge_status(json_response)
+          end
+        end
       end
 
       context 'when repository is disabled' do
diff --git a/spec/requests/api/broadcast_messages_spec.rb b/spec/requests/api/broadcast_messages_spec.rb
index 9bfbbe0daab..b5b6ce106e5 100644
--- a/spec/requests/api/broadcast_messages_spec.rb
+++ b/spec/requests/api/broadcast_messages_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::BroadcastMessages do
+RSpec.describe API::BroadcastMessages do
   let_it_be(:user)  { create(:user) }
   let_it_be(:admin) { create(:admin) }
   let_it_be(:message) { create(:broadcast_message) }
diff --git a/spec/requests/api/pipeline_schedules_spec.rb b/spec/requests/api/ci/pipeline_schedules_spec.rb
index 98eaf36b14e..e0199b7b51c 100644
--- a/spec/requests/api/pipeline_schedules_spec.rb
+++ b/spec/requests/api/ci/pipeline_schedules_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::PipelineSchedules do
+RSpec.describe API::Ci::PipelineSchedules do
   let_it_be(:developer) { create(:user) }
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :repository, public_builds: false) }
@@ -24,7 +24,7 @@ describe API::PipelineSchedules do
           .each do |pipeline_schedule|
           create(:user).tap do |user|
             project.add_developer(user)
-            pipeline_schedule.update(owner: user)
+            pipeline_schedule.update!(owner: user)
           end
           pipeline_schedule.pipelines << build(:ci_pipeline, project: project)
         end
diff --git a/spec/requests/api/pipelines_spec.rb b/spec/requests/api/ci/pipelines_spec.rb
index f57223f1de5..c9ca806e2c4 100644
--- a/spec/requests/api/pipelines_spec.rb
+++ b/spec/requests/api/ci/pipelines_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Pipelines do
+RSpec.describe API::Ci::Pipelines do
   let_it_be(:user) { create(:user) }
   let_it_be(:non_member) { create(:user) }
 
@@ -106,11 +106,11 @@ describe API::Pipelines do
           end
         end
 
-        HasStatus::AVAILABLE_STATUSES.each do |target|
+        Ci::HasStatus::AVAILABLE_STATUSES.each do |target|
           context "when status is #{target}" do
             before do
               create(:ci_pipeline, project: project, status: target)
-              exception_status = HasStatus::AVAILABLE_STATUSES - [target]
+              exception_status = Ci::HasStatus::AVAILABLE_STATUSES - [target]
               create(:ci_pipeline, project: project, status: exception_status.sample)
             end
 
diff --git a/spec/requests/api/runner_spec.rb b/spec/requests/api/ci/runner_spec.rb
index 774615757b9..c8718309bf2 100644
--- a/spec/requests/api/runner_spec.rb
+++ b/spec/requests/api/ci/runner_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Runner, :clean_gitlab_redis_shared_state do
+RSpec.describe API::Ci::Runner, :clean_gitlab_redis_shared_state do
   include StubGitlabCalls
   include RedisHelpers
   include WorkhorseHelpers
@@ -13,7 +13,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
     stub_feature_flags(ci_enable_live_trace: true)
     stub_gitlab_calls
     stub_application_setting(runners_registration_token: registration_token)
-    allow_any_instance_of(Ci::Runner).to receive(:cache_attributes)
+    allow_any_instance_of(::Ci::Runner).to receive(:cache_attributes)
   end
 
   describe '/api/v4/runners' do
@@ -38,7 +38,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
         it 'creates runner with default values' do
           post api('/runners'), params: { token: registration_token }
 
-          runner = Ci::Runner.first
+          runner = ::Ci::Runner.first
 
           expect(response).to have_gitlab_http_status(:created)
           expect(json_response['id']).to eq(runner.id)
@@ -57,7 +57,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
 
             expect(response).to have_gitlab_http_status(:created)
             expect(project.runners.size).to eq(1)
-            runner = Ci::Runner.first
+            runner = ::Ci::Runner.first
             expect(runner.token).not_to eq(registration_token)
             expect(runner.token).not_to eq(project.runners_token)
             expect(runner).to be_project_type
@@ -72,7 +72,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
 
             expect(response).to have_gitlab_http_status(:created)
             expect(group.runners.reload.size).to eq(1)
-            runner = Ci::Runner.first
+            runner = ::Ci::Runner.first
             expect(runner.token).not_to eq(registration_token)
             expect(runner.token).not_to eq(group.runners_token)
             expect(runner).to be_group_type
@@ -88,7 +88,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                 }
 
           expect(response).to have_gitlab_http_status(:created)
-          expect(Ci::Runner.first.description).to eq('server.hostname')
+          expect(::Ci::Runner.first.description).to eq('server.hostname')
         end
       end
 
@@ -100,7 +100,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                 }
 
           expect(response).to have_gitlab_http_status(:created)
-          expect(Ci::Runner.first.tag_list.sort).to eq(%w(tag1 tag2))
+          expect(::Ci::Runner.first.tag_list.sort).to eq(%w(tag1 tag2))
         end
       end
 
@@ -114,8 +114,8 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.run_untagged).to be false
-            expect(Ci::Runner.first.tag_list.sort).to eq(['tag'])
+            expect(::Ci::Runner.first.run_untagged).to be false
+            expect(::Ci::Runner.first.tag_list.sort).to eq(['tag'])
           end
         end
 
@@ -141,7 +141,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                 }
 
           expect(response).to have_gitlab_http_status(:created)
-          expect(Ci::Runner.first.locked).to be true
+          expect(::Ci::Runner.first.locked).to be true
         end
       end
 
@@ -154,7 +154,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.active).to be true
+            expect(::Ci::Runner.first.active).to be true
           end
         end
 
@@ -166,7 +166,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.active).to be false
+            expect(::Ci::Runner.first.active).to be false
           end
         end
       end
@@ -180,7 +180,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.ref_protected?).to be true
+            expect(::Ci::Runner.first.ref_protected?).to be true
           end
         end
 
@@ -192,7 +192,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.ref_protected?).to be false
+            expect(::Ci::Runner.first.ref_protected?).to be false
           end
         end
       end
@@ -205,7 +205,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                 }
 
           expect(response).to have_gitlab_http_status(:created)
-          expect(Ci::Runner.first.maximum_timeout).to eq(9000)
+          expect(::Ci::Runner.first.maximum_timeout).to eq(9000)
         end
 
         context 'when maximum job timeout is empty' do
@@ -216,7 +216,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.maximum_timeout).to be_nil
+            expect(::Ci::Runner.first.maximum_timeout).to be_nil
           end
         end
       end
@@ -232,7 +232,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                                   }
 
             expect(response).to have_gitlab_http_status(:created)
-            expect(Ci::Runner.first.read_attribute(param.to_sym)).to eq(value)
+            expect(::Ci::Runner.first.read_attribute(param.to_sym)).to eq(value)
           end
         end
       end
@@ -243,7 +243,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
              headers: { 'X-Forwarded-For' => '123.111.123.111' }
 
         expect(response).to have_gitlab_http_status(:created)
-        expect(Ci::Runner.first.ip_address).to eq('123.111.123.111')
+        expect(::Ci::Runner.first.ip_address).to eq('123.111.123.111')
       end
     end
 
@@ -271,7 +271,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
           delete api('/runners'), params: { token: runner.token }
 
           expect(response).to have_gitlab_http_status(:no_content)
-          expect(Ci::Runner.count).to eq(0)
+          expect(::Ci::Runner.count).to eq(0)
         end
 
         it_behaves_like '412 response' do
@@ -518,6 +518,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             request_job info: { platform: :darwin }
 
             expect(response).to have_gitlab_http_status(:created)
+            expect(response.headers['Content-Type']).to eq('application/json')
             expect(response.headers).not_to have_key('X-GitLab-Last-Update')
             expect(runner.reload.platform).to eq('darwin')
             expect(json_response['id']).to eq(job.id)
@@ -537,7 +538,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
           end
 
           it 'creates persistent ref' do
-            expect_any_instance_of(Ci::PersistentRef).to receive(:create_ref)
+            expect_any_instance_of(::Ci::PersistentRef).to receive(:create_ref)
               .with(job.sha, "refs/#{Repository::REF_PIPELINES}/#{job.commit_id}")
 
             request_job info: { platform: :darwin }
@@ -569,6 +570,24 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
               end
             end
 
+            context 'when a Gitaly exception is thrown during response' do
+              before do
+                allow_next_instance_of(Ci::BuildRunnerPresenter) do |instance|
+                  allow(instance).to receive(:artifacts).and_raise(GRPC::DeadlineExceeded)
+                end
+              end
+
+              it 'fails the job as a scheduler failure' do
+                request_job
+
+                expect(response).to have_gitlab_http_status(:no_content)
+                expect(job.reload.failed?).to be_truthy
+                expect(job.failure_reason).to eq('scheduler_failure')
+                expect(job.runner_id).to eq(runner.id)
+                expect(job.runner_session).to be_nil
+              end
+            end
+
             context 'when GIT_DEPTH is not specified and there is no default git depth for the project' do
               before do
                 project.update!(ci_default_git_depth: nil)
@@ -651,9 +670,9 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
           context 'when job is for a release' do
             let!(:job) { create(:ci_build, :release_options, pipeline: pipeline) }
 
-            context 'when `release_steps` is passed by the runner' do
+            context 'when `multi_build_steps` is passed by the runner' do
               it 'exposes release info' do
-                request_job info: { features: { release_steps: true } }
+                request_job info: { features: { multi_build_steps: true } }
 
                 expect(response).to have_gitlab_http_status(:created)
                 expect(response.headers).not_to have_key('X-GitLab-Last-Update')
@@ -668,7 +687,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
                   {
                     "name" => "release",
                     "script" =>
-                    "release-cli create --ref \"$CI_COMMIT_SHA\" --name \"Release $CI_COMMIT_SHA\" --tag-name \"release-$CI_COMMIT_SHA\" --description \"Created using the release-cli $EXTRA_DESCRIPTION\"",
+                    ["release-cli create --name \"Release $CI_COMMIT_SHA\" --description \"Created using the release-cli $EXTRA_DESCRIPTION\" --tag-name \"release-$CI_COMMIT_SHA\" --ref \"$CI_COMMIT_SHA\""],
                     "timeout" => 3600,
                     "when" => "on_success",
                     "allow_failure" => false
@@ -677,7 +696,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
               end
             end
 
-            context 'when `release_steps` is not passed by the runner' do
+            context 'when `multi_build_steps` is not passed by the runner' do
               it 'drops the job' do
                 request_job
 
@@ -749,7 +768,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
 
           context 'when concurrently updating a job' do
             before do
-              expect_any_instance_of(Ci::Build).to receive(:run!)
+              expect_any_instance_of(::Ci::Build).to receive(:run!)
                   .and_raise(ActiveRecord::StaleObjectError.new(nil, nil))
             end
 
@@ -890,7 +909,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             let!(:trigger_request) { create(:ci_trigger_request, pipeline: pipeline, builds: [job], trigger: trigger) }
 
             before do
-              project.variables << Ci::Variable.new(key: 'SECRET_KEY', value: 'secret_value')
+              project.variables << ::Ci::Variable.new(key: 'SECRET_KEY', value: 'secret_value')
             end
 
             shared_examples 'expected variables behavior' do
@@ -1090,7 +1109,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
 
         def request_job(token = runner.token, **params)
           new_params = params.merge(token: token, last_update: last_update)
-          post api('/jobs/request'), params: new_params, headers: { 'User-Agent' => user_agent }
+          post api('/jobs/request'), params: new_params.to_json, headers: { 'User-Agent' => user_agent, 'Content-Type': 'application/json' }
         end
       end
 
@@ -1099,7 +1118,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
         let_it_be(:project) { create(:project, :repository) }
 
         let(:runner) { create(:ci_runner, :project, projects: [project]) }
-        let(:service) { Ci::CreateWebIdeTerminalService.new(project, user, ref: 'master').execute }
+        let(:service) { ::Ci::CreateWebIdeTerminalService.new(project, user, ref: 'master').execute }
         let(:pipeline) { service[:pipeline] }
         let(:build) { pipeline.builds.first }
         let(:job) { {} }
@@ -1592,8 +1611,105 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
         job.run!
       end
 
+      shared_examples_for 'rejecting artifacts that are too large' do
+        let(:filesize) { 100.megabytes.to_i }
+        let(:sample_max_size) { (filesize / 1.megabyte) - 10 } # Set max size to be smaller than file size to trigger error
+
+        shared_examples_for 'failed request' do
+          it 'responds with payload too large error' do
+            send_request
+
+            expect(response).to have_gitlab_http_status(:payload_too_large)
+          end
+        end
+
+        context 'based on plan limit setting' do
+          let(:application_max_size) { sample_max_size + 100 }
+          let(:limit_name) { "#{Ci::JobArtifact::PLAN_LIMIT_PREFIX}archive" }
+
+          before do
+            create(:plan_limits, :default_plan, limit_name => sample_max_size)
+            stub_application_setting(max_artifacts_size: application_max_size)
+          end
+
+          context 'and feature flag ci_max_artifact_size_per_type is enabled' do
+            before do
+              stub_feature_flags(ci_max_artifact_size_per_type: true)
+            end
+
+            it_behaves_like 'failed request'
+          end
+
+          context 'and feature flag ci_max_artifact_size_per_type is disabled' do
+            before do
+              stub_feature_flags(ci_max_artifact_size_per_type: false)
+            end
+
+            it 'bases of project closest setting' do
+              send_request
+
+              expect(response).to have_gitlab_http_status(success_code)
+            end
+          end
+        end
+
+        context 'based on application setting' do
+          before do
+            stub_application_setting(max_artifacts_size: sample_max_size)
+          end
+
+          it_behaves_like 'failed request'
+        end
+
+        context 'based on root namespace setting' do
+          let(:application_max_size) { sample_max_size + 10 }
+
+          before do
+            stub_application_setting(max_artifacts_size: application_max_size)
+            root_namespace.update!(max_artifacts_size: sample_max_size)
+          end
+
+          it_behaves_like 'failed request'
+        end
+
+        context 'based on child namespace setting' do
+          let(:application_max_size) { sample_max_size + 10 }
+          let(:root_namespace_max_size) { sample_max_size + 10 }
+
+          before do
+            stub_application_setting(max_artifacts_size: application_max_size)
+            root_namespace.update!(max_artifacts_size: root_namespace_max_size)
+            namespace.update!(max_artifacts_size: sample_max_size)
+          end
+
+          it_behaves_like 'failed request'
+        end
+
+        context 'based on project setting' do
+          let(:application_max_size) { sample_max_size + 10 }
+          let(:root_namespace_max_size) { sample_max_size + 10 }
+          let(:child_namespace_max_size) { sample_max_size + 10 }
+
+          before do
+            stub_application_setting(max_artifacts_size: application_max_size)
+            root_namespace.update!(max_artifacts_size: root_namespace_max_size)
+            namespace.update!(max_artifacts_size: child_namespace_max_size)
+            project.update!(max_artifacts_size: sample_max_size)
+          end
+
+          it_behaves_like 'failed request'
+        end
+      end
+
       describe 'POST /api/v4/jobs/:id/artifacts/authorize' do
         context 'when using token as parameter' do
+          context 'and the artifact is too large' do
+            it_behaves_like 'rejecting artifacts that are too large' do
+              let(:success_code) { :ok }
+              let(:send_request) { authorize_artifacts_with_token_in_params(filesize: filesize) }
+            end
+          end
+
           context 'posting artifacts to running job' do
             subject do
               authorize_artifacts_with_token_in_params
@@ -1651,56 +1767,6 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
               end
             end
           end
-
-          context 'when artifact is too large' do
-            let(:sample_max_size) { 100 }
-
-            shared_examples_for 'rejecting too large artifacts' do
-              it 'fails to post' do
-                authorize_artifacts_with_token_in_params(filesize: sample_max_size.megabytes.to_i)
-
-                expect(response).to have_gitlab_http_status(:payload_too_large)
-              end
-            end
-
-            context 'based on application setting' do
-              before do
-                stub_application_setting(max_artifacts_size: sample_max_size)
-              end
-
-              it_behaves_like 'rejecting too large artifacts'
-            end
-
-            context 'based on root namespace setting' do
-              before do
-                stub_application_setting(max_artifacts_size: 200)
-                root_namespace.update!(max_artifacts_size: sample_max_size)
-              end
-
-              it_behaves_like 'rejecting too large artifacts'
-            end
-
-            context 'based on child namespace setting' do
-              before do
-                stub_application_setting(max_artifacts_size: 200)
-                root_namespace.update!(max_artifacts_size: 200)
-                namespace.update!(max_artifacts_size: sample_max_size)
-              end
-
-              it_behaves_like 'rejecting too large artifacts'
-            end
-
-            context 'based on project setting' do
-              before do
-                stub_application_setting(max_artifacts_size: 200)
-                root_namespace.update!(max_artifacts_size: 200)
-                namespace.update!(max_artifacts_size: 200)
-                project.update!(max_artifacts_size: sample_max_size)
-              end
-
-              it_behaves_like 'rejecting too large artifacts'
-            end
-          end
         end
 
         context 'when using token as header' do
@@ -1757,19 +1823,36 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             expect(json_response['ProcessLsif']).to be_truthy
           end
 
-          it 'fails to authorize too large artifact' do
-            authorize_artifacts_with_token_in_headers(artifact_type: :lsif, filesize: 30.megabytes)
+          it 'adds ProcessLsifReferences header' do
+            authorize_artifacts_with_token_in_headers(artifact_type: :lsif)
 
-            expect(response).to have_gitlab_http_status(:payload_too_large)
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response['ProcessLsifReferences']).to be_truthy
           end
 
           context 'code_navigation feature flag is disabled' do
-            it 'does not add ProcessLsif header' do
+            it 'responds with a forbidden error' do
               stub_feature_flags(code_navigation: false)
+              authorize_artifacts_with_token_in_headers(artifact_type: :lsif)
+
+              aggregate_failures do
+                expect(response).to have_gitlab_http_status(:forbidden)
+                expect(json_response['ProcessLsif']).to be_falsy
+                expect(json_response['ProcessLsifReferences']).to be_falsy
+              end
+            end
+          end
 
+          context 'code_navigation_references feature flag is disabled' do
+            it 'sets ProcessLsifReferences header to false' do
+              stub_feature_flags(code_navigation_references: false)
               authorize_artifacts_with_token_in_headers(artifact_type: :lsif)
 
-              expect(response).to have_gitlab_http_status(:forbidden)
+              aggregate_failures do
+                expect(response).to have_gitlab_http_status(:ok)
+                expect(json_response['ProcessLsif']).to be_truthy
+                expect(json_response['ProcessLsifReferences']).to be_falsy
+              end
             end
           end
         end
@@ -1799,6 +1882,32 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
           expect { upload_artifacts(file_upload, headers_with_token) }.to change { runner.reload.contacted_at }
         end
 
+        context 'when the artifact is too large' do
+          it_behaves_like 'rejecting artifacts that are too large' do
+            # This filesize validation also happens in non remote stored files,
+            # it's just that it's hard to stub the filesize in other cases to be
+            # more than a megabyte.
+            let!(:fog_connection) do
+              stub_artifacts_object_storage(direct_upload: true)
+            end
+            let(:object) do
+              fog_connection.directories.new(key: 'artifacts').files.create(
+                key: 'tmp/uploads/12312300',
+                body: 'content'
+              )
+            end
+            let(:file_upload) { fog_to_uploaded_file(object) }
+            let(:send_request) do
+              upload_artifacts(file_upload, headers_with_token, 'file.remote_id' => '12312300')
+            end
+            let(:success_code) { :created }
+
+            before do
+              allow(object).to receive(:content_length).and_return(filesize)
+            end
+          end
+        end
+
         context 'when artifacts are being stored inside of tmp path' do
           before do
             # by configuring this path we allow to pass temp file from any path
@@ -1877,16 +1986,6 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             end
           end
 
-          context 'when artifacts file is too large' do
-            it 'fails to post too large artifact' do
-              stub_application_setting(max_artifacts_size: 0)
-
-              upload_artifacts(file_upload, headers_with_token)
-
-              expect(response).to have_gitlab_http_status(:payload_too_large)
-            end
-          end
-
           context 'when artifacts post request does not contain file' do
             it 'fails to post artifacts without file' do
               post api("/jobs/#{job.id}/artifacts"), params: {}, headers: headers_with_token
@@ -2258,7 +2357,7 @@ describe API::Runner, :clean_gitlab_redis_shared_state do
             FileUtils.remove_entry(new_tmpdir)
           end
 
-          it' "fails to post artifacts for outside of tmp path"' do
+          it 'fails to post artifacts for outside of tmp path' do
             upload_artifacts(file_upload, headers_with_token)
 
             expect(response).to have_gitlab_http_status(:bad_request)
diff --git a/spec/requests/api/runners_spec.rb b/spec/requests/api/ci/runners_spec.rb
index 67c258260bf..670456e5dba 100644
--- a/spec/requests/api/runners_spec.rb
+++ b/spec/requests/api/ci/runners_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Runners do
+RSpec.describe API::Ci::Runners do
   let_it_be(:admin) { create(:user, :admin) }
   let_it_be(:user) { create(:user) }
   let_it_be(:user2) { create(:user) }
@@ -266,7 +266,7 @@ describe API::Runners do
               delete api("/runners/#{unused_project_runner.id}", admin)
 
               expect(response).to have_gitlab_http_status(:no_content)
-            end.to change { Ci::Runner.project_type.count }.by(-1)
+            end.to change { ::Ci::Runner.project_type.count }.by(-1)
           end
         end
 
@@ -284,7 +284,7 @@ describe API::Runners do
         end
       end
 
-      it 'returns 404 if runner does not exists' do
+      it 'returns 404 if runner does not exist' do
         get api('/runners/0', admin)
 
         expect(response).to have_gitlab_http_status(:not_found)
@@ -437,7 +437,7 @@ describe API::Runners do
         end
       end
 
-      it 'returns 404 if runner does not exists' do
+      it 'returns 404 if runner does not exist' do
         update_runner(0, admin, description: 'test')
 
         expect(response).to have_gitlab_http_status(:not_found)
@@ -493,7 +493,7 @@ describe API::Runners do
             delete api("/runners/#{shared_runner.id}", admin)
 
             expect(response).to have_gitlab_http_status(:no_content)
-          end.to change { Ci::Runner.instance_type.count }.by(-1)
+          end.to change { ::Ci::Runner.instance_type.count }.by(-1)
         end
 
         it_behaves_like '412 response' do
@@ -507,11 +507,11 @@ describe API::Runners do
             delete api("/runners/#{project_runner.id}", admin)
 
             expect(response).to have_gitlab_http_status(:no_content)
-          end.to change { Ci::Runner.project_type.count }.by(-1)
+          end.to change { ::Ci::Runner.project_type.count }.by(-1)
         end
       end
 
-      it 'returns 404 if runner does not exists' do
+      it 'returns 404 if runner does not exist' do
         delete api('/runners/0', admin)
 
         expect(response).to have_gitlab_http_status(:not_found)
@@ -542,7 +542,7 @@ describe API::Runners do
             delete api("/runners/#{project_runner.id}", user)
 
             expect(response).to have_gitlab_http_status(:no_content)
-          end.to change { Ci::Runner.project_type.count }.by(-1)
+          end.to change { ::Ci::Runner.project_type.count }.by(-1)
         end
 
         it 'does not delete group runner with guest access' do
@@ -574,7 +574,7 @@ describe API::Runners do
             delete api("/runners/#{group_runner_a.id}", user)
 
             expect(response).to have_gitlab_http_status(:no_content)
-          end.to change { Ci::Runner.group_type.count }.by(-1)
+          end.to change { ::Ci::Runner.group_type.count }.by(-1)
         end
 
         it 'deletes inherited group runner with owner access' do
@@ -582,7 +582,7 @@ describe API::Runners do
             delete api("/runners/#{group_runner_b.id}", user)
 
             expect(response).to have_gitlab_http_status(:no_content)
-          end.to change { Ci::Runner.group_type.count }.by(-1)
+          end.to change { ::Ci::Runner.group_type.count }.by(-1)
         end
 
         it_behaves_like '412 response' do
@@ -968,7 +968,7 @@ describe API::Runners do
       end
 
       it 'does not enable locked runner' do
-        project_runner2.update(locked: true)
+        project_runner2.update!(locked: true)
 
         expect do
           post api("/projects/#{project.id}/runners", user), params: { runner_id: project_runner2.id }
diff --git a/spec/requests/api/commit_statuses_spec.rb b/spec/requests/api/commit_statuses_spec.rb
index 0c0bf8b4df0..bec15b788c3 100644
--- a/spec/requests/api/commit_statuses_spec.rb
+++ b/spec/requests/api/commit_statuses_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::CommitStatuses do
+RSpec.describe API::CommitStatuses do
   let!(:project) { create(:project, :repository) }
   let(:commit) { project.repository.commit }
   let(:guest) { create_user(:guest) }
diff --git a/spec/requests/api/commits_spec.rb b/spec/requests/api/commits_spec.rb
index a423c92e2fb..724e3177173 100644
--- a/spec/requests/api/commits_spec.rb
+++ b/spec/requests/api/commits_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 require 'mime/types'
 
-describe API::Commits do
+RSpec.describe API::Commits do
   include ProjectForksHelper
 
