Merge remote-tracking branch 'origin/master' into 21698-redis-runner-last-build

16 files changed, 876 insertions, 235 deletions

diff --git a/spec/requests/api/commits_spec.rb b/spec/requests/api/commits_spec.rb
index 964cded917c..7f8ea5251f0 100644
--- a/spec/requests/api/commits_spec.rb
+++ b/spec/requests/api/commits_spec.rb
@@ -146,6 +146,16 @@ describe API::Commits, api: true  do
 
         expect(response).to have_http_status(400)
       end
+
+      context 'with project path in URL' do
+        let(:url) { "/projects/#{project.namespace.path}%2F#{project.path}/repository/commits" }
+
+        it 'a new file in project repo' do
+          post api(url, user), valid_c_params
+
+          expect(response).to have_http_status(201)
+        end
+      end
     end
 
     context :delete do
diff --git a/spec/requests/api/doorkeeper_access_spec.rb b/spec/requests/api/doorkeeper_access_spec.rb
index 5262a623761..bd9ecaf2685 100644
--- a/spec/requests/api/doorkeeper_access_spec.rb
+++ b/spec/requests/api/doorkeeper_access_spec.rb
@@ -5,7 +5,7 @@ describe API::API, api: true  do
 
   let!(:user) { create(:user) }
   let!(:application) { Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user) }
-  let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id }
+  let!(:token) { Doorkeeper::AccessToken.create! application_id: application.id, resource_owner_id: user.id, scopes: "api" }
 
   describe "when unauthenticated" do
     it "returns authentication success" do
diff --git a/spec/requests/api/environments_spec.rb b/spec/requests/api/environments_spec.rb
index 126496c43a5..b9d535bc314 100644
--- a/spec/requests/api/environments_spec.rb
+++ b/spec/requests/api/environments_spec.rb
@@ -46,6 +46,7 @@ describe API::Environments, api: true  do
 
         expect(response).to have_http_status(201)
         expect(json_response['name']).to eq('mepmep')
+        expect(json_response['slug']).to eq('mepmep')
         expect(json_response['external']).to be nil
       end
 
@@ -60,6 +61,13 @@ describe API::Environments, api: true  do
 
         expect(response).to have_http_status(400)
       end
+
+      it 'returns a 400 if slug is specified' do
+        post api("/projects/#{project.id}/environments", user), name: "foo", slug: "foo"
+
+        expect(response).to have_http_status(400)
+        expect(json_response["error"]).to eq("slug is automatically generated and cannot be changed")
+      end
     end
 
     context 'a non member' do
@@ -86,6 +94,15 @@ describe API::Environments, api: true  do
       expect(json_response['external_url']).to eq(url)
     end
 
+    it "won't allow slug to be changed" do
+      slug = environment.slug
+      api_url = api("/projects/#{project.id}/environments/#{environment.id}", user)
+      put api_url, slug: slug + "-foo"
+
+      expect(response).to have_http_status(400)
+      expect(json_response["error"]).to eq("slug is automatically generated and cannot be changed")
+    end
+
     it "won't update the external_url if only the name is passed" do
       url = environment.external_url
       put api("/projects/#{project.id}/environments/#{environment.id}", user),
diff --git a/spec/requests/api/files_spec.rb b/spec/requests/api/files_spec.rb
index 2081f80ccc1..685da28c673 100644
--- a/spec/requests/api/files_spec.rb
+++ b/spec/requests/api/files_spec.rb
@@ -4,7 +4,14 @@ describe API::Files, api: true  do
   include ApiHelpers
   let(:user) { create(:user) }
   let!(:project) { create(:project, namespace: user.namespace ) }
+  let(:guest) { create(:user).tap { |u| create(:project_member, :guest, user: u, project: project) } }
   let(:file_path) { 'files/ruby/popen.rb' }
+  let(:params) do
+    {
+      file_path: file_path,
+      ref: 'master'
+    }
+  end
   let(:author_email) { FFaker::Internet.email }
 
   # I have to remove periods from the end of the name
@@ -24,36 +31,72 @@ describe API::Files, api: true  do
   before { project.team << [user, :developer] }
 
   describe "GET /projects/:id/repository/files" do
-    it "returns file info" do
-      params = {
-        file_path: file_path,
-        ref: 'master',
-      }
+    let(:route) { "/projects/#{project.id}/repository/files" }
 
-      get api("/projects/#{project.id}/repository/files", user), params
+    shared_examples_for 'repository files' do
+      it "returns file info" do
+        get api(route, current_user), params
 
-      expect(response).to have_http_status(200)
-      expect(json_response['file_path']).to eq(file_path)
-      expect(json_response['file_name']).to eq('popen.rb')
-      expect(json_response['last_commit_id']).to eq('570e7b2abdd848b95f2f578043fc23bd6f6fd24d')
-      expect(Base64.decode64(json_response['content']).lines.first).to eq("require 'fileutils'\n")
-    end
+        expect(response).to have_http_status(200)
+        expect(json_response['file_path']).to eq(file_path)
+        expect(json_response['file_name']).to eq('popen.rb')
+        expect(json_response['last_commit_id']).to eq('570e7b2abdd848b95f2f578043fc23bd6f6fd24d')
+        expect(Base64.decode64(json_response['content']).lines.first).to eq("require 'fileutils'\n")
+      end
 
-    it "returns a 400 bad request if no params given" do
-      get api("/projects/#{project.id}/repository/files", user)
+      context 'when no params are given' do
+        it_behaves_like '400 response' do
+          let(:request) { get api(route, current_user) }
+        end
+      end
 
-      expect(response).to have_http_status(400)
+      context 'when file_path does not exist' do
+        let(:params) do
+          {
+            file_path: 'app/models/application.rb',
+            ref: 'master',
+          }
+        end
+
+        it_behaves_like '404 response' do
+          let(:request) { get api(route, current_user), params }
+          let(:message) { '404 File Not Found' }
+        end
+      end
+
+      context 'when repository is disabled' do
+        include_context 'disabled repository'
+
+        it_behaves_like '403 response' do
+          let(:request) { get api(route, current_user), params }
+        end
+      end
     end
 
-    it "returns a 404 if such file does not exist" do
-      params = {
-        file_path: 'app/models/application.rb',
-        ref: 'master',
-      }
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository files' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
+      end
+    end
 
-      get api("/projects/#{project.id}/repository/files", user), params
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route), params }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository files' do
+        let(:current_user) { user }
+      end
+    end
 
-      expect(response).to have_http_status(404)
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest), params }
+      end
     end
   end
 
diff --git a/spec/requests/api/groups_spec.rb b/spec/requests/api/groups_spec.rb
index a75ba824e85..e355d5e28bc 100644
--- a/spec/requests/api/groups_spec.rb
+++ b/spec/requests/api/groups_spec.rb
@@ -2,13 +2,13 @@ require 'spec_helper'
 
 describe API::Groups, api: true  do
   include ApiHelpers
+  include UploadHelpers
 
   let(:user1) { create(:user, can_create_group: false) }
   let(:user2) { create(:user) }
   let(:user3) { create(:user) }
   let(:admin) { create(:admin) }
-  let(:avatar_file_path) { File.join(Rails.root, 'spec', 'fixtures', 'banana_sample.gif') }
-  let!(:group1) { create(:group, avatar: File.open(avatar_file_path)) }
+  let!(:group1) { create(:group, avatar: File.open(uploaded_image_temp_path)) }
   let!(:group2) { create(:group, :private) }
   let!(:project1) { create(:project, namespace: group1) }
   let!(:project2) { create(:project, namespace: group2) }
@@ -23,6 +23,7 @@ describe API::Groups, api: true  do
     context "when unauthenticated" do
       it "returns authentication error" do
         get api("/groups")
+
         expect(response).to have_http_status(401)
       end
     end
@@ -30,20 +31,55 @@ describe API::Groups, api: true  do
     context "when authenticated as user" do
       it "normal user: returns an array of groups of user1" do
         get api("/groups", user1)
+
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.length).to eq(1)
         expect(json_response.first['name']).to eq(group1.name)
       end
+
+      it "does not include statistics" do
+        get api("/groups", user1), statistics: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).not_to include 'statistics'
+      end
     end
 
