Merge remote-tracking branch 'upstream/master' into use-update-runner-service

* upstream/master: (488 commits)
  Remove duplicate CHANGELOG.md entries for 8.16.5
  Update CHANGELOG.md for 8.14.9
  Update CHANGELOG.md for 8.15.6
  #27631: Add missing top-area div to activity header page
  Update CHANGELOG.md for 8.16.5
  Update CHANGELOG.md for 8.16.5
  Update CHANGELOG.md for 8.16.5
  Fix yarn lock and package.json mismatch caused by MR 9133
  sync yarn.lock with recent changes to package.json
  Add changelog
  Fix z index bugs
  Add Links to Branches in Calendar Activity
  SidekiqStatus need to be qualified in some cases
  Replace static fixture for behaviors/requires_input_spec.js (!9162)
  API: Consolidate /projects endpoint
  Add MySQL info in install requirements
  Fix timezone on issue boards due date
  Use Gitlab::Database.with_connection_pool from !9192
  Disconnect the pool after done
  Use threads directly, introduce pool later:
  ...

12 files changed, 1214 insertions, 399 deletions

diff --git a/spec/requests/api/fork_spec.rb b/spec/requests/api/fork_spec.rb
deleted file mode 100644
index 92ac4fd334d..00000000000
--- a/spec/requests/api/fork_spec.rb
+++ /dev/null
@@ -1,134 +0,0 @@
-require 'spec_helper'
-
-describe API::Projects, api: true  do
-  include ApiHelpers
-  let(:user)  { create(:user) }
-  let(:user2) { create(:user) }
-  let(:admin) { create(:admin) }
-  let(:group) { create(:group) }
-  let(:group2) do
-    group = create(:group, name: 'group2_name')
-    group.add_owner(user2)
-    group
-  end
-
-  describe 'POST /projects/fork/:id' do
-    let(:project) do
-      create(:project, :repository, creator: user, namespace: user.namespace)
-    end
-
-    before do
-      project.add_reporter(user2)
-    end
-
-    context 'when authenticated' do
-      it 'forks if user has sufficient access to project' do
-        post api("/projects/fork/#{project.id}", user2)
-
-        expect(response).to have_http_status(201)
-        expect(json_response['name']).to eq(project.name)
-        expect(json_response['path']).to eq(project.path)
-        expect(json_response['owner']['id']).to eq(user2.id)
-        expect(json_response['namespace']['id']).to eq(user2.namespace.id)
-        expect(json_response['forked_from_project']['id']).to eq(project.id)
-      end
-
-      it 'forks if user is admin' do
-        post api("/projects/fork/#{project.id}", admin)
-
-        expect(response).to have_http_status(201)
-        expect(json_response['name']).to eq(project.name)
-        expect(json_response['path']).to eq(project.path)
-        expect(json_response['owner']['id']).to eq(admin.id)
-        expect(json_response['namespace']['id']).to eq(admin.namespace.id)
-        expect(json_response['forked_from_project']['id']).to eq(project.id)
-      end
-
-      it 'fails on missing project access for the project to fork' do
-        new_user = create(:user)
-        post api("/projects/fork/#{project.id}", new_user)
-
-        expect(response).to have_http_status(404)
-        expect(json_response['message']).to eq('404 Project Not Found')
-      end
-
-      it 'fails if forked project exists in the user namespace' do
-        post api("/projects/fork/#{project.id}", user)
-
-        expect(response).to have_http_status(409)
-        expect(json_response['message']['name']).to eq(['has already been taken'])
-        expect(json_response['message']['path']).to eq(['has already been taken'])
-      end
-
-      it 'fails if project to fork from does not exist' do
-        post api('/projects/fork/424242', user)
-
-        expect(response).to have_http_status(404)
-        expect(json_response['message']).to eq('404 Project Not Found')
-      end
-
-      it 'forks with explicit own user namespace id' do
-        post api("/projects/fork/#{project.id}", user2), namespace: user2.namespace.id
-
-        expect(response).to have_http_status(201)
-        expect(json_response['owner']['id']).to eq(user2.id)
-      end
-
-      it 'forks with explicit own user name as namespace' do
-        post api("/projects/fork/#{project.id}", user2), namespace: user2.username
-
-        expect(response).to have_http_status(201)
-        expect(json_response['owner']['id']).to eq(user2.id)
-      end
-
-      it 'forks to another user when admin' do
-        post api("/projects/fork/#{project.id}", admin), namespace: user2.username
-
-        expect(response).to have_http_status(201)
-        expect(json_response['owner']['id']).to eq(user2.id)
-      end
-
-      it 'fails if trying to fork to another user when not admin' do
-        post api("/projects/fork/#{project.id}", user2), namespace: admin.namespace.id
-
-        expect(response).to have_http_status(404)
-      end
-
-      it 'fails if trying to fork to non-existent namespace' do
-        post api("/projects/fork/#{project.id}", user2), namespace: 42424242
-
-        expect(response).to have_http_status(404)
-        expect(json_response['message']).to eq('404 Target Namespace Not Found')
-      end
-
-      it 'forks to owned group' do
-        post api("/projects/fork/#{project.id}", user2), namespace: group2.name
-
-        expect(response).to have_http_status(201)
-        expect(json_response['namespace']['name']).to eq(group2.name)
-      end
-
-      it 'fails to fork to not owned group' do
-        post api("/projects/fork/#{project.id}", user2), namespace: group.name
-
-        expect(response).to have_http_status(404)
-      end
-
-      it 'forks to not owned group when admin' do
-        post api("/projects/fork/#{project.id}", admin), namespace: group.name
-
-        expect(response).to have_http_status(201)
-        expect(json_response['namespace']['name']).to eq(group.name)
-      end
-    end
-
-    context 'when unauthenticated' do
-      it 'returns authentication error' do
-        post api("/projects/fork/#{project.id}")
-
-        expect(response).to have_http_status(401)
-        expect(json_response['message']).to eq('401 Unauthorized')
-      end
-    end
-  end
-end
diff --git a/spec/requests/api/groups_spec.rb b/spec/requests/api/groups_spec.rb
index a027c23bb88..ccd7898586c 100644
--- a/spec/requests/api/groups_spec.rb
+++ b/spec/requests/api/groups_spec.rb
@@ -35,7 +35,8 @@ describe API::Groups, api: true  do
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
         expect(json_response.length).to eq(1)
-        expect(json_response.first['name']).to eq(group1.name)
+        expect(json_response)
+          .to satisfy_one { |group| group['name'] == group1.name }
       end
 