   let(:user) { create(:user) }
diff --git a/spec/requests/api/composer_packages_spec.rb b/spec/requests/api/composer_packages_spec.rb
new file mode 100644
index 00000000000..d756a7700f6
--- /dev/null
+++ b/spec/requests/api/composer_packages_spec.rb
@@ -0,0 +1,302 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe API::ComposerPackages do
+  include PackagesManagerApiSpecHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:group, reload: true) { create(:group, :public) }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:package_name) { 'package-name' }
+  let_it_be(:project, reload: true) { create(:project, :custom_repo, files: { 'composer.json' => { name: package_name }.to_json }, group: group) }
+  let(:headers) { {} }
+
+  describe 'GET /api/v4/group/:id/-/packages/composer/packages' do
+    let(:url) { "/group/#{group.id}/-/packages/composer/packages.json" }
+
+    subject { get api(url), headers: headers }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        let!(:package) { create(:composer_package, :with_metadatum, project: project) }
+
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'Composer package index'       | :success
+          'PUBLIC'  | :guest      | true  | true  | 'Composer package index'       | :success
+          'PUBLIC'  | :developer  | true  | false | 'Composer package index'       | :success
+          'PUBLIC'  | :guest      | true  | false | 'Composer package index'       | :success
+          'PUBLIC'  | :developer  | false | true  | 'Composer package index'       | :success
+          'PUBLIC'  | :guest      | false | true  | 'Composer package index'       | :success
+          'PUBLIC'  | :developer  | false | false | 'Composer package index'       | :success
+          'PUBLIC'  | :guest      | false | false | 'Composer package index'       | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'Composer package index'       | :success
+          'PRIVATE' | :developer  | true  | true  | 'Composer package index'       | :success
+          'PRIVATE' | :guest      | true  | true  | 'Composer package index'       | :success
+          'PRIVATE' | :developer  | true  | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :guest      | true  | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :developer  | false | true  | 'process Composer api request' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'process Composer api request' | :not_found
+          'PRIVATE' | :developer  | false | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :guest      | false | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :anonymous  | false | true  | 'process Composer api request' | :not_found
+        end
+
+        with_them do
+          include_context 'Composer api group access', params[:project_visibility_level], params[:user_role], params[:user_token] do
+            it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+          end
+        end
+      end
+
+      it_behaves_like 'rejects Composer access with unknown group id'
+    end
+  end
+
+  describe 'GET /api/v4/group/:id/-/packages/composer/p/:sha.json' do
+    let(:sha) { '123' }
+    let(:url) { "/group/#{group.id}/-/packages/composer/p/#{sha}.json" }
+    let!(:package) { create(:composer_package, :with_metadatum, project: project) }
+
+    subject { get api(url), headers: headers }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'Composer provider index'       | :success
+          'PUBLIC'  | :guest      | true  | true  | 'Composer provider index'       | :success
+          'PUBLIC'  | :developer  | true  | false | 'Composer provider index'       | :success
+          'PUBLIC'  | :guest      | true  | false | 'Composer provider index'       | :success
+          'PUBLIC'  | :developer  | false | true  | 'Composer provider index'       | :success
+          'PUBLIC'  | :guest      | false | true  | 'Composer provider index'       | :success
+          'PUBLIC'  | :developer  | false | false | 'Composer provider index'       | :success
+          'PUBLIC'  | :guest      | false | false | 'Composer provider index'       | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'Composer provider index'       | :success
+          'PRIVATE' | :developer  | true  | true  | 'Composer provider index'       | :success
+          'PRIVATE' | :guest      | true  | true  | 'Composer empty provider index' | :success
+          'PRIVATE' | :developer  | true  | false | 'process Composer api request'  | :not_found
+          'PRIVATE' | :guest      | true  | false | 'process Composer api request'  | :not_found
+          'PRIVATE' | :developer  | false | true  | 'process Composer api request'  | :not_found
+          'PRIVATE' | :guest      | false | true  | 'process Composer api request'  | :not_found
+          'PRIVATE' | :developer  | false | false | 'process Composer api request'  | :not_found
+          'PRIVATE' | :guest      | false | false | 'process Composer api request'  | :not_found
+          'PRIVATE' | :anonymous  | false | true  | 'process Composer api request'  | :not_found
+        end
+
+        with_them do
+          include_context 'Composer api group access', params[:project_visibility_level], params[:user_role], params[:user_token] do
+            it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+          end
+        end
+      end
+
+      it_behaves_like 'rejects Composer access with unknown group id'
+    end
+  end
+
+  describe 'GET /api/v4/group/:id/-/packages/composer/*package_name.json' do
+    let(:package_name) { 'foobar' }
+    let(:url) { "/group/#{group.id}/-/packages/composer/#{package_name}.json" }
+
+    subject { get api(url), headers: headers }
+
+    context 'without the need for a license' do
+      context 'with no packages' do
+        include_context 'Composer user type', :developer, true do
+          it_behaves_like 'returning response status', :not_found
+        end
+      end
+
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        let!(:package) { create(:composer_package, :with_metadatum, name: package_name, project: project) }
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'Composer package api request' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'Composer package api request' | :success
+          'PUBLIC'  | :developer  | true  | false | 'Composer package api request' | :success
+          'PUBLIC'  | :guest      | true  | false | 'Composer package api request' | :success
+          'PUBLIC'  | :developer  | false | true  | 'Composer package api request' | :success
+          'PUBLIC'  | :guest      | false | true  | 'Composer package api request' | :success
+          'PUBLIC'  | :developer  | false | false | 'Composer package api request' | :success
+          'PUBLIC'  | :guest      | false | false | 'Composer package api request' | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'Composer package api request' | :success
+          'PRIVATE' | :developer  | true  | true  | 'Composer package api request' | :success
+          'PRIVATE' | :guest      | true  | true  | 'process Composer api request' | :not_found
+          'PRIVATE' | :developer  | true  | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :guest      | true  | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :developer  | false | true  | 'process Composer api request' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'process Composer api request' | :not_found
+          'PRIVATE' | :developer  | false | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :guest      | false | false | 'process Composer api request' | :not_found
+          'PRIVATE' | :anonymous  | false | true  | 'process Composer api request' | :not_found
+        end
+
+        with_them do
+          include_context 'Composer api group access', params[:project_visibility_level], params[:user_role], params[:user_token] do
+            it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+          end
+        end
+      end
+
+      it_behaves_like 'rejects Composer access with unknown group id'
+    end
+  end
+
+  describe 'POST /api/v4/projects/:id/packages/composer' do
+    let(:url) { "/projects/#{project.id}/packages/composer" }
+    let(:params) { {} }
+
+    before(:all) do
+      project.repository.add_tag(user, 'v1.2.99', 'master')
+    end
+
+    subject { post api(url), headers: headers, params: params }
+
+    shared_examples 'composer package publish' do
+      context 'without the need for a license' do
+        context 'with valid project' do
+          using RSpec::Parameterized::TableSyntax
+
+          where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+            'PUBLIC'  | :developer  | true  | true  | 'Composer package creation'    | :created
+            'PUBLIC'  | :guest      | true  | true  | 'process Composer api request' | :forbidden
+            'PUBLIC'  | :developer  | true  | false | 'process Composer api request' | :unauthorized
+            'PUBLIC'  | :guest      | true  | false | 'process Composer api request' | :unauthorized
+            'PUBLIC'  | :developer  | false | true  | 'process Composer api request' | :forbidden
+            'PUBLIC'  | :guest      | false | true  | 'process Composer api request' | :forbidden
+            'PUBLIC'  | :developer  | false | false | 'process Composer api request' | :unauthorized
+            'PUBLIC'  | :guest      | false | false | 'process Composer api request' | :unauthorized
+            'PUBLIC'  | :anonymous  | false | true  | 'process Composer api request' | :unauthorized
+            'PRIVATE' | :developer  | true  | true  | 'Composer package creation'    | :created
+            'PRIVATE' | :guest      | true  | true  | 'process Composer api request' | :forbidden
+            'PRIVATE' | :developer  | true  | false | 'process Composer api request' | :unauthorized
+            'PRIVATE' | :guest      | true  | false | 'process Composer api request' | :unauthorized
+            'PRIVATE' | :developer  | false | true  | 'process Composer api request' | :not_found
+            'PRIVATE' | :guest      | false | true  | 'process Composer api request' | :not_found
+            'PRIVATE' | :developer  | false | false | 'process Composer api request' | :unauthorized
+            'PRIVATE' | :guest      | false | false | 'process Composer api request' | :unauthorized
+            'PRIVATE' | :anonymous  | false | true  | 'process Composer api request' | :unauthorized
+          end
+
+          with_them do
+            include_context 'Composer api project access', params[:project_visibility_level], params[:user_role], params[:user_token] do
+              it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+            end
+          end
+        end
+
+        it_behaves_like 'rejects Composer access with unknown project id'
+      end
+    end
+
+    context 'with no tag or branch params' do
+      let(:headers) { build_basic_auth_header(user.username, personal_access_token.token) }
+
+      it_behaves_like 'process Composer api request', :developer, :bad_request
+    end
+
+    context 'with a tag' do
+      context 'with an existing branch' do
+        let(:params) { { tag: 'v1.2.99' } }
+
+        it_behaves_like 'composer package publish'
+      end
+
+      context 'with a non existing tag' do
+        let(:params) { { tag: 'non-existing-tag' } }
+        let(:headers) { build_basic_auth_header(user.username, personal_access_token.token) }
+
+        it_behaves_like 'process Composer api request', :developer, :not_found
+      end
+    end
+
+    context 'with a branch' do
+      context 'with an existing branch' do
+        let(:params) { { branch: 'master' } }
+
+        it_behaves_like 'composer package publish'
+      end
+
+      context 'with a non existing branch' do
+        let(:params) { { branch: 'non-existing-branch' } }
+        let(:headers) { build_basic_auth_header(user.username, personal_access_token.token) }
+
+        it_behaves_like 'process Composer api request', :developer, :not_found
+      end
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/composer/archives/*package_name?sha=:sha' do
+    let(:sha) { '123' }
+    let(:url) { "/projects/#{project.id}/packages/composer/archives/#{package_name}.zip" }
+    let(:params) { { sha: sha } }
+
+    subject { get api(url), headers: headers, params: params }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        let!(:package) { create(:composer_package, :with_metadatum, name: package_name, project: project) }
+
+        context 'when the sha does not match the package name' do
+          let(:sha) { '123' }
+
+          it_behaves_like 'process Composer api request', :anonymous, :not_found
+        end
+
+        context 'when the package name does not match the sha' do
+          let(:branch) { project.repository.find_branch('master') }
+          let(:sha) { branch.target }
+          let(:url) { "/projects/#{project.id}/packages/composer/archives/unexisting-package-name.zip" }
+
+          it_behaves_like 'process Composer api request', :anonymous, :not_found
+        end
+
+        context 'with a match package name and sha' do
+          let(:branch) { project.repository.find_branch('master') }
+          let(:sha) { branch.target }
+
+          using RSpec::Parameterized::TableSyntax
+
+          where(:project_visibility_level, :user_role, :member, :user_token, :expected_status) do
+            'PUBLIC'  | :developer  | true  | true  | :success
+            'PUBLIC'  | :guest      | true  | true  | :success
+            'PUBLIC'  | :developer  | true  | false | :success
+            'PUBLIC'  | :guest      | true  | false | :success
+            'PUBLIC'  | :developer  | false | true  | :success
+            'PUBLIC'  | :guest      | false | true  | :success
+            'PUBLIC'  | :developer  | false | false | :success
+            'PUBLIC'  | :guest      | false | false | :success
+            'PUBLIC'  | :anonymous  | false | true  | :success
+            'PRIVATE' | :developer  | true  | true  | :success
+            'PRIVATE' | :guest      | true  | true  | :success
+            'PRIVATE' | :developer  | true  | false | :success
+            'PRIVATE' | :guest      | true  | false | :success
+            'PRIVATE' | :developer  | false | true  | :success
+            'PRIVATE' | :guest      | false | true  | :success
+            'PRIVATE' | :developer  | false | false | :success
+            'PRIVATE' | :guest      | false | false | :success
+            'PRIVATE' | :anonymous  | false | true  | :success
+          end
+
+          with_them do
+            let(:token) { user_token ? personal_access_token.token : 'wrong' }
+            let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+            before do
+              project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+            end
+
+            it_behaves_like 'process Composer api request', params[:user_role], params[:expected_status], params[:member]
+          end
+        end
+      end
+
+      it_behaves_like 'rejects Composer access with unknown project id'
+    end
+  end
+end
diff --git a/spec/requests/api/conan_packages_spec.rb b/spec/requests/api/conan_packages_spec.rb
new file mode 100644
index 00000000000..1d88eaef79c
--- /dev/null
+++ b/spec/requests/api/conan_packages_spec.rb
@@ -0,0 +1,840 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe API::ConanPackages do
+  include WorkhorseHelpers
+  include PackagesManagerApiSpecHelpers
+
+  let(:package) { create(:conan_package) }
+  let_it_be(:personal_access_token) { create(:personal_access_token) }
+  let_it_be(:user) { personal_access_token.user }
+  let(:project) { package.project }
+
+  let(:base_secret) { SecureRandom.base64(64) }
+  let(:auth_token) { personal_access_token.token }
+  let(:job) { create(:ci_build, user: user) }
+  let(:job_token) { job.token }
+  let(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
+  let(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
+
+  let(:headers) do
+    { 'HTTP_AUTHORIZATION' => ActionController::HttpAuthentication::Basic.encode_credentials('foo', auth_token) }
+  end
+
+  let(:jwt_secret) do
+    OpenSSL::HMAC.hexdigest(
+      OpenSSL::Digest::SHA256.new,
+      base_secret,
+      Gitlab::ConanToken::HMAC_KEY
+    )
+  end
+
+  before do
+    project.add_developer(user)
+    allow(Settings).to receive(:attr_encrypted_db_key_base).and_return(base_secret)
+  end
+
+  describe 'GET /api/v4/packages/conan/v1/ping' do
+    it 'responds with 401 Unauthorized when no token provided' do
+      get api('/packages/conan/v1/ping')
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    it 'responds with 200 OK when valid token is provided' do
+      jwt = build_jwt(personal_access_token)
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header(jwt.encoded)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.headers['X-Conan-Server-Capabilities']).to eq("")
+    end
+
+    it 'responds with 200 OK when valid job token is provided' do
+      jwt = build_jwt_from_job(job)
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header(jwt.encoded)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.headers['X-Conan-Server-Capabilities']).to eq("")
+    end
+
+    it 'responds with 200 OK when valid deploy token is provided' do
+      jwt = build_jwt_from_deploy_token(deploy_token)
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header(jwt.encoded)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.headers['X-Conan-Server-Capabilities']).to eq("")
+    end
+
+    it 'responds with 401 Unauthorized when invalid access token ID is provided' do
+      jwt = build_jwt(double(id: 12345), user_id: personal_access_token.user_id)
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header(jwt.encoded)
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    it 'responds with 401 Unauthorized when invalid user is provided' do
+      jwt = build_jwt(personal_access_token, user_id: 12345)
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header(jwt.encoded)
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    it 'responds with 401 Unauthorized when the provided JWT is signed with different secret' do
+      jwt = build_jwt(personal_access_token, secret: SecureRandom.base64(32))
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header(jwt.encoded)
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    it 'responds with 401 Unauthorized when invalid JWT is provided' do
+      get api('/packages/conan/v1/ping'), headers: build_token_auth_header('invalid-jwt')
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    context 'packages feature disabled' do
+      it 'responds with 404 Not Found' do
+        stub_packages_setting(enabled: false)
+        get api('/packages/conan/v1/ping')
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+  end
+
+  describe 'GET /api/v4/packages/conan/v1/conans/search' do
+    before do
+      project.update!(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+
+      get api('/packages/conan/v1/conans/search'), headers: headers, params: params
+    end
+
+    subject { json_response['results'] }
+
+    context 'returns packages with a matching name' do
+      let(:params) { { q: package.conan_recipe } }
+
+      it { is_expected.to contain_exactly(package.conan_recipe) }
+    end
+
+    context 'returns packages using a * wildcard' do
+      let(:params) { { q: "#{package.name[0, 3]}*" } }
+
+      it { is_expected.to contain_exactly(package.conan_recipe) }
+    end
+
+    context 'does not return non-matching packages' do
+      let(:params) { { q: "foo" } }
+
+      it { is_expected.to be_blank }
+    end
+  end
+
+  describe 'GET /api/v4/packages/conan/v1/users/authenticate' do
+    subject { get api('/packages/conan/v1/users/authenticate'), headers: headers }
+
+    context 'when using invalid token' do
+      let(:auth_token) { 'invalid_token' }
+
+      it 'responds with 401' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    context 'when valid JWT access token is provided' do
+      it 'responds with 200' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'token has valid validity time' do
+        Timecop.freeze do
+          subject
+
+          payload = JSONWebToken::HMACToken.decode(
+            response.body, jwt_secret).first
+          expect(payload['access_token']).to eq(personal_access_token.id)
+          expect(payload['user_id']).to eq(personal_access_token.user_id)
+
+          duration = payload['exp'] - payload['iat']
+          expect(duration).to eq(1.hour)
+        end
+      end
+    end
+
+    context 'with valid job token' do
+      let(:auth_token) { job_token }
+
+      it 'responds with 200' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    context 'with valid deploy token' do
+      let(:auth_token) { deploy_token.token }
+
+      it 'responds with 200' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+  end
+
+  describe 'GET /api/v4/packages/conan/v1/users/check_credentials' do
+    it 'responds with a 200 OK with PAT' do
+      get api('/packages/conan/v1/users/check_credentials'), headers: headers
+
+      expect(response).to have_gitlab_http_status(:ok)
+    end
+
+    context 'with job token' do
+      let(:auth_token) { job_token }
+
+      it 'responds with a 200 OK with job token' do
+        get api('/packages/conan/v1/users/check_credentials'), headers: headers
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    context 'with deploy token' do
+      let(:auth_token) { deploy_token.token }
+
+      it 'responds with a 200 OK with job token' do
+        get api('/packages/conan/v1/users/check_credentials'), headers: headers
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    it 'responds with a 401 Unauthorized when an invalid token is used' do
+      get api('/packages/conan/v1/users/check_credentials'), headers: build_token_auth_header('invalid-token')
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+  end
+
+  shared_examples 'rejects invalid recipe' do
+    context 'with invalid recipe path' do
+      let(:recipe_path) { '../../foo++../..' }
+
+      it 'returns 400' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+  end
+
+  shared_examples 'rejects recipe for invalid project' do
+    context 'with invalid recipe path' do
+      let(:recipe_path) { 'aa/bb/not-existing-project/ccc' }
+
+      it 'returns forbidden' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+  end
+
+  shared_examples 'rejects recipe for not found package' do
+    context 'with invalid recipe path' do
+      let(:recipe_path) do
+        'aa/bb/%{project}/ccc' % { project: ::Packages::Conan::Metadatum.package_username_from(full_path: project.full_path) }
+      end
+
+      it 'returns not found' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+  end
+
+  shared_examples 'empty recipe for not found package' do
+    context 'with invalid recipe url' do
+      let(:recipe_path) do
+        'aa/bb/%{project}/ccc' % { project: ::Packages::Conan::Metadatum.package_username_from(full_path: project.full_path) }
+      end
+
+      it 'returns not found' do
+        allow(::Packages::Conan::PackagePresenter).to receive(:new)
+          .with(
+            'aa/bb@%{project}/ccc' % { project: ::Packages::Conan::Metadatum.package_username_from(full_path: project.full_path) },
+            user,
+            project,
+            any_args
+          ).and_return(presenter)
+        allow(presenter).to receive(:recipe_snapshot) { {} }
+        allow(presenter).to receive(:package_snapshot) { {} }
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.body).to eq("{}")
+      end
+    end
+  end
+
+  shared_examples 'recipe download_urls' do
+    let(:recipe_path) { package.conan_recipe_path }
+
+    it 'returns the download_urls for the recipe files' do
+      expected_response = {
+        'conanfile.py'      => "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/export/conanfile.py",
+        'conanmanifest.txt' => "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/export/conanmanifest.txt"
+      }
+
+      allow(presenter).to receive(:recipe_urls) { expected_response }
+
+      subject
+
+      expect(json_response).to eq(expected_response)
+    end
+  end
+
+  shared_examples 'package download_urls' do
+    let(:recipe_path) { package.conan_recipe_path }
+
+    it 'returns the download_urls for the package files' do
+      expected_response = {
+        'conaninfo.txt'     => "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/package/123456789/0/conaninfo.txt",
+        'conanmanifest.txt' => "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/package/123456789/0/conanmanifest.txt",
+        'conan_package.tgz' => "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/package/123456789/0/conan_package.tgz"
+      }
+
+      allow(presenter).to receive(:package_urls) { expected_response }
+
+      subject
+
+      expect(json_response).to eq(expected_response)
+    end
+  end
+
+  context 'recipe endpoints' do
+    let(:jwt) { build_jwt(personal_access_token) }
+    let(:headers) { build_token_auth_header(jwt.encoded) }
+    let(:conan_package_reference) { '123456789' }
+    let(:presenter) { double('::Packages::Conan::PackagePresenter') }
+
+    before do
+      allow(::Packages::Conan::PackagePresenter).to receive(:new)
+        .with(package.conan_recipe, user, package.project, any_args)
+        .and_return(presenter)
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel' do
+      let(:recipe_path) { package.conan_recipe_path }
+
+      subject { get api("/packages/conan/v1/conans/#{recipe_path}"), headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'rejects recipe for invalid project'
+      it_behaves_like 'empty recipe for not found package'
+
+      context 'with existing package' do
+        it 'returns a hash of files with their md5 hashes' do
+          expected_response = {
+            'conanfile.py'      => 'md5hash1',
+            'conanmanifest.txt' => 'md5hash2'
+          }
+
+          allow(presenter).to receive(:recipe_snapshot) { expected_response }
+
+          subject
+
+          expect(json_response).to eq(expected_response)
+        end
+      end
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/packages/:conan_package_reference' do
+      let(:recipe_path) { package.conan_recipe_path }
+
+      subject { get api("/packages/conan/v1/conans/#{recipe_path}/packages/#{conan_package_reference}"), headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'rejects recipe for invalid project'
+      it_behaves_like 'empty recipe for not found package'
+
+      context 'with existing package' do
+        it 'returns a hash of md5 values for the files' do
+          expected_response = {
+            'conaninfo.txt'     => "md5hash1",
+            'conanmanifest.txt' => "md5hash2",
+            'conan_package.tgz' => "md5hash3"
+          }
+
+          allow(presenter).to receive(:package_snapshot) { expected_response }
+
+          subject
+
+          expect(json_response).to eq(expected_response)
+        end
+      end
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/digest' do
+      subject { get api("/packages/conan/v1/conans/#{recipe_path}/digest"), headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'rejects recipe for invalid project'
+      it_behaves_like 'recipe download_urls'
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/packages/:conan_package_reference/download_urls' do
+      subject { get api("/packages/conan/v1/conans/#{recipe_path}/packages/#{conan_package_reference}/download_urls"), headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'rejects recipe for invalid project'
+      it_behaves_like 'package download_urls'
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/download_urls' do
+      subject { get api("/packages/conan/v1/conans/#{recipe_path}/download_urls"), headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'rejects recipe for invalid project'
+      it_behaves_like 'recipe download_urls'
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/packages/:conan_package_reference/digest' do
+      subject { get api("/packages/conan/v1/conans/#{recipe_path}/packages/#{conan_package_reference}/digest"), headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'rejects recipe for invalid project'
+      it_behaves_like 'package download_urls'
+    end
+
+    describe 'POST /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/upload_urls' do
+      let(:recipe_path) { package.conan_recipe_path }
+
+      let(:params) do
+        { "conanfile.py": 24,
+          "conanmanifext.txt": 123 }
+      end
+
+      subject { post api("/packages/conan/v1/conans/#{recipe_path}/upload_urls"), params: params, headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+
+      it 'returns a set of upload urls for the files requested' do
+        subject
+
+        expected_response = {
+          'conanfile.py':      "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/export/conanfile.py",
+          'conanmanifest.txt': "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/export/conanmanifest.txt"
+        }
+
+        expect(response.body).to eq(expected_response.to_json)
+      end
+    end
+
+    describe 'POST /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel/packages/:conan_package_reference/upload_urls' do
+      let(:recipe_path) { package.conan_recipe_path }
+
+      let(:params) do
+        { "conaninfo.txt": 24,
+          "conanmanifext.txt": 123,
+          "conan_package.tgz": 523 }
+      end
+
+      subject { post api("/packages/conan/v1/conans/#{recipe_path}/packages/123456789/upload_urls"), params: params, headers: headers }
+
+      it_behaves_like 'rejects invalid recipe'
+
+      it 'returns a set of upload urls for the files requested' do
+        expected_response = {
+          'conaninfo.txt':     "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/package/123456789/0/conaninfo.txt",
+          'conanmanifest.txt': "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/package/123456789/0/conanmanifest.txt",
+          'conan_package.tgz': "#{Settings.gitlab.base_url}/api/v4/packages/conan/v1/files/#{package.conan_recipe_path}/0/package/123456789/0/conan_package.tgz"
+        }
+
+        subject
+
+        expect(response.body).to eq(expected_response.to_json)
+      end
+    end
+
+    describe 'DELETE /api/v4/packages/conan/v1/conans/:package_name/package_version/:package_username/:package_channel' do
+      let(:recipe_path) { package.conan_recipe_path }
+
+      subject { delete api("/packages/conan/v1/conans/#{recipe_path}"), headers: headers}
+
+      it_behaves_like 'rejects invalid recipe'
+
+      it 'returns unauthorized for users without valid permission' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      context 'with delete permissions' do
+        before do
+          project.add_maintainer(user)
+        end
+
+        it_behaves_like 'a gitlab tracking event', described_class.name, 'delete_package'
+
+        it 'deletes a package' do
+          expect { subject }.to change { Packages::Package.count }.from(2).to(1)
+        end
+      end
+    end
+  end
+
+  context 'file endpoints' do
+    let(:jwt) { build_jwt(personal_access_token) }
+    let(:headers) { build_token_auth_header(jwt.encoded) }
+    let(:recipe_path) { package.conan_recipe_path }
+
+    shared_examples 'denies download with no token' do
+      context 'with no private token' do
+        let(:headers) { {} }
+
+        it 'returns 400' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:unauthorized)
+        end
+      end
+    end
+
+    shared_examples 'a public project with packages' do
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+    end
+
+    shared_examples 'an internal project with packages' do
+      before do
+        project.team.truncate
+        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+      end
+
+      it_behaves_like 'denies download with no token'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+    end
+
+    shared_examples 'a private project with packages' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      it_behaves_like 'denies download with no token'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download when not enough permissions' do
+        project.add_guest(user)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
+    shared_examples 'a project is not found' do
+      let(:recipe_path) { 'not/package/for/project' }
+
+      it 'returns forbidden' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/files/:package_name/package_version/:package_username/:package_channel/
+:recipe_revision/export/:file_name' do
+      let(:recipe_file) { package.package_files.find_by(file_name: 'conanfile.py') }
+      let(:metadata) { recipe_file.conan_file_metadatum }
+
+      subject do
+        get api("/packages/conan/v1/files/#{recipe_path}/#{metadata.recipe_revision}/export/#{recipe_file.file_name}"),
+            headers: headers
+      end
+
+      it_behaves_like 'a public project with packages'
+      it_behaves_like 'an internal project with packages'
+      it_behaves_like 'a private project with packages'
+      it_behaves_like 'a project is not found'
+    end
+
+    describe 'GET /api/v4/packages/conan/v1/files/:package_name/package_version/:package_username/:package_channel/
+:recipe_revision/package/:conan_package_reference/:package_revision/:file_name' do
+      let(:package_file) { package.package_files.find_by(file_name: 'conaninfo.txt') }
+      let(:metadata) { package_file.conan_file_metadatum }
+
+      subject do
+        get api("/packages/conan/v1/files/#{recipe_path}/#{metadata.recipe_revision}/package/#{metadata.conan_package_reference}/#{metadata.package_revision}/#{package_file.file_name}"),
+            headers: headers
+      end
+
+      it_behaves_like 'a public project with packages'
+      it_behaves_like 'an internal project with packages'
+      it_behaves_like 'a private project with packages'
+      it_behaves_like 'a project is not found'
+
+      context 'tracking the conan_package.tgz download' do
+        let(:package_file) { package.package_files.find_by(file_name: ::Packages::Conan::FileMetadatum::PACKAGE_BINARY) }
+
+        it_behaves_like 'a gitlab tracking event', described_class.name, 'pull_package'
+      end
+    end
+  end
+
+  context 'file uploads' do
+    let(:jwt) { build_jwt(personal_access_token) }
+    let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+    let(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+    let(:headers_with_token) { build_token_auth_header(jwt.encoded).merge(workhorse_header) }
+    let(:recipe_path) { "foo/bar/#{project.full_path.tr('/', '+')}/baz"}
+
+    shared_examples 'uploads a package file' do
+      context 'with object storage disabled' do
+        context 'without a file from workhorse' do
+          let(:params) { { file: nil } }
+
+          it_behaves_like 'package workhorse uploads'
+
+          it 'rejects the request' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:bad_request)
+          end
+        end
+
+        context 'without a token' do
+          it 'rejects request without a token' do
+            headers_with_token.delete('HTTP_AUTHORIZATION')
+
+            subject
+
+            expect(response).to have_gitlab_http_status(:unauthorized)
+          end
+        end
+
+        context 'when params from workhorse are correct' do
+          it 'creates package and stores package file' do
+            expect { subject }
+              .to change { project.packages.count }.by(1)
+              .and change { Packages::PackageFile.count }.by(1)
+
+            expect(response).to have_gitlab_http_status(:ok)
+
+            package_file = project.packages.last.package_files.reload.last
+            expect(package_file.file_name).to eq(params[:file].original_filename)
+          end
+
+          it "doesn't attempt to migrate file to object storage" do
+            expect(ObjectStorage::BackgroundMoveWorker).not_to receive(:perform_async)
+
+            subject
+          end
+        end
+      end
+
+      context 'with object storage enabled' do
+        context 'and direct upload enabled' do
+          let!(:fog_connection) do
+            stub_package_file_object_storage(direct_upload: true)
+          end
+
+          let(:tmp_object) do
+            fog_connection.directories.new(key: 'packages').files.create(
+              key: "tmp/uploads/#{file_name}",
+              body: 'content'
+            )
+          end
+
+          let(:fog_file) { fog_to_uploaded_file(tmp_object) }
+
+          ['123123', '../../123123'].each do |remote_id|
+            context "with invalid remote_id: #{remote_id}" do
+              let(:params) do
+                {
+                  file: fog_file,
+                  'file.remote_id' => remote_id
+                }
+              end
+
+              it 'responds with status 403' do
+                subject
+
+                expect(response).to have_gitlab_http_status(:forbidden)
+              end
+            end
+          end
+
+          context 'with valid remote_id' do
+            let(:params) do
+              {
+                file: fog_file,
+                'file.remote_id' => file_name
+              }
+            end
+
+            it 'creates package and stores package file' do
+              expect { subject }
+                .to change { project.packages.count }.by(1)
+                .and change { Packages::PackageFile.count }.by(1)
+
+              expect(response).to have_gitlab_http_status(:ok)
+
+              package_file = project.packages.last.package_files.reload.last
+              expect(package_file.file_name).to eq(params[:file].original_filename)
+              expect(package_file.file.read).to eq('content')
+            end
+          end
+        end
+
+        it_behaves_like 'background upload schedules a file migration'
+      end
+    end
+
+    shared_examples 'workhorse authorization' do
+      it 'authorizes posting package with a valid token' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+      end
+
+      it 'rejects request without a valid token' do
+        headers_with_token['HTTP_AUTHORIZATION'] = 'foo'
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+
+      it 'rejects request without a valid permission' do
+        project.add_guest(user)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      it 'rejects requests that bypassed gitlab-workhorse' do
+        headers_with_token.delete(Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      context 'when using remote storage' do
+        context 'when direct upload is enabled' do
+          before do
+            stub_package_file_object_storage(enabled: true, direct_upload: true)
+          end
+
+          it 'responds with status 200, location of package remote store and object details' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response.media_type).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+            expect(json_response).not_to have_key('TempPath')
+            expect(json_response['RemoteObject']).to have_key('ID')
+            expect(json_response['RemoteObject']).to have_key('GetURL')
+            expect(json_response['RemoteObject']).to have_key('StoreURL')
+            expect(json_response['RemoteObject']).to have_key('DeleteURL')
+            expect(json_response['RemoteObject']).not_to have_key('MultipartUpload')
+          end
+        end
+
+        context 'when direct upload is disabled' do
+          before do
+            stub_package_file_object_storage(enabled: true, direct_upload: false)
+          end
+
+          it 'handles as a local file' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response.media_type).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+            expect(json_response['TempPath']).to eq(::Packages::PackageFileUploader.workhorse_local_upload_path)
+            expect(json_response['RemoteObject']).to be_nil
+          end
+        end
+      end
+    end
+
+    describe 'PUT /api/v4/packages/conan/v1/files/:package_name/package_version/:package_username/:package_channel/:recipe_revision/export/:file_name/authorize' do
+      subject { put api("/packages/conan/v1/files/#{recipe_path}/0/export/conanfile.py/authorize"), headers: headers_with_token }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'workhorse authorization'
+    end
+
+    describe 'PUT /api/v4/packages/conan/v1/files/:package_name/package_version/:package_username/:package_channel/:recipe_revision/export/:conan_package_reference/:package_revision/:file_name/authorize' do
+      subject { put api("/packages/conan/v1/files/#{recipe_path}/0/package/123456789/0/conaninfo.txt/authorize"), headers: headers_with_token }
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'workhorse authorization'
+    end
+
+    describe 'PUT /api/v4/packages/conan/v1/files/:package_name/package_version/:package_username/:package_channel/:recipe_revision/export/:file_name' do
+      let(:file_name) { 'conanfile.py' }
+      let(:params) { { file: temp_file(file_name) } }
+
+      subject do
+        workhorse_finalize(
+          "/api/v4/packages/conan/v1/files/#{recipe_path}/0/export/#{file_name}",
+          method: :put,
+          file_key: :file,
+          params: params,
+          headers: headers_with_token
+        )
+      end
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'uploads a package file'
+    end
+
+    describe 'PUT /api/v4/packages/conan/v1/files/:package_name/package_version/:package_username/:package_channel/:recipe_revision/export/:conan_package_reference/:package_revision/:file_name' do
+      let(:file_name) { 'conaninfo.txt' }
+      let(:params) { { file: temp_file(file_name) } }
+
+      subject do
+        workhorse_finalize(
+          "/api/v4/packages/conan/v1/files/#{recipe_path}/0/package/123456789/0/#{file_name}",
+          method: :put,
+          file_key: :file,
+          params: params,
+          headers: headers_with_token
+        )
+      end
+
+      it_behaves_like 'rejects invalid recipe'
+      it_behaves_like 'uploads a package file'
+      context 'tracking the conan_package.tgz upload' do
+        let(:file_name) { ::Packages::Conan::FileMetadatum::PACKAGE_BINARY }
+
+        it_behaves_like 'a gitlab tracking event', described_class.name, 'push_package'
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/container_registry_event_spec.rb b/spec/requests/api/container_registry_event_spec.rb
index 2cdf2656cb7..4d38ddddffd 100644
--- a/spec/requests/api/container_registry_event_spec.rb
+++ b/spec/requests/api/container_registry_event_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ContainerRegistryEvent do
+RSpec.describe API::ContainerRegistryEvent do
   let(:secret_token) { 'secret_token' }
   let(:events) { [{ action: 'push' }] }
   let(:registry_headers) { { 'Content-Type' => ::API::ContainerRegistryEvent::DOCKER_DISTRIBUTION_EVENTS_V1_JSON } }
diff --git a/spec/requests/api/deploy_keys_spec.rb b/spec/requests/api/deploy_keys_spec.rb
index e8cc6bc71ae..81cef653770 100644
--- a/spec/requests/api/deploy_keys_spec.rb
+++ b/spec/requests/api/deploy_keys_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::DeployKeys do
+RSpec.describe API::DeployKeys do
   let(:user)        { create(:user) }
   let(:maintainer)  { create(:user) }
   let(:admin)       { create(:admin) }
diff --git a/spec/requests/api/deploy_tokens_spec.rb b/spec/requests/api/deploy_tokens_spec.rb
index 2b86d59fbba..8ec4f888e2e 100644
--- a/spec/requests/api/deploy_tokens_spec.rb
+++ b/spec/requests/api/deploy_tokens_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::DeployTokens do
+RSpec.describe API::DeployTokens do
   let_it_be(:user)          { create(:user) }
   let_it_be(:creator)       { create(:user) }
   let_it_be(:project)       { create(:project, creator_id: creator.id) }
diff --git a/spec/requests/api/deployments_spec.rb b/spec/requests/api/deployments_spec.rb
index ef2415a0cde..8113de96ac4 100644
--- a/spec/requests/api/deployments_spec.rb
+++ b/spec/requests/api/deployments_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Deployments do
+RSpec.describe API::Deployments do
   let(:user)        { create(:user) }
   let(:non_member)  { create(:user) }
 
diff --git a/spec/requests/api/discussions_spec.rb b/spec/requests/api/discussions_spec.rb
index cb3efb2cf5f..720ea429c2c 100644
--- a/spec/requests/api/discussions_spec.rb
+++ b/spec/requests/api/discussions_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Discussions do
+RSpec.describe API::Discussions do
   let(:user) { create(:user) }
   let!(:project) { create(:project, :public, :repository, namespace: user.namespace) }
   let(:private_user) { create(:user) }
diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb
index a25a6485f47..f16cd58bb34 100644
--- a/spec/requests/api/doorkeeper_access_spec.rb
+++ b/spec/requests/api/doorkeeper_access_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'doorkeeper access' do
+RSpec.describe 'doorkeeper access' do
   let!(:user) { create(:user) }
   let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
   let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api" }
diff --git a/spec/requests/api/environments_spec.rb b/spec/requests/api/environments_spec.rb
index 91b3dd93433..b1ac8f9eeec 100644
--- a/spec/requests/api/environments_spec.rb
+++ b/spec/requests/api/environments_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Environments do
+RSpec.describe API::Environments do
   let(:user)          { create(:user) }
   let(:non_member)    { create(:user) }
   let(:project)       { create(:project, :private, :repository, namespace: user.namespace) }
diff --git a/spec/requests/api/error_tracking_spec.rb b/spec/requests/api/error_tracking_spec.rb
index deed9777025..8c9ca1b6a9d 100644
--- a/spec/requests/api/error_tracking_spec.rb
+++ b/spec/requests/api/error_tracking_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ErrorTracking do
+RSpec.describe API::ErrorTracking do
   let_it_be(:user) { create(:user) }
   let(:setting) { create(:project_error_tracking_setting) }
   let(:project) { setting.project }
diff --git a/spec/requests/api/events_spec.rb b/spec/requests/api/events_spec.rb
index 58a55c2e6d0..6a8d5f91abd 100644
--- a/spec/requests/api/events_spec.rb
+++ b/spec/requests/api/events_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Events do
+RSpec.describe API::Events do
   let(:user) { create(:user) }
   let(:non_member) { create(:user) }
   let(:private_project) { create(:project, :private, creator_id: user.id, namespace: user.namespace) }
diff --git a/spec/requests/api/features_spec.rb b/spec/requests/api/features_spec.rb
index 59a9ed2f77d..2746e777306 100644
--- a/spec/requests/api/features_spec.rb
+++ b/spec/requests/api/features_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Features, stub_feature_flags: false do
+RSpec.describe API::Features, stub_feature_flags: false do
   let_it_be(:user)  { create(:user) }
   let_it_be(:admin) { create(:admin) }
 
diff --git a/spec/requests/api/files_spec.rb b/spec/requests/api/files_spec.rb
index 198e4f64bcc..b50f63ed67c 100644
--- a/spec/requests/api/files_spec.rb
+++ b/spec/requests/api/files_spec.rb
@@ -2,7 +2,9 @@
 
 require 'spec_helper'
 
-describe API::Files do
+RSpec.describe API::Files do
+  include RepoHelpers
+
   let(:user) { create(:user) }
   let!(:project) { create(:project, :repository, namespace: user.namespace ) }
   let(:guest) { create(:user) { |u| project.add_guest(u) } }
@@ -183,6 +185,26 @@ describe API::Files do
         expect(response.content_type).to eq('application/json')
       end
 
+      context 'with filename with pathspec characters' do
+        let(:file_path) { ':wq' }
+        let(:newrev) { project.repository.commit('master').sha }
+
+        before do
+          create_file_in_repo(project, 'master', 'master', file_path, 'Test file')
+        end
+
+        it 'returns JSON wth commit SHA' do
+          params[:ref] = 'master'
+
+          get api(route(file_path), api_user), params: params
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response['file_path']).to eq(file_path)
+          expect(json_response['file_name']).to eq(file_path)
+          expect(json_response['last_commit_id']).to eq(newrev)
+        end
+      end
+
       it 'returns file by commit sha' do
         # This file is deleted on HEAD
         file_path = "files%2Fjs%2Fcommit%2Ejs%2Ecoffee"
diff --git a/spec/requests/api/freeze_periods_spec.rb b/spec/requests/api/freeze_periods_spec.rb
index 0b7828ebedf..5589d4d543d 100644
--- a/spec/requests/api/freeze_periods_spec.rb
+++ b/spec/requests/api/freeze_periods_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::FreezePeriods do
+RSpec.describe API::FreezePeriods do
   let_it_be(:project) { create(:project, :repository, :private) }
   let_it_be(:user) { create(:user) }
   let_it_be(:admin) { create(:admin) }
diff --git a/spec/requests/api/go_proxy_spec.rb b/spec/requests/api/go_proxy_spec.rb
new file mode 100644
index 00000000000..91e455dac19
--- /dev/null
+++ b/spec/requests/api/go_proxy_spec.rb
@@ -0,0 +1,465 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::GoProxy do
+  include PackagesManagerApiSpecHelpers
+
+  let_it_be(:user) { create :user }
+  let_it_be(:project) { create :project_empty_repo, creator: user, path: 'my-go-lib' }
+  let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
+
+  let_it_be(:oauth) { create :oauth_access_token, scopes: 'api', resource_owner: user }
+  let_it_be(:job) { create :ci_build, user: user }
+  let_it_be(:pa_token) { create :personal_access_token, user: user }
+
+  let_it_be(:modules) do
+    commits = [
+      create(:go_module_commit, :files,   project: project, tag: 'v1.0.0', files: { 'README.md' => 'Hi' }       ),
+      create(:go_module_commit, :module,  project: project, tag: 'v1.0.1'                                       ),
+      create(:go_module_commit, :package, project: project, tag: 'v1.0.2', path: 'pkg'                          ),
+      create(:go_module_commit, :module,  project: project, tag: 'v1.0.3', name: 'mod'                          ),
+      create(:go_module_commit, :files,   project: project,                files: { 'y.go' => "package a\n" }   ),
+      create(:go_module_commit, :module,  project: project,                name: 'v2'                           ),
+      create(:go_module_commit, :files,   project: project, tag: 'v2.0.0', files: { 'v2/x.go' => "package a\n" })
+    ]
+
+    { sha: [commits[4].sha, commits[5].sha] }
+  end
+
+  before do
+    project.add_developer(user)
+
+    stub_feature_flags(go_proxy_disable_gomod_validation: false)
+
+    modules
+  end
+
+  shared_examples 'an unavailable resource' do
+    it 'returns not found' do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:not_found)
+    end
+  end
+
+  shared_examples 'a module version list resource' do |*versions, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "list" }
+
+    it "returns #{versions.empty? ? 'nothing' : versions.join(', ')}" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.body.split("\n").to_set).to eq(versions.to_set)
+    end
+  end
+
+  shared_examples 'a missing module version list resource' do |path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "list" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module version information resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.info" }
+
+    it "returns information for #{version}" do
+      get_resource(user)
+
+      time = project.repository.find_tag(version).dereferenced_target.committed_date
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response).to be_kind_of(Hash)
+      expect(json_response['Version']).to eq(version)
+      expect(json_response['Time']).to eq(time.strftime('%Y-%m-%dT%H:%M:%S.%L%:z'))
+    end
+  end
+
+  shared_examples 'a missing module version information resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.info" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module pseudo-version information resource' do |prefix, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:commit) { project.repository.commit_by(oid: sha) }
+    let(:version) { fmt_pseudo_version prefix, commit }
+    let(:resource) { "#{version}.info" }
+
+    it "returns information for #{prefix}yyyymmddhhmmss-abcdefabcdef" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response).to be_kind_of(Hash)
+      expect(json_response['Version']).to eq(version)
+      expect(json_response['Time']).to eq(commit.committed_date.strftime('%Y-%m-%dT%H:%M:%S.%L%:z'))
+    end
+  end
+
+  shared_examples 'a missing module pseudo-version information resource' do |path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:commit) do
+      raise "tried to reference :commit without defining :sha" unless defined?(sha)
+
+      project.repository.commit_by(oid: sha)
+    end
+    let(:resource) { "#{version}.info" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module file resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.mod" }
+
+    it "returns #{path}/go.mod from the repo" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.body.split("\n", 2).first).to eq("module #{module_name}")
+    end
+  end
+
+  shared_examples 'a missing module file resource' do |version, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.mod" }
+
+    it_behaves_like 'an unavailable resource'
+  end
+
+  shared_examples 'a module archive resource' do |version, entries, path: ''|
+    let(:module_name) { "#{base}#{path}" }
+    let(:resource) { "#{version}.zip" }
+
+    it "returns an archive of #{path.empty? ? '/' : path} @ #{version} from the repo" do
+      get_resource(user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+
+      entries = entries.map { |e| "#{module_name}@#{version}/#{e}" }.to_set
+      actual = Set[]
+      Zip::InputStream.open(StringIO.new(response.body)) do |zip|
+        while (entry = zip.get_next_entry)
+          actual.add(entry.name)
+        end
+      end
+
+      expect(actual).to eq(entries)
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+    context 'for the root module' do
+      it_behaves_like 'a module version list resource', 'v1.0.1', 'v1.0.2', 'v1.0.3'
+    end
+
+    context 'for the package' do
+      it_behaves_like 'a module version list resource', path: '/pkg'
+    end
+
+    context 'for the submodule' do
+      it_behaves_like 'a module version list resource', 'v1.0.3', path: '/mod'
+    end
+
+    context 'for the root module v2' do
+      it_behaves_like 'a module version list resource', 'v2.0.0', path: '/v2'
+    end
+
+    context 'with a URL encoded relative path component' do
+      it_behaves_like 'a missing module version list resource', path: '/%2E%2E%2Fxyz'
+    end
+
+    context 'with the feature disabled' do
+      before do
+        stub_feature_flags(go_proxy: false)
+      end
+
+      it_behaves_like 'a missing module version list resource'
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
+    context 'with the root module v1.0.1' do
+      it_behaves_like 'a module version information resource', 'v1.0.1'
+    end
+
+    context 'with the submodule v1.0.3' do
+      it_behaves_like 'a module version information resource', 'v1.0.3', path: '/mod'
+    end
+
+    context 'with the root module v2.0.0' do
+      it_behaves_like 'a module version information resource', 'v2.0.0', path: '/v2'
+    end
+
+    context 'with an invalid path' do
+      it_behaves_like 'a missing module version information resource', 'v1.0.3', path: '/pkg'
+    end
+
+    context 'with an invalid version' do
+      it_behaves_like 'a missing module version information resource', 'v1.0.1', path: '/mod'
+    end
+
+    context 'with a pseudo-version for v1' do
+      it_behaves_like 'a module pseudo-version information resource', 'v1.0.4-0.' do
+        let(:sha) { modules[:sha][0] }
+      end
+    end
+
+    context 'with a pseudo-version for v2' do
+      it_behaves_like 'a module pseudo-version information resource', 'v2.0.0-', path: '/v2' do
+        let(:sha) { modules[:sha][1] }
+      end
+    end
+
+    context 'with a pseudo-version with an invalid timestamp' do
+      it_behaves_like 'a missing module pseudo-version information resource' do
+        let(:version) { "v1.0.4-0.00000000000000-#{modules[:sha][0][0..11]}" }
+      end
+    end
+
+    context 'with a pseudo-version with an invalid commit sha' do
+      it_behaves_like 'a missing module pseudo-version information resource' do
+        let(:sha) { modules[:sha][0] }
+        let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-000000000000" }
+      end
+    end
+
+    context 'with a pseudo-version with a short commit sha' do
+      it_behaves_like 'a missing module pseudo-version information resource' do
+        let(:sha) { modules[:sha][0] }
+        let(:version) { "v1.0.4-0.#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{modules[:sha][0][0..10]}" }
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.mod' do
+    context 'with the root module v1.0.1' do
+      it_behaves_like 'a module file resource', 'v1.0.1'
+    end
+
+    context 'with the submodule v1.0.3' do
+      it_behaves_like 'a module file resource', 'v1.0.3', path: '/mod'
+    end
+
+    context 'with the root module v2.0.0' do
+      it_behaves_like 'a module file resource', 'v2.0.0', path: '/v2'
+    end
+
+    context 'with an invalid path' do
+      it_behaves_like 'a missing module file resource', 'v1.0.3', path: '/pkg'
+    end
+
+    context 'with an invalid version' do
+      it_behaves_like 'a missing module file resource', 'v1.0.1', path: '/mod'
+    end
+  end
+
+  describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.zip' do
+    context 'with the root module v1.0.1' do
+      it_behaves_like 'a module archive resource', 'v1.0.1', ['README.md', 'go.mod', 'a.go']
+    end
+
+    context 'with the root module v1.0.2' do
+      it_behaves_like 'a module archive resource', 'v1.0.2', ['README.md', 'go.mod', 'a.go', 'pkg/b.go']
+    end
+
+    context 'with the root module v1.0.3' do
+      it_behaves_like 'a module archive resource', 'v1.0.3', ['README.md', 'go.mod', 'a.go', 'pkg/b.go']
+    end
+
+    context 'with the submodule v1.0.3' do
+      it_behaves_like 'a module archive resource', 'v1.0.3', ['go.mod', 'a.go'], path: '/mod'
+    end
+
+    context 'with the root module v2.0.0' do
+      it_behaves_like 'a module archive resource', 'v2.0.0', ['go.mod', 'a.go', 'x.go'], path: '/v2'
+    end
+  end
+
+  context 'with an invalid module directive' do
+    let_it_be(:project) { create :project_empty_repo, :public, creator: user }
+    let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
+
+    let_it_be(:modules) do
+      create(:go_module_commit, :files, project: project,                files: { 'a.go' => "package\a" }                   )
+      create(:go_module_commit, :files, project: project, tag: 'v1.0.0', files: { 'go.mod' => "module not/a/real/module\n" })
+      create(:go_module_commit, :files, project: project,                files: { 'v2/a.go' => "package a\n" }              )
+      create(:go_module_commit, :files, project: project, tag: 'v2.0.0', files: { 'v2/go.mod' => "module #{base}\n" }       )
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      context 'with a completely wrong directive for v1' do
+        it_behaves_like 'a module version list resource'
+      end
+
+      context 'with a directive omitting the suffix for v2' do
+        it_behaves_like 'a module version list resource', path: '/v2'
+      end
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
+      context 'with a completely wrong directive for v1' do
+        it_behaves_like 'a missing module version information resource', 'v1.0.0'
+      end
+
+      context 'with a directive omitting the suffix for v2' do
+        it_behaves_like 'a missing module version information resource', 'v2.0.0', path: '/v2'
+      end
+    end
+  end
+
+  context 'with a case sensitive project and versions' do
+    let_it_be(:project) { create :project_empty_repo, :public, creator: user, path: 'MyGoLib' }
+    let_it_be(:base) { "#{Settings.build_gitlab_go_url}/#{project.full_path}" }
+    let_it_be(:base_encoded) { base.gsub(/[A-Z]/) { |s| "!#{s.downcase}"} }
+
+    let_it_be(:modules) do
+      create(:go_module_commit, :files,   project: project, files: { 'README.md' => "Hi" })
+      create(:go_module_commit, :module,  project: project, tag: 'v1.0.1-prerelease')
+      create(:go_module_commit, :package, project: project, tag: 'v1.0.1-Prerelease', path: 'pkg')
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      let(:resource) { "list" }
+
+      context 'with a case encoded path' do
+        it_behaves_like 'a module version list resource', 'v1.0.1-prerelease', 'v1.0.1-Prerelease' do
+          let(:module_name) { base_encoded }
+        end
+      end
+
+      context 'without a case encoded path' do
+        it_behaves_like 'a missing module version list resource' do
+          let(:module_name) { base.downcase }
+        end
+      end
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/:module_version.info' do
+      context 'with a case encoded path' do
+        it_behaves_like 'a module version information resource', 'v1.0.1-Prerelease' do
+          let(:module_name) { base_encoded }
+          let(:resource) { "v1.0.1-!prerelease.info" }
+        end
+      end
+
+      context 'without a case encoded path' do
+        it_behaves_like 'a module version information resource', 'v1.0.1-prerelease' do
+          let(:module_name) { base_encoded }
+          let(:resource) { "v1.0.1-prerelease.info" }
+        end
+      end
+    end
+  end
+
+  context 'with a private project' do
+    let(:module_name) { base }
+
+    before do
+      project.update(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      let(:resource) { "list" }
+
+      it 'returns ok with an oauth token' do
+        get_resource(oauth_access_token: oauth)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns ok with a job token' do
+        get_resource(oauth_access_token: job)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns ok with a personal access token' do
+        get_resource(personal_access_token: pa_token)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns ok with a personal access token and basic authentication' do
+        get_resource(headers: build_basic_auth_header(user.username, pa_token.token))
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns unauthorized with no authentication' do
+        get_resource
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+  end
+
+  context 'with a public project' do
+    let(:module_name) { base }
+
+    before do
+      project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      let(:resource) { "list" }
+
+      it 'returns ok with no authentication' do
+        get_resource
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+  end
+
+  context 'with a non-existent project' do
+    def get_resource(user = nil, **params)
+      get api("/projects/not%2fa%2fproject/packages/go/#{base}/@v/list", user, params)
+    end
+
+    describe 'GET /projects/:id/packages/go/*module_name/@v/list' do
+      it 'returns not found with a user' do
+        get_resource(user)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns not found with an oauth token' do
+        get_resource(oauth_access_token: oauth)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns not found with a job token' do
+        get_resource(oauth_access_token: job)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns not found with a personal access token' do
+        get_resource(personal_access_token: pa_token)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it 'returns unauthorized with no authentication' do
+        get_resource
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+  end
+
+  def get_resource(user = nil, headers: {}, **params)
+    get api("/projects/#{project.id}/packages/go/#{module_name}/@v/#{resource}", user, params), headers: headers
+  end
+
+  def fmt_pseudo_version(prefix, commit)
+    "#{prefix}#{commit.committed_date.strftime('%Y%m%d%H%M%S')}-#{commit.sha[0..11]}"
+  end
+end
diff --git a/spec/requests/api/graphql/boards/board_lists_query_spec.rb b/spec/requests/api/graphql/boards/board_lists_query_spec.rb
index 3cc1468be02..8a89590c85a 100644
--- a/spec/requests/api/graphql/boards/board_lists_query_spec.rb
+++ b/spec/requests/api/graphql/boards/board_lists_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'get board lists' do
+RSpec.describe 'get board lists' do
   include GraphqlHelpers
 
   let_it_be(:user)           { create(:user) }
diff --git a/spec/requests/api/graphql/boards/boards_query_spec.rb b/spec/requests/api/graphql/boards/boards_query_spec.rb
index a17554aba21..50004e5a8a1 100644
--- a/spec/requests/api/graphql/boards/boards_query_spec.rb
+++ b/spec/requests/api/graphql/boards/boards_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'get list of boards' do
+RSpec.describe 'get list of boards' do
   include GraphqlHelpers
 
   include_context 'group and project boards query context'
diff --git a/spec/requests/api/graphql/current_user/todos_query_spec.rb b/spec/requests/api/graphql/current_user/todos_query_spec.rb
index 321e1062a96..e298de0df01 100644
--- a/spec/requests/api/graphql/current_user/todos_query_spec.rb
+++ b/spec/requests/api/graphql/current_user/todos_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Query current user todos' do
+RSpec.describe 'Query current user todos' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/current_user_query_spec.rb b/spec/requests/api/graphql/current_user_query_spec.rb
index 2b38b8e98ab..dc832b42fa5 100644
--- a/spec/requests/api/graphql/current_user_query_spec.rb
+++ b/spec/requests/api/graphql/current_user_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting project information' do
+RSpec.describe 'getting project information' do
   include GraphqlHelpers
 
   let(:query) do
diff --git a/spec/requests/api/graphql/gitlab_schema_spec.rb b/spec/requests/api/graphql/gitlab_schema_spec.rb
index 266c98d6f08..ee7dba545be 100644
--- a/spec/requests/api/graphql/gitlab_schema_spec.rb
+++ b/spec/requests/api/graphql/gitlab_schema_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'GitlabSchema configurations' do
+RSpec.describe 'GitlabSchema configurations' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/group/labels_query_spec.rb b/spec/requests/api/graphql/group/labels_query_spec.rb
index 6c34cbadf95..31556ffca30 100644
--- a/spec/requests/api/graphql/group/labels_query_spec.rb
+++ b/spec/requests/api/graphql/group/labels_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting group label information' do
+RSpec.describe 'getting group label information' do
   include GraphqlHelpers
 
   let_it_be(:group) { create(:group, :public) }
diff --git a/spec/requests/api/graphql/group/milestones_spec.rb b/spec/requests/api/graphql/group/milestones_spec.rb
index bad0024e7a3..380eaea17f8 100644
--- a/spec/requests/api/graphql/group/milestones_spec.rb
+++ b/spec/requests/api/graphql/group/milestones_spec.rb
@@ -2,21 +2,22 @@
 
 require 'spec_helper'
 