     context "when authenticated as admin" do
       it "admin: returns an array of all groups" do
         get api("/groups", admin)
+
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.length).to eq(2)
       end
+
+      it "does not include statistics by default" do
+        get api("/groups", admin)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).not_to include('statistics')
+      end
+
+      it "includes statistics if requested" do
+        attributes = {
+          storage_size: 702,
+          repository_size: 123,
+          lfs_objects_size: 234,
+          build_artifacts_size: 345,
+        }
+
+        project1.statistics.update!(attributes)
+
+        get api("/groups", admin), statistics: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first['statistics']).to eq attributes.stringify_keys
+      end
     end
 
     context "when using skip_groups in request" do
@@ -61,6 +97,7 @@ describe API::Groups, api: true  do
 
       it "returns all groups you have access to" do
         public_group = create :group, :public
+
         get api("/groups", user1), all_available: true
 
         expect(response).to have_http_status(200)
@@ -107,6 +144,7 @@ describe API::Groups, api: true  do
     context 'when unauthenticated' do
       it 'returns authentication error' do
         get api('/groups/owned')
+
         expect(response).to have_http_status(401)
       end
     end
@@ -114,6 +152,7 @@ describe API::Groups, api: true  do
     context 'when authenticated as group owner' do
       it 'returns an array of groups the user owns' do
         get api('/groups/owned', user2)
+
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.first['name']).to eq(group2.name)
@@ -146,6 +185,7 @@ describe API::Groups, api: true  do
 
       it "does not return a non existing group" do
         get api("/groups/1328", user1)
+
         expect(response).to have_http_status(404)
       end
 
@@ -159,12 +199,14 @@ describe API::Groups, api: true  do
     context "when authenticated as admin" do
       it "returns any existing group" do
         get api("/groups/#{group2.id}", admin)
+
         expect(response).to have_http_status(200)
         expect(json_response['name']).to eq(group2.name)
       end
 
       it "does not return a non existing group" do
         get api("/groups/1328", admin)
+
         expect(response).to have_http_status(404)
       end
     end
@@ -172,12 +214,14 @@ describe API::Groups, api: true  do
     context 'when using group path in URL' do
       it 'returns any existing group' do
         get api("/groups/#{group1.path}", admin)
+
         expect(response).to have_http_status(200)
         expect(json_response['name']).to eq(group1.name)
       end
 
       it 'does not return a non existing group' do
         get api('/groups/unknown', admin)
+
         expect(response).to have_http_status(404)
       end
 
@@ -269,6 +313,7 @@ describe API::Groups, api: true  do
 
       it "does not return a non existing group" do
         get api("/groups/1328/projects", user1)
+
         expect(response).to have_http_status(404)
       end
 
@@ -292,6 +337,7 @@ describe API::Groups, api: true  do
     context "when authenticated as admin" do
       it "should return any existing group" do
         get api("/groups/#{group2.id}/projects", admin)
+
         expect(response).to have_http_status(200)
         expect(json_response.length).to eq(1)
         expect(json_response.first['name']).to eq(project2.name)
@@ -299,6 +345,7 @@ describe API::Groups, api: true  do
 
       it "should not return a non existing group" do
         get api("/groups/1328/projects", admin)
+
         expect(response).to have_http_status(404)
       end
     end
@@ -314,6 +361,7 @@ describe API::Groups, api: true  do
 
       it 'does not return a non existing group' do
         get api('/groups/unknown/projects', admin)
+
         expect(response).to have_http_status(404)
       end
 
@@ -329,6 +377,7 @@ describe API::Groups, api: true  do
     context "when authenticated as user without group permissions" do
       it "does not create group" do
         post api("/groups", user1), attributes_for(:group)
+
         expect(response).to have_http_status(403)
       end
     end
@@ -338,6 +387,7 @@ describe API::Groups, api: true  do
         group = attributes_for(:group, { request_access_enabled: false })
 
         post api("/groups", user3), group
+
         expect(response).to have_http_status(201)
 
         expect(json_response["name"]).to eq(group[:name])
@@ -347,17 +397,20 @@ describe API::Groups, api: true  do
 
       it "does not create group, duplicate" do
         post api("/groups", user3), { name: 'Duplicate Test', path: group2.path }
+
         expect(response).to have_http_status(400)
         expect(response.message).to eq("Bad Request")
       end
 
       it "returns 400 bad request error if name not given" do
         post api("/groups", user3), { path: group2.path }
+
         expect(response).to have_http_status(400)
       end
 
       it "returns 400 bad request error if path not given" do
         post api("/groups", user3), { name: 'test' }
+
         expect(response).to have_http_status(400)
       end
     end
@@ -367,18 +420,22 @@ describe API::Groups, api: true  do
     context "when authenticated as user" do
       it "removes group" do
         delete api("/groups/#{group1.id}", user1)
+
         expect(response).to have_http_status(200)
       end
 
       it "does not remove a group if not an owner" do
         user4 = create(:user)
         group1.add_master(user4)
+
         delete api("/groups/#{group1.id}", user3)
+
         expect(response).to have_http_status(403)
       end
 
       it "does not remove a non existing group" do
         delete api("/groups/1328", user1)
+
         expect(response).to have_http_status(404)
       end
 
@@ -392,11 +449,13 @@ describe API::Groups, api: true  do
     context "when authenticated as admin" do
       it "removes any existing group" do
         delete api("/groups/#{group2.id}", admin)
+
         expect(response).to have_http_status(200)
       end
 
       it "does not remove a non existing group" do
         delete api("/groups/1328", admin)
+
         expect(response).to have_http_status(404)
       end
     end
@@ -404,15 +463,17 @@ describe API::Groups, api: true  do
 
   describe "POST /groups/:id/projects/:project_id" do
     let(:project) { create(:project) }
+    let(:project_path) { "#{project.namespace.path}%2F#{project.path}" }
+
     before(:each) do
       allow_any_instance_of(Projects::TransferService).
         to receive(:execute).and_return(true)
-      allow(Project).to receive(:find).and_return(project)
     end
 
     context "when authenticated as user" do
       it "does not transfer project to group" do
         post api("/groups/#{group1.id}/projects/#{project.id}", user2)
+
         expect(response).to have_http_status(403)
       end
     end
@@ -420,8 +481,45 @@ describe API::Groups, api: true  do
     context "when authenticated as admin" do
       it "transfers project to group" do
         post api("/groups/#{group1.id}/projects/#{project.id}", admin)
+
         expect(response).to have_http_status(201)
       end
+
+      context 'when using project path in URL' do
+        context 'with a valid project path' do
+          it "transfers project to group" do
+            post api("/groups/#{group1.id}/projects/#{project_path}", admin)
+
+            expect(response).to have_http_status(201)
+          end
+        end
+
+        context 'with a non-existent project path' do
+          it "does not transfer project to group" do
+            post api("/groups/#{group1.id}/projects/nogroup%2Fnoproject", admin)
+
+            expect(response).to have_http_status(404)
+          end
+        end
+      end
+
+      context 'when using a group path in URL' do
+        context 'with a valid group path' do
+          it "transfers project to group" do
+            post api("/groups/#{group1.path}/projects/#{project_path}", admin)
+
+            expect(response).to have_http_status(201)
+          end
+        end
+
+        context 'with a non-existent group path' do
+          it "does not transfer project to group" do
+            post api("/groups/noexist/projects/#{project_path}", admin)
+
+            expect(response).to have_http_status(404)
+          end
+        end
+      end
     end
   end
 end
diff --git a/spec/requests/api/helpers_spec.rb b/spec/requests/api/helpers_spec.rb
index 4035fd97af5..b8ee2293a33 100644
--- a/spec/requests/api/helpers_spec.rb
+++ b/spec/requests/api/helpers_spec.rb
@@ -1,6 +1,7 @@
 require 'spec_helper'
 
 describe API::Helpers, api: true do
+  include API::APIGuard::HelperMethods
   include API::Helpers
   include SentryHelper
 