       it "does not include statistics" do
@@ -70,7 +71,7 @@ describe API::Groups, api: true  do
           repository_size: 123,
           lfs_objects_size: 234,
           build_artifacts_size: 345,
-        }
+        }.stringify_keys
 
         project1.statistics.update!(attributes)
 
@@ -78,7 +79,8 @@ describe API::Groups, api: true  do
 
         expect(response).to have_http_status(200)
         expect(json_response).to be_an Array
-        expect(json_response.first['statistics']).to eq attributes.stringify_keys
+        expect(json_response)
+          .to satisfy_one { |group| group['statistics'] == attributes }
       end
     end
 
@@ -179,6 +181,7 @@ describe API::Groups, api: true  do
         expect(json_response['request_access_enabled']).to eq(group1.request_access_enabled)
         expect(json_response['full_name']).to eq(group1.full_name)
         expect(json_response['full_path']).to eq(group1.full_path)
+        expect(json_response['parent_id']).to eq(group1.parent_id)
         expect(json_response['projects']).to be_an Array
         expect(json_response['projects'].length).to eq(2)
         expect(json_response['shared_projects']).to be_an Array
@@ -335,6 +338,26 @@ describe API::Groups, api: true  do
         expect(json_response.length).to eq(1)
         expect(json_response.first['name']).to eq(project3.name)
       end
+
+      it 'only returns the projects owned by user' do
+        project2.group.add_owner(user3)
+
+        get api("/groups/#{project2.group.id}/projects", user3), owned: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response.length).to eq(1)
+        expect(json_response.first['name']).to eq(project2.name)
+      end
+
+      it 'only returns the projects starred by user' do
+        user1.starred_projects = [project1]
+
+        get api("/groups/#{group1.id}/projects", user1), starred: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response.length).to eq(1)
+        expect(json_response.first['name']).to eq(project1.name)
+      end
     end
 
     context "when authenticated as admin" do
@@ -398,6 +421,19 @@ describe API::Groups, api: true  do
         expect(json_response["request_access_enabled"]).to eq(group[:request_access_enabled])
       end
 
+      it "creates a nested group" do
+        parent = create(:group)
+        parent.add_owner(user3)
+        group = attributes_for(:group, { parent_id: parent.id })
+
+        post api("/groups", user3), group
+
+        expect(response).to have_http_status(201)
+
+        expect(json_response["full_path"]).to eq("#{parent.path}/#{group[:path]}")
+        expect(json_response["parent_id"]).to eq(parent.id)
+      end
+
       it "does not create group, duplicate" do
         post api("/groups", user3), { name: 'Duplicate Test', path: group2.path }
 
diff --git a/spec/requests/api/members_spec.rb b/spec/requests/api/members_spec.rb
index 9892e014cb9..3e9bcfd1a60 100644
--- a/spec/requests/api/members_spec.rb
+++ b/spec/requests/api/members_spec.rb
@@ -145,11 +145,11 @@ describe API::Members, api: true  do
         end
       end
 