-describe 'Milestones through GroupQuery' do
+RSpec.describe 'Milestones through GroupQuery' do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
   let_it_be(:now) { Time.now }
-  let_it_be(:group) { create(:group) }
-  let_it_be(:milestone_1) { create(:milestone, group: group) }
-  let_it_be(:milestone_2) { create(:milestone, group: group, state: :closed, start_date: now, due_date: now + 1.day) }
-  let_it_be(:milestone_3) { create(:milestone, group: group, start_date: now, due_date: now + 2.days) }
-  let_it_be(:milestone_4) { create(:milestone, group: group, state: :closed, start_date: now - 2.days, due_date: now - 1.day) }
-  let_it_be(:milestone_from_other_group) { create(:milestone, group: create(:group)) }
-
-  let(:milestone_data) { graphql_data['group']['milestones']['edges'] }
 
   describe 'Get list of milestones from a group' do
+    let_it_be(:group) { create(:group) }
+    let_it_be(:milestone_1) { create(:milestone, group: group) }
+    let_it_be(:milestone_2) { create(:milestone, group: group, state: :closed, start_date: now, due_date: now + 1.day) }
+    let_it_be(:milestone_3) { create(:milestone, group: group, start_date: now, due_date: now + 2.days) }
+    let_it_be(:milestone_4) { create(:milestone, group: group, state: :closed, start_date: now - 2.days, due_date: now - 1.day) }
+    let_it_be(:milestone_from_other_group) { create(:milestone, group: create(:group)) }
+
+    let(:milestone_data) { graphql_data['group']['milestones']['edges'] }
+
     context 'when the request is correct' do
       before do
         fetch_milestones(user)
@@ -72,21 +73,6 @@ describe 'Milestones through GroupQuery' do
           submilestone_1.to_global_id.to_s, submilestone_2.to_global_id.to_s
         )
       end
-
-      context 'when group_milestone_descendants is disabled' do
-        before do
-          stub_feature_flags(group_milestone_descendants: false)
-        end
-
-        it 'ignores descendant milestones' do
-          fetch_milestones(user, args)
-
-          expect_array_response(
-            milestone_1.to_global_id.to_s, milestone_2.to_global_id.to_s,
-            milestone_3.to_global_id.to_s, milestone_4.to_global_id.to_s
-          )
-        end
-      end
     end
 
     def fetch_milestones(user = nil, args = {})
@@ -120,4 +106,89 @@ describe 'Milestones through GroupQuery' do
       node_array(milestone_data, extract_attribute)
     end
   end
+
+  describe 'ensures each field returns the correct value' do
+    let_it_be(:group) { create(:group) }
+    let_it_be(:project) { create(:project, group: group) }
+    let_it_be(:milestone) { create(:milestone, group: group, start_date: now, due_date: now + 1.day) }
+    let_it_be(:open_issue) { create(:issue, project: project, milestone: milestone) }
+    let_it_be(:closed_issue) { create(:issue, :closed, project: project, milestone: milestone) }
+
+    let(:milestone_query) do
+      %{
+        id
+        title
+        description
+        state
+        webPath
+        dueDate
+        startDate
+        createdAt
+        updatedAt
+        projectMilestone
+        groupMilestone
+        subgroupMilestone
+      }
+    end
+
+    def post_query
+      full_query = graphql_query_for("group",
+        { full_path: group.full_path },
+        [query_graphql_field("milestones", nil, "nodes { #{milestone_query} }")]
+      )
+
+      post_graphql(full_query, current_user: user)
+
+      graphql_data.dig('group', 'milestones', 'nodes', 0)
+    end
+
+    it 'returns correct values for scalar fields' do
+      expect(post_query).to eq({
+        'id' => global_id_of(milestone),
+        'title' => milestone.title,
+        'description' => milestone.description,
+        'state' => 'active',
+        'webPath' => milestone_path(milestone),
+        'dueDate' => milestone.due_date.iso8601,
+        'startDate' => milestone.start_date.iso8601,
+        'createdAt' => milestone.created_at.iso8601,
+        'updatedAt' => milestone.updated_at.iso8601,
+        'projectMilestone' => false,
+        'groupMilestone' => true,
+        'subgroupMilestone' => false
+      })
+    end
+
+    context 'milestone statistics' do
+      let(:milestone_query) do
+        %{
+          stats {
+            totalIssuesCount
+            closedIssuesCount
+          }
+        }
+      end
+
+      it 'returns the correct milestone statistics' do
+        expect(post_query).to eq({
+          'stats' => {
+            'totalIssuesCount' => 2,
+            'closedIssuesCount' => 1
+          }
+        })
+      end
+
+      context 'when the graphql_milestone_stats feature flag is disabled' do
+        before do
+          stub_feature_flags(graphql_milestone_stats: false)
+        end
+
+        it 'returns nil for the stats field' do
+          expect(post_query).to eq({
+            'stats' => nil
+          })
+        end
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/group_query_spec.rb b/spec/requests/api/graphql/group_query_spec.rb
index c7b537a9923..d99bff2e349 100644
--- a/spec/requests/api/graphql/group_query_spec.rb
+++ b/spec/requests/api/graphql/group_query_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 # Based on spec/requests/api/groups_spec.rb
 # Should follow closely in order to ensure all situations are covered
-describe 'getting group information', :do_not_mock_admin_mode do
+RSpec.describe 'getting group information', :do_not_mock_admin_mode do
   include GraphqlHelpers
   include UploadHelpers
 
diff --git a/spec/requests/api/graphql/metadata_query_spec.rb b/spec/requests/api/graphql/metadata_query_spec.rb
index 4c56c559cf9..6344ec371c8 100644
--- a/spec/requests/api/graphql/metadata_query_spec.rb
+++ b/spec/requests/api/graphql/metadata_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting project information' do
+RSpec.describe 'getting project information' do
   include GraphqlHelpers
 
   let(:query) { graphql_query_for('metadata', {}, all_graphql_fields_for('Metadata')) }
diff --git a/spec/requests/api/graphql/metrics/dashboard/annotations_spec.rb b/spec/requests/api/graphql/metrics/dashboard/annotations_spec.rb
index cb35411b7a5..c47920087dc 100644
--- a/spec/requests/api/graphql/metrics/dashboard/annotations_spec.rb
+++ b/spec/requests/api/graphql/metrics/dashboard/annotations_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Getting Metrics Dashboard Annotations' do
+RSpec.describe 'Getting Metrics Dashboard Annotations' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/metrics/dashboard_query_spec.rb b/spec/requests/api/graphql/metrics/dashboard_query_spec.rb
index d9d9ea9ad61..456b0a5dea1 100644
--- a/spec/requests/api/graphql/metrics/dashboard_query_spec.rb
+++ b/spec/requests/api/graphql/metrics/dashboard_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Getting Metrics Dashboard' do
+RSpec.describe 'Getting Metrics Dashboard' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
@@ -62,12 +62,12 @@ describe 'Getting Metrics Dashboard' do
 
       context 'invalid dashboard' do
         let(:path) { '.gitlab/dashboards/metrics.yml' }
-        let(:project) { create(:project, :repository, :custom_repo, namespace: current_user.namespace, files: { path => "---\ndasboard: ''" }) }
+        let(:project) { create(:project, :repository, :custom_repo, namespace: current_user.namespace, files: { path => "---\ndashboard: 'test'" }) }
 
         it 'returns metrics dashboard' do
           dashboard = graphql_data.dig('project', 'environments', 'nodes', 0, 'metricsDashboard')
 
-          expect(dashboard).to eql("path" => path, "schemaValidationWarnings" => ["dashboard: can't be blank", "panel_groups: can't be blank"])
+          expect(dashboard).to eql("path" => path, "schemaValidationWarnings" => ["panel_groups: should be an array of panel_groups objects"])
         end
       end
 
@@ -78,7 +78,7 @@ describe 'Getting Metrics Dashboard' do
         it 'returns metrics dashboard' do
           dashboard = graphql_data.dig('project', 'environments', 'nodes', 0, 'metricsDashboard')
 
-          expect(dashboard).to eql("path" => path, "schemaValidationWarnings" => ["dashboard: can't be blank", "panel_groups: can't be blank"])
+          expect(dashboard).to eql("path" => path, "schemaValidationWarnings" => ["dashboard: can't be blank", "panel_groups: should be an array of panel_groups objects"])
         end
       end
     end
diff --git a/spec/requests/api/graphql/multiplexed_queries_spec.rb b/spec/requests/api/graphql/multiplexed_queries_spec.rb
index 9ebb57f6b9c..f79bac6ae3b 100644
--- a/spec/requests/api/graphql/multiplexed_queries_spec.rb
+++ b/spec/requests/api/graphql/multiplexed_queries_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'Multiplexed queries' do
+RSpec.describe 'Multiplexed queries' do
   include GraphqlHelpers
 
   it 'returns responses for multiple queries' do
diff --git a/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb b/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb
index a5159da84f3..4ad35e7f0d1 100644
--- a/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb
+++ b/spec/requests/api/graphql/mutations/admin/sidekiq_queues/delete_jobs_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Deleting Sidekiq jobs', :clean_gitlab_redis_queues do
+RSpec.describe 'Deleting Sidekiq jobs', :clean_gitlab_redis_queues do
   include GraphqlHelpers
 
   let_it_be(:admin) { create(:admin) }
diff --git a/spec/requests/api/graphql/mutations/alert_management/alerts/create_alert_issue_spec.rb b/spec/requests/api/graphql/mutations/alert_management/alerts/create_alert_issue_spec.rb
index 5b5b2ec8788..6141a172253 100644
--- a/spec/requests/api/graphql/mutations/alert_management/alerts/create_alert_issue_spec.rb
+++ b/spec/requests/api/graphql/mutations/alert_management/alerts/create_alert_issue_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Create an alert issue from an alert' do
+RSpec.describe 'Create an alert issue from an alert' do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/alert_management/alerts/set_assignees_spec.rb b/spec/requests/api/graphql/mutations/alert_management/alerts/set_assignees_spec.rb
index 6663281e093..cd5cefa0a9a 100644
--- a/spec/requests/api/graphql/mutations/alert_management/alerts/set_assignees_spec.rb
+++ b/spec/requests/api/graphql/mutations/alert_management/alerts/set_assignees_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting assignees of an alert' do
+RSpec.describe 'Setting assignees of an alert' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/mutations/alert_management/alerts/todo/create_spec.rb b/spec/requests/api/graphql/mutations/alert_management/alerts/todo/create_spec.rb
new file mode 100644
index 00000000000..e5803f50474
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/alert_management/alerts/todo/create_spec.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Creating a todo for the alert' do
+  include GraphqlHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project) { create(:project) }
+  let(:alert) { create(:alert_management_alert, project: project) }
+
+  let(:mutation) do
+    variables = {
+      project_path: project.full_path,
+      iid: alert.iid.to_s
+    }
+    graphql_mutation(:alert_todo_create, variables) do
+      <<~QL
+         clientMutationId
+         errors
+         todo {
+           author {
+             username
+           }
+         }
+      QL
+    end
+  end
+
+  let(:mutation_response) { graphql_mutation_response(:alert_todo_create) }
+
+  before do
+    project.add_developer(user)
+  end
+
+  it 'creates a todo for the current user' do
+    post_graphql_mutation(mutation, current_user: user)
+
+    expect(response).to have_gitlab_http_status(:success)
+    expect(mutation_response['todo']['author']['username']).to eq(user.username)
+  end
+
+  context 'todo already exists' do
+    before do
+      create(:todo, :pending, project: project, user: user, target: alert)
+    end
+
+    it 'surfaces an error' do
+      post_graphql_mutation(mutation, current_user: user)
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(mutation_response['errors']).to eq(['You already have pending todo for this alert'])
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/alert_management/alerts/update_alert_status_spec.rb b/spec/requests/api/graphql/mutations/alert_management/alerts/update_alert_status_spec.rb
index 2a470bda689..ff55656a2ae 100644
--- a/spec/requests/api/graphql/mutations/alert_management/alerts/update_alert_status_spec.rb
+++ b/spec/requests/api/graphql/mutations/alert_management/alerts/update_alert_status_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting the status of an alert' do
+RSpec.describe 'Setting the status of an alert' do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb
index 83dec7dd3e2..1891300dace 100644
--- a/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb
+++ b/spec/requests/api/graphql/mutations/award_emojis/add_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Adding an AwardEmoji' do
+RSpec.describe 'Adding an AwardEmoji' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
@@ -15,11 +15,11 @@ describe 'Adding an AwardEmoji' do
       name: emoji_name
     }
 
-    graphql_mutation(:add_award_emoji, variables)
+    graphql_mutation(:award_emoji_add, variables)
   end
 
   def mutation_response
-    graphql_mutation_response(:add_award_emoji)
+    graphql_mutation_response(:award_emoji_add)
   end
 
   shared_examples 'a mutation that does not create an AwardEmoji' do
diff --git a/spec/requests/api/graphql/mutations/award_emojis/remove_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/remove_spec.rb
index a2997db6cae..665b511abb8 100644
--- a/spec/requests/api/graphql/mutations/award_emojis/remove_spec.rb
+++ b/spec/requests/api/graphql/mutations/award_emojis/remove_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Removing an AwardEmoji' do
+RSpec.describe 'Removing an AwardEmoji' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
@@ -12,11 +12,11 @@ describe 'Removing an AwardEmoji' do
   let(:input) { { awardable_id: GitlabSchema.id_from_object(awardable).to_s, name: emoji_name } }
 
   let(:mutation) do
-    graphql_mutation(:remove_award_emoji, input)
+    graphql_mutation(:award_emoji_remove, input)
   end
 
   def mutation_response
-    graphql_mutation_response(:remove_award_emoji)
+    graphql_mutation_response(:award_emoji_remove)
   end
 
   def create_award_emoji(user)
diff --git a/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb b/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb
index e1180c85c6b..ab4a213fde3 100644
--- a/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb
+++ b/spec/requests/api/graphql/mutations/award_emojis/toggle_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Toggling an AwardEmoji' do
+RSpec.describe 'Toggling an AwardEmoji' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
@@ -15,11 +15,11 @@ describe 'Toggling an AwardEmoji' do
       name: emoji_name
     }
 
-    graphql_mutation(:toggle_award_emoji, variables)
+    graphql_mutation(:award_emoji_toggle, variables)
   end
 
   def mutation_response
-    graphql_mutation_response(:toggle_award_emoji)
+    graphql_mutation_response(:award_emoji_toggle)
   end
 
   shared_examples 'a mutation that does not create or destroy an AwardEmoji' do
diff --git a/spec/requests/api/graphql/mutations/branches/create_spec.rb b/spec/requests/api/graphql/mutations/branches/create_spec.rb
index b3c378ec2bc..082b445bf3e 100644
--- a/spec/requests/api/graphql/mutations/branches/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/branches/create_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Creation of a new branch' do
+RSpec.describe 'Creation of a new branch' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/commits/create_spec.rb b/spec/requests/api/graphql/mutations/commits/create_spec.rb
index 10a69932948..9e4a96700bb 100644
--- a/spec/requests/api/graphql/mutations/commits/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/commits/create_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Creation of a new commit' do
+RSpec.describe 'Creation of a new commit' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/container_expiration_policy/update_spec.rb b/spec/requests/api/graphql/mutations/container_expiration_policy/update_spec.rb
index bc256a08f00..bc1b42d68e6 100644
--- a/spec/requests/api/graphql/mutations/container_expiration_policy/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/container_expiration_policy/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Updating the container expiration policy' do
+RSpec.describe 'Updating the container expiration policy' do
   include GraphqlHelpers
   using RSpec::Parameterized::TableSyntax
 
@@ -48,13 +48,48 @@ describe 'Updating the container expiration policy' do
     end
   end
 
-  RSpec.shared_examples 'updating the container expiration policy' do
+  RSpec.shared_examples 'rejecting invalid regex for' do |field_name|
+    context "for field #{field_name}" do
+      let_it_be(:invalid_regex) { '*production' }
+      let(:params) do
+        {
+          :project_path => project.full_path,
+          field_name => invalid_regex
+        }
+      end
+
+      it_behaves_like 'returning response status', :success
+
+      it_behaves_like 'not creating the container expiration policy'
+
+      it 'returns an error' do
+        subject
+
+        expect(graphql_errors.size).to eq(1)
+        expect(graphql_errors.first['message']).to include("#{invalid_regex} is an invalid regexp")
+      end
+    end
+  end
+
+  RSpec.shared_examples 'accepting the mutation request updating the container expiration policy' do
     it_behaves_like 'updating the container expiration policy attributes', mode: :update, from: { cadence: '1d', keep_n: 10, older_than: '90d' }, to: { cadence: '3month', keep_n: 100, older_than: '14d' }
 
     it_behaves_like 'returning a success'
+
+    it_behaves_like 'rejecting invalid regex for', :name_regex
+    it_behaves_like 'rejecting invalid regex for', :name_regex_keep
+  end
+
+  RSpec.shared_examples 'accepting the mutation request creating the container expiration policy' do
+    it_behaves_like 'creating the container expiration policy'
+
+    it_behaves_like 'returning a success'
+
+    it_behaves_like 'rejecting invalid regex for', :name_regex
+    it_behaves_like 'rejecting invalid regex for', :name_regex_keep
   end
 
-  RSpec.shared_examples 'denying access to container expiration policy' do
+  RSpec.shared_examples 'denying the mutation request' do
     it_behaves_like 'not creating the container expiration policy'
 
     it_behaves_like 'returning response status', :success
@@ -71,11 +106,11 @@ describe 'Updating the container expiration policy' do
 
     context 'with existing container expiration policy' do
       where(:user_role, :shared_examples_name) do
-        :maintainer | 'updating the container expiration policy'
-        :developer  | 'updating the container expiration policy'
-        :reporter   | 'denying access to container expiration policy'
-        :guest      | 'denying access to container expiration policy'
-        :anonymous  | 'denying access to container expiration policy'
+        :maintainer | 'accepting the mutation request updating the container expiration policy'
+        :developer  | 'accepting the mutation request updating the container expiration policy'
+        :reporter   | 'denying the mutation request'
+        :guest      | 'denying the mutation request'
+        :anonymous  | 'denying the mutation request'
       end
 
       with_them do
@@ -91,11 +126,11 @@ describe 'Updating the container expiration policy' do
       let_it_be(:project, reload: true) { create(:project, :without_container_expiration_policy) }
 
       where(:user_role, :shared_examples_name) do
-        :maintainer | 'creating the container expiration policy'
-        :developer  | 'creating the container expiration policy'
-        :reporter   | 'denying access to container expiration policy'
-        :guest      | 'denying access to container expiration policy'
-        :anonymous  | 'denying access to container expiration policy'
+        :maintainer | 'accepting the mutation request creating the container expiration policy'
+        :developer  | 'accepting the mutation request creating the container expiration policy'
+        :reporter   | 'denying the mutation request'
+        :guest      | 'denying the mutation request'
+        :anonymous  | 'denying the mutation request'
       end
 
       with_them do
diff --git a/spec/requests/api/graphql/mutations/design_management/delete_spec.rb b/spec/requests/api/graphql/mutations/design_management/delete_spec.rb
index 10376305b3e..e329416faee 100644
--- a/spec/requests/api/graphql/mutations/design_management/delete_spec.rb
+++ b/spec/requests/api/graphql/mutations/design_management/delete_spec.rb
@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe "deleting designs" do
+RSpec.describe "deleting designs" do
   include GraphqlHelpers
   include DesignManagementTestHelpers
 
diff --git a/spec/requests/api/graphql/mutations/design_management/upload_spec.rb b/spec/requests/api/graphql/mutations/design_management/upload_spec.rb
index 22adc064406..9a9c7107b20 100644
--- a/spec/requests/api/graphql/mutations/design_management/upload_spec.rb
+++ b/spec/requests/api/graphql/mutations/design_management/upload_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require "spec_helper"
 
-describe "uploading designs" do
+RSpec.describe "uploading designs" do
   include GraphqlHelpers
   include DesignManagementTestHelpers
   include WorkhorseHelpers
diff --git a/spec/requests/api/graphql/mutations/discussions/toggle_resolve_spec.rb b/spec/requests/api/graphql/mutations/discussions/toggle_resolve_spec.rb
index 95e967c039d..e83da830935 100644
--- a/spec/requests/api/graphql/mutations/discussions/toggle_resolve_spec.rb
+++ b/spec/requests/api/graphql/mutations/discussions/toggle_resolve_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Toggling the resolve status of a discussion' do
+RSpec.describe 'Toggling the resolve status of a discussion' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project, :public, :repository) }
diff --git a/spec/requests/api/graphql/mutations/issues/set_confidential_spec.rb b/spec/requests/api/graphql/mutations/issues/set_confidential_spec.rb
index 4d0bb59b030..3f804a46992 100644
--- a/spec/requests/api/graphql/mutations/issues/set_confidential_spec.rb
+++ b/spec/requests/api/graphql/mutations/issues/set_confidential_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting an issue as confidential' do
+RSpec.describe 'Setting an issue as confidential' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/issues/set_due_date_spec.rb b/spec/requests/api/graphql/mutations/issues/set_due_date_spec.rb
index 1efa9e16233..3dd1225db5a 100644
--- a/spec/requests/api/graphql/mutations/issues/set_due_date_spec.rb
+++ b/spec/requests/api/graphql/mutations/issues/set_due_date_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting Due Date of an issue' do
+RSpec.describe 'Setting Due Date of an issue' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/issues/set_locked_spec.rb b/spec/requests/api/graphql/mutations/issues/set_locked_spec.rb
new file mode 100644
index 00000000000..f1d55430e02
--- /dev/null
+++ b/spec/requests/api/graphql/mutations/issues/set_locked_spec.rb
@@ -0,0 +1,55 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Setting an issue as locked' do
+  include GraphqlHelpers
+
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:issue) { create(:issue) }
+  let_it_be(:project) { issue.project }
+  let(:input) { { locked: true } }
+
+  let(:mutation) do
+    variables = {
+      project_path: project.full_path,
+      iid: issue.iid.to_s
+    }
+    graphql_mutation(:issue_set_locked, variables.merge(input),
+                     <<-QL.strip_heredoc
+                       clientMutationId
+                       errors
+                       issue {
+                         iid
+                         discussionLocked
+                       }
+                     QL
+    )
+  end
+
+  def mutation_response
+    graphql_mutation_response(:issue_set_locked)
+  end
+
+  context 'when the user is not allowed to update the issue' do
+    it 'returns an error' do
+      error = "The resource that you are attempting to access does not exist or you don't have permission to perform this action"
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(graphql_errors).to include(a_hash_including('message' => error))
+    end
+  end
+
+  context 'when user is allowed to update the issue' do
+    before do
+      project.add_developer(current_user)
+    end
+
+    it 'updates the issue locked status' do
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      expect(response).to have_gitlab_http_status(:success)
+      expect(mutation_response['issue']['discussionLocked']).to be_truthy
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb b/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb
index be0d843d5ff..4057aa4ba9e 100644
--- a/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb
+++ b/spec/requests/api/graphql/mutations/jira_import/import_users_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Importing Jira Users' do
+RSpec.describe 'Importing Jira Users' do
   include JiraServiceHelper
   include GraphqlHelpers
 
diff --git a/spec/requests/api/graphql/mutations/jira_import/start_spec.rb b/spec/requests/api/graphql/mutations/jira_import/start_spec.rb
index 296d33aec5d..e7124512ef1 100644
--- a/spec/requests/api/graphql/mutations/jira_import/start_spec.rb
+++ b/spec/requests/api/graphql/mutations/jira_import/start_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Starting a Jira Import' do
+RSpec.describe 'Starting a Jira Import' do
   include JiraServiceHelper
   include GraphqlHelpers
 
@@ -14,7 +14,8 @@ describe 'Starting a Jira Import' do
   let(:mutation) do
     variables = {
       jira_project_key: jira_project_key,
-      project_path: project_path
+      project_path: project_path,
+      users_mapping: [{ jiraAccountId: 'abc', gitlabId: 5 }]
     }
 
     graphql_mutation(:jira_import_start, variables)
diff --git a/spec/requests/api/graphql/mutations/merge_requests/create_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/create_spec.rb
index 5c63f655f1d..d4ac639e226 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/create_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Creation of a new merge request' do
+RSpec.describe 'Creation of a new merge request' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_assignees_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_assignees_spec.rb
index 8f908b7bf88..97873b01338 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_assignees_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_assignees_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting assignees of a merge request' do
+RSpec.describe 'Setting assignees of a merge request' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_labels_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_labels_spec.rb
index 2112ff0dc74..34d347c76fd 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_labels_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_labels_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting labels of a merge request' do
+RSpec.describe 'Setting labels of a merge request' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_locked_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_locked_spec.rb
index c45da613591..a1a35bc1dcc 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_locked_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_locked_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting locked status of a merge request' do
+RSpec.describe 'Setting locked status of a merge request' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb
index bd558edf9c5..d7e2602bd0a 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_milestone_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting milestone of a merge request' do
+RSpec.describe 'Setting milestone of a merge request' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_subscription_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_subscription_spec.rb
index 975735bf246..6b3035fbf48 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_subscription_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_subscription_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting subscribed status of a merge request' do
+RSpec.describe 'Setting subscribed status of a merge request' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/merge_requests/set_wip_spec.rb b/spec/requests/api/graphql/mutations/merge_requests/set_wip_spec.rb
index 4492c51dbd7..2143abd3031 100644
--- a/spec/requests/api/graphql/mutations/merge_requests/set_wip_spec.rb
+++ b/spec/requests/api/graphql/mutations/merge_requests/set_wip_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Setting WIP status of a merge request' do
+RSpec.describe 'Setting Draft status of a merge request' do
   include GraphqlHelpers
 
   let(:current_user) { create(:user) }
@@ -41,39 +41,39 @@ describe 'Setting WIP status of a merge request' do
     expect(graphql_errors).not_to be_empty
   end
 
-  it 'marks the merge request as WIP' do
+  it 'marks the merge request as Draft' do
     post_graphql_mutation(mutation, current_user: current_user)
 
     expect(response).to have_gitlab_http_status(:success)
-    expect(mutation_response['mergeRequest']['title']).to start_with('WIP:')
+    expect(mutation_response['mergeRequest']['title']).to start_with('Draft:')
   end
 
-  it 'does not do anything if the merge request was already marked `WIP`' do
-    merge_request.update!(title: 'wip: hello world')
+  it 'does not do anything if the merge request was already marked `Draft`' do
+    merge_request.update!(title: 'draft: hello world')
 
     post_graphql_mutation(mutation, current_user: current_user)
 
     expect(response).to have_gitlab_http_status(:success)
-    expect(mutation_response['mergeRequest']['title']).to start_with('wip:')
+    expect(mutation_response['mergeRequest']['title']).to start_with('draft:')
   end
 
-  context 'when passing WIP false as input' do
+  context 'when passing Draft false as input' do
     let(:input) { { wip: false } }
 
-    it 'does not do anything if the merge reqeust was not marked wip' do
+    it 'does not do anything if the merge reqeust was not marked draft' do
       post_graphql_mutation(mutation, current_user: current_user)
 
       expect(response).to have_gitlab_http_status(:success)
-      expect(mutation_response['mergeRequest']['title']).not_to start_with(/wip\:/)
+      expect(mutation_response['mergeRequest']['title']).not_to start_with(/draft\:/)
     end
 
-    it 'unmarks the merge request as `WIP`' do
-      merge_request.update!(title: 'wip: hello world')
+    it 'unmarks the merge request as `Draft`' do
+      merge_request.update!(title: 'draft: hello world')
 
       post_graphql_mutation(mutation, current_user: current_user)
 
       expect(response).to have_gitlab_http_status(:success)
-      expect(mutation_response['mergeRequest']['title']).not_to start_with('/wip\:/')
+      expect(mutation_response['mergeRequest']['title']).not_to start_with('/draft\:/')
     end
   end
 end
diff --git a/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb b/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb
index 8568dc8ffc0..0e2da94f0f9 100644
--- a/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/create_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe Mutations::Metrics::Dashboard::Annotations::Create do
+RSpec.describe Mutations::Metrics::Dashboard::Annotations::Create do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/delete_spec.rb b/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/delete_spec.rb
index 217f538c53e..2459a6f3828 100644
--- a/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/delete_spec.rb
+++ b/spec/requests/api/graphql/mutations/metrics/dashboard/annotations/delete_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe Mutations::Metrics::Dashboard::Annotations::Delete do
+RSpec.describe Mutations::Metrics::Dashboard::Annotations::Delete do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/notes/create/diff_note_spec.rb b/spec/requests/api/graphql/mutations/notes/create/diff_note_spec.rb
index 4c535434faa..e847c46be1b 100644
--- a/spec/requests/api/graphql/mutations/notes/create/diff_note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/create/diff_note_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Adding a DiffNote' do
+RSpec.describe 'Adding a DiffNote' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/notes/create/image_diff_note_spec.rb b/spec/requests/api/graphql/mutations/notes/create/image_diff_note_spec.rb
index 0bba3e79434..896a398e308 100644
--- a/spec/requests/api/graphql/mutations/notes/create/image_diff_note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/create/image_diff_note_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Adding an image DiffNote' do
+RSpec.describe 'Adding an image DiffNote' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/notes/create/note_spec.rb b/spec/requests/api/graphql/mutations/notes/create/note_spec.rb
index 9a78d44245e..391ced7dc98 100644
--- a/spec/requests/api/graphql/mutations/notes/create/note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/create/note_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Adding a Note' do
+RSpec.describe 'Adding a Note' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
@@ -13,7 +13,8 @@ describe 'Adding a Note' do
     variables = {
       noteable_id: GitlabSchema.id_from_object(noteable).to_s,
       discussion_id: (GitlabSchema.id_from_object(discussion).to_s if discussion),
-      body: 'Body text'
+      body: 'Body text',
+      confidential: true
     }
 
     graphql_mutation(:create_note, variables)
@@ -40,6 +41,7 @@ describe 'Adding a Note' do
       post_graphql_mutation(mutation, current_user: current_user)
 
       expect(mutation_response['note']['body']).to eq('Body text')
+      expect(mutation_response['note']['confidential']).to eq(true)
     end
 
     describe 'creating Notes in reply to a discussion' do
diff --git a/spec/requests/api/graphql/mutations/notes/destroy_spec.rb b/spec/requests/api/graphql/mutations/notes/destroy_spec.rb
index 337a6e6f6e6..6002a5b5b9d 100644
--- a/spec/requests/api/graphql/mutations/notes/destroy_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/destroy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Destroying a Note' do
+RSpec.describe 'Destroying a Note' do
   include GraphqlHelpers
 
   let!(:note) { create(:note) }
diff --git a/spec/requests/api/graphql/mutations/notes/update/image_diff_note_spec.rb b/spec/requests/api/graphql/mutations/notes/update/image_diff_note_spec.rb
index 0362fef2d2e..f7be671e5f3 100644
--- a/spec/requests/api/graphql/mutations/notes/update/image_diff_note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/update/image_diff_note_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Updating an image DiffNote' do
+RSpec.describe 'Updating an image DiffNote' do
   include GraphqlHelpers
   using RSpec::Parameterized::TableSyntax
 
diff --git a/spec/requests/api/graphql/mutations/notes/update/note_spec.rb b/spec/requests/api/graphql/mutations/notes/update/note_spec.rb
index a5c6b72005e..38378310d9f 100644
--- a/spec/requests/api/graphql/mutations/notes/update/note_spec.rb
+++ b/spec/requests/api/graphql/mutations/notes/update/note_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Updating a Note' do
+RSpec.describe 'Updating a Note' do
   include GraphqlHelpers
 
   let!(:note) { create(:note, note: original_body) }
diff --git a/spec/requests/api/graphql/mutations/snippets/create_spec.rb b/spec/requests/api/graphql/mutations/snippets/create_spec.rb
index 9052f54b171..e2474e1bcce 100644
--- a/spec/requests/api/graphql/mutations/snippets/create_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/create_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Creating a Snippet' do
+RSpec.describe 'Creating a Snippet' do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }
@@ -14,9 +14,8 @@ describe 'Creating a Snippet' do
   let(:visibility_level) { 'public' }
   let(:project_path) { nil }
   let(:uploaded_files) { nil }
-
-  let(:mutation) do
-    variables = {
+  let(:mutation_vars) do
+    {
       content: content,
       description: description,
       visibility_level: visibility_level,
@@ -25,8 +24,10 @@ describe 'Creating a Snippet' do
       project_path: project_path,
       uploaded_files: uploaded_files
     }
+  end
 
-    graphql_mutation(:create_snippet, variables)
+  let(:mutation) do
+    graphql_mutation(:create_snippet, mutation_vars)
   end
 
   def mutation_response
@@ -137,6 +138,47 @@ describe 'Creating a Snippet' do
       end
     end
 
+    context 'when snippet is created using the files param' do
+      let(:action) { :create }
+      let(:file_1) { { filePath: 'example_file1', content: 'This is the example file 1' }}
+      let(:file_2) { { filePath: 'example_file2', content: 'This is the example file 2' }}
+      let(:actions) { [{ action: action }.merge(file_1), { action: action }.merge(file_2)] }
+      let(:mutation_vars) do
+        {
+          description: description,
+          visibility_level: visibility_level,
+          project_path: project_path,
+          title: title,
+          files: actions
+        }
+      end
+
+      it 'creates the Snippet' do
+        expect do
+          subject
+        end.to change { Snippet.count }.by(1)
+      end
+
+      it 'returns the created Snippet' do
+        subject
+
+        expect(mutation_response['snippet']['title']).to eq(title)
+        expect(mutation_response['snippet']['description']).to eq(description)
+        expect(mutation_response['snippet']['visibilityLevel']).to eq(visibility_level)
+        expect(mutation_response['snippet']['blobs'][0]['plainData']).to match(file_1[:content])
+        expect(mutation_response['snippet']['blobs'][0]['fileName']).to match(file_1[:file_path])
+        expect(mutation_response['snippet']['blobs'][1]['plainData']).to match(file_2[:content])
+        expect(mutation_response['snippet']['blobs'][1]['fileName']).to match(file_2[:file_path])
+      end
+
+      context 'when action is invalid' do
+        let(:file_1) { { filePath: 'example_file1' }}
+
+        it_behaves_like 'a mutation that returns errors in the response', errors: ['Snippet actions have invalid data']
+        it_behaves_like 'does not create snippet'
+      end
+    end
+
     context 'when there are ActiveRecord validation errors' do
       let(:title) { '' }
 
diff --git a/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb b/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb
index cb9aeea74b2..8ade72635af 100644
--- a/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/destroy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Destroying a Snippet' do
+RSpec.describe 'Destroying a Snippet' do
   include GraphqlHelpers
 
   let(:current_user) { snippet.author }
diff --git a/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb b/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb
index 6d4dce3f6f1..97e6ae8fda8 100644
--- a/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/mark_as_spam_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Mark snippet as spam', :do_not_mock_admin_mode do
+RSpec.describe 'Mark snippet as spam', :do_not_mock_admin_mode do
   include GraphqlHelpers
 
   let_it_be(:admin) { create(:admin) }
diff --git a/spec/requests/api/graphql/mutations/snippets/update_spec.rb b/spec/requests/api/graphql/mutations/snippets/update_spec.rb
index 968ea5aed52..3b2f9dc0f19 100644
--- a/spec/requests/api/graphql/mutations/snippets/update_spec.rb
+++ b/spec/requests/api/graphql/mutations/snippets/update_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Updating a Snippet' do
+RSpec.describe 'Updating a Snippet' do
   include GraphqlHelpers
 
   let_it_be(:original_content) { 'Initial content' }
@@ -16,8 +16,8 @@ describe 'Updating a Snippet' do
   let(:current_user) { snippet.author }
 
   let(:snippet_gid) { GitlabSchema.id_from_object(snippet).to_s }
-  let(:mutation) do
-    variables = {
+  let(:mutation_vars) do
+    {
       id: snippet_gid,
       content: updated_content,
       description: updated_description,
@@ -25,8 +25,9 @@ describe 'Updating a Snippet' do
       file_name: updated_file_name,
       title: updated_title
     }
-
-    graphql_mutation(:update_snippet, variables)
+  end
+  let(:mutation) do
+    graphql_mutation(:update_snippet, mutation_vars)
   end
 
   def mutation_response
@@ -101,7 +102,6 @@ describe 'Updating a Snippet' do
     end
 
     it_behaves_like 'graphql update actions'
-
     it_behaves_like 'when the snippet is not found'
   end
 
@@ -148,4 +148,40 @@ describe 'Updating a Snippet' do
 
     it_behaves_like 'when the snippet is not found'
   end
+
+  context 'when using the files params' do
+    let!(:snippet) { create(:personal_snippet, :private, :repository) }
+    let(:updated_content) { 'updated_content' }
+    let(:updated_file) { 'CHANGELOG' }
+    let(:deleted_file) { 'README' }
+    let(:mutation_vars) do
+      {
+        id: snippet_gid,
+        files: [
+          { action: :update, filePath: updated_file, content: updated_content },
+          { action: :delete, filePath: deleted_file }
+        ]
+      }
+    end
+
+    it 'updates the Snippet' do
+      blob_to_update = blob_at(updated_file)
+      expect(blob_to_update.data).not_to eq updated_content
+
+      blob_to_delete = blob_at(deleted_file)
+      expect(blob_to_delete).to be_present
+
+      post_graphql_mutation(mutation, current_user: current_user)
+
+      blob_to_update = blob_at(updated_file)
+      expect(blob_to_update.data).to eq updated_content
+
+      blob_to_delete = blob_at(deleted_file)
+      expect(blob_to_delete).to be_nil
+    end
+
+    def blob_at(filename)
+      snippet.repository.blob_at('HEAD', filename)
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/mutations/todos/mark_all_done_spec.rb b/spec/requests/api/graphql/mutations/todos/mark_all_done_spec.rb
index 40e085027d7..ed5552f3e30 100644
--- a/spec/requests/api/graphql/mutations/todos/mark_all_done_spec.rb
+++ b/spec/requests/api/graphql/mutations/todos/mark_all_done_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Marking all todos done' do
+RSpec.describe 'Marking all todos done' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/todos/mark_done_spec.rb b/spec/requests/api/graphql/mutations/todos/mark_done_spec.rb
index fabbb3aeb49..9c4733f6769 100644
--- a/spec/requests/api/graphql/mutations/todos/mark_done_spec.rb
+++ b/spec/requests/api/graphql/mutations/todos/mark_done_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Marking todos done' do
+RSpec.describe 'Marking todos done' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/mutations/todos/restore_spec.rb b/spec/requests/api/graphql/mutations/todos/restore_spec.rb
index faa36c8273a..6dedde56e13 100644
--- a/spec/requests/api/graphql/mutations/todos/restore_spec.rb
+++ b/spec/requests/api/graphql/mutations/todos/restore_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Restoring Todos' do
+RSpec.describe 'Restoring Todos' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/namespace/projects_spec.rb b/spec/requests/api/graphql/namespace/projects_spec.rb
index 2a95b99572f..0b634e6b689 100644
--- a/spec/requests/api/graphql/namespace/projects_spec.rb
+++ b/spec/requests/api/graphql/namespace/projects_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting projects' do
+RSpec.describe 'getting projects' do
   include GraphqlHelpers
 
   let(:group)             { create(:group) }
diff --git a/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb b/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb
index f7e28043930..44e68c59248 100644
--- a/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb
+++ b/spec/requests/api/graphql/namespace/root_storage_statistics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'rendering namespace statistics' do
+RSpec.describe 'rendering namespace statistics' do
   include GraphqlHelpers
 
   let(:namespace) { user.namespace }
diff --git a/spec/requests/api/graphql/project/alert_management/alert/assignees_spec.rb b/spec/requests/api/graphql/project/alert_management/alert/assignees_spec.rb
index 4c048caaeee..dd001a73349 100644
--- a/spec/requests/api/graphql/project/alert_management/alert/assignees_spec.rb
+++ b/spec/requests/api/graphql/project/alert_management/alert/assignees_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting Alert Management Alert Assignees' do
+RSpec.describe 'getting Alert Management Alert Assignees' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/project/alert_management/alert/metrics_dashboard_url_spec.rb b/spec/requests/api/graphql/project/alert_management/alert/metrics_dashboard_url_spec.rb
new file mode 100644
index 00000000000..352a94cfc1d
--- /dev/null
+++ b/spec/requests/api/graphql/project/alert_management/alert/metrics_dashboard_url_spec.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'getting Alert Management Alert Assignees' do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:current_user) { create(:user) }
+
+  let(:fields) do
+    <<~QUERY
+      nodes {
+        iid
+        metricsDashboardUrl
+      }
+    QUERY
+  end
+
+  let(:graphql_query) do
+    graphql_query_for(
+      'project',
+      { 'fullPath' => project.full_path },
+      query_graphql_field('alertManagementAlerts', {}, fields)
+    )
+  end
+
+  let(:alerts) { graphql_data.dig('project', 'alertManagementAlerts', 'nodes') }
+  let(:first_alert) { alerts.first }
+
+  before do
+    project.add_developer(current_user)
+  end
+
+  context 'with self-managed prometheus payload' do
+    include_context 'self-managed prometheus alert attributes'
+
+    before do
+      create(:alert_management_alert, :prometheus, project: project, payload: payload)
+    end
+
+    it 'includes the correct metrics dashboard url' do
+      post_graphql(graphql_query, current_user: current_user)
+
+      expect(first_alert).to include('metricsDashboardUrl' => dashboard_url_for_alert)
+    end
+  end
+
+  context 'with gitlab-managed prometheus payload' do
+    include_context 'gitlab-managed prometheus alert attributes'
+
+    before do
+      create(:alert_management_alert, :prometheus, project: project, payload: payload, prometheus_alert: prometheus_alert)
+    end
+
+    it 'includes the correct metrics dashboard url' do
+      post_graphql(graphql_query, current_user: current_user)
+
+      expect(first_alert).to include('metricsDashboardUrl' => dashboard_url_for_alert)
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/project/alert_management/alert/notes_spec.rb b/spec/requests/api/graphql/project/alert_management/alert/notes_spec.rb
index df6bfa8c97b..1350cba119b 100644
--- a/spec/requests/api/graphql/project/alert_management/alert/notes_spec.rb
+++ b/spec/requests/api/graphql/project/alert_management/alert/notes_spec.rb
@@ -2,15 +2,15 @@
 
 require 'spec_helper'
 
-describe 'getting Alert Management Alert Notes' do
+RSpec.describe 'getting Alert Management Alert Notes' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
   let_it_be(:current_user) { create(:user) }
   let_it_be(:first_alert) { create(:alert_management_alert, project: project, assignees: [current_user]) }
   let_it_be(:second_alert) { create(:alert_management_alert, project: project) }
-  let_it_be(:first_system_note) { create(:note_on_alert, noteable: first_alert, project: project) }
-  let_it_be(:second_system_note) { create(:note_on_alert, noteable: first_alert, project: project) }
+  let_it_be(:first_system_note) { create(:note_on_alert, :with_system_note_metadata, noteable: first_alert, project: project) }
+  let_it_be(:second_system_note) { create(:note_on_alert, :with_system_note_metadata, noteable: first_alert, project: project) }
 
   let(:params) { {} }
 
@@ -21,6 +21,8 @@ describe 'getting Alert Management Alert Notes' do
         notes {
           nodes {
             id
+            body
+            systemNoteIconName
           }
         }
       }
@@ -44,7 +46,17 @@ describe 'getting Alert Management Alert Notes' do
     project.add_developer(current_user)
   end
 