@@ -15,24 +16,24 @@ describe API::Helpers, api: true do
   def set_env(user_or_token, identifier)
     clear_env
     clear_param
-    env[API::Helpers::PRIVATE_TOKEN_HEADER] = user_or_token.respond_to?(:private_token) ? user_or_token.private_token : user_or_token
+    env[API::APIGuard::PRIVATE_TOKEN_HEADER] = user_or_token.respond_to?(:private_token) ? user_or_token.private_token : user_or_token
     env[API::Helpers::SUDO_HEADER] = identifier.to_s
   end
 
   def set_param(user_or_token, identifier)
     clear_env
     clear_param
-    params[API::Helpers::PRIVATE_TOKEN_PARAM] = user_or_token.respond_to?(:private_token) ? user_or_token.private_token : user_or_token
+    params[API::APIGuard::PRIVATE_TOKEN_PARAM] = user_or_token.respond_to?(:private_token) ? user_or_token.private_token : user_or_token
     params[API::Helpers::SUDO_PARAM] = identifier.to_s
   end
 
   def clear_env
-    env.delete(API::Helpers::PRIVATE_TOKEN_HEADER)
+    env.delete(API::APIGuard::PRIVATE_TOKEN_HEADER)
     env.delete(API::Helpers::SUDO_HEADER)
   end
 
   def clear_param
-    params.delete(API::Helpers::PRIVATE_TOKEN_PARAM)
+    params.delete(API::APIGuard::PRIVATE_TOKEN_PARAM)
     params.delete(API::Helpers::SUDO_PARAM)
   end
 
@@ -94,22 +95,28 @@ describe API::Helpers, api: true do
 
     describe "when authenticating using a user's private token" do
       it "returns nil for an invalid token" do
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = 'invalid token'
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = 'invalid token'
         allow_any_instance_of(self.class).to receive(:doorkeeper_guard){ false }
+
         expect(current_user).to be_nil
       end
 
       it "returns nil for a user without access" do
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = user.private_token
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = user.private_token
         allow_any_instance_of(Gitlab::UserAccess).to receive(:allowed?).and_return(false)
+
         expect(current_user).to be_nil
       end
 
       it "leaves user as is when sudo not specified" do
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = user.private_token
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = user.private_token
+
         expect(current_user).to eq(user)
+
         clear_env
-        params[API::Helpers::PRIVATE_TOKEN_PARAM] = user.private_token
+
+        params[API::APIGuard::PRIVATE_TOKEN_PARAM] = user.private_token
+
         expect(current_user).to eq(user)
       end
     end
@@ -117,37 +124,51 @@ describe API::Helpers, api: true do
     describe "when authenticating using a user's personal access tokens" do
       let(:personal_access_token) { create(:personal_access_token, user: user) }
 
+      before do
+        allow_any_instance_of(self.class).to receive(:doorkeeper_guard) { false }
+      end
+
       it "returns nil for an invalid token" do
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = 'invalid token'
-        allow_any_instance_of(self.class).to receive(:doorkeeper_guard){ false }
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = 'invalid token'
+
         expect(current_user).to be_nil
       end
 
       it "returns nil for a user without access" do
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = personal_access_token.token
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token
         allow_any_instance_of(Gitlab::UserAccess).to receive(:allowed?).and_return(false)
+
+        expect(current_user).to be_nil
+      end
+
+      it "returns nil for a token without the appropriate scope" do
+        personal_access_token = create(:personal_access_token, user: user, scopes: ['read_user'])
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token
+        allow_access_with_scope('write_user')
+
         expect(current_user).to be_nil
       end
 
       it "leaves user as is when sudo not specified" do
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = personal_access_token.token
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token
         expect(current_user).to eq(user)
         clear_env
-        params[API::Helpers::PRIVATE_TOKEN_PARAM] = personal_access_token.token
+        params[API::APIGuard::PRIVATE_TOKEN_PARAM] = personal_access_token.token
+
         expect(current_user).to eq(user)
       end
 
       it 'does not allow revoked tokens' do
         personal_access_token.revoke!
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = personal_access_token.token
-        allow_any_instance_of(self.class).to receive(:doorkeeper_guard){ false }
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token
+
         expect(current_user).to be_nil
       end
 
       it 'does not allow expired tokens' do
         personal_access_token.update_attributes!(expires_at: 1.day.ago)
-        env[API::Helpers::PRIVATE_TOKEN_HEADER] = personal_access_token.token
-        allow_any_instance_of(self.class).to receive(:doorkeeper_guard){ false }
+        env[API::APIGuard::PRIVATE_TOKEN_HEADER] = personal_access_token.token
+
         expect(current_user).to be_nil
       end
     end
@@ -375,7 +396,7 @@ describe API::Helpers, api: true do
     %w[HEAD GET].each do |method_name|
       context "method is #{method_name}" do
         before do
-          expect_any_instance_of(self.class).to receive(:route).and_return(double(route_method: method_name))
+          expect_any_instance_of(self.class).to receive(:route).and_return(double(request_method: method_name))
         end
 
         it 'does not raise an error' do
@@ -389,7 +410,7 @@ describe API::Helpers, api: true do
     %w[POST PUT PATCH DELETE].each do |method_name|
       context "method is #{method_name}" do
         before do
-          expect_any_instance_of(self.class).to receive(:route).and_return(double(route_method: method_name))
+          expect_any_instance_of(self.class).to receive(:route).and_return(double(request_method: method_name))
         end
 
         it 'calls authenticate!' do
diff --git a/spec/requests/api/issues_spec.rb b/spec/requests/api/issues_spec.rb
index 5c80dd98dc7..807c999b84a 100644
--- a/spec/requests/api/issues_spec.rb
+++ b/spec/requests/api/issues_spec.rb
@@ -50,6 +50,8 @@ describe API::Issues, api: true  do
   end
   let!(:note) { create(:note_on_issue, author: user, project: project, noteable: issue) }
 
+  let(:no_milestone_title) { URI.escape(Milestone::None.title) }
+
   before do
     project.team << [user, :reporter]
     project.team << [guest, :guest]
@@ -107,6 +109,7 @@ describe API::Issues, api: true  do
 
       it 'returns an array of labeled issues when at least one label matches' do
         get api("/issues?labels=#{label.title},foo,bar", user)
+
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.length).to eq(1)
@@ -136,6 +139,51 @@ describe API::Issues, api: true  do
         expect(json_response.length).to eq(0)
       end
 
+      it 'returns an empty array if no issue matches milestone' do
+        get api("/issues?milestone=#{empty_milestone.title}", user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(0)
+      end
+
+      it 'returns an empty array if milestone does not exist' do
+        get api("/issues?milestone=foo", user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(0)
+      end
+
+      it 'returns an array of issues in given milestone' do
+        get api("/issues?milestone=#{milestone.title}", user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(2)
+        expect(json_response.first['id']).to eq(issue.id)
+        expect(json_response.second['id']).to eq(closed_issue.id)
+      end
+
+      it 'returns an array of issues matching state in milestone' do
+        get api("/issues?milestone=#{milestone.title}"\
+                '&state=closed', user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(1)
+        expect(json_response.first['id']).to eq(closed_issue.id)
+      end
+
+      it 'returns an array of issues with no milestone' do
+        get api("/issues?milestone=#{no_milestone_title}", author)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.length).to eq(1)
+        expect(json_response.first['id']).to eq(confidential_issue.id)
+      end
+
       it 'sorts by created_at descending by default' do
         get api('/issues', user)
         response_dates = json_response.map { |issue| issue['created_at'] }
@@ -318,6 +366,15 @@ describe API::Issues, api: true  do
       expect(json_response.first['id']).to eq(group_closed_issue.id)
     end
 