-      it "returns #{source_type == 'project' ? 201 : 409} if member already exists" do
+      it "returns 409 if member already exists" do
         post api("/#{source_type.pluralize}/#{source.id}/members", master),
              user_id: master.id, access_level: Member::MASTER
 
-        expect(response).to have_http_status(source_type == 'project' ? 201 : 409)
+        expect(response).to have_http_status(409)
       end
 
       it 'returns 400 when user_id is not given' do
diff --git a/spec/requests/api/project_snippets_spec.rb b/spec/requests/api/project_snippets_spec.rb
index 45d5ae267c5..eea76c7bb94 100644
--- a/spec/requests/api/project_snippets_spec.rb
+++ b/spec/requests/api/project_snippets_spec.rb
@@ -7,18 +7,6 @@ describe API::ProjectSnippets, api: true do
   let(:user) { create(:user) }
   let(:admin) { create(:admin) }
 
-  describe 'GET /projects/:project_id/snippets/:id' do
-    # TODO (rspeicher): Deprecated; remove in 9.0
-    it 'always exposes expires_at as nil' do
-      snippet = create(:project_snippet, author: admin)
-
-      get api("/projects/#{snippet.project.id}/snippets/#{snippet.id}", admin)
-
-      expect(json_response).to have_key('expires_at')
-      expect(json_response['expires_at']).to be_nil
-    end
-  end
-
   describe 'GET /projects/:project_id/snippets/' do
     let(:user) { create(:user) }
 
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index 225e2e005df..bca7642b6fc 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -41,26 +41,40 @@ describe API::Projects, api: true  do
   end
 
   describe 'GET /projects' do
-    before { project }
+    shared_examples_for 'projects response' do
+      it 'returns an array of projects' do
+        get api('/projects', current_user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.map { |p| p['id'] }).to contain_exactly(*projects.map(&:id))
+      end
+    end
+
+    let!(:public_project) { create(:empty_project, :public, name: 'public_project') }
+    before do
+      project
+      project2
+      project3
+      project4
+    end
 
     context 'when unauthenticated' do
-      it 'returns authentication error' do
-        get api('/projects')
-        expect(response).to have_http_status(401)
+      it_behaves_like 'projects response' do
+        let(:current_user) { nil }
+        let(:projects) { [public_project] }
       end
     end
 
     context 'when authenticated as regular user' do
-      it 'returns an array of projects' do
-        get api('/projects', user)
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.first['name']).to eq(project.name)
-        expect(json_response.first['owner']['username']).to eq(user.username)
+      it_behaves_like 'projects response' do
+        let(:current_user) { user }
+        let(:projects) { [public_project, project, project2, project3] }
       end
 
       it 'includes the project labels as the tag_list' do
         get api('/projects', user)
+
         expect(response.status).to eq 200
         expect(json_response).to be_an Array
         expect(json_response.first.keys).to include('tag_list')
@@ -68,21 +82,39 @@ describe API::Projects, api: true  do
 
       it 'includes open_issues_count' do
         get api('/projects', user)
+
         expect(response.status).to eq 200
         expect(json_response).to be_an Array
         expect(json_response.first.keys).to include('open_issues_count')
       end
 
-      it 'does not include open_issues_count' do
+      it 'does not include open_issues_count if issues are disabled' do
         project.project_feature.update_attribute(:issues_access_level, ProjectFeature::DISABLED)
 
         get api('/projects', user)
+
         expect(response.status).to eq 200
         expect(json_response).to be_an Array
-        expect(json_response.first.keys).not_to include('open_issues_count')
+        expect(json_response.find { |hash| hash['id'] == project.id }.keys).not_to include('open_issues_count')
       end
 
-      context 'GET /projects?simple=true' do
+      it "does not include statistics by default" do
+        get api('/projects', user)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).not_to include('statistics')
+      end
+
+      it "includes statistics if requested" do
+        get api('/projects', user), statistics: true
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first).to include 'statistics'
+      end
+
+      context 'and with simple=true' do
         it 'returns a simplified version of all the projects' do
           expected_keys = ["id", "http_url_to_repo", "web_url", "name", "name_with_namespace", "path", "path_with_namespace"]
 