-  it 'returns the notes ordered by createdAt' do
+  it 'includes expected data' do
+    post_graphql(query, current_user: current_user)
+
+    expect(first_notes_result.first).to include(
+      'id' => first_system_note.to_global_id.to_s,
+      'systemNoteIconName' => 'git-merge',
+      'body' => first_system_note.note
+    )
+  end
+
+  it 'returns the notes ordered by createdAt with sufficient content' do
     post_graphql(query, current_user: current_user)
 
     expect(first_notes_result.length).to eq(2)
@@ -64,4 +76,18 @@ describe 'getting Alert Management Alert Notes' do
     expect { post_graphql(query, current_user: current_user) }.not_to exceed_query_limit(base_count)
     expect(alerts_result.length).to eq(3)
   end
+
+  context 'for non-system notes' do
+    let_it_be(:user_note) { create(:note_on_alert, noteable: second_alert, project: project) }
+
+    it 'includes expected data' do
+      post_graphql(query, current_user: current_user)
+
+      expect(second_notes_result.first).to include(
+        'id' => user_note.to_global_id.to_s,
+        'systemNoteIconName' => nil,
+        'body' => user_note.note
+      )
+    end
+  end
 end
diff --git a/spec/requests/api/graphql/project/alert_management/alert_status_counts_spec.rb b/spec/requests/api/graphql/project/alert_management/alert_status_counts_spec.rb
index a0d1ff7efc5..b62215f43fb 100644
--- a/spec/requests/api/graphql/project/alert_management/alert_status_counts_spec.rb
+++ b/spec/requests/api/graphql/project/alert_management/alert_status_counts_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'getting Alert Management Alert counts by status' do
+RSpec.describe 'getting Alert Management Alert counts by status' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project, :repository) }
diff --git a/spec/requests/api/graphql/project/alert_management/alerts_spec.rb b/spec/requests/api/graphql/project/alert_management/alerts_spec.rb
index c591895f295..f050c6873f3 100644
--- a/spec/requests/api/graphql/project/alert_management/alerts_spec.rb
+++ b/spec/requests/api/graphql/project/alert_management/alerts_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'getting Alert Management Alerts' do
+RSpec.describe 'getting Alert Management Alerts' do
   include GraphqlHelpers
 
   let_it_be(:payload) { { 'custom' => { 'alert' => 'payload' } } }
@@ -73,12 +73,13 @@ describe 'getting Alert Management Alerts' do
           'endedAt' => nil,
           'details' => { 'custom.alert' => 'payload' },
           'createdAt' => triggered_alert.created_at.strftime('%Y-%m-%dT%H:%M:%SZ'),
-          'updatedAt' => triggered_alert.updated_at.strftime('%Y-%m-%dT%H:%M:%SZ')
+          'updatedAt' => triggered_alert.updated_at.strftime('%Y-%m-%dT%H:%M:%SZ'),
+          'metricsDashboardUrl' => nil
         )
 
         expect(second_alert).to include(
           'iid' => resolved_alert.iid.to_s,
-          'issueIid' => nil,
+          'issueIid' => resolved_alert.issue_iid.to_s,
           'status' => 'RESOLVED',
           'endedAt' => resolved_alert.ended_at.strftime('%Y-%m-%dT%H:%M:%SZ')
         )
@@ -109,14 +110,14 @@ describe 'getting Alert Management Alerts' do
         it_behaves_like 'a working graphql query'
 
         it 'sorts in the correct order' do
-          expect(iids).to eq [resolved_alert.iid.to_s, triggered_alert.iid.to_s]
+          expect(iids).to eq [triggered_alert.iid.to_s, resolved_alert.iid.to_s]
         end
 
         context 'ascending order' do
           let(:params) { 'sort: SEVERITY_ASC' }
 
           it 'sorts in the correct order' do
-            expect(iids).to eq [triggered_alert.iid.to_s, resolved_alert.iid.to_s]
+            expect(iids).to eq [resolved_alert.iid.to_s, triggered_alert.iid.to_s]
           end
         end
       end
diff --git a/spec/requests/api/graphql/project/base_service_spec.rb b/spec/requests/api/graphql/project/base_service_spec.rb
index 8199f331fbf..4dfc242da80 100644
--- a/spec/requests/api/graphql/project/base_service_spec.rb
+++ b/spec/requests/api/graphql/project/base_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'query Jira service' do
+RSpec.describe 'query Jira service' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/project/container_expiration_policy_spec.rb b/spec/requests/api/graphql/project/container_expiration_policy_spec.rb
index d0563f9ff05..b064e4d43e9 100644
--- a/spec/requests/api/graphql/project/container_expiration_policy_spec.rb
+++ b/spec/requests/api/graphql/project/container_expiration_policy_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'getting a repository in a project' do
+RSpec.describe 'getting a repository in a project' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/project/error_tracking/sentry_detailed_error_request_spec.rb b/spec/requests/api/graphql/project/error_tracking/sentry_detailed_error_request_spec.rb
index a1f9fa1f10c..b2b42137acf 100644
--- a/spec/requests/api/graphql/project/error_tracking/sentry_detailed_error_request_spec.rb
+++ b/spec/requests/api/graphql/project/error_tracking/sentry_detailed_error_request_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'getting a detailed sentry error' do
+RSpec.describe 'getting a detailed sentry error' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project, :repository) }
diff --git a/spec/requests/api/graphql/project/error_tracking/sentry_errors_request_spec.rb b/spec/requests/api/graphql/project/error_tracking/sentry_errors_request_spec.rb
index 06a0bfc0d32..cd84ce9cb96 100644
--- a/spec/requests/api/graphql/project/error_tracking/sentry_errors_request_spec.rb
+++ b/spec/requests/api/graphql/project/error_tracking/sentry_errors_request_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'sentry errors requests' do
+RSpec.describe 'sentry errors requests' do
   include GraphqlHelpers
   let_it_be(:project) { create(:project, :repository) }
   let_it_be(:project_setting) { create(:project_error_tracking_setting, project: project) }
diff --git a/spec/requests/api/graphql/project/grafana_integration_spec.rb b/spec/requests/api/graphql/project/grafana_integration_spec.rb
index c9bc6c1a68e..688959e622d 100644
--- a/spec/requests/api/graphql/project/grafana_integration_spec.rb
+++ b/spec/requests/api/graphql/project/grafana_integration_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'Getting Grafana Integration' do
+RSpec.describe 'Getting Grafana Integration' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project, :repository) }
diff --git a/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb b/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb
index 04f445b4318..1b654e660e3 100644
--- a/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb
+++ b/spec/requests/api/graphql/project/issue/design_collection/version_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Query.project(fullPath).issue(iid).designCollection.version(sha)' do
+RSpec.describe 'Query.project(fullPath).issue(iid).designCollection.version(sha)' do
   include GraphqlHelpers
   include DesignManagementTestHelpers
 
diff --git a/spec/requests/api/graphql/project/issue/design_collection/versions_spec.rb b/spec/requests/api/graphql/project/issue/design_collection/versions_spec.rb
index 18787bf925d..640ac95cd86 100644
--- a/spec/requests/api/graphql/project/issue/design_collection/versions_spec.rb
+++ b/spec/requests/api/graphql/project/issue/design_collection/versions_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Getting versions related to an issue' do
+RSpec.describe 'Getting versions related to an issue' do
   include GraphqlHelpers
   include DesignManagementTestHelpers
 
diff --git a/spec/requests/api/graphql/project/issue/designs/designs_spec.rb b/spec/requests/api/graphql/project/issue/designs/designs_spec.rb
index b6fd0d91bda..e47c025f8b2 100644
--- a/spec/requests/api/graphql/project/issue/designs/designs_spec.rb
+++ b/spec/requests/api/graphql/project/issue/designs/designs_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Getting designs related to an issue' do
+RSpec.describe 'Getting designs related to an issue' do
   include GraphqlHelpers
   include DesignManagementTestHelpers
 
diff --git a/spec/requests/api/graphql/project/issue/designs/notes_spec.rb b/spec/requests/api/graphql/project/issue/designs/notes_spec.rb
index 0207bb9123a..ae5c8363d0f 100644
--- a/spec/requests/api/graphql/project/issue/designs/notes_spec.rb
+++ b/spec/requests/api/graphql/project/issue/designs/notes_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Getting designs related to an issue' do
+RSpec.describe 'Getting designs related to an issue' do
   include GraphqlHelpers
   include DesignManagementTestHelpers
 
diff --git a/spec/requests/api/graphql/project/issue/notes_spec.rb b/spec/requests/api/graphql/project/issue/notes_spec.rb
index bfc89434370..97f5261ef1d 100644
--- a/spec/requests/api/graphql/project/issue/notes_spec.rb
+++ b/spec/requests/api/graphql/project/issue/notes_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting notes for an issue' do
+RSpec.describe 'getting notes for an issue' do
   include GraphqlHelpers
 
   let(:noteable) { create(:issue) }
diff --git a/spec/requests/api/graphql/project/issue_spec.rb b/spec/requests/api/graphql/project/issue_spec.rb
index 92d2f9d0d31..5f368833181 100644
--- a/spec/requests/api/graphql/project/issue_spec.rb
+++ b/spec/requests/api/graphql/project/issue_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Query.project(fullPath).issue(iid)' do
+RSpec.describe 'Query.project(fullPath).issue(iid)' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/project/issues_spec.rb b/spec/requests/api/graphql/project/issues_spec.rb
index 3128f527356..cdfff2f50d4 100644
--- a/spec/requests/api/graphql/project/issues_spec.rb
+++ b/spec/requests/api/graphql/project/issues_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting an issue list for a project' do
+RSpec.describe 'getting an issue list for a project' do
   include GraphqlHelpers
 
   let(:project) { create(:project, :repository, :public) }
diff --git a/spec/requests/api/graphql/project/jira_import_spec.rb b/spec/requests/api/graphql/project/jira_import_spec.rb
index 7be14696963..814965262b6 100644
--- a/spec/requests/api/graphql/project/jira_import_spec.rb
+++ b/spec/requests/api/graphql/project/jira_import_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'query Jira import data' do
+RSpec.describe 'query Jira import data' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/project/jira_projects_spec.rb b/spec/requests/api/graphql/project/jira_projects_spec.rb
index d67c89f18c9..d5f59711ab1 100644
--- a/spec/requests/api/graphql/project/jira_projects_spec.rb
+++ b/spec/requests/api/graphql/project/jira_projects_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'query Jira projects' do
+RSpec.describe 'query Jira projects' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
@@ -80,34 +80,6 @@ describe 'query Jira projects' do
 
           it_behaves_like 'fetches first project'
         end
-
-        context 'with before cursor' do
-          let(:projects_query) { 'projects(before: "Mg==", first: 1)' }
-
-          it_behaves_like 'fetches first project'
-        end
-
-        context 'with after cursor' do
-          let(:projects_query) { 'projects(after: "MA==", first: 1)' }
-
-          it_behaves_like 'fetches first project'
-        end
-      end
-
-      context 'with valid but inexistent after cursor' do
-        let(:projects_query) { 'projects(after: "MTk==")' }
-
-        it 'retuns empty list of jira projects' do
-          expect(jira_projects.size).to eq(0)
-        end
-      end
-
-      context 'with invalid after cursor' do
-        let(:projects_query) { 'projects(after: "invalid==")' }
-
-        it 'treats the invalid cursor as no cursor and returns list of jira projects' do
-          expect(jira_projects.size).to eq(2)
-        end
       end
     end
   end
diff --git a/spec/requests/api/graphql/project/jira_service_spec.rb b/spec/requests/api/graphql/project/jira_service_spec.rb
index 4ac598b789f..905a669bf0d 100644
--- a/spec/requests/api/graphql/project/jira_service_spec.rb
+++ b/spec/requests/api/graphql/project/jira_service_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'query Jira service' do
+RSpec.describe 'query Jira service' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/project/labels_query_spec.rb b/spec/requests/api/graphql/project/labels_query_spec.rb
index ecc43e0a3db..eeaaaaee575 100644
--- a/spec/requests/api/graphql/project/labels_query_spec.rb
+++ b/spec/requests/api/graphql/project/labels_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting project label information' do
+RSpec.describe 'getting project label information' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project, :public) }
diff --git a/spec/requests/api/graphql/project/merge_request/diff_notes_spec.rb b/spec/requests/api/graphql/project/merge_request/diff_notes_spec.rb
index c616310a72c..dd16b052e0e 100644
--- a/spec/requests/api/graphql/project/merge_request/diff_notes_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request/diff_notes_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting notes for a merge request' do
+RSpec.describe 'getting notes for a merge request' do
   include GraphqlHelpers
 
   let_it_be(:noteable) { create(:merge_request) }
diff --git a/spec/requests/api/graphql/project/merge_request_spec.rb b/spec/requests/api/graphql/project/merge_request_spec.rb
index 643532bf2e2..c39358a2db1 100644
--- a/spec/requests/api/graphql/project/merge_request_spec.rb
+++ b/spec/requests/api/graphql/project/merge_request_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting merge request information nested in a project' do
+RSpec.describe 'getting merge request information nested in a project' do
   include GraphqlHelpers
 
   let(:project) { create(:project, :repository, :public) }
@@ -43,6 +43,59 @@ describe 'getting merge request information nested in a project' do
     expect(merge_request_graphql_data['author']['username']).to eq(merge_request.author.username)
   end
 
+  it 'includes diff stats' do
+    be_natural = an_instance_of(Integer).and(be >= 0)
+
+    post_graphql(query, current_user: current_user)
+
+    sums = merge_request_graphql_data['diffStats'].reduce([0, 0, 0]) do |(a, d, c), node|
+      a_, d_ = node.values_at('additions', 'deletions')
+      [a + a_, d + d_, c + a_ + d_]
+    end
+
+    expect(merge_request_graphql_data).to include(
+      'diffStats' => all(a_hash_including('path' => String, 'additions' => be_natural, 'deletions' => be_natural)),
+      'diffStatsSummary' => a_hash_including(
+        'fileCount' => merge_request.diff_stats.count,
+        'additions' => be_natural,
+        'deletions' => be_natural,
+        'changes' => be_natural
+      )
+    )
+
+    # diff_stats is consistent with summary
+    expect(merge_request_graphql_data['diffStatsSummary']
+      .values_at('additions', 'deletions', 'changes')).to eq(sums)
+
+    # diff_stats_summary is internally consistent
+    expect(merge_request_graphql_data['diffStatsSummary']
+      .values_at('additions', 'deletions').sum)
+      .to eq(merge_request_graphql_data.dig('diffStatsSummary', 'changes'))
+      .and be_positive
+  end
+
+  context 'requesting a specific diff stat' do
+    let(:diff_stat) { merge_request.diff_stats.first }
+
+    let(:query) do
+      graphql_query_for(:project, { full_path: project.full_path },
+        query_graphql_field(:merge_request, { iid: merge_request.iid.to_s }, [
+          query_graphql_field(:diff_stats, { path: diff_stat.path }, all_graphql_fields_for('DiffStats'))
+        ])
+      )
+    end
+
+    it 'includes only the requested stats' do
+      post_graphql(query, current_user: current_user)
+
+      expect(merge_request_graphql_data).to include(
+        'diffStats' => contain_exactly(
+          a_hash_including('path' => diff_stat.path, 'additions' => diff_stat.additions, 'deletions' => diff_stat.deletions)
+        )
+      )
+    end
+  end
+
   it 'includes correct mergedAt value when merged' do
     time = 1.week.ago
     merge_request.mark_as_merged
diff --git a/spec/requests/api/graphql/project/merge_requests_spec.rb b/spec/requests/api/graphql/project/merge_requests_spec.rb
index 49fdfe29874..e2255fdb048 100644
--- a/spec/requests/api/graphql/project/merge_requests_spec.rb
+++ b/spec/requests/api/graphql/project/merge_requests_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting merge request listings nested in a project' do
+RSpec.describe 'getting merge request listings nested in a project' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project, :repository, :public) }
diff --git a/spec/requests/api/graphql/project/packages_spec.rb b/spec/requests/api/graphql/project/packages_spec.rb
new file mode 100644
index 00000000000..88f97f9256b
--- /dev/null
+++ b/spec/requests/api/graphql/project/packages_spec.rb
@@ -0,0 +1,69 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'getting a package list for a project' do
+  include GraphqlHelpers
+
+  let_it_be(:project) { create(:project) }
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:package) { create(:package, project: project) }
+  let(:packages_data) { graphql_data['project']['packages']['edges'] }
+
+  let(:fields) do
+    <<~QUERY
+    edges {
+      node {
+        #{all_graphql_fields_for('packages'.classify)}
+      }
+    }
+    QUERY
+  end
+
+  let(:query) do
+    graphql_query_for(
+      'project',
+      { 'fullPath' => project.full_path },
+      query_graphql_field('packages', {}, fields)
+    )
+  end
+
+  context 'without the need for a license' do
+    context 'when user has access to the project' do
+      before do
+        project.add_reporter(current_user)
+        post_graphql(query, current_user: current_user)
+      end
+
+      it_behaves_like 'a working graphql query'
+
+      it 'returns packages successfully' do
+        expect(packages_data[0]['node']['name']).to eq package.name
+      end
+    end
+
+    context 'when the user does not have access to the project/packages' do
+      before do
+        post_graphql(query, current_user: current_user)
+      end
+
+      it_behaves_like 'a working graphql query'
+
+      it 'returns nil' do
+        expect(graphql_data['project']).to be_nil
+      end
+    end
+
+    context 'when the user is not autenthicated' do
+      before do
+        post_graphql(query)
+      end
+
+      it_behaves_like 'a working graphql query'
+
+      it 'returns nil' do
+        expect(graphql_data['project']).to be_nil
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/project/pipeline_spec.rb b/spec/requests/api/graphql/project/pipeline_spec.rb
index bed9a18577f..57b9de25c3d 100644
--- a/spec/requests/api/graphql/project/pipeline_spec.rb
+++ b/spec/requests/api/graphql/project/pipeline_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting pipeline information nested in a project' do
+RSpec.describe 'getting pipeline information nested in a project' do
   include GraphqlHelpers
 
   let(:project) { create(:project, :repository, :public) }
diff --git a/spec/requests/api/graphql/project/project_statistics_spec.rb b/spec/requests/api/graphql/project/project_statistics_spec.rb
index 05dd5d36c26..c226b10ab51 100644
--- a/spec/requests/api/graphql/project/project_statistics_spec.rb
+++ b/spec/requests/api/graphql/project/project_statistics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'rendering project statistics' do
+RSpec.describe 'rendering project statistics' do
   include GraphqlHelpers
 
   let(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/project/release_spec.rb b/spec/requests/api/graphql/project/release_spec.rb
index f8624a97a2b..f9c19d9747d 100644
--- a/spec/requests/api/graphql/project/release_spec.rb
+++ b/spec/requests/api/graphql/project/release_spec.rb
@@ -1,206 +1,374 @@
 # frozen_string_literal: true
 
 require 'spec_helper'
-require 'pp'
 
-describe 'Query.project(fullPath).release(tagName)' do
+RSpec.describe 'Query.project(fullPath).release(tagName)' do
   include GraphqlHelpers
   include Presentable
 
-  let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:milestone_1) { create(:milestone, project: project) }
-  let_it_be(:milestone_2) { create(:milestone, project: project) }
-  let_it_be(:release) { create(:release, :with_evidence, project: project, milestones: [milestone_1, milestone_2]) }
-  let_it_be(:release_link_1) { create(:release_link, release: release) }
-  let_it_be(:release_link_2) { create(:release_link, release: release) }
   let_it_be(:developer) { create(:user) }
+  let_it_be(:guest) { create(:user) }
+  let_it_be(:reporter) { create(:user) }
+  let_it_be(:stranger) { create(:user) }
 
-  let(:current_user) { developer }
+  let(:params_for_issues_and_mrs) { { scope: 'all', state: 'opened', release_tag: release.tag } }
+  let(:post_query) { post_graphql(query, current_user: current_user) }
+  let(:path_prefix) { %w[project release] }
+  let(:data) { graphql_data.dig(*path) }
 
   def query(rq = release_fields)
     graphql_query_for(:project, { fullPath: project.full_path },
       query_graphql_field(:release, { tagName: release.tag }, rq))
   end
 
-  let(:post_query) { post_graphql(query, current_user: current_user) }
-  let(:path_prefix) { %w[project release] }
-
-  let(:data) { graphql_data.dig(*path) }
-
   before do
-    project.add_developer(developer)
+    stub_default_url_options(host: 'www.example.com')
   end
 
-  describe 'scalar fields' do
-    let(:path) { path_prefix }
-    let(:release_fields) do
-      query_graphql_field(%{
-        tagName
-        tagPath
-        description
-        descriptionHtml
-        name
-        createdAt
-        releasedAt
-      })
+  shared_examples 'full access to the release field' do
+    describe 'scalar fields' do
+      let(:path) { path_prefix }
+
+      let(:release_fields) do
+        query_graphql_field(%{
+          tagName
+          tagPath
+          description
+          descriptionHtml
+          name
+          createdAt
+          releasedAt
+        })
+      end
+
+      before do
+        post_query
+      end
+
+      it 'finds all release data' do
+        expect(data).to eq({
+          'tagName' => release.tag,
+          'tagPath' => project_tag_path(project, release.tag),
+          'description' => release.description,
+          'descriptionHtml' => release.description_html,
+          'name' => release.name,
+          'createdAt' => release.created_at.iso8601,
+          'releasedAt' => release.released_at.iso8601
+        })
+      end
     end
 
-    before do
-      post_query
+    describe 'milestones' do
+      let(:path) { path_prefix + %w[milestones nodes] }
+
+      let(:release_fields) do
+        query_graphql_field(:milestones, nil, 'nodes { id title }')
+      end
+
+      it 'finds all milestones associated to a release' do
+        post_query
+
+        expected = release.milestones.map do |milestone|
+          { 'id' => global_id_of(milestone), 'title' => milestone.title }
+        end
+
+        expect(data).to match_array(expected)
+      end
     end
 
-    it 'finds all release data' do
-      expect(data).to eq({
-        'tagName' => release.tag,
-        'tagPath' => project_tag_path(project, release.tag),
-        'description' => release.description,
-        'descriptionHtml' => release.description_html,
-        'name' => release.name,
-        'createdAt' => release.created_at.iso8601,
-        'releasedAt' => release.released_at.iso8601
-      })
+    describe 'author' do
+      let(:path) { path_prefix + %w[author] }
+
+      let(:release_fields) do
+        query_graphql_field(:author, nil, 'id username')
+      end
+
+      it 'finds the author of the release' do
+        post_query
+
+        expect(data).to eq(
+          'id' => global_id_of(release.author),
+          'username' => release.author.username
+        )
+      end
     end
-  end
 
-  describe 'milestones' do
-    let(:path) { path_prefix + %w[milestones nodes] }
-    let(:release_fields) do
-      query_graphql_field(:milestones, nil, 'nodes { id title }')
+    describe 'commit' do
+      let(:path) { path_prefix + %w[commit] }
+
+      let(:release_fields) do
+        query_graphql_field(:commit, nil, 'sha')
+      end
+
+      it 'finds the commit associated with the release' do
+        post_query
+
+        expect(data).to eq('sha' => release.commit.sha)
+      end
     end
 
-    it 'finds all milestones associated to a release' do
-      post_query
+    describe 'assets' do
+      describe 'count' do
+        let(:path) { path_prefix + %w[assets] }
+
+        let(:release_fields) do
+          query_graphql_field(:assets, nil, 'count')
+        end
+
+        it 'returns the number of assets associated to the release' do
+          post_query
+
+          expect(data).to eq('count' => release.sources.size + release.links.size)
+        end
+      end
+
+      describe 'links' do
+        let(:path) { path_prefix + %w[assets links nodes] }
 
-      expected = release.milestones.map do |milestone|
-        { 'id' => global_id_of(milestone), 'title' => milestone.title }
+        let(:release_fields) do
+          query_graphql_field(:assets, nil,
+            query_graphql_field(:links, nil, 'nodes { id name url external }'))
+        end
+
+        it 'finds all release links' do
+          post_query
+
+          expected = release.links.map do |link|
+            {
+              'id' => global_id_of(link),
+              'name' => link.name,
+              'url' => link.url,
+              'external' => link.external?
+            }
+          end
+
+          expect(data).to match_array(expected)
+        end
       end
 
-      expect(data).to match_array(expected)
+      describe 'sources' do
+        let(:path) { path_prefix + %w[assets sources nodes] }
+
+        let(:release_fields) do
+          query_graphql_field(:assets, nil,
+            query_graphql_field(:sources, nil, 'nodes { format url }'))
+        end
+
+        it 'finds all release sources' do
+          post_query
+
+          expected = release.sources.map do |source|
+            {
+              'format' => source.format,
+              'url' => source.url
+            }
+          end
+
+          expect(data).to match_array(expected)
+        end
+      end
+    end
+
+    describe 'links' do
+      let(:path) { path_prefix + %w[links] }
+
+      let(:release_fields) do
+        query_graphql_field(:links, nil, %{
+          selfUrl
+          mergeRequestsUrl
+          issuesUrl
+        })
+      end
+
+      it 'finds all release links' do
+        post_query
+
+        expect(data).to eq(
+          'selfUrl' => project_release_url(project, release),
+          'mergeRequestsUrl' => project_merge_requests_url(project, params_for_issues_and_mrs),
+          'issuesUrl' => project_issues_url(project, params_for_issues_and_mrs)
+        )
+      end
+    end
+
+    describe 'evidences' do
+      let(:path) { path_prefix + %w[evidences] }
+
+      let(:release_fields) do
+        query_graphql_field(:evidences, nil, 'nodes { id sha filepath collectedAt }')
+      end
+
+      it 'finds all evidence fields' do
+        post_query
+
+        evidence = release.evidences.first.present
+
+        expect(data["nodes"].first).to eq(
+          'id' => global_id_of(evidence),
+          'sha' => evidence.sha,
+          'filepath' => evidence.filepath,
+          'collectedAt' => evidence.collected_at.utc.iso8601
+        )
+      end
+    end
+  end
+
+  shared_examples 'no access to the release field' do
+    describe 'repository-related fields' do
+      let(:path) { path_prefix }
+
+      let(:release_fields) do
+        query_graphql_field('description')
+      end
+
+      before do
+        post_query
+      end
+
+      it 'returns nil' do
+        expect(data).to eq(nil)
+      end
     end
   end
 
-  describe 'author' do
-    let(:path) { path_prefix + %w[author] }
+  shared_examples 'access to editUrl' do
+    let(:path) { path_prefix + %w[links] }
+
     let(:release_fields) do
-      query_graphql_field(:author, nil, 'id username')
+      query_graphql_field(:links, nil, 'editUrl')
     end
 
-    it 'finds the author of the release' do
+    before do
       post_query
+    end
 
-      expect(data).to eq({
-        'id' => global_id_of(release.author),
-        'username' => release.author.username
-      })
+    it 'returns editUrl' do
+      expect(data).to eq('editUrl' => edit_project_release_url(project, release))
     end
   end
 
-  describe 'commit' do
-    let(:path) { path_prefix + %w[commit] }
+  shared_examples 'no access to editUrl' do
+    let(:path) { path_prefix + %w[links] }
+
     let(:release_fields) do
-      query_graphql_field(:commit, nil, 'sha')
+      query_graphql_field(:links, nil, 'editUrl')
     end
 
-    it 'finds the commit associated with the release' do
+    before do
       post_query
+    end
 
-      expect(data).to eq({ 'sha' => release.commit.sha })
+    it 'does not return editUrl' do
+      expect(data).to eq('editUrl' => nil)
     end
   end
 
-  describe 'assets' do
-    describe 'assetsCount' do
-      let(:path) { path_prefix + %w[assets] }
-      let(:release_fields) do
-        query_graphql_field(:assets, nil, 'assetsCount')
+  describe "ensures that the correct data is returned based on the project's visibility and the user's access level" do
+    context 'when the project is private' do
+      let_it_be(:project) { create(:project, :repository, :private) }
+      let_it_be(:milestone_1) { create(:milestone, project: project) }
+      let_it_be(:milestone_2) { create(:milestone, project: project) }
+      let_it_be(:release) { create(:release, :with_evidence, project: project, milestones: [milestone_1, milestone_2]) }
+      let_it_be(:release_link_1) { create(:release_link, release: release) }
+      let_it_be(:release_link_2) { create(:release_link, release: release) }
+
+      before_all do
+        project.add_developer(developer)
+        project.add_guest(guest)
+        project.add_reporter(reporter)
       end
 
-      it 'returns the number of assets associated to the release' do
-        post_query
+      context 'when the user is not logged in' do
+        let(:current_user) { stranger }
 
-        expect(data).to eq({ 'assetsCount' => release.sources.size + release.links.size })
+        it_behaves_like 'no access to the release field'
       end
-    end
 
-    describe 'links' do
-      let(:path) { path_prefix + %w[assets links nodes] }
-      let(:release_fields) do
-        query_graphql_field(:assets, nil,
-          query_graphql_field(:links, nil, 'nodes { id name url external }'))
+      context 'when the user has Guest permissions' do
+        let(:current_user) { guest }
+
+        it_behaves_like 'no access to the release field'
       end
 
-      it 'finds all release links' do
-        post_query
+      context 'when the user has Reporter permissions' do
+        let(:current_user) { reporter }
 
-        expected = release.links.map do |link|
-          {
-            'id' => global_id_of(link),
-            'name' => link.name,
-            'url' => link.url,
-            'external' => link.external?
-          }
-        end
+        it_behaves_like 'full access to the release field'
+        it_behaves_like 'no access to editUrl'
+      end
 
-        expect(data).to match_array(expected)
+      context 'when the user has Developer permissions' do
+        let(:current_user) { developer }
+
+        it_behaves_like 'full access to the release field'
+        it_behaves_like 'access to editUrl'
       end
     end
 
-    describe 'sources' do
-      let(:path) { path_prefix + %w[assets sources nodes] }
-      let(:release_fields) do
-        query_graphql_field(:assets, nil,
-          query_graphql_field(:sources, nil, 'nodes { format url }'))
+    context 'when the project is public' do
+      let_it_be(:project) { create(:project, :repository, :public) }
+      let_it_be(:milestone_1) { create(:milestone, project: project) }
+      let_it_be(:milestone_2) { create(:milestone, project: project) }
+      let_it_be(:release) { create(:release, :with_evidence, project: project, milestones: [milestone_1, milestone_2]) }
+      let_it_be(:release_link_1) { create(:release_link, release: release) }
+      let_it_be(:release_link_2) { create(:release_link, release: release) }
+
+      before_all do
+        project.add_developer(developer)
+        project.add_guest(guest)
+        project.add_reporter(reporter)
       end
 
-      it 'finds all release sources' do
-        post_query
+      context 'when the user is not logged in' do
+        let(:current_user) { stranger }
 
-        expected = release.sources.map do |source|
-          {
-            'format' => source.format,
-            'url' => source.url
-          }
-        end
+        it_behaves_like 'full access to the release field'
+        it_behaves_like 'no access to editUrl'
+      end
 
-        expect(data).to match_array(expected)
+      context 'when the user has Guest permissions' do
+        let(:current_user) { guest }
+
+        it_behaves_like 'full access to the release field'
+        it_behaves_like 'no access to editUrl'
       end
-    end
 
-    describe 'evidences' do
-      let(:path) { path_prefix + %w[evidences] }
-      let(:release_fields) do
-        query_graphql_field(:evidences, nil, 'nodes { id sha filepath collectedAt }')
+      context 'when the user has Reporter permissions' do
+        let(:current_user) { reporter }
+
+        it_behaves_like 'full access to the release field'
+        it_behaves_like 'no access to editUrl'
       end
 
-      context 'for a developer' do
-        it 'finds all evidence fields' do
-          post_query
+      context 'when the user has Reporter permissions' do
+        let(:current_user) { reporter }
 
-          evidence = release.evidences.first.present
-          expected = {
-            'id' => global_id_of(evidence),
-            'sha' => evidence.sha,
-            'filepath' => evidence.filepath,
-            'collectedAt' => evidence.collected_at.utc.iso8601
-          }
+        it_behaves_like 'full access to the release field'
+      end
 
-          expect(data["nodes"].first).to eq(expected)
-        end
+      context 'when the user has Developer permissions' do
+        let(:current_user) { developer }
+
+        it_behaves_like 'full access to the release field'
+        it_behaves_like 'access to editUrl'
       end
+    end
+  end
 
-      context 'for a guest' do
-        let(:current_user) { create :user }
+  describe 'ensures that the release data can be contolled by a feature flag' do
+    context 'when the graphql_release_data feature flag is disabled' do
+      let_it_be(:project) { create(:project, :repository, :public) }
+      let_it_be(:release) { create(:release, project: project) }
 
-        before do
-          project.add_guest(current_user)
-        end
+      let(:current_user) { developer }
 
-        it 'denies access' do
-          post_query
+      before do
+        stub_feature_flags(graphql_release_data: false)
 
-          expect(data['node']).to be_nil
-        end
+        project.add_developer(developer)
       end
+
+      it_behaves_like 'no access to the release field'
     end
   end
 end
diff --git a/spec/requests/api/graphql/project/releases_spec.rb b/spec/requests/api/graphql/project/releases_spec.rb
new file mode 100644
index 00000000000..7e418bbaa5b
--- /dev/null
+++ b/spec/requests/api/graphql/project/releases_spec.rb
@@ -0,0 +1,284 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Query.project(fullPath).releases()' do
+  include GraphqlHelpers
+
+  let_it_be(:stranger) { create(:user) }
+  let_it_be(:guest) { create(:user) }
+  let_it_be(:reporter) { create(:user) }
+  let_it_be(:developer) { create(:user) }
+
+  let(:query) do
+    graphql_query_for(:project, { fullPath: project.full_path },
+    %{
+      releases {
+        nodes {
+          tagName
+          tagPath
+          name
+          commit {
+            sha
+          }
+          assets {
+            count
+            sources {
+              nodes {
+                url
+              }
+            }
+          }
+          evidences {
+            nodes {
+              sha
+            }
+          }
+          links {
+            selfUrl
+            mergeRequestsUrl
+            issuesUrl
+          }
+        }
+      }
+    })
+  end
+
+  let(:params_for_issues_and_mrs) { { scope: 'all', state: 'opened', release_tag: release.tag } }
+  let(:post_query) { post_graphql(query, current_user: current_user) }
+
+  let(:data) { graphql_data.dig('project', 'releases', 'nodes', 0) }
+
+  before do
+    stub_default_url_options(host: 'www.example.com')
+  end
+
+  shared_examples 'full access to all repository-related fields' do
+    describe 'repository-related fields' do
+      before do
+        post_query
+      end
+
+      it 'returns data for fields that are protected in private projects' do
+        expected_sources = release.sources.map do |s|
+          { 'url' => s.url }
+        end
+
+        expected_evidences = release.evidences.map do |e|
+          { 'sha' => e.sha }
+        end
+
+        expect(data).to eq(
+          'tagName' => release.tag,
+          'tagPath' => project_tag_path(project, release.tag),
+          'name' => release.name,
+          'commit' => {
+            'sha' => release.commit.sha
+          },
+          'assets' => {
+            'count' => release.assets_count,
+            'sources' => {
+              'nodes' => expected_sources
+            }
+          },
+          'evidences' => {
+            'nodes' => expected_evidences
+          },
+          'links' => {
+            'selfUrl' => project_release_url(project, release),
+            'mergeRequestsUrl' => project_merge_requests_url(project, params_for_issues_and_mrs),
+            'issuesUrl' => project_issues_url(project, params_for_issues_and_mrs)
+          }
+        )
+      end
+    end
+  end
+
+  shared_examples 'no access to any repository-related fields' do
+    describe 'repository-related fields' do
+      before do
+        post_query
+      end
+
+      it 'does not return data for fields that expose repository information' do
+        expect(data).to eq(
+          'tagName' => nil,
+          'tagPath' => nil,
+          'name' => "Release-#{release.id}",
+          'commit' => nil,
+          'assets' => {
+            'count' => release.assets_count(except: [:sources]),
+            'sources' => {
+              'nodes' => []
+            }
+          },
+          'evidences' => {
+            'nodes' => []
+          },
+          'links' => nil
+        )
+      end
+    end
+  end
+
+  # editUrl is tested separately becuase its permissions
+  # are slightly different than other release fields
+  shared_examples 'access to editUrl' do
+    let(:query) do
+      graphql_query_for(:project, { fullPath: project.full_path },
+        %{
+          releases {
+            nodes {
+              links {
+                editUrl
+              }
+            }
+          }
+        })
+    end
+
+    before do
+      post_query
+    end
+
+    it 'returns editUrl' do
+      expect(data).to eq(
+        'links' => {
+          'editUrl' => edit_project_release_url(project, release)
+        }
+      )
+    end
+  end
+
+  shared_examples 'no access to editUrl' do
+    let(:query) do
+      graphql_query_for(:project, { fullPath: project.full_path },
+        %{
+          releases {
+            nodes {
+              links {
+                editUrl
+              }
+            }
+          }
+        })
+    end
+
+    before do
+      post_query
+    end
+
+    it 'does not return editUrl' do
+      expect(data).to eq(
+        'links' => {
+          'editUrl' => nil
+        }
+      )
+    end
+  end
+
+  shared_examples 'no access to any release data' do
+    before do
+      post_query
+    end
+
+    it 'returns nil' do
+      expect(data).to eq(nil)
+    end
+  end
+
+  describe "ensures that the correct data is returned based on the project's visibility and the user's access level" do
+    context 'when the project is private' do
+      let_it_be(:project) { create(:project, :repository, :private) }
+      let_it_be(:release) { create(:release, :with_evidence, project: project) }
+
+      before_all do
+        project.add_guest(guest)
+        project.add_reporter(reporter)
+        project.add_developer(developer)
+      end
+
+      context 'when the user is not logged in' do
+        let(:current_user) { stranger }
+
+        it_behaves_like 'no access to any release data'
+      end
+
+      context 'when the user has Guest permissions' do
+        let(:current_user) { guest }
+
+        it_behaves_like 'no access to any repository-related fields'
+      end
+
+      context 'when the user has Reporter permissions' do
+        let(:current_user) { reporter }
+
+        it_behaves_like 'full access to all repository-related fields'
+        it_behaves_like 'no access to editUrl'
+      end
+
+      context 'when the user has Developer permissions' do
+        let(:current_user) { developer }
+
+        it_behaves_like 'full access to all repository-related fields'
+        it_behaves_like 'access to editUrl'
+      end
+    end
+
+    context 'when the project is public' do
+      let_it_be(:project) { create(:project, :repository, :public) }
+      let_it_be(:release) { create(:release, :with_evidence, project: project) }
+
+      before_all do
+        project.add_guest(guest)
+        project.add_reporter(reporter)
+        project.add_developer(developer)
+      end
+
+      context 'when the user is not logged in' do
+        let(:current_user) { stranger }
+
+        it_behaves_like 'full access to all repository-related fields'
+        it_behaves_like 'no access to editUrl'
+      end
+
+      context 'when the user has Guest permissions' do
+        let(:current_user) { guest }
+
+        it_behaves_like 'full access to all repository-related fields'
+        it_behaves_like 'no access to editUrl'
+      end
+
+      context 'when the user has Reporter permissions' do
+        let(:current_user) { reporter }
+
+        it_behaves_like 'full access to all repository-related fields'
+        it_behaves_like 'no access to editUrl'
+      end
+
+      context 'when the user has Developer permissions' do
+        let(:current_user) { developer }
+
+        it_behaves_like 'full access to all repository-related fields'
+        it_behaves_like 'access to editUrl'
+      end
+    end
+  end
+
+  describe 'ensures that the release data can be contolled by a feature flag' do
+    context 'when the graphql_release_data feature flag is disabled' do
+      let_it_be(:project) { create(:project, :repository, :public) }
+      let_it_be(:release) { create(:release, project: project) }
+
+      let(:current_user) { developer }
+
+      before do
+        stub_feature_flags(graphql_release_data: false)
+
+        project.add_developer(developer)
+      end
+
+      it_behaves_like 'no access to any release data'
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/project/repository_spec.rb b/spec/requests/api/graphql/project/repository_spec.rb
index 261433a3d6a..bd719a69647 100644
--- a/spec/requests/api/graphql/project/repository_spec.rb
+++ b/spec/requests/api/graphql/project/repository_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'getting a repository in a project' do
+RSpec.describe 'getting a repository in a project' do
   include GraphqlHelpers
 
   let(:project) { create(:project, :repository) }
diff --git a/spec/requests/api/graphql/project/tree/tree_spec.rb b/spec/requests/api/graphql/project/tree/tree_spec.rb
index 94128cc21ee..bce63d57c38 100644
--- a/spec/requests/api/graphql/project/tree/tree_spec.rb
+++ b/spec/requests/api/graphql/project/tree/tree_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'getting a tree in a project' do
+RSpec.describe 'getting a tree in a project' do
   include GraphqlHelpers
 
   let(:project) { create(:project, :repository) }
diff --git a/spec/requests/api/graphql/project_query_spec.rb b/spec/requests/api/graphql/project_query_spec.rb
index 9a88b47eea6..b115030afbc 100644
--- a/spec/requests/api/graphql/project_query_spec.rb
+++ b/spec/requests/api/graphql/project_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting project information' do
+RSpec.describe 'getting project information' do
   include GraphqlHelpers
 
   let(:project) { create(:project, :repository) }
diff --git a/spec/requests/api/graphql/query_spec.rb b/spec/requests/api/graphql/query_spec.rb
index 26b4c6eafd7..6bd0703c121 100644
--- a/spec/requests/api/graphql/query_spec.rb
+++ b/spec/requests/api/graphql/query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Query' do
+RSpec.describe 'Query' do
   include GraphqlHelpers
 
   let_it_be(:project) { create(:project) }
diff --git a/spec/requests/api/graphql/read_only_spec.rb b/spec/requests/api/graphql/read_only_spec.rb
index 1d28a71258d..ce8a3f6ef5c 100644
--- a/spec/requests/api/graphql/read_only_spec.rb
+++ b/spec/requests/api/graphql/read_only_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Requests on a read-only node' do
+RSpec.describe 'Requests on a read-only node' do
   include GraphqlHelpers
 
   before do
diff --git a/spec/requests/api/graphql/tasks/task_completion_status_spec.rb b/spec/requests/api/graphql/tasks/task_completion_status_spec.rb
index c47406ea534..5f4d2aec718 100644
--- a/spec/requests/api/graphql/tasks/task_completion_status_spec.rb
+++ b/spec/requests/api/graphql/tasks/task_completion_status_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting task completion status information' do
+RSpec.describe 'getting task completion status information' do
   include GraphqlHelpers
 
   description_0_done = '- [ ] task 1\n- [ ] task 2'
diff --git a/spec/requests/api/graphql/user/group_member_query_spec.rb b/spec/requests/api/graphql/user/group_member_query_spec.rb
index 022ee79297c..3a16d962214 100644
--- a/spec/requests/api/graphql/user/group_member_query_spec.rb
+++ b/spec/requests/api/graphql/user/group_member_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'GroupMember' do
+RSpec.describe 'GroupMember' do
   include GraphqlHelpers
 
   let_it_be(:member) { create(:group_member, :developer) }
diff --git a/spec/requests/api/graphql/user/project_member_query_spec.rb b/spec/requests/api/graphql/user/project_member_query_spec.rb
index 397d2872189..0790e148caf 100644
--- a/spec/requests/api/graphql/user/project_member_query_spec.rb
+++ b/spec/requests/api/graphql/user/project_member_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'ProjectMember' do
+RSpec.describe 'ProjectMember' do
   include GraphqlHelpers
 
   let_it_be(:member) { create(:project_member, :developer) }
diff --git a/spec/requests/api/graphql/user_query_spec.rb b/spec/requests/api/graphql/user_query_spec.rb
index 5ac94bc7323..7ba1788a9ef 100644
--- a/spec/requests/api/graphql/user_query_spec.rb
+++ b/spec/requests/api/graphql/user_query_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'getting user information' do
+RSpec.describe 'getting user information' do
   include GraphqlHelpers
 
   let(:query) do
diff --git a/spec/requests/api/graphql/user_spec.rb b/spec/requests/api/graphql/user_spec.rb
index 097c75b3541..d2d6b1fca66 100644
--- a/spec/requests/api/graphql/user_spec.rb
+++ b/spec/requests/api/graphql/user_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'User' do
+RSpec.describe 'User' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user) }
diff --git a/spec/requests/api/graphql/users_spec.rb b/spec/requests/api/graphql/users_spec.rb
index 1e6d73cbd7d..91ac206676b 100644
--- a/spec/requests/api/graphql/users_spec.rb
+++ b/spec/requests/api/graphql/users_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'Users' do
+RSpec.describe 'Users' do
   include GraphqlHelpers
 
   let_it_be(:current_user) { create(:user, created_at: 1.day.ago) }
diff --git a/spec/requests/api/graphql_spec.rb b/spec/requests/api/graphql_spec.rb
index 84be5ab0951..ff1a5aa1540 100644
--- a/spec/requests/api/graphql_spec.rb
+++ b/spec/requests/api/graphql_spec.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-describe 'GraphQL' do
+RSpec.describe 'GraphQL' do
   include GraphqlHelpers
 
   let(:query) { graphql_query_for('echo', 'text' => 'Hello world' ) }
diff --git a/spec/requests/api/group_boards_spec.rb b/spec/requests/api/group_boards_spec.rb
index a9083f82f25..6ce8b766807 100644
--- a/spec/requests/api/group_boards_spec.rb
+++ b/spec/requests/api/group_boards_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupBoards do
+RSpec.describe API::GroupBoards do
   let_it_be(:user) { create(:user) }
   let_it_be(:non_member) { create(:user) }
   let_it_be(:guest) { create(:user) }
diff --git a/spec/requests/api/group_clusters_spec.rb b/spec/requests/api/group_clusters_spec.rb
index fade54f6b11..068af1485e2 100644
--- a/spec/requests/api/group_clusters_spec.rb
+++ b/spec/requests/api/group_clusters_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupClusters do
+RSpec.describe API::GroupClusters do
   include KubernetesHelpers
 
   let(:current_user) { create(:user) }
@@ -266,29 +266,51 @@ describe API::GroupClusters do
       end
     end
 
-    context 'when user tries to add multiple clusters' do
+    context 'non-authorized user' do
       before do
-        create(:cluster, :provided_by_gcp, :group,
-               groups: [group])
-
-        post api("/groups/#{group.id}/clusters/user", current_user), params: cluster_params
+        post api("/groups/#{group.id}/clusters/user", developer_user), params: cluster_params
       end
 
-      it 'responds with 400' do
-        expect(response).to have_gitlab_http_status(:bad_request)
-        expect(json_response['message']['base'].first).to eq(_('Instance does not support multiple Kubernetes clusters'))
+      it 'responds with 403' do
+        expect(response).to have_gitlab_http_status(:forbidden)
+
+        expect(json_response['message']).to eq('403 Forbidden')
       end
     end
+  end
 