+    it 'returns an array of issues with no milestone' do
+      get api("#{base_url}?milestone=#{no_milestone_title}", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response).to be_an Array
+      expect(json_response.length).to eq(1)
+      expect(json_response.first['id']).to eq(group_confidential_issue.id)
+    end
+
     it 'sorts by created_at descending by default' do
       get api(base_url, user)
       response_dates = json_response.map { |issue| issue['created_at'] }
@@ -357,7 +414,6 @@ describe API::Issues, api: true  do
 
   describe "GET /projects/:id/issues" do
     let(:base_url) { "/projects/#{project.id}" }
-    let(:title) { milestone.title }
 
     it "returns 404 on private projects for other users" do
       private_project = create(:empty_project, :private)
@@ -433,8 +489,9 @@ describe API::Issues, api: true  do
       expect(json_response.first['labels']).to eq([label.title])
     end
 
-    it 'returns an array of labeled project issues when at least one label matches' do
+    it 'returns an array of labeled project issues where all labels match' do
       get api("#{base_url}/issues?labels=#{label.title},foo,bar", user)
+
       expect(response).to have_http_status(200)
       expect(json_response).to be_an Array
       expect(json_response.length).to eq(1)
@@ -463,7 +520,8 @@ describe API::Issues, api: true  do
     end
 
     it 'returns an array of issues in given milestone' do
-      get api("#{base_url}/issues?milestone=#{title}", user)
+      get api("#{base_url}/issues?milestone=#{milestone.title}", user)
+
       expect(response).to have_http_status(200)
       expect(json_response).to be_an Array
       expect(json_response.length).to eq(2)
@@ -480,6 +538,15 @@ describe API::Issues, api: true  do
       expect(json_response.first['id']).to eq(closed_issue.id)
     end
 
+    it 'returns an array of issues with no milestone' do
+      get api("#{base_url}/issues?milestone=#{no_milestone_title}", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response).to be_an Array
+      expect(json_response.length).to eq(1)
+      expect(json_response.first['id']).to eq(confidential_issue.id)
+    end
+
     it 'sorts by created_at descending by default' do
       get api("#{base_url}/issues", user)
       response_dates = json_response.map { |issue| issue['created_at'] }
@@ -547,12 +614,21 @@ describe API::Issues, api: true  do
 
     it 'returns a project issue by iid' do
       get api("/projects/#{project.id}/issues?iid=#{issue.iid}", user)
+
       expect(response.status).to eq 200
+      expect(json_response.length).to eq 1
       expect(json_response.first['title']).to eq issue.title
       expect(json_response.first['id']).to eq issue.id
       expect(json_response.first['iid']).to eq issue.iid
     end
 
+    it 'returns an empty array for an unknown project issue iid' do
+      get api("/projects/#{project.id}/issues?iid=#{issue.iid + 10}", user)
+
+      expect(response.status).to eq 200
+      expect(json_response.length).to eq 0
+    end
+
     it "returns 404 if issue id not found" do
       get api("/projects/#{project.id}/issues/54321", user)
       expect(response).to have_http_status(404)
@@ -932,6 +1008,13 @@ describe API::Issues, api: true  do
       expect(json_response['state']).to eq "closed"
     end
 
+    it 'reopens a project isssue' do
+      put api("/projects/#{project.id}/issues/#{closed_issue.id}", user), state_event: 'reopen'
+
+      expect(response).to have_http_status(200)
+      expect(json_response['state']).to eq 'reopened'
+    end
+
     context 'when an admin or owner makes the request' do
       it 'accepts the update date to be set' do
         update_time = 2.weeks.ago
@@ -1110,4 +1193,10 @@ describe API::Issues, api: true  do
       expect(response).to have_http_status(404)
     end
   end
+
+  describe 'time tracking endpoints' do
+    let(:issuable) { issue }
+
+    include_examples 'time tracking endpoints', 'issue'
+  end
 end
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index f032d1b683d..4e4fea1dad8 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -6,7 +6,7 @@ describe API::MergeRequests, api: true  do
   let(:user)        { create(:user) }
   let(:admin)       { create(:user, :admin) }
   let(:non_member)  { create(:user) }
-  let!(:project)    { create(:project, creator_id: user.id, namespace: user.namespace) }
+  let!(:project)    { create(:project, :public, creator_id: user.id, namespace: user.namespace) }
   let!(:merge_request) { create(:merge_request, :simple, author: user, assignee: user, source_project: project, target_project: project, title: "Test", created_at: base_time) }
   let!(:merge_request_closed) { create(:merge_request, state: "closed", author: user, assignee: user, source_project: project, target_project: project, title: "Closed test", created_at: base_time + 1.second) }
   let!(:merge_request_merged) { create(:merge_request, state: "merged", author: user, assignee: user, source_project: project, target_project: project, title: "Merged test", created_at: base_time + 2.seconds, merge_commit_sha: '9999999999999999999999999999999999999999') }
@@ -671,6 +671,12 @@ describe API::MergeRequests, api: true  do
     end
   end
 
+  describe 'Time tracking' do
+    let(:issuable) { merge_request }
+
+    include_examples 'time tracking endpoints', 'merge_request'
+  end
+
   def mr_with_later_created_and_updated_at_time
     merge_request
     merge_request.created_at += 1.hour
diff --git a/spec/requests/api/project_hooks_spec.rb b/spec/requests/api/project_hooks_spec.rb
index a42cedae614..36fbcf088e7 100644
--- a/spec/requests/api/project_hooks_spec.rb
+++ b/spec/requests/api/project_hooks_spec.rb
@@ -86,7 +86,8 @@ describe API::ProjectHooks, 'ProjectHooks', api: true do
   describe "POST /projects/:id/hooks" do
     it "adds hook to project" do
       expect do
-        post api("/projects/#{project.id}/hooks", user), url: "http://example.com", issues_events: true
+        post api("/projects/#{project.id}/hooks", user),
+          url: "http://example.com", issues_events: true, wiki_page_events: true
       end.to change {project.hooks.count}.by(1)
 
       expect(response).to have_http_status(201)
@@ -98,7 +99,7 @@ describe API::ProjectHooks, 'ProjectHooks', api: true do
       expect(json_response['note_events']).to eq(false)
       expect(json_response['build_events']).to eq(false)
       expect(json_response['pipeline_events']).to eq(false)
-      expect(json_response['wiki_page_events']).to eq(false)
+      expect(json_response['wiki_page_events']).to eq(true)
       expect(json_response['enable_ssl_verification']).to eq(true)
       expect(json_response).not_to include('token')
     end
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index c5d67a90abc..cdb16b4c46b 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -49,7 +49,7 @@ describe API::Projects, api: true  do
       end
     end
 
-    context 'when authenticated' do
+    context 'when authenticated as regular user' do
       it 'returns an array of projects' do
         get api('/projects', user)
         expect(response).to have_http_status(200)
@@ -167,11 +167,27 @@ describe API::Projects, api: true  do
         expect(json_response).to satisfy do |response|
           response.one? do |entry|
             entry.has_key?('permissions') &&
-            entry['name'] == project.name &&
+              entry['name'] == project.name &&
               entry['owner']['username'] == user.username
           end
         end
       end
+
+      it "does not include statistics by default" do
+        get api('/projects/all', admin)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).not_to include('statistics')
+      end
+
+      it "includes statistics if requested" do
+        get api('/projects/all', admin), statistics: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).to include 'statistics'
+      end
     end
   end
 
@@ -196,6 +212,32 @@ describe API::Projects, api: true  do
         expect(json_response.first['name']).to eq(project4.name)
         expect(json_response.first['owner']['username']).to eq(user4.username)
       end
+
+      it "does not include statistics by default" do
+        get api('/projects/owned', user4)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).not_to include('statistics')
+      end
+
+      it "includes statistics if requested" do
+        attributes = {
+          commit_count: 23,
+          storage_size: 702,
+          repository_size: 123,
+          lfs_objects_size: 234,
+          build_artifacts_size: 345,
+        }
+
+        project4.statistics.update!(attributes)
+
+        get api('/projects/owned', user4), statistics: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first['statistics']).to eq attributes.stringify_keys
+      end
     end
   end
 