-    context 'non-authorized user' do
+  describe 'PUT /groups/:id/clusters/:cluster_id' do
+    let(:api_url) { 'https://kubernetes.example.com' }
+
+    let(:platform_kubernetes_attributes) do
+      {
+        api_url: api_url,
+        token: 'sample-token'
+      }
+    end
+
+    let(:cluster_params) do
+      {
+        name: 'test-cluster',
+        environment_scope: 'test/*',
+        platform_kubernetes_attributes: platform_kubernetes_attributes
+      }
+    end
+
+    context 'when another cluster exists' do
       before do
-        post api("/groups/#{group.id}/clusters/user", developer_user), params: cluster_params
+        create(:cluster, :provided_by_gcp, :group,
+               groups: [group])
+
+        post api("/groups/#{group.id}/clusters/user", current_user), params: cluster_params
       end
 
-      it 'responds with 403' do
-        expect(response).to have_gitlab_http_status(:forbidden)
+      it 'responds with 201' do
+        expect(response).to have_gitlab_http_status(:created)
+      end
 
-        expect(json_response['message']).to eq('403 Forbidden')
+      it 'allows multiple clusters to be associated to group' do
+        expect(group.reload.clusters.count).to eq(2)
       end
     end
   end
diff --git a/spec/requests/api/group_container_repositories_spec.rb b/spec/requests/api/group_container_repositories_spec.rb
index 9f439bb2167..3128becae6d 100644
--- a/spec/requests/api/group_container_repositories_spec.rb
+++ b/spec/requests/api/group_container_repositories_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupContainerRepositories do
+RSpec.describe API::GroupContainerRepositories do
   let_it_be(:group) { create(:group, :private) }
   let_it_be(:project) { create(:project, :private, group: group) }
   let_it_be(:reporter) { create(:user) }
diff --git a/spec/requests/api/group_export_spec.rb b/spec/requests/api/group_export_spec.rb
index 9dd7797c768..50a1e9d0c3d 100644
--- a/spec/requests/api/group_export_spec.rb
+++ b/spec/requests/api/group_export_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupExport do
+RSpec.describe API::GroupExport do
   let_it_be(:group) { create(:group) }
   let_it_be(:user) { create(:user) }
 
@@ -33,6 +33,10 @@ describe API::GroupExport do
     context 'group_import_export feature flag enabled' do
       before do
         stub_feature_flags(group_import_export: true)
+
+        allow(Gitlab::ApplicationRateLimiter)
+          .to receive(:increment)
+          .and_return(0)
       end
 
       context 'when export file exists' do
@@ -87,7 +91,7 @@ describe API::GroupExport do
       before do
         allow(Gitlab::ApplicationRateLimiter)
           .to receive(:increment)
-          .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:group_download_export][:threshold] + 1)
+          .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:group_download_export][:threshold].call + 1)
       end
 
       it 'throttles the endpoint' do
@@ -162,7 +166,7 @@ describe API::GroupExport do
 
         allow(Gitlab::ApplicationRateLimiter)
           .to receive(:increment)
-          .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:group_export][:threshold] + 1)
+          .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:group_export][:threshold].call + 1)
       end
 
       it 'throttles the endpoint' do
diff --git a/spec/requests/api/group_import_spec.rb b/spec/requests/api/group_import_spec.rb
index b60a1b3f119..ad67f737725 100644
--- a/spec/requests/api/group_import_spec.rb
+++ b/spec/requests/api/group_import_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupImport do
+RSpec.describe API::GroupImport do
   include WorkhorseHelpers
 
   let_it_be(:user) { create(:user) }
@@ -122,6 +122,7 @@ describe API::GroupImport do
           before do
             allow_next_instance_of(Group) do |group|
               allow(group).to receive(:persisted?).and_return(false)
+              allow(group).to receive(:save).and_return(false)
             end
           end
 
diff --git a/spec/requests/api/group_labels_spec.rb b/spec/requests/api/group_labels_spec.rb
index 715c1255cb3..f965a845bbe 100644
--- a/spec/requests/api/group_labels_spec.rb
+++ b/spec/requests/api/group_labels_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupLabels do
+RSpec.describe API::GroupLabels do
   let(:user) { create(:user) }
   let(:group) { create(:group) }
   let(:subgroup) { create(:group, parent: group) }
diff --git a/spec/requests/api/group_milestones_spec.rb b/spec/requests/api/group_milestones_spec.rb
index 3e9b6246434..2b361f2b503 100644
--- a/spec/requests/api/group_milestones_spec.rb
+++ b/spec/requests/api/group_milestones_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupMilestones do
+RSpec.describe API::GroupMilestones do
   let(:user) { create(:user) }
   let(:group) { create(:group, :private) }
   let(:project) { create(:project, namespace: group) }
diff --git a/spec/requests/api/group_packages_spec.rb b/spec/requests/api/group_packages_spec.rb
new file mode 100644
index 00000000000..7c7e8da3fb1
--- /dev/null
+++ b/spec/requests/api/group_packages_spec.rb
@@ -0,0 +1,147 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::GroupPackages do
+  let_it_be(:group) { create(:group, :public) }
+  let_it_be(:project) { create(:project, :public, namespace: group, name: 'project A') }
+  let_it_be(:user) { create(:user) }
+
+  subject { get api(url) }
+
+  describe 'GET /groups/:id/packages' do
+    let(:url) { "/groups/#{group.id}/packages" }
+    let(:package_schema) { 'public_api/v4/packages/group_packages' }
+
+    context 'without the need for a license' do
+      context 'with sorting' do
+        let_it_be(:package1) { create(:npm_package, project: project, version: '3.1.0', name: "@#{project.root_namespace.path}/foo1") }
+        let_it_be(:package2) { create(:nuget_package, project: project, version: '2.0.4') }
+        let(:package3) { create(:maven_package, project: project, version: '1.1.1', name: 'zzz') }
+
+        before do
+          travel_to(1.day.ago) do
+            package3
+          end
+        end
+
+        context 'without sorting params' do
+          let(:packages) { [package3, package1, package2] }
+
+          it 'sorts by created_at asc' do
+            subject
+
+            expect(json_response.map { |package| package['id'] }).to eq(packages.map(&:id))
+          end
+        end
+
+        it_behaves_like 'package sorting', 'name' do
+          let(:packages) { [package1, package2, package3] }
+        end
+
+        it_behaves_like 'package sorting', 'created_at' do
+          let(:packages) { [package3, package1, package2] }
+        end
+
+        it_behaves_like 'package sorting', 'version' do
+          let(:packages) { [package3, package2, package1] }
+        end
+
+        it_behaves_like 'package sorting', 'type' do
+          let(:packages) { [package3, package1, package2] }
+        end
+
+        it_behaves_like 'package sorting', 'project_path' do
+          let(:another_project) { create(:project, :public, namespace: group, name: 'project B') }
+          let!(:package4) { create(:npm_package, project: another_project, version: '3.1.0', name: "@#{project.root_namespace.path}/bar") }
+
+          let(:packages) { [package1, package2, package3, package4] }
+        end
+      end
+
+      context 'with private group' do
+        let!(:package1) { create(:package, project: project) }
+        let!(:package2) { create(:package, project: project) }
+
+        let(:group) { create(:group, :private) }
+        let(:subgroup) { create(:group, :private, parent: group) }
+        let(:project) { create(:project, :private, namespace: group) }
+        let(:subproject) { create(:project, :private, namespace: subgroup) }
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'rejects packages access', :group, :no_type, :not_found
+        end
+
+        context 'with authenticated user' do
+          subject { get api(url, user) }
+
+          it_behaves_like 'returns packages', :group, :owner
+          it_behaves_like 'returns packages', :group, :maintainer
+          it_behaves_like 'returns packages', :group, :developer
+          it_behaves_like 'rejects packages access', :group, :reporter, :forbidden
+          it_behaves_like 'rejects packages access', :group, :guest, :forbidden
+
+          context 'with subgroup' do
+            let(:subgroup) { create(:group, :private, parent: group) }
+            let(:subproject) { create(:project, :private, namespace: subgroup) }
+            let!(:package3) { create(:npm_package, project: subproject) }
+
+            it_behaves_like 'returns packages with subgroups', :group, :owner
+            it_behaves_like 'returns packages with subgroups', :group, :maintainer
+            it_behaves_like 'returns packages with subgroups', :group, :developer
+            it_behaves_like 'rejects packages access', :group, :reporter, :forbidden
+            it_behaves_like 'rejects packages access', :group, :guest, :forbidden
+
+            context 'excluding subgroup' do
+              let(:url) { "/groups/#{group.id}/packages?exclude_subgroups=true" }
+
+              it_behaves_like 'returns packages', :group, :owner
+              it_behaves_like 'returns packages', :group, :maintainer
+              it_behaves_like 'returns packages', :group, :developer
+              it_behaves_like 'rejects packages access', :group, :reporter, :forbidden
+              it_behaves_like 'rejects packages access', :group, :guest, :forbidden
+            end
+          end
+        end
+      end
+
+      context 'with public group' do
+        let_it_be(:package1) { create(:package, project: project) }
+        let_it_be(:package2) { create(:package, project: project) }
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'returns packages', :group, :no_type
+        end
+
+        context 'with authenticated user' do
+          subject { get api(url, user) }
+
+          it_behaves_like 'returns packages', :group, :owner
+          it_behaves_like 'returns packages', :group, :maintainer
+          it_behaves_like 'returns packages', :group, :developer
+          it_behaves_like 'returns packages', :group, :reporter
+          it_behaves_like 'returns packages', :group, :guest
+        end
+      end
+
+      context 'with pagination params' do
+        let_it_be(:package1) { create(:package, project: project) }
+        let_it_be(:package2) { create(:package, project: project) }
+        let_it_be(:package3) { create(:npm_package, project: project) }
+        let_it_be(:package4) { create(:npm_package, project: project) }
+
+        it_behaves_like 'returns paginated packages'
+      end
+
+      it_behaves_like 'filters on each package_type', is_project: false
+
+      context 'does not accept non supported package_type value' do
+        include_context 'package filter context'
+
+        let(:url) { group_filter_url(:type, 'foo') }
+
+        it_behaves_like 'returning response status', :bad_request
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/group_variables_spec.rb b/spec/requests/api/group_variables_spec.rb
index a5b48985df5..c6d6ae1615b 100644
--- a/spec/requests/api/group_variables_spec.rb
+++ b/spec/requests/api/group_variables_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::GroupVariables do
+RSpec.describe API::GroupVariables do
   let(:group) { create(:group) }
   let(:user) { create(:user) }
 
diff --git a/spec/requests/api/groups_spec.rb b/spec/requests/api/groups_spec.rb
index 9a449499576..fac9f4dfe00 100644
--- a/spec/requests/api/groups_spec.rb
+++ b/spec/requests/api/groups_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Groups do
+RSpec.describe API::Groups do
   include GroupAPIHelpers
   include UploadHelpers
 
@@ -15,6 +15,7 @@ describe API::Groups do
   let_it_be(:project1) { create(:project, namespace: group1) }
   let_it_be(:project2) { create(:project, namespace: group2) }
   let_it_be(:project3) { create(:project, namespace: group1, path: 'test', visibility_level: Gitlab::VisibilityLevel::PRIVATE) }
+  let_it_be(:archived_project) { create(:project, namespace: group1, archived: true) }
 
   before do
     group1.add_owner(user1)
@@ -184,11 +185,12 @@ describe API::Groups do
 
       it "includes statistics if requested" do
         attributes = {
-          storage_size: 1158,
+          storage_size: 2392,
           repository_size: 123,
           wiki_size: 456,
           lfs_objects_size: 234,
-          build_artifacts_size: 345
+          build_artifacts_size: 345,
+          snippets_size: 1234
         }.stringify_keys
         exposed_attributes = attributes.dup
         exposed_attributes['job_artifacts_size'] = exposed_attributes.delete('build_artifacts_size')
@@ -470,7 +472,7 @@ describe API::Groups do
         expect(json_response['shared_with_groups'][0]['group_access_level']).to eq(link.group_access)
         expect(json_response['shared_with_groups'][0]).to have_key('expires_at')
         expect(json_response['projects']).to be_an Array
-        expect(json_response['projects'].length).to eq(2)
+        expect(json_response['projects'].length).to eq(3)
         expect(json_response['shared_projects']).to be_an Array
         expect(json_response['shared_projects'].length).to eq(1)
         expect(json_response['shared_projects'][0]['id']).to eq(project.id)
@@ -695,7 +697,7 @@ describe API::Groups do
         expect(json_response['parent_id']).to eq(nil)
         expect(json_response['created_at']).to be_present
         expect(json_response['projects']).to be_an Array
-        expect(json_response['projects'].length).to eq(2)
+        expect(json_response['projects'].length).to eq(3)
         expect(json_response['shared_projects']).to be_an Array
         expect(json_response['shared_projects'].length).to eq(0)
         expect(json_response['default_branch_protection']).to eq(::Gitlab::Access::MAINTAINER_PROJECT_ACCESS)
@@ -821,20 +823,51 @@ describe API::Groups do
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to include_pagination_headers
-        expect(json_response.length).to eq(2)
+        expect(json_response.length).to eq(3)
         project_names = json_response.map { |proj| proj['name'] }
-        expect(project_names).to match_array([project1.name, project3.name])
+        expect(project_names).to match_array([project1.name, project3.name, archived_project.name])
         expect(json_response.first['visibility']).to be_present
       end
 
+      context 'and using archived' do
+        it "returns the group's archived projects" do
+          get api("/groups/#{group1.id}/projects?archived=true", user1)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(Project.public_or_visible_to_user(user1).where(archived: true).size)
+          expect(json_response.map { |project| project['id'] }).to include(archived_project.id)
+        end
+
+        it "returns the group's non-archived projects" do
+          get api("/groups/#{group1.id}/projects?archived=false", user1)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(json_response).to be_an Array
+          expect(json_response.length).to eq(Project.public_or_visible_to_user(user1).where(archived: false).size)
+          expect(json_response.map { |project| project['id'] }).not_to include(archived_project.id)
+        end
+
+        it "returns all of the group's projects" do
+          get api("/groups/#{group1.id}/projects", user1)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to include_pagination_headers
+          expect(json_response).to be_an Array
+          expect(json_response.map { |project| project['id'] }).to contain_exactly(*Project.public_or_visible_to_user(user1).pluck(:id))
+        end
+      end
+
       it "returns the group's projects with simple representation" do
         get api("/groups/#{group1.id}/projects", user1), params: { simple: true }
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to include_pagination_headers
-        expect(json_response.length).to eq(2)
+        expect(json_response.length).to eq(3)
         project_names = json_response.map { |proj| proj['name'] }
-        expect(project_names).to match_array([project1.name, project3.name])
+        expect(project_names).to match_array([project1.name, project3.name, archived_project.name])
         expect(json_response.first['visibility']).not_to be_present
       end
 
@@ -860,7 +893,7 @@ describe API::Groups do
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an(Array)
-        expect(json_response.length).to eq(2)
+        expect(json_response.length).to eq(3)
       end
 
       it "returns projects including those in subgroups" do
@@ -873,7 +906,7 @@ describe API::Groups do
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an(Array)
-        expect(json_response.length).to eq(4)
+        expect(json_response.length).to eq(5)
       end
 
       it "does not return a non existing group" do
@@ -958,7 +991,7 @@ describe API::Groups do
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to include_pagination_headers
         project_names = json_response.map { |proj| proj['name'] }
-        expect(project_names).to match_array([project1.name, project3.name])
+        expect(project_names).to match_array([project1.name, project3.name, archived_project.name])
       end
 
       it 'does not return a non existing group' do
diff --git a/spec/requests/api/helpers_spec.rb b/spec/requests/api/helpers_spec.rb
index d65c89f48ea..12cd5ace84e 100644
--- a/spec/requests/api/helpers_spec.rb
+++ b/spec/requests/api/helpers_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 require 'raven/transports/dummy'
 require_relative '../../../config/initializers/sentry'
 
-describe API::Helpers do
+RSpec.describe API::Helpers do
   include API::APIGuard::HelperMethods
   include described_class
   include TermsHelper
diff --git a/spec/requests/api/import_bitbucket_server_spec.rb b/spec/requests/api/import_bitbucket_server_spec.rb
new file mode 100644
index 00000000000..5828dab3080
--- /dev/null
+++ b/spec/requests/api/import_bitbucket_server_spec.rb
@@ -0,0 +1,218 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::ImportBitbucketServer do
+  let(:base_uri) { "https://test:7990" }
+  let(:user) { create(:user) }
+  let(:token) { "asdasd12345" }
+  let(:secret) { "sekrettt" }
+  let(:project_key) { 'TES' }
+  let(:repo_slug) { 'vim' }
+  let(:repo) { { name: 'vim' } }
+
+  describe "POST /import/bitbucket_server" do
+    context 'with no optional parameters' do
+      let_it_be(:project) { create(:project) }
+      let(:client) { double(BitbucketServer::Client) }
+
+      before do
+        Grape::Endpoint.before_each do |endpoint|
+          allow(endpoint).to receive(:client).and_return(client.as_null_object)
+          allow(client).to receive(:repo).with(project_key, repo_slug).and_return(double(name: repo_slug))
+        end
+      end
+
+      after do
+        Grape::Endpoint.before_each nil
+      end
+
+      it 'returns 201 response when the project is imported successfully' do
+        allow(Gitlab::BitbucketServerImport::ProjectCreator)
+          .to receive(:new).with(project_key, repo_slug, anything, repo_slug, user.namespace, user, anything)
+            .and_return(double(execute: project))
+
+        post api("/import/bitbucket_server", user), params: {
+          bitbucket_server_url: base_uri,
+          bitbucket_server_username: user,
+          personal_access_token: token,
+          bitbucket_server_project: project_key,
+          bitbucket_server_repo: repo_slug
+        }
+
+        expect(response).to have_gitlab_http_status(:created)
+        expect(json_response).to be_a Hash
+        expect(json_response['name']).to eq(project.name)
+      end
+    end
+
+    context 'with a new project name' do
+      let_it_be(:project) { create(:project, name: 'new-name') }
+      let(:client) { instance_double(BitbucketServer::Client) }
+
+      before do
+        Grape::Endpoint.before_each do |endpoint|
+          allow(endpoint).to receive(:client).and_return(client)
+          allow(client).to receive(:repo).with(project_key, repo_slug).and_return(double(name: repo_slug))
+        end
+      end
+
+      after do
+        Grape::Endpoint.before_each nil
+      end
+
+      it 'returns 201 response when the project is imported successfully with a new project name' do
+        allow(Gitlab::BitbucketServerImport::ProjectCreator)
+        .to receive(:new).with(project_key, repo_slug, anything, project.name, user.namespace, user, anything)
+        .and_return(double(execute: project))
+
+        post api("/import/bitbucket_server", user), params: {
+          bitbucket_server_url: base_uri,
+          bitbucket_server_username: user,
+          personal_access_token: token,
+          bitbucket_server_project: project_key,
+          bitbucket_server_repo: repo_slug,
+          new_name: 'new-name'
+        }
+
+        expect(response).to have_gitlab_http_status(:created)
+        expect(json_response).to be_a Hash
+        expect(json_response['name']).to eq('new-name')
+      end
+    end
+
+    context 'with an invalid URL' do
+      let_it_be(:project) { create(:project, name: 'new-name') }
+      let(:client) { instance_double(BitbucketServer::Client) }
+
+      before do
+        Grape::Endpoint.before_each do |endpoint|
+          allow(endpoint).to receive(:client).and_return(client)
+          allow(client).to receive(:repo).with(project_key, repo_slug).and_return(double(name: repo_slug))
+        end
+      end
+
+      after do
+        Grape::Endpoint.before_each nil
+      end
+
+      it 'returns 400 response due to a blcoked URL' do
+        allow(Gitlab::BitbucketServerImport::ProjectCreator)
+        .to receive(:new).with(project_key, repo_slug, anything, project.name, user.namespace, user, anything)
+        .and_return(double(execute: project))
+
+        allow(Gitlab::UrlBlocker)
+        .to receive(:blocked_url?)
+        .and_return(true)
+        post api("/import/bitbucket_server", user), params: {
+          bitbucket_server_url: base_uri,
+          bitbucket_server_username: user,
+          personal_access_token: token,
+          bitbucket_server_project: project_key,
+          bitbucket_server_repo: repo_slug,
+          new_name: 'new-name'
+        }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+
+    context 'with a new namespace' do
+      let(:bitbucket_client) { instance_double(BitbucketServer::Client) }
+
+      before do
+        Grape::Endpoint.before_each do |endpoint|
+          allow(endpoint).to receive(:client).and_return(bitbucket_client)
+          repo = double(name: repo_slug, full_path: "/other-namespace/#{repo_slug}")
+          allow(bitbucket_client).to receive(:repo).with(project_key, repo_slug).and_return(repo)
+        end
+      end
+
+      after do
+        Grape::Endpoint.before_each nil
+      end
+
+      it 'returns 201 response when the project is imported successfully to a new namespace' do
+        allow(Gitlab::BitbucketServerImport::ProjectCreator)
+        .to receive(:new).with(project_key, repo_slug, anything, repo_slug, an_instance_of(Group), user, anything)
+        .and_return(double(execute: create(:project, name: repo_slug)))
+
+        post api("/import/bitbucket_server", user), params: {
+          bitbucket_server_url: base_uri,
+          bitbucket_server_username: user,
+          personal_access_token: token,
+          bitbucket_server_project: project_key,
+          bitbucket_server_repo: repo_slug,
+          new_namespace: 'new-namespace'
+        }
+
+        expect(response).to have_gitlab_http_status(:created)
+        expect(json_response).to be_a Hash
+        expect(json_response['full_path']).not_to eq("/#{user.namespace}/#{repo_slug}")
+      end
+    end
+
+    context 'with a private inaccessible namespace' do
+      let(:bitbucket_client) { instance_double(BitbucketServer::Client) }
+      let(:project) { create(:project, import_type: 'bitbucket', creator_id: user.id, import_source: 'asd/vim', namespace: 'private-group/vim') }
+
+      before do
+        Grape::Endpoint.before_each do |endpoint|
+          allow(endpoint).to receive(:client).and_return(bitbucket_client)
+          repo = double(name: repo_slug, full_path: "/private-group/#{repo_slug}")
+          allow(bitbucket_client).to receive(:repo).with(project_key, repo_slug).and_return(repo)
+        end
+      end
+
+      after do
+        Grape::Endpoint.before_each nil
+      end
+
+      it 'returns 401 response when user can not create projects in the chosen namespace' do
+        allow(Gitlab::BitbucketServerImport::ProjectCreator)
+        .to receive(:new).with(project_key, repo_slug, anything, repo_slug, an_instance_of(Group), user, anything)
+        .and_return(double(execute: build(:project)))
+
+        other_namespace = create(:group, :private, name: 'private-group')
+
+        post api("/import/bitbucket_server", user), params: {
+          bitbucket_server_url: base_uri,
+          bitbucket_server_username: user,
+          personal_access_token: token,
+          bitbucket_server_project: project_key,
+          bitbucket_server_repo: repo_slug,
+          new_namespace: other_namespace.name
+        }
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    context 'with an inaccessible bitbucket server instance' do
+      let(:bitbucket_client) { instance_double(BitbucketServer::Client) }
+      let(:project) { create(:project, import_type: 'bitbucket', creator_id: user.id, import_source: 'asd/vim', namespace: 'private-group/vim') }
+
+      before do
+        Grape::Endpoint.before_each do |endpoint|
+          allow(endpoint).to receive(:client).and_return(bitbucket_client)
+          allow(bitbucket_client).to receive(:repo).with(project_key, repo_slug).and_raise(::BitbucketServer::Connection::ConnectionError)
+        end
+      end
+
+      after do
+        Grape::Endpoint.before_each nil
+      end
+
+      it 'raises a connection error' do
+        post api("/import/bitbucket_server", user), params: {
+          bitbucket_server_url: base_uri,
+          bitbucket_server_username: user,
+          personal_access_token: token,
+          bitbucket_server_project: project_key,
+          bitbucket_server_repo: repo_slug,
+          new_namespace: 'new-namespace'
+        }
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/import_github_spec.rb b/spec/requests/api/import_github_spec.rb
index f33436df40e..f026314f7a8 100644
--- a/spec/requests/api/import_github_spec.rb
+++ b/spec/requests/api/import_github_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ImportGithub do
+RSpec.describe API::ImportGithub do
   let(:token) { "asdasd12345" }
   let(:provider) { :github }
   let(:access_params) { { github_access_token: token } }
@@ -26,6 +26,10 @@ describe API::ImportGithub do
       end
     end
 
+    after do
+      Grape::Endpoint.before_each nil
+    end
+
     it 'rejects requests when Github Importer is disabled' do
       stub_application_setting(import_sources: nil)
 
diff --git a/spec/requests/api/internal/base_spec.rb b/spec/requests/api/internal/base_spec.rb
index aa5e2367a2b..7d219954e9d 100644
--- a/spec/requests/api/internal/base_spec.rb
+++ b/spec/requests/api/internal/base_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Internal::Base do
+RSpec.describe API::Internal::Base do
   let_it_be(:user, reload: true) { create(:user) }
   let_it_be(:project, reload: true) { create(:project, :repository, :wiki_repo) }
   let_it_be(:personal_snippet) { create(:personal_snippet, :repository, author: user) }
@@ -467,21 +467,6 @@ describe API::Internal::Base do
             expect(json_response["git_config_options"]).to include("uploadpack.allowFilter=true")
             expect(json_response["git_config_options"]).to include("uploadpack.allowAnySHA1InWant=true")
           end
-
-          context 'when gitaly_upload_pack_filter feature flag is disabled' do
-            before do
-              stub_feature_flags(gitaly_upload_pack_filter: false)
-            end
-
-            it 'returns only maxInputSize and not partial clone git config' do
-              push(key, project)
-
-              expect(json_response["git_config_options"]).to be_present
-              expect(json_response["git_config_options"]).to include("receive.maxInputSize=1048576")
-              expect(json_response["git_config_options"]).not_to include("uploadpack.allowFilter=true")
-              expect(json_response["git_config_options"]).not_to include("uploadpack.allowAnySHA1InWant=true")
-            end
-          end
         end
 
         context 'when receive_max_input_size is empty' do
@@ -496,18 +481,6 @@ describe API::Internal::Base do
             expect(json_response["git_config_options"]).to include("uploadpack.allowFilter=true")
             expect(json_response["git_config_options"]).to include("uploadpack.allowAnySHA1InWant=true")
           end
-
-          context 'when gitaly_upload_pack_filter feature flag is disabled' do
-            before do
-              stub_feature_flags(gitaly_upload_pack_filter: false)
-            end
-
-            it 'returns an empty git config' do
-              push(key, project)
-
-              expect(json_response["git_config_options"]).to be_empty
-            end
-          end
         end
       end
 
diff --git a/spec/requests/api/internal/pages_spec.rb b/spec/requests/api/internal/pages_spec.rb
index fecf15c29c2..48fc95b6574 100644
--- a/spec/requests/api/internal/pages_spec.rb
+++ b/spec/requests/api/internal/pages_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Internal::Pages do
+RSpec.describe API::Internal::Pages do
   let(:auth_headers) do
     jwt_token = JWT.encode({ 'iss' => 'gitlab-pages' }, Gitlab::Pages.secret, 'HS256')
     { Gitlab::Pages::INTERNAL_API_REQUEST_HEADER => jwt_token }
diff --git a/spec/requests/api/issues/get_group_issues_spec.rb b/spec/requests/api/issues/get_group_issues_spec.rb
index 5c925d2a32e..b53fac3679d 100644
--- a/spec/requests/api/issues/get_group_issues_spec.rb
+++ b/spec/requests/api/issues/get_group_issues_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Issues do
+RSpec.describe API::Issues do
   let_it_be(:user2)               { create(:user) }
   let_it_be(:admin)               { create(:user, :admin) }
   let_it_be(:non_member)          { create(:user) }
diff --git a/spec/requests/api/issues/get_project_issues_spec.rb b/spec/requests/api/issues/get_project_issues_spec.rb
index 4a728c81215..7ff07bf580d 100644
--- a/spec/requests/api/issues/get_project_issues_spec.rb
+++ b/spec/requests/api/issues/get_project_issues_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Issues do
+RSpec.describe API::Issues do
   let_it_be(:user) { create(:user) }
   let_it_be(:project, reload: true) { create(:project, :public, :repository, creator_id: user.id, namespace: user.namespace) }
   let_it_be(:private_mrs_project) do
diff --git a/spec/requests/api/issues/issues_spec.rb b/spec/requests/api/issues/issues_spec.rb
index 315396c89c3..519bea22501 100644
--- a/spec/requests/api/issues/issues_spec.rb
+++ b/spec/requests/api/issues/issues_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Issues do
+RSpec.describe API::Issues do
   let_it_be(:user) { create(:user) }
   let_it_be(:project, reload: true) { create(:project, :public, :repository, creator_id: user.id, namespace: user.namespace) }
   let_it_be(:private_mrs_project) do
@@ -886,4 +886,53 @@ describe API::Issues do
 
     include_examples 'time tracking endpoints', 'issue'
   end
+
+  describe 'PUT /projects/:id/issues/:issue_iid/reorder' do
+    let_it_be(:project) { create(:project) }
+    let_it_be(:issue1) { create(:issue, project: project, relative_position: 10) }
+    let_it_be(:issue2) { create(:issue, project: project, relative_position: 20) }
+    let_it_be(:issue3) { create(:issue, project: project, relative_position: 30) }
+
+    context 'when user has access' do
+      before do
+        project.add_developer(user)
+      end
+
+      context 'with valid params' do
+        it 'reorders issues and returns a successful 200 response' do
+          put api("/projects/#{project.id}/issues/#{issue1.iid}/reorder", user), params: { move_after_id: issue2.id, move_before_id: issue3.id }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(issue1.reload.relative_position)
+                .to be_between(issue2.reload.relative_position, issue3.reload.relative_position)
+        end
+      end
+
+      context 'with invalid params' do
+        it 'returns a unprocessable entity 422 response for invalid move ids' do
+          put api("/projects/#{project.id}/issues/#{issue1.iid}/reorder", user), params: { move_after_id: issue2.id, move_before_id: non_existing_record_id }
+
+          expect(response).to have_gitlab_http_status(:unprocessable_entity)
+        end
+
+        it 'returns a not found 404 response for invalid issue id' do
+          put api("/projects/#{project.id}/issues/#{non_existing_record_iid}/reorder", user), params: { move_after_id: issue2.id, move_before_id: issue3.id }
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'with unauthorized user' do
+      before do
+        project.add_guest(user)
+      end
+
+      it 'responds with 403 forbidden' do
+        put api("/projects/#{project.id}/issues/#{issue1.iid}/reorder", user), params: { move_after_id: issue2.id, move_before_id: issue3.id }
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/issues/post_projects_issues_spec.rb b/spec/requests/api/issues/post_projects_issues_spec.rb
index 2e1e5d3204e..e2f1bb2cd1a 100644
--- a/spec/requests/api/issues/post_projects_issues_spec.rb
+++ b/spec/requests/api/issues/post_projects_issues_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Issues do
+RSpec.describe API::Issues do
   let_it_be(:user) { create(:user) }
   let_it_be(:project, reload: true) do
     create(:project, :public, creator_id: user.id, namespace: user.namespace)
diff --git a/spec/requests/api/issues/put_projects_issues_spec.rb b/spec/requests/api/issues/put_projects_issues_spec.rb
index 62a4d3b48b2..dac721cbea0 100644
--- a/spec/requests/api/issues/put_projects_issues_spec.rb
+++ b/spec/requests/api/issues/put_projects_issues_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Issues do
+RSpec.describe API::Issues do
   let_it_be(:user) { create(:user) }
   let_it_be(:owner) { create(:owner) }
   let(:user2)             { create(:user) }
diff --git a/spec/requests/api/jobs_spec.rb b/spec/requests/api/jobs_spec.rb
index 18b5c00d64f..53c57931d36 100644
--- a/spec/requests/api/jobs_spec.rb
+++ b/spec/requests/api/jobs_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Jobs do
+RSpec.describe API::Jobs do
   include HttpIOHelpers
 
   shared_examples 'a job with artifacts and trace' do |result_is_array: true|
@@ -36,9 +36,9 @@ describe API::Jobs do
   end
 
   let_it_be(:pipeline, reload: true) do
-    create(:ci_empty_pipeline, project: project,
-                               sha: project.commit.id,
-                               ref: project.default_branch)
+    create(:ci_pipeline, project: project,
+                         sha: project.commit.id,
+                         ref: project.default_branch)
   end
 
   let!(:job) do
diff --git a/spec/requests/api/keys_spec.rb b/spec/requests/api/keys_spec.rb
index 089ee22982c..49b8f4a8520 100644
--- a/spec/requests/api/keys_spec.rb
+++ b/spec/requests/api/keys_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Keys do
+RSpec.describe API::Keys do
   let(:user)  { create(:user) }
   let(:admin) { create(:admin) }
   let(:key)   { create(:key, user: user, expires_at: 1.day.from_now) }
diff --git a/spec/requests/api/labels_spec.rb b/spec/requests/api/labels_spec.rb
index 697f22e5f29..fc674fca9b2 100644
--- a/spec/requests/api/labels_spec.rb
+++ b/spec/requests/api/labels_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Labels do
+RSpec.describe API::Labels do
   def put_labels_api(route_type, user, spec_params, request_params = {})
     if route_type == :deprecated
       put api("/projects/#{project.id}/labels", user),
diff --git a/spec/requests/api/lint_spec.rb b/spec/requests/api/lint_spec.rb
index 71c2619d898..4c60c8bd2a3 100644
--- a/spec/requests/api/lint_spec.rb
+++ b/spec/requests/api/lint_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Lint do
+RSpec.describe API::Lint do
   describe 'POST /ci/lint' do
     context 'with valid .gitlab-ci.yaml content' do
       let(:yaml_content) do
diff --git a/spec/requests/api/markdown_spec.rb b/spec/requests/api/markdown_spec.rb
index 53e43430b1f..35d91963ac9 100644
--- a/spec/requests/api/markdown_spec.rb
+++ b/spec/requests/api/markdown_spec.rb
@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe API::Markdown do
+RSpec.describe API::Markdown do
   describe "POST /markdown" do
     let(:user) {} # No-op. It gets overwritten in the contexts below.
 
diff --git a/spec/requests/api/maven_packages_spec.rb b/spec/requests/api/maven_packages_spec.rb
new file mode 100644
index 00000000000..189d6a4c1a4
--- /dev/null
+++ b/spec/requests/api/maven_packages_spec.rb
@@ -0,0 +1,569 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe API::MavenPackages do
+  include WorkhorseHelpers
+
+  let_it_be(:group) { create(:group) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project, reload: true) { create(:project, :public, namespace: group) }
+  let_it_be(:package, reload: true) { create(:maven_package, project: project, name: project.full_path) }
+  let_it_be(:maven_metadatum, reload: true) { package.maven_metadatum }
+  let_it_be(:package_file) { package.package_files.with_file_name_like('%.xml').first }
+  let_it_be(:jar_file) { package.package_files.with_file_name_like('%.jar').first }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:job) { create(:ci_build, user: user) }
+  let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
+  let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
+
+  let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+  let(:headers) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+  let(:headers_with_token) { headers.merge('Private-Token' => personal_access_token.token) }
+
+  let(:headers_with_deploy_token) do
+    headers.merge(
+      Gitlab::Auth::AuthFinders::DEPLOY_TOKEN_HEADER => deploy_token.token
+    )
+  end
+
+  let(:version) { '1.0-SNAPSHOT' }
+
+  before do
+    project.add_developer(user)
+  end
+
+  shared_examples 'tracking the file download event' do
+    context 'with jar file' do
+      let_it_be(:package_file) { jar_file }
+
+      it_behaves_like 'a gitlab tracking event', described_class.name, 'pull_package'
+    end
+  end
+
+  shared_examples 'processing HEAD requests' do
+    subject { head api(url) }
+
+    before do
+      allow_any_instance_of(::Packages::PackageFileUploader).to receive(:fog_credentials).and_return(object_storage_credentials)
+      stub_package_file_object_storage(enabled: object_storage_enabled)
+    end
+
+    context 'with object storage enabled' do
+      let(:object_storage_enabled) { true }
+
+      before do
+        allow_any_instance_of(::Packages::PackageFileUploader).to receive(:file_storage?).and_return(false)
+      end
+
+      context 'non AWS provider' do
+        let(:object_storage_credentials) { { provider: 'Google' } }
+
+        it 'does not generated a signed url for head' do
+          expect_any_instance_of(Fog::AWS::Storage::Files).not_to receive(:head_url)
+
+          subject
+        end
+      end
+
+      context 'with AWS provider' do
+        let(:object_storage_credentials) { { provider: 'AWS', aws_access_key_id: 'test', aws_secret_access_key: 'test' } }
+
+        it 'generates a signed url for head' do
+          expect_any_instance_of(Fog::AWS::Storage::Files).to receive(:head_url).and_call_original
+
+          subject
+        end
+      end
+    end
+
+    context 'with object storage disabled' do
+      let(:object_storage_enabled) { false }
+      let(:object_storage_credentials) { {} }
+
+      it 'does not generate a signed url for head' do
+        expect_any_instance_of(Fog::AWS::Storage::Files).not_to receive(:head_url)
+
+        subject
+      end
+    end
+  end
+
+  shared_examples 'downloads with a deploy token' do
+    it 'allows download with deploy token' do
+      download_file(
+        package_file.file_name,
+        {},
+        Gitlab::Auth::AuthFinders::DEPLOY_TOKEN_HEADER => deploy_token.token
+      )
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.media_type).to eq('application/octet-stream')
+    end
+  end
+
+  shared_examples 'downloads with a job token' do
+    it 'allows download with job token' do
+      download_file(package_file.file_name, job_token: job.token)
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.media_type).to eq('application/octet-stream')
+    end
+  end
+
+  describe 'GET /api/v4/packages/maven/*path/:file_name' do
+    context 'a public project' do
+      subject { download_file(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'returns sha1 of the file' do
+        download_file(package_file.file_name + '.sha1')
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('text/plain')
+        expect(response.body).to eq(package_file.file_sha1)
+      end
+    end
+
+    context 'internal project' do
+      before do
+        project.team.truncate
+        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+      end
+
+      subject { download_file_with_token(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download when no private token' do
+        download_file(package_file.file_name)
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      it_behaves_like 'downloads with a job token'
+
+      it_behaves_like 'downloads with a deploy token'
+    end
+
+    context 'private project' do
+      subject { download_file_with_token(package_file.file_name) }
+
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download when not enough permissions' do
+        project.add_guest(user)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      it 'denies download when no private token' do
+        download_file(package_file.file_name)
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      it_behaves_like 'downloads with a job token'
+
+      it_behaves_like 'downloads with a deploy token'
+    end
+
+    context 'project name is different from a package name' do
+      before do
+        maven_metadatum.update!(path: "wrong_name/#{package.version}")
+      end
+
+      it 'rejects request' do
+        download_file(package_file.file_name)
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
+    def download_file(file_name, params = {}, request_headers = headers)
+      get api("/packages/maven/#{maven_metadatum.path}/#{file_name}"), params: params, headers: request_headers
+    end
+
+    def download_file_with_token(file_name, params = {}, request_headers = headers_with_token)
+      download_file(file_name, params, request_headers)
+    end
+  end
+
+  describe 'HEAD /api/v4/packages/maven/*path/:file_name' do
+    let(:url) { "/packages/maven/#{package.maven_metadatum.path}/#{package_file.file_name}" }
+
+    it_behaves_like 'processing HEAD requests'
+  end
+
+  describe 'GET /api/v4/groups/:id/-/packages/maven/*path/:file_name' do
+    before do
+      project.team.truncate
+      group.add_developer(user)
+    end
+
+    context 'a public project' do
+      subject { download_file(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'returns sha1 of the file' do
+        download_file(package_file.file_name + '.sha1')
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('text/plain')
+        expect(response.body).to eq(package_file.file_sha1)
+      end
+    end
+
+    context 'internal project' do
+      before do
+        group.group_member(user).destroy
+        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+      end
+
+      subject { download_file_with_token(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download when no private token' do
+        download_file(package_file.file_name)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it_behaves_like 'downloads with a job token'
+
+      it_behaves_like 'downloads with a deploy token'
+    end
+
+    context 'private project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      subject { download_file_with_token(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download when not enough permissions' do
+        group.add_guest(user)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      it 'denies download when no private token' do
+        download_file(package_file.file_name)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it_behaves_like 'downloads with a job token'
+
+      it_behaves_like 'downloads with a deploy token'
+    end
+
+    def download_file(file_name, params = {}, request_headers = headers)
+      get api("/groups/#{group.id}/-/packages/maven/#{maven_metadatum.path}/#{file_name}"), params: params, headers: request_headers
+    end
+
+    def download_file_with_token(file_name, params = {}, request_headers = headers_with_token)
+      download_file(file_name, params, request_headers)
+    end
+  end
+
+  describe 'HEAD /api/v4/groups/:id/-/packages/maven/*path/:file_name' do
+    let(:url) { "/groups/#{group.id}/-/packages/maven/#{package.maven_metadatum.path}/#{package_file.file_name}" }
+
+    it_behaves_like 'processing HEAD requests'
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/maven/*path/:file_name' do
+    context 'a public project' do
+      subject { download_file(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'returns sha1 of the file' do
+        download_file(package_file.file_name + '.sha1')
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('text/plain')
+        expect(response.body).to eq(package_file.file_sha1)
+      end
+    end
+
+    context 'private project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      subject { download_file_with_token(package_file.file_name) }
+
+      it_behaves_like 'tracking the file download event'
+
+      it 'returns the file' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download when not enough permissions' do
+        project.add_guest(user)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+
+      it 'denies download when no private token' do
+        download_file(package_file.file_name)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it_behaves_like 'downloads with a job token'
+
+      it_behaves_like 'downloads with a deploy token'
+    end
+
+    def download_file(file_name, params = {}, request_headers = headers)
+      get api("/projects/#{project.id}/packages/maven/" \
+              "#{maven_metadatum.path}/#{file_name}"), params: params, headers: request_headers
+    end
+
+    def download_file_with_token(file_name, params = {}, request_headers = headers_with_token)
+      download_file(file_name, params, request_headers)
+    end
+  end
+
+  describe 'HEAD /api/v4/projects/:id/packages/maven/*path/:file_name' do
+    let(:url) { "/projects/#{project.id}/packages/maven/#{package.maven_metadatum.path}/#{package_file.file_name}" }
+
+    it_behaves_like 'processing HEAD requests'
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/maven/*path/:file_name/authorize' do
+    it 'rejects a malicious request' do
+      put api("/projects/#{project.id}/packages/maven/com/example/my-app/#{version}/%2e%2e%2F.ssh%2Fauthorized_keys/authorize"), params: {}, headers: headers_with_token
+
+      expect(response).to have_gitlab_http_status(:bad_request)
+    end
+
+    it 'authorizes posting package with a valid token' do
+      authorize_upload_with_token
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(response.media_type).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
+      expect(json_response['TempPath']).not_to be_nil
+    end
+
+    it 'rejects request without a valid token' do
+      headers_with_token['Private-Token'] = 'foo'
+
+      authorize_upload_with_token
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    it 'rejects request without a valid permission' do
+      project.add_guest(user)
+
+      authorize_upload_with_token
+
+      expect(response).to have_gitlab_http_status(:forbidden)
+    end
+
+    it 'rejects requests that did not go through gitlab-workhorse' do
+      headers.delete(Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER)
+
+      authorize_upload_with_token
+
+      expect(response).to have_gitlab_http_status(:forbidden)
+    end
+
+    it 'authorizes upload with job token' do
+      authorize_upload(job_token: job.token)
+
+      expect(response).to have_gitlab_http_status(:ok)
+    end
+
+    it 'authorizes upload with deploy token' do
+      authorize_upload({}, headers_with_deploy_token)
+
+      expect(response).to have_gitlab_http_status(:ok)
+    end
+
+    def authorize_upload(params = {}, request_headers = headers)
+      put api("/projects/#{project.id}/packages/maven/com/example/my-app/#{version}/maven-metadata.xml/authorize"), params: params, headers: request_headers
+    end
+
+    def authorize_upload_with_token(params = {}, request_headers = headers_with_token)
+      authorize_upload(params, request_headers)
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/maven/*path/:file_name' do
+    let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+    let(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+    let(:send_rewritten_field) { true }
+    let(:file_upload) { fixture_file_upload('spec/fixtures/packages/maven/my-app-1.0-20180724.124855-1.jar') }
+
+    before do
+      # by configuring this path we allow to pass temp file from any path
+      allow(Packages::PackageFileUploader).to receive(:workhorse_upload_path).and_return('/')
+    end
+
+    it 'rejects requests without a file from workhorse' do
+      upload_file_with_token
+
+      expect(response).to have_gitlab_http_status(:bad_request)
+    end
+
+    it 'rejects request without a token' do
+      upload_file
+
+      expect(response).to have_gitlab_http_status(:unauthorized)
+    end
+
+    context 'without workhorse rewritten field' do
+      let(:send_rewritten_field) { false }
+
+      it 'rejects the request' do
+        upload_file_with_token
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+
+    context 'when params from workhorse are correct' do
+      let(:params) { { file: file_upload } }
+
+      it 'rejects a malicious request' do
+        put api("/projects/#{project.id}/packages/maven/com/example/my-app/#{version}/%2e%2e%2f.ssh%2fauthorized_keys"), params: params, headers: headers_with_token
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+
+      context 'without workhorse header' do
+        let(:workhorse_header) { {} }
+
+        subject { upload_file_with_token(params) }
+
+        it_behaves_like 'package workhorse uploads'
+      end
+
+      context 'event tracking' do
+        subject { upload_file_with_token(params) }
+
+        it_behaves_like 'a gitlab tracking event', described_class.name, 'push_package'
+      end
+
+      it 'creates package and stores package file' do
+        expect { upload_file_with_token(params) }.to change { project.packages.count }.by(1)
+          .and change { Packages::Maven::Metadatum.count }.by(1)
+          .and change { Packages::PackageFile.count }.by(1)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(jar_file.file_name).to eq(file_upload.original_filename)
+      end
+
+      it 'allows upload with job token' do
+        upload_file(params.merge(job_token: job.token))
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(project.reload.packages.last.build_info.pipeline).to eq job.pipeline
+      end
+
+      it 'allows upload with deploy token' do
+        upload_file(params, headers_with_deploy_token)
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      context 'version is not correct' do
+        let(:version) { '$%123' }
+
+        it 'rejects request' do
+          expect { upload_file_with_token(params) }.not_to change { project.packages.count }
+
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']).to include('Validation failed')
+        end
+      end
+    end
+
+    def upload_file(params = {}, request_headers = headers)
+      url = "/projects/#{project.id}/packages/maven/com/example/my-app/#{version}/my-app-1.0-20180724.124855-1.jar"
+      workhorse_finalize(
+        api(url),
+        method: :put,
+        file_key: :file,
+        params: params,
+        headers: request_headers,
+        send_rewritten_field: send_rewritten_field
+      )
+    end
+
+    def upload_file_with_token(params = {}, request_headers = headers_with_token)
+      upload_file(params, request_headers)
+    end
+  end
+end
diff --git a/spec/requests/api/members_spec.rb b/spec/requests/api/members_spec.rb
index 0ecef26c27a..23889912d7a 100644
--- a/spec/requests/api/members_spec.rb
+++ b/spec/requests/api/members_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Members do
+RSpec.describe API::Members do
   let(:maintainer) { create(:user, username: 'maintainer_user') }
   let(:developer) { create(:user) }
   let(:access_requester) { create(:user) }
@@ -321,6 +321,26 @@ describe API::Members do
         expect(response).to have_gitlab_http_status(:bad_request)
       end
     end
+
+    context 'adding project bot' do
+      let_it_be(:project_bot) { create(:user, :project_bot) }
+
+      before do
+        unrelated_project = create(:project)
+        unrelated_project.add_maintainer(project_bot)
+      end
+
+      it 'returns 400' do
+        expect do
+          post api("/#{source_type.pluralize}/#{source.id}/members", maintainer),
+               params: { user_id: project_bot.id, access_level: Member::DEVELOPER }
+
+          expect(response).to have_gitlab_http_status(:bad_request)
+          expect(json_response['message']['user_id']).to(
+            include('project bots cannot be added to other groups / projects'))
+        end.not_to change { project.members.count }
+      end
+    end
   end
 
   shared_examples 'PUT /:source_type/:id/members/:user_id' do |source_type|
@@ -461,8 +481,34 @@ describe API::Members do
     end
   end
 