@@ -630,6 +672,18 @@ describe API::Projects, api: true  do
         expect(json_response['name']).to eq(project.name)
       end
 
+      it 'exposes namespace fields' do
+        get api("/projects/#{project.id}", user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response['namespace']).to eq({
+          'id' => user.namespace.id,
+          'name' => user.namespace.name,
+          'path' => user.namespace.path,
+          'kind' => user.namespace.kind,
+        })
+      end
+
       describe 'permissions' do
         context 'all projects' do
           before { project.team << [user, :master] }
@@ -1031,7 +1085,7 @@ describe API::Projects, api: true  do
   end
 
   describe 'GET /projects/search/:query' do
-    let!(:query) { 'query'}
+    let!(:query)            { 'query'}
     let!(:search)           { create(:empty_project, name: query, creator_id: user.id, namespace: user.namespace) }
     let!(:pre)              { create(:empty_project, name: "pre_#{query}", creator_id: user.id, namespace: user.namespace) }
     let!(:post)             { create(:empty_project, name: "#{query}_post", creator_id: user.id, namespace: user.namespace) }
@@ -1041,32 +1095,37 @@ describe API::Projects, api: true  do
     let!(:unfound_internal) { create(:empty_project, :internal, name: 'unfound internal') }
     let!(:public)           { create(:empty_project, :public, name: "public #{query}") }
     let!(:unfound_public)   { create(:empty_project, :public, name: 'unfound public') }
+    let!(:one_dot_two)      { create(:empty_project, :public, name: "one.dot.two") }
 
     shared_examples_for 'project search response' do |args = {}|
       it 'returns project search responses' do
-        get api("/projects/search/#{query}", current_user)
+        get api("/projects/search/#{args[:query]}", current_user)
 
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.size).to eq(args[:results])
-        json_response.each { |project| expect(project['name']).to match(args[:match_regex] || /.*query.*/) }
+        json_response.each { |project| expect(project['name']).to match(args[:match_regex] || /.*#{args[:query]}.*/) }
       end
     end
 
     context 'when unauthenticated' do
-      it_behaves_like 'project search response', results: 1 do
+      it_behaves_like 'project search response', query: 'query', results: 1 do
         let(:current_user) { nil }
       end
     end
 
     context 'when authenticated' do
-      it_behaves_like 'project search response', results: 6 do
+      it_behaves_like 'project search response', query: 'query', results: 6 do
+        let(:current_user) { user }
+      end
+      it_behaves_like 'project search response', query: 'one.dot.two', results: 1 do
         let(:current_user) { user }
       end
+      
     end
 
     context 'when authenticated as a different user' do
-      it_behaves_like 'project search response', results: 2, match_regex: /(internal|public) query/ do
+      it_behaves_like 'project search response', query: 'query', results: 2, match_regex: /(internal|public) query/ do
         let(:current_user) { user2 }
       end
     end
diff --git a/spec/requests/api/repositories_spec.rb b/spec/requests/api/repositories_spec.rb
index c90b69e8ebb..0b19fa38c55 100644
--- a/spec/requests/api/repositories_spec.rb
+++ b/spec/requests/api/repositories_spec.rb
@@ -7,204 +7,415 @@ describe API::Repositories, api: true  do
   include WorkhorseHelpers
 
   let(:user) { create(:user) }
-  let(:user2) { create(:user) }
+  let(:guest) { create(:user).tap { |u| create(:project_member, :guest, user: u, project: project) } }
   let!(:project) { create(:project, creator_id: user.id) }
   let!(:master) { create(:project_member, :master, user: user, project: project) }
-  let!(:guest) { create(:project_member, :guest, user: user2, project: project) }
 
   describe "GET /projects/:id/repository/tree" do
-    context "authorized user" do
-      before { project.team << [user2, :reporter] }
+    let(:route) { "/projects/#{project.id}/repository/tree" }
 
-      it "returns project commits" do
-        get api("/projects/#{project.id}/repository/tree", user)
+    shared_examples_for 'repository tree' do
+      it 'returns the repository tree' do
+        get api(route, current_user)
 
         expect(response).to have_http_status(200)
 
+        first_commit = json_response.first
+
         expect(json_response).to be_an Array
-        expect(json_response.first['name']).to eq('bar')
-        expect(json_response.first['type']).to eq('tree')
-        expect(json_response.first['mode']).to eq('040000')
+        expect(first_commit['name']).to eq('bar')
+        expect(first_commit['type']).to eq('tree')
+        expect(first_commit['mode']).to eq('040000')
+      end
+
+      context 'when ref does not exist' do
+        it_behaves_like '404 response' do
+          let(:request) { get api("#{route}?ref_name=foo", current_user) }
+          let(:message) { '404 Tree Not Found' }
+        end
       end
 
-      it 'returns a 404 for unknown ref' do
-        get api("/projects/#{project.id}/repository/tree?ref_name=foo", user)
-        expect(response).to have_http_status(404)
+      context 'when repository is disabled' do
+        include_context 'disabled repository'
 
-        expect(json_response).to be_an Object
-        json_response['message'] == '404 Tree Not Found'
+        it_behaves_like '403 response' do
+          let(:request) { get api(route, current_user) }
+        end
+      end
+
+      context 'with recursive=1' do
+        it 'returns recursive project paths tree' do
+          get api("#{route}?recursive=1", current_user)
+
+          expect(response.status).to eq(200)
+          expect(json_response).to be_an Array
+          expect(json_response[4]['name']).to eq('html')
+          expect(json_response[4]['path']).to eq('files/html')
+          expect(json_response[4]['type']).to eq('tree')
+          expect(json_response[4]['mode']).to eq('040000')
+        end
+
+        context 'when repository is disabled' do
+          include_context 'disabled repository'
+
+          it_behaves_like '403 response' do
+            let(:request) { get api(route, current_user) }
+          end
+        end
+
+        context 'when ref does not exist' do
+          it_behaves_like '404 response' do
+            let(:request) { get api("#{route}?recursive=1&ref_name=foo", current_user) }
+            let(:message) { '404 Tree Not Found' }
+          end
+        end
       end
     end
 
-    context "unauthorized user" do
-      it "does not return project commits" do
-        get api("/projects/#{project.id}/repository/tree")
-        expect(response).to have_http_status(401)
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository tree' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
       end
     end
-  end
 
-  describe 'GET /projects/:id/repository/tree?recursive=1' do
-    context 'authorized user' do
-      before { project.team << [user2, :reporter] }
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository tree' do
+        let(:current_user) { user }
+      end
+    end
 
-      it 'should return recursive project paths tree' do
-        get api("/projects/#{project.id}/repository/tree?recursive=1", user)
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest) }
+      end
+    end
+  end
 
-        expect(response.status).to eq(200)
+  {
+    'blobs/:sha' => 'blobs/master',
+    'commits/:sha/blob' => 'commits/master/blob'
+  }.each do |desc_path, example_path|
+    describe "GET /projects/:id/repository/#{desc_path}" do
+      let(:route) { "/projects/#{project.id}/repository/#{example_path}?filepath=README.md" }
+
+      shared_examples_for 'repository blob' do
+        it 'returns the repository blob' do
+          get api(route, current_user)
+
+          expect(response).to have_http_status(200)
+        end
+
+        context 'when sha does not exist' do
+          it_behaves_like '404 response' do
+            let(:request) { get api(route.sub('master', 'invalid_branch_name'), current_user) }
+            let(:message) { '404 Commit Not Found' }
+          end
+        end
+
+        context 'when filepath does not exist' do
+          it_behaves_like '404 response' do
+            let(:request) { get api(route.sub('README.md', 'README.invalid'), current_user) }
+            let(:message) { '404 File Not Found' }
+          end
+        end
+
+        context 'when no filepath is given' do
+          it_behaves_like '400 response' do
+            let(:request) { get api(route.sub('?filepath=README.md', ''), current_user) }
+          end
+        end
+
+        context 'when repository is disabled' do
+          include_context 'disabled repository'
+
+          it_behaves_like '403 response' do
+            let(:request) { get api(route, current_user) }
+          end
+        end
+      end
 