-  it_behaves_like 'POST /:source_type/:id/members', 'project' do
-    let(:source) { project }
+  describe 'POST /projects/:id/members' do
+    it_behaves_like 'POST /:source_type/:id/members', 'project' do
+      let(:source) { project }
+    end
+
+    context 'adding owner to project' do
+      it 'returns 403' do
+        expect do
+          post api("/projects/#{project.id}/members", maintainer),
+               params: { user_id: stranger.id, access_level: Member::OWNER }
+
+          expect(response).to have_gitlab_http_status(:bad_request)
+        end.not_to change { project.members.count }
+      end
+    end
+
+    context 'remove bot from project' do
+      it 'returns a 403 forbidden' do
+        project_bot = create(:user, :project_bot)
+        create(:project_member, project: project, user: project_bot)
+
+        expect do
+          delete api("/projects/#{project.id}/members/#{project_bot.id}", maintainer)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end.not_to change { project.members.count }
+      end
+    end
   end
 
   it_behaves_like 'POST /:source_type/:id/members', 'group' do
@@ -484,15 +530,4 @@ describe API::Members do
   it_behaves_like 'DELETE /:source_type/:id/members/:user_id', 'group' do
     let(:source) { group }
   end
-
-  context 'Adding owner to project' do
-    it 'returns 403' do
-      expect do
-        post api("/projects/#{project.id}/members", maintainer),
-             params: { user_id: stranger.id, access_level: Member::OWNER }
-
-        expect(response).to have_gitlab_http_status(:bad_request)
-      end.to change { project.members.count }.by(0)
-    end
-  end
 end
diff --git a/spec/requests/api/merge_request_approvals_spec.rb b/spec/requests/api/merge_request_approvals_spec.rb
new file mode 100644
index 00000000000..fad5c3fb60e
--- /dev/null
+++ b/spec/requests/api/merge_request_approvals_spec.rb
@@ -0,0 +1,84 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::MergeRequestApprovals do
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project) { create(:project, :public, :repository, creator: user, namespace: user.namespace) }
+  let_it_be(:approver) { create :user }
+  let_it_be(:group) { create :group }
+
+  let(:merge_request) { create(:merge_request, :simple, author: user, source_project: project) }
+
+  describe 'GET :id/merge_requests/:merge_request_iid/approvals' do
+    it 'retrieves the approval status' do
+      project.add_developer(approver)
+      project.add_developer(create(:user))
+
+      create(:approval, user: approver, merge_request: merge_request)
+
+      get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/approvals", user)
+
+      expect(response).to have_gitlab_http_status(:ok)
+    end
+  end
+
+  describe 'POST :id/merge_requests/:merge_request_iid/approve' do
+    context 'as a valid approver' do
+      let_it_be(:approver) { create(:user) }
+
+      before do
+        project.add_developer(approver)
+        project.add_developer(create(:user))
+      end
+
+      def approve(extra_params = {})
+        post api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/approve", approver), params: extra_params
+      end
+
+      context 'when the sha param is not set' do
+        it 'approves the merge request' do
+          approve
+
+          expect(response).to have_gitlab_http_status(:created)
+        end
+      end
+
+      context 'when the sha param is correct' do
+        it 'approves the merge request' do
+          approve(sha: merge_request.diff_head_sha)
+
+          expect(response).to have_gitlab_http_status(:created)
+        end
+      end
+
+      context 'when the sha param is incorrect' do
+        it 'does not approve the merge request' do
+          approve(sha: merge_request.diff_head_sha.reverse)
+
+          expect(response).to have_gitlab_http_status(:conflict)
+          expect(merge_request.approvals).to be_empty
+        end
+      end
+    end
+  end
+
+  describe 'POST :id/merge_requests/:merge_request_iid/unapprove' do
+    context 'as a user who has approved the merge request' do
+      it 'unapproves the merge request' do
+        unapprover = create(:user)
+
+        project.add_developer(approver)
+        project.add_developer(unapprover)
+        project.add_developer(create(:user))
+
+        create(:approval, user: approver, merge_request: merge_request)
+        create(:approval, user: unapprover, merge_request: merge_request)
+
+        post api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/unapprove", unapprover)
+
+        expect(response).to have_gitlab_http_status(:created)
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/merge_request_diffs_spec.rb b/spec/requests/api/merge_request_diffs_spec.rb
index d00bc4a6dde..3f41a7a034d 100644
--- a/spec/requests/api/merge_request_diffs_spec.rb
+++ b/spec/requests/api/merge_request_diffs_spec.rb
@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe API::MergeRequestDiffs, 'MergeRequestDiffs' do
+RSpec.describe API::MergeRequestDiffs, 'MergeRequestDiffs' do
   let!(:user)          { create(:user) }
   let!(:merge_request) { create(:merge_request, importing: true) }
   let!(:project)       { merge_request.target_project }
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 7a0077f853a..68f1a0f1ba1 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe API::MergeRequests do
+RSpec.describe API::MergeRequests do
   include ProjectForksHelper
 
   let(:base_time)   { Time.now }
@@ -425,6 +425,73 @@ describe API::MergeRequests do
         end
       end
 
+      context 'NOT params' do
+        let(:merge_request2) do
+          create(
+            :merge_request,
+            :simple,
+            milestone: milestone,
+            author: user,
+            assignees: [user],
+            merge_request_context_commits: [merge_request_context_commit],
+            source_project: project,
+            target_project: project,
+            source_branch: 'what',
+            title: "What",
+            created_at: base_time
+          )
+        end
+
+        before do
+          create(:label_link, label: label, target: merge_request)
+          create(:label_link, label: label2, target: merge_request2)
+        end
+
+        it 'returns merge requests without any of the labels given', :aggregate_failures do
+          get api(endpoint_path, user), params: { not: { labels: ["#{label.title}, #{label2.title}"] } }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to be_an(Array)
+          expect(json_response.length).to eq(3)
+          json_response.each do |mr|
+            expect(mr['labels']).not_to include(label2.title, label.title)
+          end
+        end
+
+        it 'returns merge requests without any of the milestones given', :aggregate_failures do
+          get api(endpoint_path, user), params: { not: { milestone: milestone.title } }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to be_an(Array)
+          expect(json_response.length).to eq(4)
+          json_response.each do |mr|
+            expect(mr['milestone']).not_to eq(milestone.title)
+          end
+        end
+
+        it 'returns merge requests without the author given', :aggregate_failures do
+          get api(endpoint_path, user), params: { not: { author_id: user2.id } }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to be_an(Array)
+          expect(json_response.length).to eq(5)
+          json_response.each do |mr|
+            expect(mr['author']['id']).not_to eq(user2.id)
+          end
+        end
+
+        it 'returns merge requests without the assignee given', :aggregate_failures do
+          get api(endpoint_path, user), params: { not: { assignee_id: user2.id } }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(json_response).to be_an(Array)
+          expect(json_response.length).to eq(5)
+          json_response.each do |mr|
+            expect(mr['assignee']['id']).not_to eq(user2.id)
+          end
+        end
+      end
+
       context 'source_branch param' do
         it 'returns merge requests with the given source branch' do
           get api(endpoint_path, user), params: { source_branch: merge_request_closed.source_branch, state: 'all' }
@@ -1930,7 +1997,7 @@ describe API::MergeRequests do
     it "updates the MR's squash attribute" do
       expect do
         put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/merge", user), params: { squash: true }
-      end.to change { merge_request.reload.squash }
+      end.to change { merge_request.reload.squash_on_merge? }
 
       expect(response).to have_gitlab_http_status(:ok)
     end
diff --git a/spec/requests/api/metrics/dashboard/annotations_spec.rb b/spec/requests/api/metrics/dashboard/annotations_spec.rb
index 6377ef2435a..07de2925ee2 100644
--- a/spec/requests/api/metrics/dashboard/annotations_spec.rb
+++ b/spec/requests/api/metrics/dashboard/annotations_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Metrics::Dashboard::Annotations do
+RSpec.describe API::Metrics::Dashboard::Annotations do
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :private, :repository, namespace: user.namespace) }
   let_it_be(:environment) { create(:environment, project: project) }
diff --git a/spec/requests/api/metrics/user_starred_dashboards_spec.rb b/spec/requests/api/metrics/user_starred_dashboards_spec.rb
index 8f9394a0e20..533dff05f27 100644
--- a/spec/requests/api/metrics/user_starred_dashboards_spec.rb
+++ b/spec/requests/api/metrics/user_starred_dashboards_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Metrics::UserStarredDashboards do
+RSpec.describe API::Metrics::UserStarredDashboards do
   let_it_be(:user) { create(:user) }
   let_it_be(:dashboard_yml) { fixture_file('lib/gitlab/metrics/dashboard/sample_dashboard.yml') }
   let_it_be(:dashboard) { '.gitlab/dashboards/find&seek.yml' }
diff --git a/spec/requests/api/namespaces_spec.rb b/spec/requests/api/namespaces_spec.rb
index 68fffc638df..2ac76d469d5 100644
--- a/spec/requests/api/namespaces_spec.rb
+++ b/spec/requests/api/namespaces_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Namespaces do
+RSpec.describe API::Namespaces do
   let(:admin) { create(:admin) }
   let(:user) { create(:user) }
   let!(:group1) { create(:group, name: 'group.one') }
diff --git a/spec/requests/api/notes_spec.rb b/spec/requests/api/notes_spec.rb
index 797dd3bb4e2..1510d31a1a6 100644
--- a/spec/requests/api/notes_spec.rb
+++ b/spec/requests/api/notes_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Notes do
+RSpec.describe API::Notes do
   let!(:user) { create(:user) }
   let!(:project) { create(:project, :public) }
   let(:private_user) { create(:user) }
diff --git a/spec/requests/api/notification_settings_spec.rb b/spec/requests/api/notification_settings_spec.rb
index 2dfde4c8ec9..73cb4948524 100644
--- a/spec/requests/api/notification_settings_spec.rb
+++ b/spec/requests/api/notification_settings_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::NotificationSettings do
+RSpec.describe API::NotificationSettings do
   let(:user) { create(:user) }
   let!(:group) { create(:group) }
   let!(:project) { create(:project, :public, creator_id: user.id, namespace: group) }
diff --git a/spec/requests/api/npm_packages_spec.rb b/spec/requests/api/npm_packages_spec.rb
new file mode 100644
index 00000000000..98a1ca978a8
--- /dev/null
+++ b/spec/requests/api/npm_packages_spec.rb
@@ -0,0 +1,550 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::NpmPackages do
+  include PackagesManagerApiSpecHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project, reload: true) { create(:project, :public, namespace: group) }
+  let_it_be(:package, reload: true) { create(:npm_package, project: project) }
+  let_it_be(:token) { create(:oauth_access_token, scopes: 'api', resource_owner: user) }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:job) { create(:ci_build, user: user) }
+  let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
+  let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
+
+  before do
+    project.add_developer(user)
+  end
+
+  shared_examples 'a package that requires auth' do
+    it 'returns the package info with oauth token' do
+      get_package_with_token(package)
+
+      expect_a_valid_package_response
+    end
+
+    it 'returns the package info with job token' do
+      get_package_with_job_token(package)
+
+      expect_a_valid_package_response
+    end
+
+    it 'denies request without oauth token' do
+      get_package(package)
+
+      expect(response).to have_gitlab_http_status(:forbidden)
+    end
+
+    it 'returns the package info with deploy token' do
+      get_package_with_deploy_token(package)
+
+      expect_a_valid_package_response
+    end
+  end
+
+  describe 'GET /api/v4/packages/npm/*package_name' do
+    let_it_be(:package_dependency_link1) { create(:packages_dependency_link, package: package, dependency_type: :dependencies) }
+    let_it_be(:package_dependency_link2) { create(:packages_dependency_link, package: package, dependency_type: :devDependencies) }
+    let_it_be(:package_dependency_link3) { create(:packages_dependency_link, package: package, dependency_type: :bundleDependencies) }
+    let_it_be(:package_dependency_link4) { create(:packages_dependency_link, package: package, dependency_type: :peerDependencies) }
+
+    shared_examples 'returning the npm package info' do
+      it 'returns the package info' do
+        get_package(package)
+
+        expect_a_valid_package_response
+      end
+    end
+
+    shared_examples 'returning forbidden for unknown package' do
+      context 'with an unknown package' do
+        it 'returns forbidden' do
+          get api("/packages/npm/unknown")
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+    end
+
+    context 'a public project' do
+      it_behaves_like 'returning the npm package info'
+
+      context 'with application setting enabled' do
+        before do
+          stub_application_setting(npm_package_requests_forwarding: true)
+        end
+
+        it_behaves_like 'returning the npm package info'
+
+        context 'with unknown package' do
+          it 'returns a redirect' do
+            get api("/packages/npm/unknown")
+
+            expect(response).to have_gitlab_http_status(:found)
+            expect(response.headers['Location']).to eq('https://registry.npmjs.org/unknown')
+          end
+        end
+      end
+
+      context 'with application setting disabled' do
+        before do
+          stub_application_setting(npm_package_requests_forwarding: false)
+        end
+
+        it_behaves_like 'returning the npm package info'
+
+        it_behaves_like 'returning forbidden for unknown package'
+      end
+
+      context 'project path with a dot' do
+        before do
+          project.update!(path: 'foo.bar')
+        end
+
+        it_behaves_like 'returning the npm package info'
+      end
+    end
+
+    context 'internal project' do
+      before do
+        project.team.truncate
+        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+      end
+
+      it_behaves_like 'a package that requires auth'
+    end
+
+    context 'private project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      it_behaves_like 'a package that requires auth'
+
+      it 'denies request when not enough permissions' do
+        project.add_guest(user)
+
+        get_package_with_token(package)
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
+    def get_package(package, params = {}, headers = {})
+      get api("/packages/npm/#{package.name}"), params: params, headers: headers
+    end
+
+    def get_package_with_token(package, params = {})
+      get_package(package, params.merge(access_token: token.token))
+    end
+
+    def get_package_with_job_token(package, params = {})
+      get_package(package, params.merge(job_token: job.token))
+    end
+
+    def get_package_with_deploy_token(package, params = {})
+      get_package(package, {}, build_token_auth_header(deploy_token.token))
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/npm/*package_name/-/*file_name' do
+    let_it_be(:package_file) { package.package_files.first }
+
+    shared_examples 'a package file that requires auth' do
+      it 'returns the file with an access token' do
+        get_file_with_token(package_file)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'returns the file with a job token' do
+        get_file_with_job_token(package_file)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it 'denies download with no token' do
+        get_file(package_file)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+
+    context 'a public project' do
+      subject { get_file(package_file) }
+
+      it 'returns the file with no token needed' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it_behaves_like 'a gitlab tracking event', described_class.name, 'pull_package'
+    end
+
+    context 'private project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      it_behaves_like 'a package file that requires auth'
+
+      it 'denies download when not enough permissions' do
+        project.add_guest(user)
+
+        get_file_with_token(package_file)
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+
+    context 'internal project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+      end
+
+      it_behaves_like 'a package file that requires auth'
+    end
+
+    def get_file(package_file, params = {})
+      get api("/projects/#{project.id}/packages/npm/" \
+              "#{package_file.package.name}/-/#{package_file.file_name}"), params: params
+    end
+
+    def get_file_with_token(package_file, params = {})
+      get_file(package_file, params.merge(access_token: token.token))
+    end
+
+    def get_file_with_job_token(package_file, params = {})
+      get_file(package_file, params.merge(job_token: job.token))
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/npm/:package_name' do
+    RSpec.shared_examples 'handling invalid record with 400 error' do
+      it 'handles an ActiveRecord::RecordInvalid exception with 400 error' do
+        expect { upload_package_with_token(package_name, params) }
+          .not_to change { project.packages.count }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+
+    context 'when params are correct' do
+      context 'invalid package record' do
+        context 'unscoped package' do
+          let(:package_name) { 'my_unscoped_package' }
+          let(:params) { upload_params(package_name: package_name) }
+
+          it_behaves_like 'handling invalid record with 400 error'
+
+          context 'with empty versions' do
+            let(:params) { upload_params(package_name: package_name).merge!(versions: {}) }
+
+            it 'throws a 400 error' do
+              expect { upload_package_with_token(package_name, params) }
+              .not_to change { project.packages.count }
+
+              expect(response).to have_gitlab_http_status(:bad_request)
+            end
+          end
+        end
+
+        context 'invalid package name' do
+          let(:package_name) { "@#{group.path}/my_inv@@lid_package_name" }
+          let(:params) { upload_params(package_name: package_name) }
+
+          it_behaves_like 'handling invalid record with 400 error'
+        end
+
+        context 'invalid package version' do
+          using RSpec::Parameterized::TableSyntax
+
+          let(:package_name) { "@#{group.path}/my_package_name" }
+
+          where(:version) do
+            [
+              '1',
+              '1.2',
+              '1./2.3',
+              '../../../../../1.2.3',
+              '%2e%2e%2f1.2.3'
+            ]
+          end
+
+          with_them do
+            let(:params) { upload_params(package_name: package_name, package_version: version) }
+
+            it_behaves_like 'handling invalid record with 400 error'
+          end
+        end
+      end
+
+      context 'scoped package' do
+        let(:package_name) { "@#{group.path}/my_package_name" }
+        let(:params) { upload_params(package_name: package_name) }
+
+        context 'with access token' do
+          subject { upload_package_with_token(package_name, params) }
+
+          it_behaves_like 'a gitlab tracking event', described_class.name, 'push_package'
+
+          it 'creates npm package with file' do
+            expect { subject }
+              .to change { project.packages.count }.by(1)
+              .and change { Packages::PackageFile.count }.by(1)
+              .and change { Packages::Tag.count }.by(1)
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+
+        it 'creates npm package with file with job token' do
+          expect { upload_package_with_job_token(package_name, params) }
+            .to change { project.packages.count }.by(1)
+            .and change { Packages::PackageFile.count }.by(1)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        context 'with an authenticated job token' do
+          let!(:job) { create(:ci_build, user: user) }
+
+          before do
+            Grape::Endpoint.before_each do |endpoint|
+              expect(endpoint).to receive(:current_authenticated_job) { job }
+            end
+          end
+
+          after do
+            Grape::Endpoint.before_each nil
+          end
+
+          it 'creates the package metadata' do
+            upload_package_with_token(package_name, params)
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(project.reload.packages.find(json_response['id']).build_info.pipeline).to eq job.pipeline
+          end
+        end
+      end
+
+      context 'package creation fails' do
+        let(:package_name) { "@#{group.path}/my_package_name" }
+        let(:params) { upload_params(package_name: package_name) }
+
+        it 'returns an error if the package already exists' do
+          create(:npm_package, project: project, version: '1.0.1', name: "@#{group.path}/my_package_name")
+          expect { upload_package_with_token(package_name, params) }
+            .not_to change { project.packages.count }
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
+      context 'with dependencies' do
+        let(:package_name) { "@#{group.path}/my_package_name" }
+        let(:params) { upload_params(package_name: package_name, file: 'npm/payload_with_duplicated_packages.json') }
+
+        it 'creates npm package with file and dependencies' do
+          expect { upload_package_with_token(package_name, params) }
+            .to change { project.packages.count }.by(1)
+            .and change { Packages::PackageFile.count }.by(1)
+            .and change { Packages::Dependency.count}.by(4)
+            .and change { Packages::DependencyLink.count}.by(6)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        context 'with existing dependencies' do
+          before do
+            name = "@#{group.path}/existing_package"
+            upload_package_with_token(name, upload_params(package_name: name, file: 'npm/payload_with_duplicated_packages.json'))
+          end
+
+          it 'reuses them' do
+            expect { upload_package_with_token(package_name, params) }
+              .to change { project.packages.count }.by(1)
+              .and change { Packages::PackageFile.count }.by(1)
+              .and not_change { Packages::Dependency.count}
+              .and change { Packages::DependencyLink.count}.by(6)
+          end
+        end
+      end
+    end
+
+    def upload_package(package_name, params = {})
+      put api("/projects/#{project.id}/packages/npm/#{package_name.sub('/', '%2f')}"), params: params
+    end
+
+    def upload_package_with_token(package_name, params = {})
+      upload_package(package_name, params.merge(access_token: token.token))
+    end
+
+    def upload_package_with_job_token(package_name, params = {})
+      upload_package(package_name, params.merge(job_token: job.token))
+    end
+
+    def upload_params(package_name:, package_version: '1.0.1', file: 'npm/payload.json')
+      Gitlab::Json.parse(fixture_file("packages/#{file}")
+          .gsub('@root/npm-test', package_name)
+          .gsub('1.0.1', package_version))
+    end
+  end
+
+  describe 'GET /api/v4/packages/npm/-/package/*package_name/dist-tags' do
+    let_it_be(:package_tag1) { create(:packages_tag, package: package) }
+    let_it_be(:package_tag2) { create(:packages_tag, package: package) }
+
+    let(:package_name) { package.name }
+    let(:url) { "/packages/npm/-/package/#{package_name}/dist-tags" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with public project' do
+        context 'with authenticated user' do
+          subject { get api(url, personal_access_token: personal_access_token) }
+
+          it_behaves_like 'returns package tags', :maintainer
+          it_behaves_like 'returns package tags', :developer
+          it_behaves_like 'returns package tags', :reporter
+          it_behaves_like 'returns package tags', :guest
+        end
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'returns package tags', :no_type
+        end
+      end
+
+      context 'with private project' do
+        before do
+          project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+        end
+
+        context 'with authenticated user' do
+          subject { get api(url, personal_access_token: personal_access_token) }
+
+          it_behaves_like 'returns package tags', :maintainer
+          it_behaves_like 'returns package tags', :developer
+          it_behaves_like 'returns package tags', :reporter
+          it_behaves_like 'rejects package tags access', :guest, :forbidden
+        end
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'rejects package tags access', :no_type, :forbidden
+        end
+      end
+    end
+  end
+
+  describe 'PUT /api/v4/packages/npm/-/package/*package_name/dist-tags/:tag' do
+    let_it_be(:tag_name) { 'test' }
+
+    let(:package_name) { package.name }
+    let(:version) { package.version }
+    let(:url) { "/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}" }
+
+    subject { put api(url), env: { 'api.request.body': version } }
+
+    context 'without the need for a license' do
+      context 'with public project' do
+        context 'with authenticated user' do
+          subject { put api(url, personal_access_token: personal_access_token), env: { 'api.request.body': version } }
+
+          it_behaves_like 'create package tag', :maintainer
+          it_behaves_like 'create package tag', :developer
+          it_behaves_like 'rejects package tags access', :reporter, :forbidden
+          it_behaves_like 'rejects package tags access', :guest, :forbidden
+        end
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+        end
+      end
+
+      context 'with private project' do
+        before do
+          project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+        end
+
+        context 'with authenticated user' do
+          subject { put api(url, personal_access_token: personal_access_token), env: { 'api.request.body': version } }
+
+          it_behaves_like 'create package tag', :maintainer
+          it_behaves_like 'create package tag', :developer
+          it_behaves_like 'rejects package tags access', :reporter, :forbidden
+          it_behaves_like 'rejects package tags access', :guest, :forbidden
+        end
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+        end
+      end
+    end
+  end
+
+  describe 'DELETE /api/v4/packages/npm/-/package/*package_name/dist-tags/:tag' do
+    let_it_be(:package_tag) { create(:packages_tag, package: package) }
+
+    let(:package_name) { package.name }
+    let(:tag_name) { package_tag.name }
+    let(:url) { "/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}" }
+
+    subject { delete api(url) }
+
+    context 'without the need for a license' do
+      context 'with public project' do
+        context 'with authenticated user' do
+          subject { delete api(url, personal_access_token: personal_access_token) }
+
+          it_behaves_like 'delete package tag', :maintainer
+          it_behaves_like 'rejects package tags access', :developer, :forbidden
+          it_behaves_like 'rejects package tags access', :reporter, :forbidden
+          it_behaves_like 'rejects package tags access', :guest, :forbidden
+        end
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+        end
+      end
+
+      context 'with private project' do
+        before do
+          project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+        end
+
+        context 'with authenticated user' do
+          subject { delete api(url, personal_access_token: personal_access_token) }
+
+          it_behaves_like 'delete package tag', :maintainer
+          it_behaves_like 'rejects package tags access', :developer, :forbidden
+          it_behaves_like 'rejects package tags access', :reporter, :forbidden
+          it_behaves_like 'rejects package tags access', :guest, :forbidden
+        end
+
+        context 'with unauthenticated user' do
+          it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+        end
+      end
+    end
+  end
+
+  def expect_a_valid_package_response
+    expect(response).to have_gitlab_http_status(:ok)
+    expect(response.media_type).to eq('application/json')
+    expect(response).to match_response_schema('public_api/v4/packages/npm_package')
+    expect(json_response['name']).to eq(package.name)
+    expect(json_response['versions'][package.version]).to match_schema('public_api/v4/packages/npm_package_version')
+    ::Packages::Npm::PackagePresenter::NPM_VALID_DEPENDENCY_TYPES.each do |dependency_type|
+      expect(json_response.dig('versions', package.version, dependency_type.to_s)).to be_any
+    end
+    expect(json_response['dist-tags']).to match_schema('public_api/v4/packages/npm_package_tags')
+  end
+end
diff --git a/spec/requests/api/nuget_packages_spec.rb b/spec/requests/api/nuget_packages_spec.rb
new file mode 100644
index 00000000000..43aa65d1f76
--- /dev/null
+++ b/spec/requests/api/nuget_packages_spec.rb
@@ -0,0 +1,482 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe API::NugetPackages do
+  include WorkhorseHelpers
+  include PackagesManagerApiSpecHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project, reload: true) { create(:project, :public) }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
+  let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
+
+  describe 'GET /api/v4/projects/:id/packages/nuget' do
+    let(:url) { "/projects/#{project.id}/packages/nuget/index.json" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget service index request'   | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process nuget service index request'   | :success
+          'PUBLIC'  | :developer  | true  | false | 'process nuget service index request'   | :success
+          'PUBLIC'  | :guest      | true  | false | 'process nuget service index request'   | :success
+          'PUBLIC'  | :developer  | false | true  | 'process nuget service index request'   | :success
+          'PUBLIC'  | :guest      | false | true  | 'process nuget service index request'   | :success
+          'PUBLIC'  | :developer  | false | false | 'process nuget service index request'   | :success
+          'PUBLIC'  | :guest      | false | false | 'process nuget service index request'   | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'process nuget service index request'   | :success
+          'PRIVATE' | :developer  | true  | true  | 'process nuget service index request'   | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access'         | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access'         | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access'         | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access'         | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package GET requests'
+
+      it_behaves_like 'rejects nuget access with unknown project id'
+
+      it_behaves_like 'rejects nuget access with invalid project id'
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/nuget/authorize' do
+    let_it_be(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+    let_it_be(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+    let(:url) { "/projects/#{project.id}/packages/nuget/authorize" }
+    let(:headers) { {} }
+
+    subject { put api(url), headers: headers }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget workhorse authorization' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'rejects nuget packages access'         | :forbidden
+          'PUBLIC'  | :developer  | true  | false | 'rejects nuget packages access'         | :unauthorized
+          'PUBLIC'  | :guest      | true  | false | 'rejects nuget packages access'         | :unauthorized
+          'PUBLIC'  | :developer  | false | true  | 'rejects nuget packages access'         | :forbidden
+          'PUBLIC'  | :guest      | false | true  | 'rejects nuget packages access'         | :forbidden
+          'PUBLIC'  | :developer  | false | false | 'rejects nuget packages access'         | :unauthorized
+          'PUBLIC'  | :guest      | false | false | 'rejects nuget packages access'         | :unauthorized
+          'PUBLIC'  | :anonymous  | false | true  | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :developer  | true  | true  | 'process nuget workhorse authorization' | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access'         | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access'         | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access'         | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access'         | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access'         | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:user_headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+          let(:headers) { user_headers.merge(workhorse_header) }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package uploads'
+
+      it_behaves_like 'rejects nuget access with unknown project id'
+
+      it_behaves_like 'rejects nuget access with invalid project id'
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/nuget' do
+    let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+    let(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+    let_it_be(:file_name) { 'package.nupkg' }
+    let(:url) { "/projects/#{project.id}/packages/nuget" }
+    let(:headers) { {} }
+    let(:params) { { package: temp_file(file_name) } }
+    let(:file_key) { :package }
+    let(:send_rewritten_field) { true }
+
+    subject do
+      workhorse_finalize(
+        api(url),
+        method: :put,
+        file_key: file_key,
+        params: params,
+        headers: headers,
+        send_rewritten_field: send_rewritten_field
+      )
+    end
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget upload'          | :created
+          'PUBLIC'  | :guest      | true  | true  | 'rejects nuget packages access' | :forbidden
+          'PUBLIC'  | :developer  | true  | false | 'rejects nuget packages access' | :unauthorized
+          'PUBLIC'  | :guest      | true  | false | 'rejects nuget packages access' | :unauthorized
+          'PUBLIC'  | :developer  | false | true  | 'rejects nuget packages access' | :forbidden
+          'PUBLIC'  | :guest      | false | true  | 'rejects nuget packages access' | :forbidden
+          'PUBLIC'  | :developer  | false | false | 'rejects nuget packages access' | :unauthorized
+          'PUBLIC'  | :guest      | false | false | 'rejects nuget packages access' | :unauthorized
+          'PUBLIC'  | :anonymous  | false | true  | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :developer  | true  | true  | 'process nuget upload'          | :created
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access' | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access' | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access' | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:user_headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+          let(:headers) { user_headers.merge(workhorse_header) }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package uploads'
+
+      it_behaves_like 'rejects nuget access with unknown project id'
+
+      it_behaves_like 'rejects nuget access with invalid project id'
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/index' do
+    include_context 'with expected presenters dependency groups'
+
+    let_it_be(:package_name) { 'Dummy.Package' }
+    let_it_be(:packages) { create_list(:nuget_package, 5, :with_metadatum, name: package_name, project: project) }
+    let_it_be(:tags) { packages.each { |pkg| create(:packages_tag, package: pkg, name: 'test') } }
+    let(:url) { "/projects/#{project.id}/packages/nuget/metadata/#{package_name}/index.json" }
+
+    subject { get api(url) }
+
+    before do
+      packages.each { |pkg| create_dependencies_for(pkg) }
+    end
+
+    context 'without the need for license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :developer  | true  | false | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :guest      | true  | false | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :developer  | false | true  | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :guest      | false | true  | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :developer  | false | false | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :guest      | false | false | 'process nuget metadata request at package name level' | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'process nuget metadata request at package name level' | :success
+          'PRIVATE' | :developer  | true  | true  | 'process nuget metadata request at package name level' | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access'                        | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access'                        | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access'                        | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access'                        | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access'                        | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access'                        | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access'                        | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access'                        | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+
+        it_behaves_like 'deploy token for package GET requests'
+
+        it_behaves_like 'rejects nuget access with unknown project id'
+
+        it_behaves_like 'rejects nuget access with invalid project id'
+      end
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/nuget/metadata/*package_name/*package_version' do
+    include_context 'with expected presenters dependency groups'
+
+    let_it_be(:package_name) { 'Dummy.Package' }
+    let_it_be(:package) { create(:nuget_package, :with_metadatum, name: 'Dummy.Package', project: project) }
+    let_it_be(:tag) { create(:packages_tag, package: package, name: 'test') }
+    let(:url) { "/projects/#{project.id}/packages/nuget/metadata/#{package_name}/#{package.version}.json" }
+
+    subject { get api(url) }
+
+    before do
+      create_dependencies_for(package)
+    end
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :developer  | true  | false | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :guest      | true  | false | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :developer  | false | true  | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :guest      | false | true  | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :developer  | false | false | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :guest      | false | false | 'process nuget metadata request at package name and package version level' | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'process nuget metadata request at package name and package version level' | :success
+          'PRIVATE' | :developer  | true  | true  | 'process nuget metadata request at package name and package version level' | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access'                                            | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access'                                            | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access'                                            | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access'                                            | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access'                                            | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access'                                            | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access'                                            | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access'                                            | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package GET requests'
+
+      context 'with invalid package name' do
+        let_it_be(:package_name) { 'Unkown' }
+
+        it_behaves_like 'rejects nuget packages access', :developer, :not_found
+      end
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/nuget/download/*package_name/index' do
+    let_it_be(:package_name) { 'Dummy.Package' }
+    let_it_be(:packages) { create_list(:nuget_package, 5, name: package_name, project: project) }
+    let(:url) { "/projects/#{project.id}/packages/nuget/download/#{package_name}/index.json" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :developer  | true  | false | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :guest      | true  | false | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :developer  | false | true  | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :guest      | false | true  | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :developer  | false | false | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :guest      | false | false | 'process nuget download versions request'   | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'process nuget download versions request'   | :success
+          'PRIVATE' | :developer  | true  | true  | 'process nuget download versions request'   | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access'             | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access'             | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access'             | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access'             | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access'             | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access'             | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access'             | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access'             | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package GET requests'
+
+      it_behaves_like 'rejects nuget access with unknown project id'
+
+      it_behaves_like 'rejects nuget access with invalid project id'
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/nuget/download/*package_name/*package_version/*package_filename' do
+    let_it_be(:package_name) { 'Dummy.Package' }
+    let_it_be(:package) { create(:nuget_package, project: project, name: package_name) }
+
+    let(:url) { "/projects/#{project.id}/packages/nuget/download/#{package.name}/#{package.version}/#{package.name}.#{package.version}.nupkg" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget download content request'   | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process nuget download content request'   | :success
+          'PUBLIC'  | :developer  | true  | false | 'process nuget download content request'   | :success
+          'PUBLIC'  | :guest      | true  | false | 'process nuget download content request'   | :success
+          'PUBLIC'  | :developer  | false | true  | 'process nuget download content request'   | :success
+          'PUBLIC'  | :guest      | false | true  | 'process nuget download content request'   | :success
+          'PUBLIC'  | :developer  | false | false | 'process nuget download content request'   | :success
+          'PUBLIC'  | :guest      | false | false | 'process nuget download content request'   | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'process nuget download content request'   | :success
+          'PRIVATE' | :developer  | true  | true  | 'process nuget download content request'   | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access'            | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access'            | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access'            | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access'            | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access'            | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access'            | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access'            | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access'            | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package GET requests'
+
+      it_behaves_like 'rejects nuget access with unknown project id'
+
+      it_behaves_like 'rejects nuget access with invalid project id'
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/nuget/query' do
+    let_it_be(:package_a) { create(:nuget_package, :with_metadatum, name: 'Dummy.PackageA', project: project) }
+    let_it_be(:tag) { create(:packages_tag, package: package_a, name: 'test') }
+    let_it_be(:packages_b) { create_list(:nuget_package, 5, name: 'Dummy.PackageB', project: project) }
+    let_it_be(:packages_c) { create_list(:nuget_package, 5, name: 'Dummy.PackageC', project: project) }
+    let_it_be(:package_d) { create(:nuget_package, name: 'Dummy.PackageD', version: '5.0.5-alpha', project: project) }
+    let_it_be(:package_e) { create(:nuget_package, name: 'Foo.BarE', project: project) }
+    let(:search_term) { 'uMmy' }
+    let(:take) { 26 }
+    let(:skip) { 0 }
+    let(:include_prereleases) { true }
+    let(:query_parameters) { { q: search_term, take: take, skip: skip, prerelease: include_prereleases } }
+    let(:url) { "/projects/#{project.id}/packages/nuget/query?#{query_parameters.to_query}" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process nuget search request'  | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process nuget search request'  | :success
+          'PUBLIC'  | :developer  | true  | false | 'process nuget search request'  | :success
+          'PUBLIC'  | :guest      | true  | false | 'process nuget search request'  | :success
+          'PUBLIC'  | :developer  | false | true  | 'process nuget search request'  | :success
+          'PUBLIC'  | :guest      | false | true  | 'process nuget search request'  | :success
+          'PUBLIC'  | :developer  | false | false | 'process nuget search request'  | :success
+          'PUBLIC'  | :guest      | false | false | 'process nuget search request'  | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'process nuget search request'  | :success
+          'PRIVATE' | :developer  | true  | true  | 'process nuget search request'  | :success
+          'PRIVATE' | :guest      | true  | true  | 'rejects nuget packages access' | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'rejects nuget packages access' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'rejects nuget packages access' | :not_found
+          'PRIVATE' | :developer  | false | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'rejects nuget packages access' | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'rejects nuget packages access' | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package GET requests'
+
+      it_behaves_like 'rejects nuget access with unknown project id'
+
+      it_behaves_like 'rejects nuget access with invalid project id'
+    end
+  end
+end
diff --git a/spec/requests/api/oauth_tokens_spec.rb b/spec/requests/api/oauth_tokens_spec.rb
index 5e775841f12..f5971054b3c 100644
--- a/spec/requests/api/oauth_tokens_spec.rb
+++ b/spec/requests/api/oauth_tokens_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'OAuth tokens' do
+RSpec.describe 'OAuth tokens' do
   include HttpBasicAuthHelpers
 
   context 'Resource Owner Password Credentials' do
diff --git a/spec/requests/api/package_files_spec.rb b/spec/requests/api/package_files_spec.rb
new file mode 100644
index 00000000000..11170066d6e
--- /dev/null
+++ b/spec/requests/api/package_files_spec.rb
@@ -0,0 +1,81 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::PackageFiles do
+  let(:user) { create(:user) }
+  let(:project) { create(:project, :public) }
+  let(:package) { create(:maven_package, project: project) }
+
+  before do
+    project.add_developer(user)
+  end
+
+  describe 'GET /projects/:id/packages/:package_id/package_files' do
+    let(:url) { "/projects/#{project.id}/packages/#{package.id}/package_files" }
+
+    context 'without the need for a license' do
+      context 'project is public' do
+        it 'returns 200' do
+          get api(url)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        it 'returns 404 if package does not exist' do
+          get api("/projects/#{project.id}/packages/0/package_files")
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+
+      context 'project is private' do
+        let(:project) { create(:project, :private) }
+
+        it 'returns 404 for non authenticated user' do
+          get api(url)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 404 for a user without access to the project' do
+          project.team.truncate
+
+          get api(url, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 200 and valid response schema' do
+          get api(url, user)
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('public_api/v4/packages/package_files')
+        end
+      end
+
+      context 'with pagination params' do
+        let(:per_page) { 2 }
+        let!(:package_file_1) { package.package_files[0] }
+        let!(:package_file_2) { package.package_files[1] }
+        let!(:package_file_3) { package.package_files[2] }
+
+        context 'when viewing the first page' do
+          it 'returns first 2 packages' do
+            get api(url, user), params: { page: 1, per_page: per_page }
+
+            expect_paginated_array_response([package_file_1.id, package_file_2.id])
+          end
+        end
+
+        context 'viewing the second page' do
+          it 'returns the last package' do
+            get api(url, user), params: { page: 2, per_page: per_page }
+
+            expect_paginated_array_response([package_file_3.id])
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/pages/internal_access_spec.rb b/spec/requests/api/pages/internal_access_spec.rb
index ee55d1c54b7..c894a2d3ca4 100644
--- a/spec/requests/api/pages/internal_access_spec.rb
+++ b/spec/requests/api/pages/internal_access_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe "Internal Project Pages Access" do
+RSpec.describe "Internal Project Pages Access" do
   using RSpec::Parameterized::TableSyntax
   include AccessMatchers
 
diff --git a/spec/requests/api/pages/pages_spec.rb b/spec/requests/api/pages/pages_spec.rb
index 62d43ecff16..53e732928ff 100644
--- a/spec/requests/api/pages/pages_spec.rb
+++ b/spec/requests/api/pages/pages_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Pages do
+RSpec.describe API::Pages do
   let_it_be(:project) { create(:project, path: 'my.project', pages_https_only: false) }
   let_it_be(:admin) { create(:admin) }
   let_it_be(:user) { create(:user) }
diff --git a/spec/requests/api/pages/private_access_spec.rb b/spec/requests/api/pages/private_access_spec.rb
index 146c6a389f3..ea5db691b14 100644
--- a/spec/requests/api/pages/private_access_spec.rb
+++ b/spec/requests/api/pages/private_access_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe "Private Project Pages Access" do
+RSpec.describe "Private Project Pages Access" do
   using RSpec::Parameterized::TableSyntax
   include AccessMatchers
 
diff --git a/spec/requests/api/pages/public_access_spec.rb b/spec/requests/api/pages/public_access_spec.rb
index 7d929e2a287..ae73cee91d5 100644
--- a/spec/requests/api/pages/public_access_spec.rb
+++ b/spec/requests/api/pages/public_access_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe "Public Project Pages Access" do
+RSpec.describe "Public Project Pages Access" do
   using RSpec::Parameterized::TableSyntax
   include AccessMatchers
 
diff --git a/spec/requests/api/pages_domains_spec.rb b/spec/requests/api/pages_domains_spec.rb
index 8c411233b27..b6838a39257 100644
--- a/spec/requests/api/pages_domains_spec.rb
+++ b/spec/requests/api/pages_domains_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::PagesDomains do
+RSpec.describe API::PagesDomains do
   let_it_be(:project) { create(:project, path: 'my.project', pages_https_only: false) }
   let_it_be(:user) { create(:user) }
   let_it_be(:admin) { create(:admin) }
diff --git a/spec/requests/api/project_clusters_spec.rb b/spec/requests/api/project_clusters_spec.rb
index ed899e830e1..ff35e380476 100644
--- a/spec/requests/api/project_clusters_spec.rb
+++ b/spec/requests/api/project_clusters_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectClusters do
+RSpec.describe API::ProjectClusters do
   include KubernetesHelpers
 
   let_it_be(:current_user) { create(:user) }
@@ -40,7 +40,7 @@ describe API::ProjectClusters do
         expect(response).to include_pagination_headers
       end
 