-        expect(json_response).to be_an Array
-        expect(json_response[4]['name']).to eq('html')
-        expect(json_response[4]['path']).to eq('files/html')
-        expect(json_response[4]['type']).to eq('tree')
-        expect(json_response[4]['mode']).to eq('040000')
+      context 'when unauthenticated', 'and project is public' do
+        it_behaves_like 'repository blob' do
+          let(:project) { create(:project, :public) }
+          let(:current_user) { nil }
+        end
       end
 
-      it 'returns a 404 for unknown ref' do
-        get api("/projects/#{project.id}/repository/tree?ref_name=foo&recursive=1", user)
-        expect(response).to have_http_status(404)
+      context 'when unauthenticated', 'and project is private' do
+        it_behaves_like '404 response' do
+          let(:request) { get api(route) }
+          let(:message) { '404 Project Not Found' }
+        end
+      end
 
-        expect(json_response).to be_an Object
-        json_response['message'] == '404 Tree Not Found'
+      context 'when authenticated', 'as a developer' do
+        it_behaves_like 'repository blob' do
+          let(:current_user) { user }
+        end
       end
-    end
 
-    context "unauthorized user" do
-      it "does not return project commits" do
-        get api("/projects/#{project.id}/repository/tree?recursive=1")
-        expect(response).to have_http_status(401)
+      context 'when authenticated', 'as a guest' do
+        it_behaves_like '403 response' do
+          let(:request) { get api(route, guest) }
+        end
       end
     end
   end
 
-  describe "GET /projects/:id/repository/blobs/:sha" do
-    it "gets the raw file contents" do
-      get api("/projects/#{project.id}/repository/blobs/master?filepath=README.md", user)
-      expect(response).to have_http_status(200)
+  describe "GET /projects/:id/repository/raw_blobs/:sha" do
+    let(:route) { "/projects/#{project.id}/repository/raw_blobs/#{sample_blob.oid}" }
+
+    shared_examples_for 'repository raw blob' do
+      it 'returns the repository raw blob' do
+        get api(route, current_user)
+
+        expect(response).to have_http_status(200)
+      end
+
+      context 'when sha does not exist' do
+        it_behaves_like '404 response' do
+          let(:request) { get api(route.sub(sample_blob.oid, '123456'), current_user) }
+          let(:message) { '404 Blob Not Found' }
+        end
+      end
+
+      context 'when repository is disabled' do
+        include_context 'disabled repository'
+
+        it_behaves_like '403 response' do
+          let(:request) { get api(route, current_user) }
+        end
+      end
     end
 
-    it "returns 404 for invalid branch_name" do
-      get api("/projects/#{project.id}/repository/blobs/invalid_branch_name?filepath=README.md", user)
-      expect(response).to have_http_status(404)
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository raw blob' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
+      end
     end
 
-    it "returns 404 for invalid file" do
-      get api("/projects/#{project.id}/repository/blobs/master?filepath=README.invalid", user)
-      expect(response).to have_http_status(404)
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
     end
 
-    it "returns a 400 error if filepath is missing" do
-      get api("/projects/#{project.id}/repository/blobs/master", user)
-      expect(response).to have_http_status(400)
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository raw blob' do
+        let(:current_user) { user }
+      end
     end
-  end
 
-  describe "GET /projects/:id/repository/commits/:sha/blob" do
-    it "gets the raw file contents" do
-      get api("/projects/#{project.id}/repository/commits/master/blob?filepath=README.md", user)
-      expect(response).to have_http_status(200)
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest) }
+      end
     end
   end
 
-  describe "GET /projects/:id/repository/raw_blobs/:sha" do
-    it "gets the raw file contents" do
-      get api("/projects/#{project.id}/repository/raw_blobs/#{sample_blob.oid}", user)
-      expect(response).to have_http_status(200)
-    end
+  describe "GET /projects/:id/repository/archive(.:format)?:sha" do
+    let(:route) { "/projects/#{project.id}/repository/archive" }
+
+    shared_examples_for 'repository archive' do
+      it 'returns the repository archive' do
+        get api(route, current_user)
+
+        expect(response).to have_http_status(200)
 
-    it 'returns a 404 for unknown blob' do
-      get api("/projects/#{project.id}/repository/raw_blobs/123456", user)
-      expect(response).to have_http_status(404)
+        repo_name = project.repository.name.gsub("\.git", "")
+        type, params = workhorse_send_data
 
-      expect(json_response).to be_an Object
-      json_response['message'] == '404 Blob Not Found'
+        expect(type).to eq('git-archive')
+        expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.tar.gz/)
+      end
+
+      it 'returns the repository archive archive.zip' do
+        get api("/projects/#{project.id}/repository/archive.zip", user)
+
+        expect(response).to have_http_status(200)
+
+        repo_name = project.repository.name.gsub("\.git", "")
+        type, params = workhorse_send_data
+
+        expect(type).to eq('git-archive')
+        expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.zip/)
+      end
+
+      it 'returns the repository archive archive.tar.bz2' do
+        get api("/projects/#{project.id}/repository/archive.tar.bz2", user)
+
+        expect(response).to have_http_status(200)
+
+        repo_name = project.repository.name.gsub("\.git", "")
+        type, params = workhorse_send_data
+
+        expect(type).to eq('git-archive')
+        expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.tar.bz2/)
+      end
+
+      context 'when sha does not exist' do
+        it_behaves_like '404 response' do
+          let(:request) { get api("#{route}?sha=xxx", current_user) }
+          let(:message) { '404 File Not Found' }
+        end
+      end
     end
-  end
 
-  describe "GET /projects/:id/repository/archive(.:format)?:sha" do
-    it "gets the archive" do
-      get api("/projects/#{project.id}/repository/archive", user)
-      repo_name = project.repository.name.gsub("\.git", "")
-      expect(response).to have_http_status(200)
-      type, params = workhorse_send_data
-      expect(type).to eq('git-archive')
-      expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.tar.gz/)
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository archive' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
+      end
     end
 
-    it "gets the archive.zip" do
-      get api("/projects/#{project.id}/repository/archive.zip", user)
-      repo_name = project.repository.name.gsub("\.git", "")
-      expect(response).to have_http_status(200)
-      type, params = workhorse_send_data
-      expect(type).to eq('git-archive')
-      expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.zip/)
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
     end
 
-    it "gets the archive.tar.bz2" do
-      get api("/projects/#{project.id}/repository/archive.tar.bz2", user)
-      repo_name = project.repository.name.gsub("\.git", "")
-      expect(response).to have_http_status(200)
-      type, params = workhorse_send_data
-      expect(type).to eq('git-archive')
-      expect(params['ArchivePath']).to match(/#{repo_name}\-[^\.]+\.tar.bz2/)
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository archive' do
+        let(:current_user) { user }
+      end
     end
 
-    it "returns 404 for invalid sha" do
-      get api("/projects/#{project.id}/repository/archive/?sha=xxx", user)
-      expect(response).to have_http_status(404)
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest) }
+      end
     end
   end
 
   describe 'GET /projects/:id/repository/compare' do
-    it "compares branches" do
-      get api("/projects/#{project.id}/repository/compare", user), from: 'master', to: 'feature'
-      expect(response).to have_http_status(200)
-      expect(json_response['commits']).to be_present
-      expect(json_response['diffs']).to be_present
+    let(:route) { "/projects/#{project.id}/repository/compare" }
+
+    shared_examples_for 'repository compare' do
+      it "compares branches" do
+        get api(route, current_user), from: 'master', to: 'feature'
+
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_present
+        expect(json_response['diffs']).to be_present
+      end
+
+      it "compares tags" do
+        get api(route, current_user), from: 'v1.0.0', to: 'v1.1.0'
+
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_present
+        expect(json_response['diffs']).to be_present
+      end
+
+      it "compares commits" do
+        get api(route, current_user), from: sample_commit.id, to: sample_commit.parent_id
+
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_empty
+        expect(json_response['diffs']).to be_empty
+        expect(json_response['compare_same_ref']).to be_falsey
+      end
+
+      it "compares commits in reverse order" do
+        get api(route, current_user), from: sample_commit.parent_id, to: sample_commit.id
+
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_present
+        expect(json_response['diffs']).to be_present
+      end
+
+      it "compares same refs" do
+        get api(route, current_user), from: 'master', to: 'master'
+
+        expect(response).to have_http_status(200)
+        expect(json_response['commits']).to be_empty
+        expect(json_response['diffs']).to be_empty
+        expect(json_response['compare_same_ref']).to be_truthy
+      end
     end
 
-    it "compares tags" do
-      get api("/projects/#{project.id}/repository/compare", user), from: 'v1.0.0', to: 'v1.1.0'
-      expect(response).to have_http_status(200)
-      expect(json_response['commits']).to be_present
-      expect(json_response['diffs']).to be_present
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository compare' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
+      end
     end
 
-    it "compares commits" do
-      get api("/projects/#{project.id}/repository/compare", user), from: sample_commit.id, to: sample_commit.parent_id
-      expect(response).to have_http_status(200)
-      expect(json_response['commits']).to be_empty
-      expect(json_response['diffs']).to be_empty
-      expect(json_response['compare_same_ref']).to be_falsey
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
     end
 
-    it "compares commits in reverse order" do
-      get api("/projects/#{project.id}/repository/compare", user), from: sample_commit.parent_id, to: sample_commit.id
-      expect(response).to have_http_status(200)
-      expect(json_response['commits']).to be_present
-      expect(json_response['diffs']).to be_present
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository compare' do
+        let(:current_user) { user }
+      end
     end
 
-    it "compares same refs" do
-      get api("/projects/#{project.id}/repository/compare", user), from: 'master', to: 'master'
-      expect(response).to have_http_status(200)
-      expect(json_response['commits']).to be_empty
-      expect(json_response['diffs']).to be_empty
-      expect(json_response['compare_same_ref']).to be_truthy
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest) }
+      end
     end
   end
 
   describe 'GET /projects/:id/repository/contributors' do
-    it 'returns valid data' do
-      get api("/projects/#{project.id}/repository/contributors", user)
-      expect(response).to have_http_status(200)
-      expect(json_response).to be_an Array
-      contributor = json_response.first
-      expect(contributor['email']).to eq('tiagonbotelho@hotmail.com')
-      expect(contributor['name']).to eq('tiagonbotelho')
-      expect(contributor['commits']).to eq(1)
-      expect(contributor['additions']).to eq(0)
-      expect(contributor['deletions']).to eq(0)
+    let(:route) { "/projects/#{project.id}/repository/contributors" }
+
+    shared_examples_for 'repository contributors' do
+      it 'returns valid data' do
+        get api(route, current_user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+
+        first_contributor = json_response.first
+
+        expect(first_contributor['email']).to eq('tiagonbotelho@hotmail.com')
+        expect(first_contributor['name']).to eq('tiagonbotelho')
+        expect(first_contributor['commits']).to eq(1)
+        expect(first_contributor['additions']).to eq(0)
+        expect(first_contributor['deletions']).to eq(0)
+      end
+    end
+
+    context 'when unauthenticated', 'and project is public' do
+      it_behaves_like 'repository contributors' do
+        let(:project) { create(:project, :public) }
+        let(:current_user) { nil }
+      end
+    end
+
+    context 'when unauthenticated', 'and project is private' do
+      it_behaves_like '404 response' do
+        let(:request) { get api(route) }
+        let(:message) { '404 Project Not Found' }
+      end
+    end
+
+    context 'when authenticated', 'as a developer' do
+      it_behaves_like 'repository contributors' do
+        let(:current_user) { user }
+      end
+    end
+
+    context 'when authenticated', 'as a guest' do
+      it_behaves_like '403 response' do
+        let(:request) { get api(route, guest) }
+      end
     end
   end
 end
diff --git a/spec/requests/api/services_spec.rb b/spec/requests/api/services_spec.rb
index 668e39f9dba..39c9e0505d1 100644
--- a/spec/requests/api/services_spec.rb
+++ b/spec/requests/api/services_spec.rb
@@ -6,7 +6,7 @@ describe API::Services, api: true  do
   let(:user) { create(:user) }
   let(:admin) { create(:admin) }
   let(:user2) { create(:user) }
-  let(:project) {create(:project, creator_id: user.id, namespace: user.namespace) }
+  let(:project) {create(:empty_project, creator_id: user.id, namespace: user.namespace) }
 
   Service.available_services_names.each do |service|
     describe "PUT /projects/:id/services/#{service.dasherize}" do
@@ -92,57 +92,78 @@ describe API::Services, api: true  do
 
   describe 'POST /projects/:id/services/:slug/trigger' do
     let!(:project) { create(:empty_project) }
-    let(:service_name) { 'mattermost_slash_commands' }
 
-    context 'no service is available' do
-      it 'returns a not found message' do
-        post api("/projects/#{project.id}/services/idonotexist/trigger")
+    describe 'Mattermost Service' do
+      let(:service_name) { 'mattermost_slash_commands' }
 
-        expect(response).to have_http_status(404)
-        expect(json_response["error"]).to eq("404 Not Found")
+      context 'no service is available' do
+        it 'returns a not found message' do
+          post api("/projects/#{project.id}/services/idonotexist/trigger")
+
+          expect(response).to have_http_status(404)
+          expect(json_response["error"]).to eq("404 Not Found")
+        end
       end
-    end
 
-    context 'the service exists' do
-      let(:params) { { token: 'token' } }
+      context 'the service exists' do
+        let(:params) { { token: 'token' } }
 
-      context 'the service is not active' do
-        let!(:inactive_service) do
-          project.create_mattermost_slash_commands_service(
-            active: false,
-            properties: { token: 'token' }
-          )
-        end
+        context 'the service is not active' do
+          before do
+            project.create_mattermost_slash_commands_service(
+              active: false,
+              properties: params
+            )
+          end
 
-        it 'when the service is inactive' do
-          post api("/projects/#{project.id}/services/mattermost_slash_commands/trigger"), params
+          it 'when the service is inactive' do
+            post api("/projects/#{project.id}/services/#{service_name}/trigger"), params
 
-          expect(response).to have_http_status(404)
+            expect(response).to have_http_status(404)
+          end
         end
-      end
 
-      context 'the service is active' do
-        let!(:active_service) do
-          project.create_mattermost_slash_commands_service(
-            active: true,
-            properties: { token: 'token' }
-          )
+        context 'the service is active' do
+          before do
+            project.create_mattermost_slash_commands_service(
+              active: true,
+              properties: params
+            )
+          end
+
+          it 'returns status 200' do
+            post api("/projects/#{project.id}/services/#{service_name}/trigger"), params
+
+            expect(response).to have_http_status(200)
+          end
         end
 
-        it 'returns status 200' do
-          post api("/projects/#{project.id}/services/mattermost_slash_commands/trigger"), params
+        context 'when the project can not be found' do
+          it 'returns a generic 404' do
+            post api("/projects/404/services/#{service_name}/trigger"), params
 
-          expect(response).to have_http_status(200)
+            expect(response).to have_http_status(404)
+            expect(json_response["message"]).to eq("404 Service Not Found")
+          end
         end
       end
+    end
 
-      context 'when the project can not be found' do
-        it 'returns a generic 404' do
-          post api("/projects/404/services/mattermost_slash_commands/trigger"), params
+    describe 'Slack Service' do
+      let(:service_name) { 'slack_slash_commands' }
 