-      it 'onlies include authorized clusters' do
+      it 'only includes authorized clusters' do
         cluster_ids = json_response.map { |cluster| cluster['id'] }
 
         expect(response).to have_gitlab_http_status(:ok)
@@ -258,29 +258,52 @@ describe API::ProjectClusters do
       end
     end
 
-    context 'when user tries to add multiple clusters' do
+    context 'non-authorized user' do
       before do
-        create(:cluster, :provided_by_gcp, :project,
-               projects: [project])
-
-        post api("/projects/#{project.id}/clusters/user", current_user), params: cluster_params
+        post api("/projects/#{project.id}/clusters/user", developer_user), params: cluster_params
       end
 
-      it 'responds with 400' do
-        expect(response).to have_gitlab_http_status(:bad_request)
-        expect(json_response['message']['base'].first)
-          .to eq(_('Instance does not support multiple Kubernetes clusters'))
+      it 'responds with 403' do
+        expect(response).to have_gitlab_http_status(:forbidden)
+        expect(json_response['message']).to eq('403 Forbidden')
       end
     end
+  end
 
-    context 'non-authorized user' do
+  describe 'POST /projects/:id/clusters/user with multiple clusters' do
+    let(:api_url) { 'https://kubernetes.example.com' }
+    let(:namespace) { project.path }
+
+    let(:platform_kubernetes_attributes) do
+      {
+        api_url: api_url,
+        token: 'sample-token',
+        namespace: namespace
+      }
+    end
+
+    let(:cluster_params) do
+      {
+        name: 'test-cluster',
+        environment_scope: 'production/*',
+        platform_kubernetes_attributes: platform_kubernetes_attributes
+      }
+    end
+
+    context 'when another cluster exists' do
       before do
-        post api("/projects/#{project.id}/clusters/user", developer_user), params: cluster_params
+        create(:cluster, :provided_by_gcp, :project,
+               projects: [project])
+
+        post api("/projects/#{project.id}/clusters/user", current_user), params: cluster_params
       end
 
-      it 'responds with 403' do
-        expect(response).to have_gitlab_http_status(:forbidden)
-        expect(json_response['message']).to eq('403 Forbidden')
+      it 'responds with 201' do
+        expect(response).to have_gitlab_http_status(:created)
+      end
+
+      it 'allows multiple clusters to be associated to project' do
+        expect(project.reload.clusters.count).to eq(2)
       end
     end
   end
diff --git a/spec/requests/api/project_container_repositories_spec.rb b/spec/requests/api/project_container_repositories_spec.rb
index 471fc99117b..6cf0619cde4 100644
--- a/spec/requests/api/project_container_repositories_spec.rb
+++ b/spec/requests/api/project_container_repositories_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectContainerRepositories do
+RSpec.describe API::ProjectContainerRepositories do
   include ExclusiveLeaseHelpers
 
   let_it_be(:project) { create(:project, :private) }
diff --git a/spec/requests/api/project_events_spec.rb b/spec/requests/api/project_events_spec.rb
index f65c62f9402..f3e592f9796 100644
--- a/spec/requests/api/project_events_spec.rb
+++ b/spec/requests/api/project_events_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectEvents do
+RSpec.describe API::ProjectEvents do
   let(:user) { create(:user) }
   let(:non_member) { create(:user) }
   let(:private_project) { create(:project, :private, creator_id: user.id, namespace: user.namespace) }
diff --git a/spec/requests/api/project_export_spec.rb b/spec/requests/api/project_export_spec.rb
index 58034322a13..d7ba3b4e158 100644
--- a/spec/requests/api/project_export_spec.rb
+++ b/spec/requests/api/project_export_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectExport, :clean_gitlab_redis_cache do
+RSpec.describe API::ProjectExport, :clean_gitlab_redis_cache do
   let_it_be(:project) { create(:project) }
   let_it_be(:project_none) { create(:project) }
   let_it_be(:project_started) { create(:project) }
@@ -237,7 +237,7 @@ describe API::ProjectExport, :clean_gitlab_redis_cache do
           before do
             allow(Gitlab::ApplicationRateLimiter)
               .to receive(:increment)
-              .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:project_download_export][:threshold] + 1)
+              .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:project_download_export][:threshold].call + 1)
           end
 
           it 'prevents requesting project export' do
@@ -362,7 +362,7 @@ describe API::ProjectExport, :clean_gitlab_redis_cache do
           before do
             allow(Gitlab::ApplicationRateLimiter)
               .to receive(:increment)
-              .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:project_export][:threshold] + 1)
+              .and_return(Gitlab::ApplicationRateLimiter.rate_limits[:project_export][:threshold].call + 1)
           end
 
           it 'prevents requesting project export' do
diff --git a/spec/requests/api/project_hooks_spec.rb b/spec/requests/api/project_hooks_spec.rb
index 4474f2f0577..8ab90e26a51 100644
--- a/spec/requests/api/project_hooks_spec.rb
+++ b/spec/requests/api/project_hooks_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectHooks, 'ProjectHooks' do
+RSpec.describe API::ProjectHooks, 'ProjectHooks' do
   let(:user) { create(:user) }
   let(:user3) { create(:user) }
   let!(:project) { create(:project, creator_id: user.id, namespace: user.namespace) }
diff --git a/spec/requests/api/project_import_spec.rb b/spec/requests/api/project_import_spec.rb
index 563acd0ece4..a6ae636996e 100644
--- a/spec/requests/api/project_import_spec.rb
+++ b/spec/requests/api/project_import_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectImport do
+RSpec.describe API::ProjectImport do
   include WorkhorseHelpers
 
   let(:user) { create(:user) }
diff --git a/spec/requests/api/project_milestones_spec.rb b/spec/requests/api/project_milestones_spec.rb
index c5911d51706..b238949ce47 100644
--- a/spec/requests/api/project_milestones_spec.rb
+++ b/spec/requests/api/project_milestones_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectMilestones do
+RSpec.describe API::ProjectMilestones do
   let(:user) { create(:user) }
   let!(:project) { create(:project, namespace: user.namespace ) }
   let!(:closed_milestone) { create(:closed_milestone, project: project, title: 'version1', description: 'closed milestone') }
diff --git a/spec/requests/api/project_packages_spec.rb b/spec/requests/api/project_packages_spec.rb
new file mode 100644
index 00000000000..0ece3bff8f9
--- /dev/null
+++ b/spec/requests/api/project_packages_spec.rb
@@ -0,0 +1,272 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::ProjectPackages do
+  let(:user) { create(:user) }
+  let_it_be(:project) { create(:project, :public) }
+  let!(:package1) { create(:npm_package, project: project, version: '3.1.0', name: "@#{project.root_namespace.path}/foo1") }
+  let(:package_url) { "/projects/#{project.id}/packages/#{package1.id}" }
+  let!(:package2) { create(:nuget_package, project: project, version: '2.0.4') }
+  let!(:another_package) { create(:npm_package) }
+  let(:no_package_url) { "/projects/#{project.id}/packages/0" }
+  let(:wrong_package_url) { "/projects/#{project.id}/packages/#{another_package.id}" }
+
+  describe 'GET /projects/:id/packages' do
+    let(:url) { "/projects/#{project.id}/packages" }
+    let(:package_schema) { 'public_api/v4/packages/packages' }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'project is public' do
+        it_behaves_like 'returns packages', :project, :no_type
+      end
+
+      context 'project is private' do
+        let(:project) { create(:project, :private) }
+
+        context 'for unauthenticated user' do
+          it_behaves_like 'rejects packages access', :project, :no_type, :not_found
+        end
+
+        context 'for authenticated user' do
+          subject { get api(url, user) }
+
+          it_behaves_like 'returns packages', :project, :maintainer
+          it_behaves_like 'returns packages', :project, :developer
+          it_behaves_like 'returns packages', :project, :reporter
+          it_behaves_like 'rejects packages access', :project, :no_type, :not_found
+          it_behaves_like 'rejects packages access', :project, :guest, :forbidden
+
+          context 'user is a maintainer' do
+            before do
+              project.add_maintainer(user)
+            end
+
+            it 'returns the destroy url' do
+              subject
+
+              expect(json_response.first['_links']).to include('delete_api_path')
+            end
+          end
+        end
+      end
+
+      context 'with pagination params' do
+        let!(:package3) { create(:maven_package, project: project) }
+        let!(:package4) { create(:maven_package, project: project) }
+
+        context 'with pagination params' do
+          let!(:package3) { create(:npm_package, project: project) }
+          let!(:package4) { create(:npm_package, project: project) }
+
+          it_behaves_like 'returns paginated packages'
+        end
+      end
+
+      context 'with sorting' do
+        let(:package3) { create(:maven_package, project: project, version: '1.1.1', name: 'zzz') }
+
+        before do
+          travel_to(1.day.ago) do
+            package3
+          end
+        end
+
+        it_behaves_like 'package sorting', 'name' do
+          let(:packages) { [package1, package2, package3] }
+        end
+
+        it_behaves_like 'package sorting', 'created_at' do
+          let(:packages) { [package3, package1, package2] }
+        end
+
+        it_behaves_like 'package sorting', 'version' do
+          let(:packages) { [package3, package2, package1] }
+        end
+
+        it_behaves_like 'package sorting', 'type' do
+          let(:packages) { [package3, package1, package2] }
+        end
+      end
+
+      it_behaves_like 'filters on each package_type', is_project: true
+
+      context 'filtering on package_name' do
+        include_context 'package filter context'
+
+        it 'returns the named package' do
+          url = package_filter_url(:name, 'nuget')
+          get api(url, user)
+
+          expect(json_response.length).to eq(1)
+          expect(json_response.first['name']).to include(package2.name)
+        end
+      end
+    end
+  end
+
+  describe 'GET /projects/:id/packages/:package_id' do
+    subject { get api(package_url, user) }
+
+    shared_examples 'no destroy url' do
+      it 'returns no destroy url' do
+        subject
+
+        expect(json_response['_links']).not_to include('delete_api_path')
+      end
+    end
+
+    shared_examples 'destroy url' do
+      it 'returns destroy url' do
+        subject
+
+        expect(json_response['_links']['delete_api_path']).to be_present
+      end
+    end
+
+    context 'without the need for a license' do
+      context 'project is public' do
+        it 'returns 200 and the package information' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to match_response_schema('public_api/v4/packages/package')
+        end
+
+        it 'returns 404 when the package does not exist' do
+          get api(no_package_url, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 404 for the package from a different project' do
+          get api(wrong_package_url, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it_behaves_like 'no destroy url'
+      end
+
+      context 'project is private' do
+        let(:project) { create(:project, :private) }
+
+        it 'returns 404 for non authenticated user' do
+          get api(package_url)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 404 for a user without access to the project' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        context 'user is a developer' do
+          before do
+            project.add_developer(user)
+          end
+
+          it 'returns 200 and the package information' do
+            subject
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to match_response_schema('public_api/v4/packages/package')
+          end
+
+          it_behaves_like 'no destroy url'
+        end
+
+        context 'user is a maintainer' do
+          before do
+            project.add_maintainer(user)
+          end
+
+          it_behaves_like 'destroy url'
+        end
+
+        context 'with pipeline' do
+          let!(:package1) { create(:npm_package, :with_build, project: project) }
+
+          it 'returns the pipeline info' do
+            project.add_developer(user)
+
+            get api(package_url, user)
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(response).to match_response_schema('public_api/v4/packages/package_with_build')
+          end
+        end
+      end
+    end
+  end
+
+  describe 'DELETE /projects/:id/packages/:package_id' do
+    context 'without the need for a license' do
+      context 'project is public' do
+        it 'returns 403 for non authenticated user' do
+          delete api(package_url)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+
+        it 'returns 403 for a user without access to the project' do
+          delete api(package_url, user)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
+      context 'project is private' do
+        let(:project) { create(:project, :private) }
+
+        it 'returns 404 for non authenticated user' do
+          delete api(package_url)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 404 for a user without access to the project' do
+          delete api(package_url, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 404 when the package does not exist' do
+          project.add_maintainer(user)
+
+          delete api(no_package_url, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 404 for the package from a different project' do
+          project.add_maintainer(user)
+
+          delete api(wrong_package_url, user)
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+
+        it 'returns 403 for a user without enough permissions' do
+          project.add_developer(user)
+
+          delete api(package_url, user)
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+
+        it 'returns 204' do
+          project.add_maintainer(user)
+
+          delete api(package_url, user)
+
+          expect(response).to have_gitlab_http_status(:no_content)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/project_repository_storage_moves_spec.rb b/spec/requests/api/project_repository_storage_moves_spec.rb
index 40966e31d0d..4c9e058ef13 100644
--- a/spec/requests/api/project_repository_storage_moves_spec.rb
+++ b/spec/requests/api/project_repository_storage_moves_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectRepositoryStorageMoves do
+RSpec.describe API::ProjectRepositoryStorageMoves do
   include AccessMatchersForRequest
 
   let_it_be(:user) { create(:admin) }
diff --git a/spec/requests/api/project_snapshots_spec.rb b/spec/requests/api/project_snapshots_spec.rb
index a54f317782b..f23e374407b 100644
--- a/spec/requests/api/project_snapshots_spec.rb
+++ b/spec/requests/api/project_snapshots_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectSnapshots do
+RSpec.describe API::ProjectSnapshots do
   include WorkhorseHelpers
 
   let(:project) { create(:project) }
diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb
index 22189dc3299..fbb0e3e109f 100644
--- a/spec/requests/api/project_snippets_spec.rb
+++ b/spec/requests/api/project_snippets_spec.rb
@@ -2,7 +2,9 @@
 
 require 'spec_helper'
 
-describe API::ProjectSnippets do
+RSpec.describe API::ProjectSnippets do
+  include SnippetHelpers
+
   let_it_be(:project) { create(:project, :public) }
   let_it_be(:user) { create(:user) }
   let_it_be(:admin) { create(:admin) }
@@ -84,19 +86,22 @@ describe API::ProjectSnippets do
   end
 
   describe 'GET /projects/:project_id/snippets/:id' do
-    let(:user) { create(:user) }
-    let(:snippet) { create(:project_snippet, :public, :repository, project: project) }
+    let_it_be(:user) { create(:user) }
+    let_it_be(:snippet) { create(:project_snippet, :public, :repository, project: project) }
 
     it 'returns snippet json' do
       get api("/projects/#{project.id}/snippets/#{snippet.id}", user)
 
-      expect(response).to have_gitlab_http_status(:ok)
+      aggregate_failures do
+        expect(response).to have_gitlab_http_status(:ok)
 
-      expect(json_response['title']).to eq(snippet.title)
-      expect(json_response['description']).to eq(snippet.description)
-      expect(json_response['file_name']).to eq(snippet.file_name_on_repo)
-      expect(json_response['ssh_url_to_repo']).to eq(snippet.ssh_url_to_repo)
-      expect(json_response['http_url_to_repo']).to eq(snippet.http_url_to_repo)
+        expect(json_response['title']).to eq(snippet.title)
+        expect(json_response['description']).to eq(snippet.description)
+        expect(json_response['file_name']).to eq(snippet.file_name_on_repo)
+        expect(json_response['files']).to eq(snippet.blobs.map { |blob| snippet_blob_file(blob) } )
+        expect(json_response['ssh_url_to_repo']).to eq(snippet.ssh_url_to_repo)
+        expect(json_response['http_url_to_repo']).to eq(snippet.http_url_to_repo)
+      end
     end
 
     it 'returns 404 for invalid snippet id' do
@@ -111,6 +116,10 @@ describe API::ProjectSnippets do
         let(:request) { get api("/projects/#{project_no_snippets.id}/snippets/123", user) }
       end
     end
+
+    it_behaves_like 'snippet_multiple_files feature disabled' do
+      subject { get api("/projects/#{project.id}/snippets/#{snippet.id}", user) }
+    end
   end
 
   describe 'POST /projects/:project_id/snippets/' do
@@ -443,7 +452,7 @@ describe API::ProjectSnippets do
       get api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/raw", admin)
 
       expect(response).to have_gitlab_http_status(:ok)
-      expect(response.content_type).to eq 'text/plain'
+      expect(response.media_type).to eq 'text/plain'
     end
 
     it 'returns 404 for invalid snippet id' do
@@ -465,4 +474,12 @@ describe API::ProjectSnippets do
       subject { get api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/raw", snippet.author) }
     end
   end
+
+  describe 'GET /projects/:project_id/snippets/:id/files/:ref/:file_path/raw' do
+    let_it_be(:snippet) { create(:project_snippet, :repository, author: admin, project: project) }
+
+    it_behaves_like 'raw snippet files' do
+      let(:api_path) { "/projects/#{snippet.project.id}/snippets/#{snippet_id}/files/#{ref}/#{file_path}/raw" }
+    end
+  end
 end
diff --git a/spec/requests/api/project_statistics_spec.rb b/spec/requests/api/project_statistics_spec.rb
index 89809a97b96..5f0cac403aa 100644
--- a/spec/requests/api/project_statistics_spec.rb
+++ b/spec/requests/api/project_statistics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectStatistics do
+RSpec.describe API::ProjectStatistics do
   let_it_be(:developer) { create(:user) }
   let_it_be(:public_project) { create(:project, :public) }
 
diff --git a/spec/requests/api/project_templates_spec.rb b/spec/requests/api/project_templates_spec.rb
index caeb465080e..59b2b09f0bf 100644
--- a/spec/requests/api/project_templates_spec.rb
+++ b/spec/requests/api/project_templates_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProjectTemplates do
+RSpec.describe API::ProjectTemplates do
   let_it_be(:public_project) { create(:project, :public, path: 'path.with.dot') }
   let_it_be(:private_project) { create(:project, :private) }
   let_it_be(:developer) { create(:user) }
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index c3f29ec47a9..76b0c04e32d 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-shared_examples 'languages and percentages JSON response' do
+RSpec.shared_examples 'languages and percentages JSON response' do
   let(:expected_languages) { project.repository.languages.map { |language| language.values_at(:label, :value)}.to_h }
 
   before do
@@ -46,7 +46,7 @@ shared_examples 'languages and percentages JSON response' do
   end
 end
 
-describe API::Projects do
+RSpec.describe API::Projects do
   include ProjectForksHelper
 
   let(:user) { create(:user) }
@@ -254,7 +254,10 @@ describe API::Projects do
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an Array
-        expect(json_response.first).to include 'statistics'
+
+        statistics = json_response.first['statistics']
+        expect(statistics).to be_present
+        expect(statistics).to include('commit_count', 'storage_size', 'repository_size', 'wiki_size', 'lfs_objects_size', 'job_artifacts_size', 'snippets_size')
       end
 
       it "does not include license by default" do
@@ -584,6 +587,85 @@ describe API::Projects do
       end
     end
 
+    context 'sorting by project statistics' do
+      %w(repository_size storage_size wiki_size).each do |order_by|
+        context "sorting by #{order_by}" do
+          before do
+            ProjectStatistics.update_all(order_by => 100)
+            project4.statistics.update_columns(order_by => 10)
+            project.statistics.update_columns(order_by => 200)
+          end
+
+          context 'admin user' do
+            let(:current_user) { admin }
+
+            context "when sorting by #{order_by} ascendingly" do
+              it 'returns a properly sorted list of projects' do
+                get api('/projects', current_user), params: { order_by: order_by, sort: :asc }
+
+                expect(response).to have_gitlab_http_status(:ok)
+                expect(response).to include_pagination_headers
+                expect(json_response).to be_an Array
+                expect(json_response.first['id']).to eq(project4.id)
+              end
+            end
+
+            context "when sorting by #{order_by} descendingly" do
+              it 'returns a properly sorted list of projects' do
+                get api('/projects', current_user), params: { order_by: order_by, sort: :desc }
+
+                expect(response).to have_gitlab_http_status(:ok)
+                expect(response).to include_pagination_headers
+                expect(json_response).to be_an Array
+                expect(json_response.first['id']).to eq(project.id)
+              end
+            end
+          end
+
+          context 'non-admin user' do
+            let(:current_user) { user }
+            let(:projects) { [public_project, project, project2, project3] }
+
+            it 'returns projects ordered normally' do
+              get api('/projects', current_user), params: { order_by: order_by }
+
+              expect(response).to have_gitlab_http_status(:ok)
+              expect(response).to include_pagination_headers
+              expect(json_response).to be_an Array
+              expect(json_response.map { |project| project['id'] }).to eq(projects.map(&:id).reverse)
+            end
+          end
+        end
+      end
+    end
+
+    context 'filtering by repository_storage' do
+      before do
+        [project, project3].each { |proj| proj.update_columns(repository_storage: 'nfs-11') }
+        # Since we don't actually have Gitaly configured with an nfs-11 storage, an error would be raised
+        # when we present the projects in a response, as we ask Gitaly for stuff like default branch and Gitaly
+        # is not configured for a nfs-11 storage. So we trick Rails into thinking the storage for these projects
+        # is still default (in reality, it is).
+        allow_any_instance_of(Project).to receive(:repository_storage).and_return('default')
+      end
+
+      context 'admin user' do
+        it_behaves_like 'projects response' do
+          let(:filter) { { repository_storage: 'nfs-11' } }
+          let(:current_user) { admin }
+          let(:projects) { [project, project3] }
+        end
+      end
+
+      context 'non-admin user' do
+        it_behaves_like 'projects response' do
+          let(:filter) { { repository_storage: 'nfs-11' } }
+          let(:current_user) { user }
+          let(:projects) { [public_project, project, project2, project3] }
+        end
+      end
+    end
+
     context 'with keyset pagination' do
       let(:current_user) { user }
       let(:projects) { [public_project, project, project2, project3] }
@@ -1846,6 +1928,13 @@ describe API::Projects do
         end
       end
     end
+
+    it 'exposes service desk attributes' do
+      get api("/projects/#{project.id}", user)
+
+      expect(json_response).to have_key 'service_desk_enabled'
+      expect(json_response).to have_key 'service_desk_address'
+    end
   end
 
   describe 'GET /projects/:id/users' do
@@ -2133,7 +2222,7 @@ describe API::Projects do
       expect(json_response['expires_at']).to eq(expires_at.to_s)
     end
 
-    it 'updates project authorization' do
+    it 'updates project authorization', :sidekiq_inline do
       expect do
         post api("/projects/#{project.id}/share", user), params: { group_id: group.id, group_access: Gitlab::Access::DEVELOPER }
       end.to(
@@ -2590,6 +2679,26 @@ describe API::Projects do
         end
       end
     end
+
+    context 'when updating service desk' do
+      subject { put(api("/projects/#{project.id}", user), params: { service_desk_enabled: true }) }
+
+      before do
+        project.update!(service_desk_enabled: false)
+
+        allow(::Gitlab::IncomingEmail).to receive(:enabled?).and_return(true)
+      end
+
+      it 'returns 200' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'enables the service_desk' do
+        expect { subject }.to change { project.reload.service_desk_enabled }.to(true)
+      end
+    end
   end
 
   describe 'POST /projects/:id/archive' do
diff --git a/spec/requests/api/protected_branches_spec.rb b/spec/requests/api/protected_branches_spec.rb
index 9203e0ec819..8bcd493eb1f 100644
--- a/spec/requests/api/protected_branches_spec.rb
+++ b/spec/requests/api/protected_branches_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProtectedBranches do
+RSpec.describe API::ProtectedBranches do
   let(:user) { create(:user) }
   let!(:project) { create(:project, :repository) }
   let(:protected_name) { 'feature' }
diff --git a/spec/requests/api/protected_tags_spec.rb b/spec/requests/api/protected_tags_spec.rb
index 3bc8ecbee73..cc7261dafc9 100644
--- a/spec/requests/api/protected_tags_spec.rb
+++ b/spec/requests/api/protected_tags_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ProtectedTags do
+RSpec.describe API::ProtectedTags do
   let(:user) { create(:user) }
   let!(:project) { create(:project, :repository) }
   let(:project2) { create(:project, path: 'project2', namespace: user.namespace) }
diff --git a/spec/requests/api/pypi_packages_spec.rb b/spec/requests/api/pypi_packages_spec.rb
new file mode 100644
index 00000000000..b4e83c8caab
--- /dev/null
+++ b/spec/requests/api/pypi_packages_spec.rb
@@ -0,0 +1,259 @@
+# frozen_string_literal: true
+require 'spec_helper'
+
+RSpec.describe API::PypiPackages do
+  include WorkhorseHelpers
+  include PackagesManagerApiSpecHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project, reload: true) { create(:project, :public) }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
+  let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
+
+  describe 'GET /api/v4/projects/:id/packages/pypi/simple/:package_name' do
+    let_it_be(:package) { create(:pypi_package, project: project) }
+    let(:url) { "/projects/#{project.id}/packages/pypi/simple/#{package.name}" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'PyPi package versions' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'PyPi package versions' | :success
+          'PUBLIC'  | :developer  | true  | false | 'PyPi package versions' | :success
+          'PUBLIC'  | :guest      | true  | false | 'PyPi package versions' | :success
+          'PUBLIC'  | :developer  | false | true  | 'PyPi package versions' | :success
+          'PUBLIC'  | :guest      | false | true  | 'PyPi package versions' | :success
+          'PUBLIC'  | :developer  | false | false | 'PyPi package versions' | :success
+          'PUBLIC'  | :guest      | false | false | 'PyPi package versions' | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'PyPi package versions' | :success
+          'PRIVATE' | :developer  | true  | true  | 'PyPi package versions' | :success
+          'PRIVATE' | :guest      | true  | true  | 'process PyPi api request' | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'process PyPi api request' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'process PyPi api request' | :not_found
+          'PRIVATE' | :developer  | false | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'process PyPi api request' | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package GET requests'
+
+      it_behaves_like 'rejects PyPI access with unknown project id'
+    end
+  end
+
+  describe 'POST /api/v4/projects/:id/packages/pypi/authorize' do
+    let_it_be(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+    let_it_be(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+    let(:url) { "/projects/#{project.id}/packages/pypi/authorize" }
+    let(:headers) { {} }
+
+    subject { post api(url), headers: headers }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'process PyPi api request' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'process PyPi api request' | :forbidden
+          'PUBLIC'  | :developer  | true  | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :guest      | true  | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :developer  | false | true  | 'process PyPi api request' | :forbidden
+          'PUBLIC'  | :guest      | false | true  | 'process PyPi api request' | :forbidden
+          'PUBLIC'  | :developer  | false | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :guest      | false | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :anonymous  | false | true  | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :developer  | true  | true  | 'process PyPi api request' | :success
+          'PRIVATE' | :guest      | true  | true  | 'process PyPi api request' | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'process PyPi api request' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'process PyPi api request' | :not_found
+          'PRIVATE' | :developer  | false | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'process PyPi api request' | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:user_headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+          let(:headers) { user_headers.merge(workhorse_header) }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      it_behaves_like 'deploy token for package uploads'
+
+      it_behaves_like 'rejects PyPI access with unknown project id'
+    end
+  end
+
+  describe 'POST /api/v4/projects/:id/packages/pypi' do
+    let(:workhorse_token) { JWT.encode({ 'iss' => 'gitlab-workhorse' }, Gitlab::Workhorse.secret, 'HS256') }
+    let(:workhorse_header) { { 'GitLab-Workhorse' => '1.0', Gitlab::Workhorse::INTERNAL_API_REQUEST_HEADER => workhorse_token } }
+    let_it_be(:file_name) { 'package.whl' }
+    let(:url) { "/projects/#{project.id}/packages/pypi" }
+    let(:headers) { {} }
+    let(:base_params) { { requires_python: '>=3.7', version: '1.0.0', name: 'sample-project', sha256_digest: '123' } }
+    let(:params) { base_params.merge(content: temp_file(file_name)) }
+    let(:send_rewritten_field) { true }
+
+    subject do
+      workhorse_finalize(
+        api(url),
+        method: :post,
+        file_key: :content,
+        params: params,
+        headers: headers,
+        send_rewritten_field: send_rewritten_field
+      )
+    end
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'PyPi package creation'    | :created
+          'PUBLIC'  | :guest      | true  | true  | 'process PyPi api request' | :forbidden
+          'PUBLIC'  | :developer  | true  | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :guest      | true  | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :developer  | false | true  | 'process PyPi api request' | :forbidden
+          'PUBLIC'  | :guest      | false | true  | 'process PyPi api request' | :forbidden
+          'PUBLIC'  | :developer  | false | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :guest      | false | false | 'process PyPi api request' | :unauthorized
+          'PUBLIC'  | :anonymous  | false | true  | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :developer  | true  | true  | 'process PyPi api request' | :created
+          'PRIVATE' | :guest      | true  | true  | 'process PyPi api request' | :forbidden
+          'PRIVATE' | :developer  | true  | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :guest      | true  | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :developer  | false | true  | 'process PyPi api request' | :not_found
+          'PRIVATE' | :guest      | false | true  | 'process PyPi api request' | :not_found
+          'PRIVATE' | :developer  | false | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :guest      | false | false | 'process PyPi api request' | :unauthorized
+          'PRIVATE' | :anonymous  | false | true  | 'process PyPi api request' | :unauthorized
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:user_headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+          let(:headers) { user_headers.merge(workhorse_header) }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      context 'with an invalid package' do
+        let(:token) { personal_access_token.token }
+        let(:user_headers) { build_basic_auth_header(user.username, token) }
+        let(:headers) { user_headers.merge(workhorse_header) }
+
+        before do
+          params[:name] = '.$/@!^*'
+          project.add_developer(user)
+        end
+
+        it_behaves_like 'returning response status', :bad_request
+      end
+
+      it_behaves_like 'deploy token for package uploads'
+
+      it_behaves_like 'rejects PyPI access with unknown project id'
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/pypi/files/:sha256/*file_identifier' do
+    let_it_be(:package_name) { 'Dummy-Package' }
+    let_it_be(:package) { create(:pypi_package, project: project, name: package_name, version: '1.0.0') }
+
+    let(:url) { "/projects/#{project.id}/packages/pypi/files/#{package.package_files.first.file_sha256}/#{package_name}-1.0.0.tar.gz" }
+
+    subject { get api(url) }
+
+    context 'without the need for a license' do
+      context 'with valid project' do
+        using RSpec::Parameterized::TableSyntax
+
+        where(:project_visibility_level, :user_role, :member, :user_token, :shared_examples_name, :expected_status) do
+          'PUBLIC'  | :developer  | true  | true  | 'PyPi package download' | :success
+          'PUBLIC'  | :guest      | true  | true  | 'PyPi package download' | :success
+          'PUBLIC'  | :developer  | true  | false | 'PyPi package download' | :success
+          'PUBLIC'  | :guest      | true  | false | 'PyPi package download' | :success
+          'PUBLIC'  | :developer  | false | true  | 'PyPi package download' | :success
+          'PUBLIC'  | :guest      | false | true  | 'PyPi package download' | :success
+          'PUBLIC'  | :developer  | false | false | 'PyPi package download' | :success
+          'PUBLIC'  | :guest      | false | false | 'PyPi package download' | :success
+          'PUBLIC'  | :anonymous  | false | true  | 'PyPi package download' | :success
+          'PRIVATE' | :developer  | true  | true  | 'PyPi package download' | :success
+          'PRIVATE' | :guest      | true  | true  | 'PyPi package download' | :success
+          'PRIVATE' | :developer  | true  | false | 'PyPi package download' | :success
+          'PRIVATE' | :guest      | true  | false | 'PyPi package download' | :success
+          'PRIVATE' | :developer  | false | true  | 'PyPi package download' | :success
+          'PRIVATE' | :guest      | false | true  | 'PyPi package download' | :success
+          'PRIVATE' | :developer  | false | false | 'PyPi package download' | :success
+          'PRIVATE' | :guest      | false | false | 'PyPi package download' | :success
+          'PRIVATE' | :anonymous  | false | true  | 'PyPi package download' | :success
+        end
+
+        with_them do
+          let(:token) { user_token ? personal_access_token.token : 'wrong' }
+          let(:headers) { user_role == :anonymous ? {} : build_basic_auth_header(user.username, token) }
+
+          subject { get api(url), headers: headers }
+
+          before do
+            project.update!(visibility_level: Gitlab::VisibilityLevel.const_get(project_visibility_level, false))
+          end
+
+          it_behaves_like params[:shared_examples_name], params[:user_role], params[:expected_status], params[:member]
+        end
+      end
+
+      context 'with deploy token headers' do
+        let(:headers) { build_basic_auth_header(deploy_token.username, deploy_token.token) }
+
+        context 'valid token' do
+          it_behaves_like 'returning response status', :success
+        end
+
+        context 'invalid token' do
+          let(:headers) { build_basic_auth_header('foo', 'bar') }
+
+          it_behaves_like 'returning response status', :success
+        end
+      end
+
+      it_behaves_like 'rejects PyPI access with unknown project id'
+    end
+  end
+end
diff --git a/spec/requests/api/release/links_spec.rb b/spec/requests/api/release/links_spec.rb
index cf2043ecc74..82d0d64eba4 100644
--- a/spec/requests/api/release/links_spec.rb
+++ b/spec/requests/api/release/links_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Release::Links do
+RSpec.describe API::Release::Links do
   let(:project) { create(:project, :repository, :private) }
   let(:maintainer) { create(:user) }
   let(:reporter) { create(:user) }
diff --git a/spec/requests/api/releases_spec.rb b/spec/requests/api/releases_spec.rb
index f4cb7f25990..5e8353d74c3 100644
--- a/spec/requests/api/releases_spec.rb
+++ b/spec/requests/api/releases_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Releases do
+RSpec.describe API::Releases do
   let(:project) { create(:project, :repository, :private) }
   let(:maintainer) { create(:user) }
   let(:reporter) { create(:user) }
diff --git a/spec/requests/api/remote_mirrors_spec.rb b/spec/requests/api/remote_mirrors_spec.rb
index 3029b8443b0..436efb708fd 100644
--- a/spec/requests/api/remote_mirrors_spec.rb
+++ b/spec/requests/api/remote_mirrors_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::RemoteMirrors do
+RSpec.describe API::RemoteMirrors do
   let_it_be(:user) { create(:user) }
   let_it_be(:project) { create(:project, :repository, :remote_mirror) }
   let_it_be(:developer) { create(:user) { |u| project.add_developer(u) } }
diff --git a/spec/requests/api/repositories_spec.rb b/spec/requests/api/repositories_spec.rb
index 55243e83017..36707f32d04 100644
--- a/spec/requests/api/repositories_spec.rb
+++ b/spec/requests/api/repositories_spec.rb
@@ -3,7 +3,7 @@
 require 'spec_helper'
 require 'mime/types'
 
-describe API::Repositories do
+RSpec.describe API::Repositories do
   include RepoHelpers
   include WorkhorseHelpers
 
@@ -227,7 +227,8 @@ describe API::Repositories do
   end
 
   describe "GET /projects/:id/repository/archive(.:format)?:sha" do
-    let(:route) { "/projects/#{project.id}/repository/archive" }
+    let(:project_id) { CGI.escape(project.full_path) }
+    let(:route) { "/projects/#{project_id}/repository/archive" }
 
     before do
       allow(::Gitlab::ApplicationRateLimiter).to receive(:throttled?).and_return(false)
@@ -246,7 +247,7 @@ describe API::Repositories do
       end
 
       it 'returns the repository archive archive.zip' do
-        get api("/projects/#{project.id}/repository/archive.zip", user)
+        get api("/projects/#{project_id}/repository/archive.zip", user)
 
         expect(response).to have_gitlab_http_status(:ok)
 
@@ -257,7 +258,7 @@ describe API::Repositories do
       end
 
       it 'returns the repository archive archive.tar.bz2' do
-        get api("/projects/#{project.id}/repository/archive.tar.bz2", user)
+        get api("/projects/#{project_id}/repository/archive.tar.bz2", user)
 
         expect(response).to have_gitlab_http_status(:ok)
 
@@ -277,7 +278,7 @@ describe API::Repositories do
       it 'rate limits user when thresholds hit' do
         allow(::Gitlab::ApplicationRateLimiter).to receive(:throttled?).and_return(true)
 
-        get api("/projects/#{project.id}/repository/archive.tar.bz2", user)
+        get api("/projects/#{project_id}/repository/archive.tar.bz2", user)
 
         expect(response).to have_gitlab_http_status(:too_many_requests)
       end
@@ -302,6 +303,13 @@ describe API::Repositories do
       end
     end
 
+    context 'when unauthenticated and project path has dots' do
+      it_behaves_like 'repository archive' do
+        let(:project) { create(:project, :public, :repository, path: 'path.with.dot') }
+        let(:current_user) { nil }
+      end
+    end
+
     context 'when unauthenticated', 'and project is private' do
       it_behaves_like '404 response' do
         let(:request) { get api(route) }
diff --git a/spec/requests/api/resource_label_events_spec.rb b/spec/requests/api/resource_label_events_spec.rb
index 7619399458a..a4a70d89812 100644
--- a/spec/requests/api/resource_label_events_spec.rb
+++ b/spec/requests/api/resource_label_events_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ResourceLabelEvents do
+RSpec.describe API::ResourceLabelEvents do
   let_it_be(:user) { create(:user) }
   let_it_be(:project, reload: true) { create(:project, :public, namespace: user.namespace) }
   let_it_be(:label) { create(:label, project: project) }
diff --git a/spec/requests/api/resource_milestone_events_spec.rb b/spec/requests/api/resource_milestone_events_spec.rb
index b2e92fde5ee..5c81c2180d7 100644
--- a/spec/requests/api/resource_milestone_events_spec.rb
+++ b/spec/requests/api/resource_milestone_events_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::ResourceMilestoneEvents do
+RSpec.describe API::ResourceMilestoneEvents do
   let!(:user) { create(:user) }
   let!(:project) { create(:project, :public, namespace: user.namespace) }
   let!(:milestone) { create(:milestone, project: project) }
diff --git a/spec/requests/api/resource_state_events_spec.rb b/spec/requests/api/resource_state_events_spec.rb
new file mode 100644
index 00000000000..46ca9874395
--- /dev/null
+++ b/spec/requests/api/resource_state_events_spec.rb
@@ -0,0 +1,105 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::ResourceStateEvents do
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project, reload: true) { create(:project, :public, namespace: user.namespace) }
+
+  before_all do
+    project.add_developer(user)
+  end
+
+  shared_examples 'resource_state_events API' do |parent_type, eventable_type, id_name|
+    describe "GET /#{parent_type}/:id/#{eventable_type}/:noteable_id/resource_state_events" do
+      let!(:event) { create_event }
+
+      it "returns an array of resource state events" do
+        url = "/#{parent_type}/#{parent.id}/#{eventable_type}/#{eventable[id_name]}/resource_state_events"
+        get api(url, user)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response).to include_pagination_headers
+        expect(json_response).to be_an Array
+        expect(json_response.first['id']).to eq(event.id)
+        expect(json_response.first['state']).to eq(event.state.to_s)
+      end
+
+      it "returns a 404 error when eventable id not found" do
+        get api("/#{parent_type}/#{parent.id}/#{eventable_type}/#{non_existing_record_id}/resource_state_events", user)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it "returns 404 when not authorized" do
+        parent.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+        private_user = create(:user)
+
+        get api("/#{parent_type}/#{parent.id}/#{eventable_type}/#{eventable[id_name]}/resource_state_events", private_user)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+
+    describe "GET /#{parent_type}/:id/#{eventable_type}/:noteable_id/resource_state_events/:event_id" do
+      let!(:event) { create_event }
+
+      it "returns a resource state event by id" do
+        get api("/#{parent_type}/#{parent.id}/#{eventable_type}/#{eventable[id_name]}/resource_state_events/#{event.id}", user)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(json_response['id']).to eq(event.id)
+        expect(json_response['state']).to eq(event.state.to_s)
+      end
+
+      it "returns 404 when not authorized" do
+        parent.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+        private_user = create(:user)
+
+        get api("/#{parent_type}/#{parent.id}/#{eventable_type}/#{eventable[id_name]}/resource_state_events/#{event.id}", private_user)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      it "returns a 404 error if resource state event not found" do
+        get api("/#{parent_type}/#{parent.id}/#{eventable_type}/#{eventable[id_name]}/resource_state_events/#{non_existing_record_id}", user)
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+    end
+
+    describe 'pagination' do
+      # https://gitlab.com/gitlab-org/gitlab/-/issues/220192
+      it 'returns the second page' do
+        create_event
+        event2 = create_event
+
+        get api("/#{parent_type}/#{parent.id}/#{eventable_type}/#{eventable[id_name]}/resource_state_events?page=2&per_page=1", user)
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response).to include_pagination_headers
+        expect(response.headers['X-Total']).to eq '2'
+        expect(json_response.count).to eq(1)
+        expect(json_response.first['id']).to eq(event2.id)
+      end
+    end
+
+    def create_event(state: :opened)
+      create(:resource_state_event, eventable.class.name.underscore => eventable, state: state)
+    end
+  end
+
+  context 'when eventable is an Issue' do
+    it_behaves_like 'resource_state_events API', 'projects', 'issues', 'iid' do
+      let(:parent) { project }
+      let(:eventable) { create(:issue, project: project, author: user) }
+    end
+  end
+
+  context 'when eventable is a Merge Request' do
+    it_behaves_like 'resource_state_events API', 'projects', 'merge_requests', 'iid' do
+      let(:parent) { project }
+      let(:eventable) { create(:merge_request, source_project: project, target_project: project, author: user) }
+    end
+  end
+end
diff --git a/spec/requests/api/search_spec.rb b/spec/requests/api/search_spec.rb
index a02d804ee9b..1a93be98a67 100644
--- a/spec/requests/api/search_spec.rb
+++ b/spec/requests/api/search_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Search do
+RSpec.describe API::Search do
   let_it_be(:user) { create(:user) }
   let_it_be(:group) { create(:group) }
   let_it_be(:project, reload: true) { create(:project, :wiki_repo, :public, name: 'awesome project', group: group) }
diff --git a/spec/requests/api/services_spec.rb b/spec/requests/api/services_spec.rb
index 53265574e6a..5528a0c094f 100644
--- a/spec/requests/api/services_spec.rb
+++ b/spec/requests/api/services_spec.rb
@@ -2,7 +2,7 @@
 
 require "spec_helper"
 