-          expect(response).to have_http_status(404)
-          expect(json_response["message"]).to eq("404 Service Not Found")
-        end
+      before do
+        project.create_slack_slash_commands_service(
+          active: true,
+          properties: { token: 'token' }
+        )
+      end
+
+      it 'returns status 200' do
+        post api("/projects/#{project.id}/services/#{service_name}/trigger"), token: 'token', text: 'help'
+
+        expect(response).to have_http_status(200)
+        expect(json_response['response_type']).to eq("ephemeral")
       end
     end
   end
diff --git a/spec/requests/api/settings_spec.rb b/spec/requests/api/settings_spec.rb
index 9a8d633d657..91e3c333a02 100644
--- a/spec/requests/api/settings_spec.rb
+++ b/spec/requests/api/settings_spec.rb
@@ -16,6 +16,8 @@ describe API::Settings, 'Settings', api: true  do
       expect(json_response['repository_storage']).to eq('default')
       expect(json_response['koding_enabled']).to be_falsey
       expect(json_response['koding_url']).to be_nil
+      expect(json_response['plantuml_enabled']).to be_falsey
+      expect(json_response['plantuml_url']).to be_nil
     end
   end
 
@@ -28,7 +30,8 @@ describe API::Settings, 'Settings', api: true  do
 
       it "updates application settings" do
         put api("/application/settings", admin),
-          default_projects_limit: 3, signin_enabled: false, repository_storage: 'custom', koding_enabled: true, koding_url: 'http://koding.example.com'
+          default_projects_limit: 3, signin_enabled: false, repository_storage: 'custom', koding_enabled: true, koding_url: 'http://koding.example.com',
+          plantuml_enabled: true, plantuml_url: 'http://plantuml.example.com'
         expect(response).to have_http_status(200)
         expect(json_response['default_projects_limit']).to eq(3)
         expect(json_response['signin_enabled']).to be_falsey
@@ -36,6 +39,8 @@ describe API::Settings, 'Settings', api: true  do
         expect(json_response['repository_storages']).to eq(['custom'])
         expect(json_response['koding_enabled']).to be_truthy
         expect(json_response['koding_url']).to eq('http://koding.example.com')
+        expect(json_response['plantuml_enabled']).to be_truthy
+        expect(json_response['plantuml_url']).to eq('http://plantuml.example.com')
       end
     end
 
@@ -44,8 +49,16 @@ describe API::Settings, 'Settings', api: true  do
         put api("/application/settings", admin), koding_enabled: true
 
         expect(response).to have_http_status(400)
-        expect(json_response['message']).to have_key('koding_url')
-        expect(json_response['message']['koding_url']).to include "can't be blank"
+        expect(json_response['error']).to eq('koding_url is missing')
+      end
+    end
+
+    context "missing plantuml_url value when plantuml_enabled is true" do
+      it "returns a blank parameter error message" do
+        put api("/application/settings", admin), plantuml_enabled: true
+
+        expect(response).to have_http_status(400)
+        expect(json_response['error']).to eq('plantuml_url is missing')
       end
     end
   end
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 9e317f3a7e9..5bf5bf0739e 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -137,6 +137,15 @@ describe API::Users, api: true  do
       expect(new_user.can_create_group).to eq(true)
     end
 
+    it "creates user with optional attributes" do
+      optional_attributes = { confirm: true }
+      attributes = attributes_for(:user).merge(optional_attributes)
+
+      post api('/users', admin), attributes
+
+      expect(response).to have_http_status(201)
+    end
+
     it "creates non-admin user" do
       post api('/users', admin), attributes_for(:user, admin: false, can_create_group: false)
       expect(response).to have_http_status(201)
@@ -265,6 +274,14 @@ describe API::Users, api: true  do
         expect(response).to have_http_status(409)
         expect(json_response['message']).to eq('Username has already been taken')
       end
+
+      it 'creates user with new identity' do
+        post api("/users", admin), attributes_for(:user, provider: 'github', extern_uid: '67890')
+
+        expect(response).to have_http_status(201)
+        expect(json_response['identities'].first['extern_uid']).to eq('67890')
+        expect(json_response['identities'].first['provider']).to eq('github')
+      end
     end
   end
 
@@ -317,9 +334,9 @@ describe API::Users, api: true  do
     end
 
     it 'updates user with new identity' do
-      put api("/users/#{user.id}", admin), provider: 'github', extern_uid: '67890'
+      put api("/users/#{user.id}", admin), provider: 'github', extern_uid: 'john'
       expect(response).to have_http_status(200)
-      expect(user.reload.identities.first.extern_uid).to eq('67890')
+      expect(user.reload.identities.first.extern_uid).to eq('john')
       expect(user.reload.identities.first.provider).to eq('github')
     end
 
diff --git a/spec/requests/ci/api/builds_spec.rb b/spec/requests/ci/api/builds_spec.rb
index 8ccae0d5bff..70c94c9a90f 100644
--- a/spec/requests/ci/api/builds_spec.rb
+++ b/spec/requests/ci/api/builds_spec.rb
@@ -62,6 +62,11 @@ describe Ci::API::Builds do
           let(:user_agent) { 'Go-http-client/1.1' }
           it { expect(response).to have_http_status(404) }
         end
+
+        context "when runner doesn't have a User-Agent" do
+          let(:user_agent) { nil }
+          it { expect(response).to have_http_status(404) }
+        end
       end
 
       context 'when there is a pending build' do
@@ -277,7 +282,11 @@ describe Ci::API::Builds do
     end
 
     describe 'PATCH /builds/:id/trace.txt' do
-      let(:build) { create(:ci_build, :pending, :trace, runner_id: runner.id) }
+      let(:build) do
+        attributes = { runner_id: runner.id, pipeline: pipeline }
+        create(:ci_build, :running, :trace, attributes)
+      end
+
       let(:headers) { { Ci::API::Helpers::BUILD_TOKEN_HEADER => build.token, 'Content-Type' => 'text/plain' } }
       let(:headers_with_range) { headers.merge({ 'Content-Range' => '11-20' }) }
       let(:update_interval) { 10.seconds.to_i }
@@ -304,7 +313,6 @@ describe Ci::API::Builds do
       end
 
       before do
-        build.run!
         initial_patch_the_trace
       end
 
@@ -357,6 +365,19 @@ describe Ci::API::Builds do
             end
           end
         end
+
+        context 'when project for the build has been deleted' do
+          let(:build) do
+            attributes = { runner_id: runner.id, pipeline: pipeline }
+            create(:ci_build, :running, :trace, attributes) do |build|
+              build.project.update(pending_delete: true)
+            end
+          end
+
+          it 'responds with forbidden' do
+            expect(response.status).to eq(403)
+          end
+        end
       end
 
       context 'when Runner makes a force-patch' do
diff --git a/spec/requests/git_http_spec.rb b/spec/requests/git_http_spec.rb
index f1728d61def..5abda28e26f 100644
--- a/spec/requests/git_http_spec.rb
+++ b/spec/requests/git_http_spec.rb
@@ -230,7 +230,7 @@ describe 'Git HTTP requests', lib: true do
               context "when an oauth token is provided" do
                 before do
                   application = Doorkeeper::Application.create!(name: "MyApp", redirect_uri: "https://app.com", owner: user)
-                  @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id)
+                  @token = Doorkeeper::AccessToken.create!(application_id: application.id, resource_owner_id: user.id, scopes: "api")
                 end
 
                 it "downloads get status 200" do
@@ -371,12 +371,26 @@ describe 'Git HTTP requests', lib: true do
 
             shared_examples 'can download code only' do
               it 'downloads get status 200' do
-                clone_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token
+                allow_any_instance_of(Repository).
+                  to receive(:exists?).and_return(true)
+
+                clone_get "#{project.path_with_namespace}.git",
+                  user: 'gitlab-ci-token', password: build.token
 
                 expect(response).to have_http_status(200)
                 expect(response.content_type.to_s).to eq(Gitlab::Workhorse::INTERNAL_API_CONTENT_TYPE)
               end
 
+              it 'downloads from non-existing repository and gets 403' do
+                allow_any_instance_of(Repository).
+                  to receive(:exists?).and_return(false)
+
+                clone_get "#{project.path_with_namespace}.git",
+                  user: 'gitlab-ci-token', password: build.token
+
+                expect(response).to have_http_status(403)
+              end
+
               it 'uploads get status 403' do
                 push_get "#{project.path_with_namespace}.git", user: 'gitlab-ci-token', password: build.token