-describe API::Services do
+RSpec.describe API::Services do
   let_it_be(:user) { create(:user) }
   let_it_be(:user2) { create(:user) }
 
diff --git a/spec/requests/api/settings_spec.rb b/spec/requests/api/settings_spec.rb
index e6dd1fecb69..602aacb6ced 100644
--- a/spec/requests/api/settings_spec.rb
+++ b/spec/requests/api/settings_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Settings, 'Settings' do
+RSpec.describe API::Settings, 'Settings' do
   let(:user) { create(:user) }
 
   let_it_be(:admin) { create(:admin) }
@@ -62,14 +62,14 @@ describe API::Settings, 'Settings' do
             default_projects_limit: 3,
             default_project_creation: 2,
             password_authentication_enabled_for_web: false,
-            repository_storages: ['custom'],
+            repository_storages: 'custom',
             plantuml_enabled: true,
             plantuml_url: 'http://plantuml.example.com',
             sourcegraph_enabled: true,
             sourcegraph_url: 'https://sourcegraph.com',
             sourcegraph_public_only: false,
             default_snippet_visibility: 'internal',
-            restricted_visibility_levels: ['public'],
+            restricted_visibility_levels: 'public',
             default_artifacts_expire_in: '2 days',
             help_page_text: 'custom help text',
             help_page_hide_commercial_content: true,
@@ -94,7 +94,9 @@ describe API::Settings, 'Settings' do
             issues_create_limit: 300,
             raw_blob_request_limit: 300,
             spam_check_endpoint_enabled: true,
-            spam_check_endpoint_url: 'https://example.com/spam_check'
+            spam_check_endpoint_url: 'https://example.com/spam_check',
+            disabled_oauth_sign_in_sources: 'unknown',
+            import_sources: 'github,bitbucket'
           }
 
         expect(response).to have_gitlab_http_status(:ok)
@@ -135,6 +137,8 @@ describe API::Settings, 'Settings' do
         expect(json_response['raw_blob_request_limit']).to eq(300)
         expect(json_response['spam_check_endpoint_enabled']).to be_truthy
         expect(json_response['spam_check_endpoint_url']).to eq('https://example.com/spam_check')
+        expect(json_response['disabled_oauth_sign_in_sources']).to eq([])
+        expect(json_response['import_sources']).to match_array(%w(github bitbucket))
       end
     end
 
diff --git a/spec/requests/api/sidekiq_metrics_spec.rb b/spec/requests/api/sidekiq_metrics_spec.rb
index 705ae29d5d8..23ac2ea5c0b 100644
--- a/spec/requests/api/sidekiq_metrics_spec.rb
+++ b/spec/requests/api/sidekiq_metrics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::SidekiqMetrics do
+RSpec.describe API::SidekiqMetrics do
   let(:admin) { create(:user, :admin) }
 
   describe 'GET sidekiq/*' do
diff --git a/spec/requests/api/snippets_spec.rb b/spec/requests/api/snippets_spec.rb
index c12c95ae2e0..e676eb94337 100644
--- a/spec/requests/api/snippets_spec.rb
+++ b/spec/requests/api/snippets_spec.rb
@@ -2,14 +2,16 @@
 
 require 'spec_helper'
 
-describe API::Snippets do
+RSpec.describe API::Snippets do
+  include SnippetHelpers
+
   let_it_be(:user) { create(:user) }
 
   describe 'GET /snippets/' do
     it 'returns snippets available' do
-      public_snippet = create(:personal_snippet, :public, author: user)
-      private_snippet = create(:personal_snippet, :private, author: user)
-      internal_snippet = create(:personal_snippet, :internal, author: user)
+      public_snippet = create(:personal_snippet, :repository, :public, author: user)
+      private_snippet = create(:personal_snippet, :repository, :private, author: user)
+      internal_snippet = create(:personal_snippet, :repository, :internal, author: user)
 
       get api("/snippets/", user)
 
@@ -22,6 +24,7 @@ describe API::Snippets do
         private_snippet.id)
       expect(json_response.last).to have_key('web_url')
       expect(json_response.last).to have_key('raw_url')
+      expect(json_response.last).to have_key('files')
       expect(json_response.last).to have_key('visibility')
     end
 
@@ -59,32 +62,33 @@ describe API::Snippets do
   end
 
   describe 'GET /snippets/public' do
-    let!(:other_user) { create(:user) }
-    let!(:public_snippet) { create(:personal_snippet, :public, author: user) }
-    let!(:private_snippet) { create(:personal_snippet, :private, author: user) }
-    let!(:internal_snippet) { create(:personal_snippet, :internal, author: user) }
-    let!(:public_snippet_other) { create(:personal_snippet, :public, author: other_user) }
-    let!(:private_snippet_other) { create(:personal_snippet, :private, author: other_user) }
-    let!(:internal_snippet_other) { create(:personal_snippet, :internal, author: other_user) }
-    let!(:public_snippet_project) { create(:project_snippet, :public, author: user) }
-    let!(:private_snippet_project) { create(:project_snippet, :private, author: user) }
-    let!(:internal_snippet_project) { create(:project_snippet, :internal, author: user) }
+    let_it_be(:other_user)               { create(:user) }
+    let_it_be(:public_snippet)           { create(:personal_snippet, :repository, :public, author: user) }
+    let_it_be(:private_snippet)          { create(:personal_snippet, :repository, :private, author: user) }
+    let_it_be(:internal_snippet)         { create(:personal_snippet, :repository, :internal, author: user) }
+    let_it_be(:public_snippet_other)     { create(:personal_snippet, :repository, :public, author: other_user) }
+    let_it_be(:private_snippet_other)    { create(:personal_snippet, :repository, :private, author: other_user) }
+    let_it_be(:internal_snippet_other)   { create(:personal_snippet, :repository, :internal, author: other_user) }
+    let_it_be(:public_snippet_project)   { create(:project_snippet, :repository, :public, author: user) }
+    let_it_be(:private_snippet_project)  { create(:project_snippet, :repository, :private, author: user) }
+    let_it_be(:internal_snippet_project) { create(:project_snippet, :repository, :internal, author: user) }
 
     it 'returns all snippets with public visibility from all users' do
       get api("/snippets/public", user)
 
-      expect(response).to have_gitlab_http_status(:ok)
-      expect(response).to include_pagination_headers
-      expect(json_response).to be_an Array
-      expect(json_response.map { |snippet| snippet['id']} ).to contain_exactly(
-        public_snippet.id,
-        public_snippet_other.id)
-      expect(json_response.map { |snippet| snippet['web_url']} ).to contain_exactly(
-        "http://localhost/snippets/#{public_snippet.id}",
-        "http://localhost/snippets/#{public_snippet_other.id}")
-      expect(json_response.map { |snippet| snippet['raw_url']} ).to contain_exactly(
-        "http://localhost/snippets/#{public_snippet.id}/raw",
-        "http://localhost/snippets/#{public_snippet_other.id}/raw")
+      aggregate_failures do
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response).to include_pagination_headers
+        expect(json_response).to be_an Array
+        expect(json_response.map { |snippet| snippet['id']} ).to contain_exactly(
+          public_snippet.id,
+          public_snippet_other.id)
+        expect(json_response.map { |snippet| snippet['web_url']} ).to contain_exactly(
+          "http://localhost/snippets/#{public_snippet.id}",
+          "http://localhost/snippets/#{public_snippet_other.id}")
+        expect(json_response[0]['files'].first).to eq snippet_blob_file(public_snippet_other.blobs.first)
+        expect(json_response[1]['files'].first).to eq snippet_blob_file(public_snippet.blobs.first)
+      end
     end
   end
 
@@ -102,13 +106,8 @@ describe API::Snippets do
       get api("/snippets/#{snippet.id}/raw", author)
 
       expect(response).to have_gitlab_http_status(:ok)
-      expect(response.content_type).to eq 'text/plain'
-    end
-
-    it 'forces attachment content disposition' do
-      get api("/snippets/#{snippet.id}/raw", author)
-
-      expect(headers['Content-Disposition']).to match(/^attachment/)
+      expect(response.media_type).to eq 'text/plain'
+      expect(headers['Content-Disposition']).to match(/^inline/)
     end
 
     it 'returns 404 for invalid snippet id' do
@@ -141,56 +140,88 @@ describe API::Snippets do
     end
   end
 
+  describe 'GET /snippets/:id/files/:ref/:file_path/raw' do
+    let_it_be(:snippet) { create(:personal_snippet, :repository, :private) }
+
+    it_behaves_like 'raw snippet files' do
+      let(:api_path) { "/snippets/#{snippet_id}/files/#{ref}/#{file_path}/raw" }
+    end
+  end
+
   describe 'GET /snippets/:id' do
     let_it_be(:admin) { create(:user, :admin) }
     let_it_be(:author) { create(:user) }
     let_it_be(:private_snippet) { create(:personal_snippet, :repository, :private, author: author) }
     let_it_be(:internal_snippet) { create(:personal_snippet, :repository, :internal, author: author) }
+    let(:snippet) { private_snippet }
 
-    it 'requires authentication' do
-      get api("/snippets/#{private_snippet.id}", nil)
+    subject { get api("/snippets/#{snippet.id}", user) }
 
-      expect(response).to have_gitlab_http_status(:unauthorized)
+    it 'hides private snippets from an ordinary user' do
+      subject
+
+      expect(response).to have_gitlab_http_status(:not_found)
     end
 
-    it 'returns snippet json' do
-      get api("/snippets/#{private_snippet.id}", author)
+    context 'without a user' do
+      let(:user) { nil }
 
-      expect(response).to have_gitlab_http_status(:ok)
+      it 'requires authentication' do
+        subject
 
-      expect(json_response['title']).to eq(private_snippet.title)
-      expect(json_response['description']).to eq(private_snippet.description)
-      expect(json_response['file_name']).to eq(private_snippet.file_name_on_repo)
-      expect(json_response['visibility']).to eq(private_snippet.visibility)
-      expect(json_response['ssh_url_to_repo']).to eq(private_snippet.ssh_url_to_repo)
-      expect(json_response['http_url_to_repo']).to eq(private_snippet.http_url_to_repo)
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
     end
 
-    it 'shows private snippets to an admin' do
-      get api("/snippets/#{private_snippet.id}", admin)
+    context 'with the author' do
+      let(:user) { author }
 
-      expect(response).to have_gitlab_http_status(:ok)
-    end
+      it 'returns snippet json' do
+        subject
 
-    it 'hides private snippets from an ordinary user' do
-      get api("/snippets/#{private_snippet.id}", user)
+        expect(response).to have_gitlab_http_status(:ok)
 
-      expect(response).to have_gitlab_http_status(:not_found)
+        expect(json_response['title']).to eq(private_snippet.title)
+        expect(json_response['description']).to eq(private_snippet.description)
+        expect(json_response['file_name']).to eq(private_snippet.file_name_on_repo)
+        expect(json_response['files']).to eq(private_snippet.blobs.map { |blob| snippet_blob_file(blob) })
+        expect(json_response['visibility']).to eq(private_snippet.visibility)
+        expect(json_response['ssh_url_to_repo']).to eq(private_snippet.ssh_url_to_repo)
+        expect(json_response['http_url_to_repo']).to eq(private_snippet.http_url_to_repo)
+      end
     end
 
-    it 'shows internal snippets to an ordinary user' do
-      get api("/snippets/#{internal_snippet.id}", user)
+    context 'with an admin' do
+      let(:user) { admin }
 
-      expect(response).to have_gitlab_http_status(:ok)
+      it 'shows private snippets to an admin' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+
+      it 'returns 404 for invalid snippet id' do
+        private_snippet.destroy
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:not_found)
+        expect(json_response['message']).to eq('404 Snippet Not Found')
+      end
     end
 
-    it 'returns 404 for invalid snippet id' do
-      private_snippet.destroy
+    context 'with an internal snippet' do
+      let(:snippet) { internal_snippet }
 
-      get api("/snippets/#{private_snippet.id}", admin)
+      it 'shows internal snippets to an ordinary user' do
+        subject
 
-      expect(response).to have_gitlab_http_status(:not_found)
-      expect(json_response['message']).to eq('404 Snippet Not Found')
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+
+    it_behaves_like 'snippet_multiple_files feature disabled' do
+      let(:user) { author }
     end
   end
 
@@ -221,6 +252,7 @@ describe API::Snippets do
         expect(json_response['title']).to eq(params[:title])
         expect(json_response['description']).to eq(params[:description])
         expect(json_response['file_name']).to eq(params[:file_name])
+        expect(json_response['files']).to eq(snippet.blobs.map { |blob| snippet_blob_file(blob) })
         expect(json_response['visibility']).to eq(params[:visibility])
       end
 
@@ -251,6 +283,10 @@ describe API::Snippets do
 
     it_behaves_like 'snippet creation'
 
+    it_behaves_like 'snippet_multiple_files feature disabled' do
+      let(:snippet) { Snippet.find(json_response["id"]) }
+    end
+
     context 'with an external user' do
       let(:user) { create(:user, :external) }
 
diff --git a/spec/requests/api/statistics_spec.rb b/spec/requests/api/statistics_spec.rb
index 5aea5c225a0..eab97b6916e 100644
--- a/spec/requests/api/statistics_spec.rb
+++ b/spec/requests/api/statistics_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Statistics, 'Statistics' do
+RSpec.describe API::Statistics, 'Statistics' do
   include ProjectForksHelper
   tables_to_analyze = %w[
     projects
diff --git a/spec/requests/api/submodules_spec.rb b/spec/requests/api/submodules_spec.rb
index 2604dc18005..6b141d6d036 100644
--- a/spec/requests/api/submodules_spec.rb
+++ b/spec/requests/api/submodules_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Submodules do
+RSpec.describe API::Submodules do
   let(:user) { create(:user) }
   let!(:project) { create(:project, :repository, namespace: user.namespace ) }
   let(:guest) { create(:user) { |u| project.add_guest(u) } }
diff --git a/spec/requests/api/suggestions_spec.rb b/spec/requests/api/suggestions_spec.rb
index ffb8c811622..34d3c54d700 100644
--- a/spec/requests/api/suggestions_spec.rb
+++ b/spec/requests/api/suggestions_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Suggestions do
+RSpec.describe API::Suggestions do
   let(:project) { create(:project, :repository) }
   let(:user) { create(:user) }
 
diff --git a/spec/requests/api/system_hooks_spec.rb b/spec/requests/api/system_hooks_spec.rb
index 609aa615d33..01b46053d52 100644
--- a/spec/requests/api/system_hooks_spec.rb
+++ b/spec/requests/api/system_hooks_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::SystemHooks do
+RSpec.describe API::SystemHooks do
   include StubRequests
 
   let(:user) { create(:user) }
diff --git a/spec/requests/api/tags_spec.rb b/spec/requests/api/tags_spec.rb
index 694802ce1b8..b029c0f5793 100644
--- a/spec/requests/api/tags_spec.rb
+++ b/spec/requests/api/tags_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Tags do
+RSpec.describe API::Tags do
   let(:user) { create(:user) }
   let(:guest) { create(:user).tap { |u| project.add_guest(u) } }
   let(:project) { create(:project, :repository, creator: user, path: 'my.project') }
diff --git a/spec/requests/api/task_completion_status_spec.rb b/spec/requests/api/task_completion_status_spec.rb
index 4dd1e27bd4b..97ce858ba12 100644
--- a/spec/requests/api/task_completion_status_spec.rb
+++ b/spec/requests/api/task_completion_status_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe 'task completion status response' do
+RSpec.describe 'task completion status response' do
   let_it_be(:user) { create(:user) }
   let_it_be(:project) do
     create(:project, :public, creator_id: user.id, namespace: user.namespace)
diff --git a/spec/requests/api/templates_spec.rb b/spec/requests/api/templates_spec.rb
index fae338b4ca3..e1c5bfd82c4 100644
--- a/spec/requests/api/templates_spec.rb
+++ b/spec/requests/api/templates_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Templates do
+RSpec.describe API::Templates do
   context 'the Template Entity' do
     before do
       get api('/templates/gitignores/Ruby')
diff --git a/spec/requests/api/terraform/state_spec.rb b/spec/requests/api/terraform/state_spec.rb
index ec9db5566e3..c6cba39314b 100644
--- a/spec/requests/api/terraform/state_spec.rb
+++ b/spec/requests/api/terraform/state_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Terraform::State do
+RSpec.describe API::Terraform::State do
   include HttpBasicAuthHelpers
 
   let_it_be(:project) { create(:project) }
@@ -59,10 +59,11 @@ describe API::Terraform::State do
       context 'with developer permissions' do
         let(:current_user) { developer }
 
-        it 'returns forbidden if the user cannot access the state' do
+        it 'returns terraform state belonging to a project of given state name' do
           request
 
-          expect(response).to have_gitlab_http_status(:forbidden)
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response.body).to eq(state.file.read)
         end
       end
     end
@@ -94,10 +95,11 @@ describe API::Terraform::State do
       context 'with developer permissions' do
         let(:job) { create(:ci_build, project: project, user: developer) }
 
-        it 'returns forbidden if the user cannot access the state' do
+        it 'returns terraform state belonging to a project of given state name' do
           request
 
-          expect(response).to have_gitlab_http_status(:forbidden)
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response.body).to eq(state.file.read)
         end
       end
     end
@@ -235,9 +237,43 @@ describe API::Terraform::State do
 
       expect(response).to have_gitlab_http_status(:ok)
     end
+
+    context 'state is already locked' do
+      before do
+        state.update!(lock_xid: 'locked', locked_by_user: current_user)
+      end
+
+      it 'returns an error' do
+        request
+
+        expect(response).to have_gitlab_http_status(:conflict)
+      end
+    end
+
+    context 'user does not have permission to lock the state' do
+      let(:current_user) { developer }
+
+      it 'returns an error' do
+        request
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
   end
 
   describe 'DELETE /projects/:id/terraform/state/:name/lock' do
+    let(:params) do
+      {
+        ID: lock_id,
+        Version: '0.1',
+        Operation: 'OperationTypePlan',
+        Info: '',
+        Who: "#{current_user.username}",
+        Created: Time.now.utc.iso8601(6),
+        Path: ''
+      }
+    end
+
     before do
       state.lock_xid = '123-456'
       state.save!
@@ -246,7 +282,7 @@ describe API::Terraform::State do
     subject(:request) { delete api("#{state_path}/lock"), headers: auth_header, params: params }
 
     context 'with the correct lock id' do
-      let(:params) { { ID: '123-456' } }
+      let(:lock_id) { '123-456' }
 
       it 'removes the terraform state lock' do
         request
@@ -266,7 +302,7 @@ describe API::Terraform::State do
     end
 
     context 'with an incorrect lock id' do
-      let(:params) { { ID: '456-789' } }
+      let(:lock_id) { '456-789' }
 
       it 'returns an error' do
         request
@@ -276,7 +312,7 @@ describe API::Terraform::State do
     end
 
     context 'with a longer than 255 character lock id' do
-      let(:params) { { ID: '0' * 256 } }
+      let(:lock_id) { '0' * 256 }
 
       it 'returns an error' do
         request
@@ -284,5 +320,16 @@ describe API::Terraform::State do
         expect(response).to have_gitlab_http_status(:bad_request)
       end
     end
+
+    context 'user does not have permission to unlock the state' do
+      let(:lock_id) { '123-456' }
+      let(:current_user) { developer }
+
+      it 'returns an error' do
+        request
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
   end
 end
diff --git a/spec/requests/api/todos_spec.rb b/spec/requests/api/todos_spec.rb
index 0bdc71a30e9..dfd0e13d84c 100644
--- a/spec/requests/api/todos_spec.rb
+++ b/spec/requests/api/todos_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Todos do
+RSpec.describe API::Todos do
   let_it_be(:group) { create(:group) }
   let_it_be(:project_1) { create(:project, :repository, group: group) }
   let_it_be(:project_2) { create(:project) }
diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 19b01cb7913..c51358bf659 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Triggers do
+RSpec.describe API::Triggers do
   let_it_be(:user) { create(:user) }
   let_it_be(:user2) { create(:user) }
 
diff --git a/spec/requests/api/user_counts_spec.rb b/spec/requests/api/user_counts_spec.rb
index 688dfe11115..94e25d647fc 100644
--- a/spec/requests/api/user_counts_spec.rb
+++ b/spec/requests/api/user_counts_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::UserCounts do
+RSpec.describe API::UserCounts do
   let(:user) { create(:user) }
   let(:project) { create(:project, :public) }
 
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index e780f67bcab..17f9112c1d5 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Users, :do_not_mock_admin_mode do
+RSpec.describe API::Users, :do_not_mock_admin_mode do
   let_it_be(:admin) { create(:admin) }
   let_it_be(:user, reload: true) { create(:user, username: 'user.with.dot') }
   let_it_be(:key) { create(:key, user: user) }
@@ -910,6 +910,14 @@ describe API::Users, :do_not_mock_admin_mode do
       expect(user.reload.bio).to eq('')
     end
 
+    it 'updates user with nil bio' do
+      put api("/users/#{user.id}", admin), params: { bio: nil }
+
+      expect(response).to have_gitlab_http_status(:ok)
+      expect(json_response['bio']).to eq('')
+      expect(user.reload.bio).to eq('')
+    end
+
     it "updates user with new password and forces reset on next login" do
       put api("/users/#{user.id}", admin), params: { password: '12345678' }
 
diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index f209a1d2e6e..7bb73e9664b 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Variables do
+RSpec.describe API::Variables do
   let(:user) { create(:user) }
   let(:user2) { create(:user) }
   let!(:project) { create(:project, creator_id: user.id) }
@@ -54,6 +54,59 @@ describe API::Variables do
 
         expect(response).to have_gitlab_http_status(:not_found)
       end
+
+      context 'when there are two variables with the same key on different env' do
+        let!(:var1) { create(:ci_variable, project: project, key: 'key1', environment_scope: 'staging') }
+        let!(:var2) { create(:ci_variable, project: project, key: 'key1', environment_scope: 'production') }
+
+        context 'when filter[environment_scope] is not passed' do
+          context 'FF ci_variables_api_filter_environment_scope is enabled' do
+            it 'returns 409' do
+              get api("/projects/#{project.id}/variables/key1", user)
+
+              expect(response).to have_gitlab_http_status(:conflict)
+            end
+          end
+
+          context 'FF ci_variables_api_filter_environment_scope is disabled' do
+            before do
+              stub_feature_flags(ci_variables_api_filter_environment_scope: false)
+            end
+
+            it 'returns random one' do
+              get api("/projects/#{project.id}/variables/key1", user)
+
+              expect(response).to have_gitlab_http_status(:ok)
+              expect(json_response['key']).to eq('key1')
+            end
+          end
+        end
+
+        context 'when filter[environment_scope] is passed' do
+          it 'returns the variable' do
+            get api("/projects/#{project.id}/variables/key1", user), params: { 'filter[environment_scope]': 'production' }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response['value']).to eq(var2.value)
+          end
+        end
+
+        context 'when wrong filter[environment_scope] is passed' do
+          it 'returns not_found' do
+            get api("/projects/#{project.id}/variables/key1", user), params: { 'filter[environment_scope]': 'invalid' }
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+
+          context 'when there is only one variable with provided key' do
+            it 'returns not_found' do
+              get api("/projects/#{project.id}/variables/#{variable.key}", user), params: { 'filter[environment_scope]': 'invalid' }
+
+              expect(response).to have_gitlab_http_status(:not_found)
+            end
+          end
+        end
+      end
     end
 
     context 'authorized user with invalid permissions' do
@@ -173,6 +226,52 @@ describe API::Variables do
 
         expect(response).to have_gitlab_http_status(:not_found)
       end
+
+      context 'when there are two variables with the same key on different env' do
+        let!(:var1) { create(:ci_variable, project: project, key: 'key1', environment_scope: 'staging') }
+        let!(:var2) { create(:ci_variable, project: project, key: 'key1', environment_scope: 'production') }
+
+        context 'when filter[environment_scope] is not passed' do
+          context 'FF ci_variables_api_filter_environment_scope is enabled' do
+            it 'returns 409' do
+              get api("/projects/#{project.id}/variables/key1", user)
+
+              expect(response).to have_gitlab_http_status(:conflict)
+            end
+          end
+
+          context 'FF ci_variables_api_filter_environment_scope is disabled' do
+            before do
+              stub_feature_flags(ci_variables_api_filter_environment_scope: false)
+            end
+
+            it 'updates random one' do
+              put api("/projects/#{project.id}/variables/key1", user), params: { value: 'new_val' }
+
+              expect(response).to have_gitlab_http_status(:ok)
+              expect(json_response['value']).to eq('new_val')
+            end
+          end
+        end
+
+        context 'when filter[environment_scope] is passed' do
+          it 'updates the variable' do
+            put api("/projects/#{project.id}/variables/key1", user), params: { value: 'new_val', 'filter[environment_scope]': 'production' }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(var1.reload.value).not_to eq('new_val')
+            expect(var2.reload.value).to eq('new_val')
+          end
+        end
+
+        context 'when wrong filter[environment_scope] is passed' do
+          it 'returns not_found' do
+            put api("/projects/#{project.id}/variables/key1", user), params: { value: 'new_val', 'filter[environment_scope]': 'invalid' }
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+      end
     end
 
     context 'authorized user with invalid permissions' do
@@ -207,6 +306,56 @@ describe API::Variables do
 
         expect(response).to have_gitlab_http_status(:not_found)
       end
+
+      context 'when there are two variables with the same key on different env' do
+        let!(:var1) { create(:ci_variable, project: project, key: 'key1', environment_scope: 'staging') }
+        let!(:var2) { create(:ci_variable, project: project, key: 'key1', environment_scope: 'production') }
+
+        context 'when filter[environment_scope] is not passed' do
+          context 'FF ci_variables_api_filter_environment_scope is enabled' do
+            it 'returns 409' do
+              get api("/projects/#{project.id}/variables/key1", user)
+
+              expect(response).to have_gitlab_http_status(:conflict)
+            end
+          end
+
+          context 'FF ci_variables_api_filter_environment_scope is disabled' do
+            before do
+              stub_feature_flags(ci_variables_api_filter_environment_scope: false)
+            end
+
+            it 'deletes random one' do
+              expect do
+                delete api("/projects/#{project.id}/variables/key1", user), params: { 'filter[environment_scope]': 'production' }
+
+                expect(response).to have_gitlab_http_status(:no_content)
+              end.to change {project.variables.count}.by(-1)
+            end
+          end
+        end
+
+        context 'when filter[environment_scope] is passed' do
+          it 'deletes the variable' do
+            expect do
+              delete api("/projects/#{project.id}/variables/key1", user), params: { 'filter[environment_scope]': 'production' }
+
+              expect(response).to have_gitlab_http_status(:no_content)
+            end.to change {project.variables.count}.by(-1)
+
+            expect(var1.reload).to be_present
+            expect { var2.reload }.to raise_error(ActiveRecord::RecordNotFound)
+          end
+        end
+
+        context 'when wrong filter[environment_scope] is passed' do
+          it 'returns not_found' do
+            delete api("/projects/#{project.id}/variables/key1", user), params: { 'filter[environment_scope]': 'invalid' }
+
+            expect(response).to have_gitlab_http_status(:not_found)
+          end
+        end
+      end
     end
 
     context 'authorized user with invalid permissions' do
diff --git a/spec/requests/api/version_spec.rb b/spec/requests/api/version_spec.rb
index 9eb8c03e273..a0a0f66c8d1 100644
--- a/spec/requests/api/version_spec.rb
+++ b/spec/requests/api/version_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-describe API::Version do
+RSpec.describe API::Version do
   shared_examples_for 'GET /version' do
     context 'when unauthenticated' do
       it 'returns authentication error' do
diff --git a/spec/requests/api/wikis_spec.rb b/spec/requests/api/wikis_spec.rb
index 43a5cb446bb..f271f8aa853 100644
--- a/spec/requests/api/wikis_spec.rb
+++ b/spec/requests/api/wikis_spec.rb
@@ -12,7 +12,7 @@ require 'spec_helper'
 # - maintainer
 # because they are 3 edge cases of using wiki pages.
 
-describe API::Wikis do
+RSpec.describe API::Wikis do
   include WorkhorseHelpers
 
   let(:user) { create(:user) }
@@ -21,178 +21,10 @@ describe API::Wikis do
   let(:payload) { { content: 'content', format: 'rdoc', title: 'title' } }
   let(:expected_keys_with_content) { %w(content format slug title) }
   let(:expected_keys_without_content) { %w(format slug title) }
+  let(:wiki) { project_wiki }
 
-  shared_examples_for 'returns list of wiki pages' do
-    context 'when wiki has pages' do
-      let!(:pages) do
-        [create(:wiki_page, wiki: project_wiki, title: 'page1', content: 'content of page1'),
-         create(:wiki_page, wiki: project_wiki, title: 'page2.with.dot', content: 'content of page2')]
-      end
-
-      it 'returns the list of wiki pages without content' do
-        get api(url, user)
-
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(json_response.size).to eq(2)
-
-        json_response.each_with_index do |page, index|
-          expect(page.keys).to match_array(expected_keys_without_content)
-          expect(page['slug']).to eq(pages[index].slug)
-          expect(page['title']).to eq(pages[index].title)
-        end
-      end
-
-      it 'returns the list of wiki pages with content' do
-        get api(url, user), params: { with_content: 1 }
-
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(json_response.size).to eq(2)
-
-        json_response.each_with_index do |page, index|
-          expect(page.keys).to match_array(expected_keys_with_content)
-          expect(page['content']).to eq(pages[index].content)
-          expect(page['slug']).to eq(pages[index].slug)
-          expect(page['title']).to eq(pages[index].title)
-        end
-      end
-    end
-
-    it 'return the empty list of wiki pages' do
-      get api(url, user)
-
-      expect(response).to have_gitlab_http_status(:ok)
-      expect(json_response.size).to eq(0)
-    end
-  end
-
-  shared_examples_for 'returns wiki page' do
-    it 'returns the wiki page' do
-      expect(response).to have_gitlab_http_status(:ok)
-      expect(json_response.size).to eq(4)
-      expect(json_response.keys).to match_array(expected_keys_with_content)
-      expect(json_response['content']).to eq(page.content)
-      expect(json_response['slug']).to eq(page.slug)
-      expect(json_response['title']).to eq(page.title)
-    end
-  end
-
-  shared_examples_for 'creates wiki page' do
-    it 'creates the wiki page' do
-      post(api(url, user), params: payload)
-
-      expect(response).to have_gitlab_http_status(:created)
-      expect(json_response.size).to eq(4)
-      expect(json_response.keys).to match_array(expected_keys_with_content)
-      expect(json_response['content']).to eq(payload[:content])
-      expect(json_response['slug']).to eq(payload[:title].tr(' ', '-'))
-      expect(json_response['title']).to eq(payload[:title])
-      expect(json_response['rdoc']).to eq(payload[:rdoc])
-    end
-
-    [:title, :content].each do |part|
-      it "responds with validation error on empty #{part}" do
-        payload.delete(part)
-
-        post(api(url, user), params: payload)
-
-        expect(response).to have_gitlab_http_status(:bad_request)
-        expect(json_response.size).to eq(1)
-        expect(json_response['error']).to eq("#{part} is missing")
-      end
-    end
-  end
-
-  shared_examples_for 'updates wiki page' do
-    it 'updates the wiki page' do
-      put(api(url, user), params: payload)
-
-      expect(response).to have_gitlab_http_status(:ok)
-      expect(json_response.size).to eq(4)
-      expect(json_response.keys).to match_array(expected_keys_with_content)
-      expect(json_response['content']).to eq(payload[:content])
-      expect(json_response['slug']).to eq(payload[:title].tr(' ', '-'))
-      expect(json_response['title']).to eq(payload[:title])
-    end
-
-    [:title, :content, :format].each do |part|
-      it "updates with wiki with missing #{part}" do
-        payload.delete(part)
-
-        put(api(url, user), params: payload)
-
-        expect(response).to have_gitlab_http_status(:ok)
-      end
-    end
-  end
-
-  shared_examples_for '403 Forbidden' do
-    it 'returns 403 Forbidden' do
-      expect(response).to have_gitlab_http_status(:forbidden)
-      expect(json_response.size).to eq(1)
-      expect(json_response['message']).to eq('403 Forbidden')
-    end
-  end
-
-  shared_examples_for '404 Wiki Page Not Found' do
-    it 'returns 404 Wiki Page Not Found' do
-      expect(response).to have_gitlab_http_status(:not_found)
-      expect(json_response.size).to eq(1)
-      expect(json_response['message']).to eq('404 Wiki Page Not Found')
-    end
-  end
-
-  shared_examples_for '404 Project Not Found' do
-    it 'returns 404 Project Not Found' do
-      expect(response).to have_gitlab_http_status(:not_found)
-      expect(json_response.size).to eq(1)
-      expect(json_response['message']).to eq('404 Project Not Found')
-    end
-  end
-
-  shared_examples_for '204 No Content' do
-    it 'returns 204 No Content' do
-      expect(response).to have_gitlab_http_status(:no_content)
-    end
-  end
-
-  shared_examples_for 'uploads wiki attachment' do
-    it 'pushes attachment to the wiki repository' do
-      allow(SecureRandom).to receive(:hex).and_return('fixed_hex')
-
-      workhorse_post_with_file(api(url, user), file_key: :file, params: payload)
-
-      expect(response).to have_gitlab_http_status(:created)
-      expect(json_response).to eq result_hash.deep_stringify_keys
-    end
-
-    it 'responds with validation error on empty file' do
-      payload.delete(:file)
-
-      post(api(url, user), params: payload)
-
-      expect(response).to have_gitlab_http_status(:bad_request)
-      expect(json_response.size).to eq(1)
-      expect(json_response['error']).to eq('file is missing')
-    end
-
-    it 'responds with validation error on invalid temp file' do
-      payload[:file] = { tempfile: '/etc/hosts' }
-
-      post(api(url, user), params: payload)
-
-      expect(response).to have_gitlab_http_status(:bad_request)
-      expect(json_response.size).to eq(1)
-      expect(json_response['error']).to eq('file is invalid')
-    end
-
-    it 'is backward compatible with regular multipart uploads' do
-      allow(SecureRandom).to receive(:hex).and_return('fixed_hex')
-
-      post(api(url, user), params: payload)
-
-      expect(response).to have_gitlab_http_status(:created)
-      expect(json_response).to eq result_hash.deep_stringify_keys
-    end
+  shared_examples_for 'wiki API 404 Project Not Found' do
+    include_examples 'wiki API 404 Not Found', 'Project'
   end
 
   describe 'GET /projects/:id/wikis' do
@@ -206,7 +38,7 @@ describe API::Wikis do
           get api(url)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -216,7 +48,7 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -226,7 +58,7 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
     end
 
@@ -238,7 +70,7 @@ describe API::Wikis do
           get api(url)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -246,7 +78,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'returns list of wiki pages'
+        include_examples 'wikis API returns list of wiki pages'
       end
 
       context 'when user is maintainer' do
@@ -254,7 +86,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'returns list of wiki pages'
+        include_examples 'wikis API returns list of wiki pages'
       end
     end
 
@@ -266,7 +98,7 @@ describe API::Wikis do
           get api(url)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -274,7 +106,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'returns list of wiki pages'
+        include_examples 'wikis API returns list of wiki pages'
       end
 
       context 'when user is maintainer' do
@@ -282,7 +114,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'returns list of wiki pages'
+        include_examples 'wikis API returns list of wiki pages'
       end
     end
   end
@@ -299,7 +131,7 @@ describe API::Wikis do
           get api(url)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -309,7 +141,7 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -319,7 +151,7 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
     end
 
@@ -331,7 +163,7 @@ describe API::Wikis do
           get api(url)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -340,12 +172,12 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples 'returns wiki page'
+        include_examples 'wikis API returns wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
 
@@ -356,12 +188,12 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples 'returns wiki page'
+        include_examples 'wikis API returns wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
     end
@@ -374,7 +206,7 @@ describe API::Wikis do
           get api(url)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -384,12 +216,12 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples 'returns wiki page'
+        include_examples 'wikis API returns wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
 
@@ -400,12 +232,12 @@ describe API::Wikis do
           get api(url, user)
         end
 
-        include_examples 'returns wiki page'
+        include_examples 'wikis API returns wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
     end
@@ -423,7 +255,7 @@ describe API::Wikis do
           post(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -432,7 +264,7 @@ describe API::Wikis do
           post(api(url, user), params: payload)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -441,7 +273,7 @@ describe API::Wikis do
           post(api(url, user), params: payload)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
     end
 
@@ -453,7 +285,7 @@ describe API::Wikis do
           post(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -461,7 +293,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'creates wiki page'
+        include_examples 'wikis API creates wiki page'
       end
 
       context 'when user is maintainer' do
@@ -469,7 +301,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'creates wiki page'
+        include_examples 'wikis API creates wiki page'
       end
     end
 
@@ -481,7 +313,7 @@ describe API::Wikis do
           post(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -489,7 +321,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'creates wiki page'
+        include_examples 'wikis API creates wiki page'
       end
 
       context 'when user is maintainer' do
@@ -497,7 +329,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'creates wiki page'
+        include_examples 'wikis API creates wiki page'
       end
     end
   end
@@ -515,7 +347,7 @@ describe API::Wikis do
           put(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -525,7 +357,7 @@ describe API::Wikis do
           put(api(url, user), params: payload)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -535,7 +367,7 @@ describe API::Wikis do
           put(api(url, user), params: payload)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
     end
 
@@ -547,7 +379,7 @@ describe API::Wikis do
           put(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -555,7 +387,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'updates wiki page'
+        include_examples 'wikis API updates wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
@@ -564,7 +396,7 @@ describe API::Wikis do
             put(api(url, user), params: payload)
           end
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
 
@@ -573,7 +405,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'updates wiki page'
+        include_examples 'wikis API updates wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
@@ -582,7 +414,7 @@ describe API::Wikis do
             put(api(url, user), params: payload)
           end
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
     end
@@ -595,7 +427,7 @@ describe API::Wikis do
           put(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -603,7 +435,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'updates wiki page'
+        include_examples 'wikis API updates wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
@@ -612,7 +444,7 @@ describe API::Wikis do
             put(api(url, user), params: payload)
           end
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
 
@@ -621,7 +453,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'updates wiki page'
+        include_examples 'wikis API updates wiki page'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
@@ -630,7 +462,7 @@ describe API::Wikis do
             put(api(url, user), params: payload)
           end
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
     end
@@ -638,7 +470,7 @@ describe API::Wikis do
     context 'when wiki belongs to a group project' do
       let(:project) { create(:project, :wiki_repo, namespace: group) }
 
-      include_examples 'updates wiki page'
+      include_examples 'wikis API updates wiki page'
     end
   end
 
@@ -654,7 +486,7 @@ describe API::Wikis do
           delete(api(url))
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -664,7 +496,7 @@ describe API::Wikis do
           delete(api(url, user))
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -674,7 +506,7 @@ describe API::Wikis do
           delete(api(url, user))
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
     end
 
@@ -686,7 +518,7 @@ describe API::Wikis do
           delete(api(url))
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -696,7 +528,7 @@ describe API::Wikis do
           delete(api(url, user))
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -706,7 +538,7 @@ describe API::Wikis do
           delete(api(url, user))
         end
 
-        include_examples '204 No Content'
+        include_examples 'wiki API 204 No Content'
       end
     end
 
@@ -718,7 +550,7 @@ describe API::Wikis do
           delete(api(url))
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -728,7 +560,7 @@ describe API::Wikis do
           delete(api(url, user))
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -738,12 +570,12 @@ describe API::Wikis do
           delete(api(url, user))
         end
 
-        include_examples '204 No Content'
+        include_examples 'wiki API 204 No Content'
 
         context 'when page is not existing' do
           let(:url) { "/projects/#{project.id}/wikis/unknown" }
 
-          include_examples '404 Wiki Page Not Found'
+          include_examples 'wiki API 404 Wiki Page Not Found'
         end
       end
     end
@@ -755,7 +587,7 @@ describe API::Wikis do
         delete(api(url, user))
       end
 
-      include_examples '204 No Content'
+      include_examples 'wiki API 204 No Content'
     end
   end
 
@@ -783,7 +615,7 @@ describe API::Wikis do
           post(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -792,7 +624,7 @@ describe API::Wikis do
           post(api(url, user), params: payload)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
 
       context 'when user is maintainer' do
@@ -801,7 +633,7 @@ describe API::Wikis do
           post(api(url, user), params: payload)
         end
 
-        include_examples '403 Forbidden'
+        include_examples 'wiki API 403 Forbidden'
       end
     end
 
@@ -813,7 +645,7 @@ describe API::Wikis do
           post(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -821,7 +653,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'uploads wiki attachment'
+        include_examples 'wiki API uploads wiki attachment'
       end
 
       context 'when user is maintainer' do
@@ -829,7 +661,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'uploads wiki attachment'
+        include_examples 'wiki API uploads wiki attachment'
       end
     end
 
@@ -841,7 +673,7 @@ describe API::Wikis do
           post(api(url), params: payload)
         end
 
-        include_examples '404 Project Not Found'
+        include_examples 'wiki API 404 Project Not Found'
       end
 
       context 'when user is developer' do
@@ -849,7 +681,7 @@ describe API::Wikis do
           project.add_developer(user)
         end
 
-        include_examples 'uploads wiki attachment'
+        include_examples 'wiki API uploads wiki attachment'
       end
 
       context 'when user is maintainer' do
@@ -857,7 +689,7 @@ describe API::Wikis do
           project.add_maintainer(user)
         end
 
-        include_examples 'uploads wiki attachment'
+        include_examples 'wiki API uploads wiki attachment'
       end
     end
   end