@@ -97,6 +129,7 @@ describe API::Projects, api: true  do
       context 'and using search' do
         it 'returns searched project' do
           get api('/projects', user), { search: project.name }
+
           expect(response).to have_http_status(200)
           expect(json_response).to be_an Array
           expect(json_response.length).to eq(1)
@@ -106,196 +139,109 @@ describe API::Projects, api: true  do
       context 'and using the visibility filter' do
         it 'filters based on private visibility param' do
           get api('/projects', user), { visibility: 'private' }
+
           expect(response).to have_http_status(200)
           expect(json_response).to be_an Array
-          expect(json_response.length).to eq(user.namespace.projects.where(visibility_level: Gitlab::VisibilityLevel::PRIVATE).count)
+          expect(json_response.map { |p| p['id'] }).to contain_exactly(project.id, project2.id, project3.id)
         end
 
         it 'filters based on internal visibility param' do
+          project2.update_attribute(:visibility_level, Gitlab::VisibilityLevel::INTERNAL)
+
           get api('/projects', user), { visibility: 'internal' }
+
           expect(response).to have_http_status(200)
           expect(json_response).to be_an Array
-          expect(json_response.length).to eq(user.namespace.projects.where(visibility_level: Gitlab::VisibilityLevel::INTERNAL).count)
+          expect(json_response.map { |p| p['id'] }).to contain_exactly(project2.id)
         end
 
         it 'filters based on public visibility param' do
           get api('/projects', user), { visibility: 'public' }
+
           expect(response).to have_http_status(200)
           expect(json_response).to be_an Array
-          expect(json_response.length).to eq(user.namespace.projects.where(visibility_level: Gitlab::VisibilityLevel::PUBLIC).count)
+          expect(json_response.map { |p| p['id'] }).to contain_exactly(public_project.id)
         end
       end
 
       context 'and using sorting' do
-        before do
-          project2
-          project3
-        end
-
         it 'returns the correct order when sorted by id' do
           get api('/projects', user), { order_by: 'id', sort: 'desc' }
+
           expect(response).to have_http_status(200)
           expect(json_response).to be_an Array
           expect(json_response.first['id']).to eq(project3.id)
         end
       end
-    end
-  end
-
-  describe 'GET /projects/all' do
-    before { project }
-
-    context 'when unauthenticated' do
-      it 'returns authentication error' do
-        get api('/projects/all')
-        expect(response).to have_http_status(401)
-      end
-    end
-
-    context 'when authenticated as regular user' do
-      it 'returns authentication error' do
-        get api('/projects/all', user)
-        expect(response).to have_http_status(403)
-      end
-    end
 
-    context 'when authenticated as admin' do
-      it 'returns an array of all projects' do
-        get api('/projects/all', admin)
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
+      context 'and with owned=true' do
+        it 'returns an array of projects the user owns' do
+          get api('/projects', user4), owned: true
 
-        expect(json_response).to satisfy do |response|
-          response.one? do |entry|
-            entry.has_key?('permissions') &&
-              entry['name'] == project.name &&
-              entry['owner']['username'] == user.username
-          end
+          expect(response).to have_http_status(200)
+          expect(json_response).to be_an Array
+          expect(json_response.first['name']).to eq(project4.name)
+          expect(json_response.first['owner']['username']).to eq(user4.username)
         end
       end
 
-      it "does not include statistics by default" do
-        get api('/projects/all', admin)
-
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.first).not_to include('statistics')
-      end
-
-      it "includes statistics if requested" do
-        get api('/projects/all', admin), statistics: true
-
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.first).to include 'statistics'
-      end
-    end
-  end
-
-  describe 'GET /projects/owned' do
-    before do
-      project3
-      project4
-    end
-
-    context 'when unauthenticated' do
-      it 'returns authentication error' do
-        get api('/projects/owned')
-        expect(response).to have_http_status(401)
-      end
-    end
+      context 'and with starred=true' do
+        let(:public_project) { create(:empty_project, :public) }
 
-    context 'when authenticated as project owner' do
-      it 'returns an array of projects the user owns' do
-        get api('/projects/owned', user4)
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.first['name']).to eq(project4.name)
-        expect(json_response.first['owner']['username']).to eq(user4.username)
-      end
-
-      it "does not include statistics by default" do
-        get api('/projects/owned', user4)
-
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.first).not_to include('statistics')
-      end
-
-      it "includes statistics if requested" do
-        attributes = {
-          commit_count: 23,
-          storage_size: 702,
-          repository_size: 123,
-          lfs_objects_size: 234,
-          build_artifacts_size: 345,
-        }
-
-        project4.statistics.update!(attributes)
+        before do
+          project_member2
+          user3.update_attributes(starred_projects: [project, project2, project3, public_project])
+        end
 
-        get api('/projects/owned', user4), statistics: true
+        it 'returns the starred projects viewable by the user' do
+          get api('/projects', user3), starred: true
 
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.first['statistics']).to eq attributes.stringify_keys
+          expect(response).to have_http_status(200)
+          expect(json_response).to be_an Array
+          expect(json_response.map { |project| project['id'] }).to contain_exactly(project.id, public_project.id)
+        end
       end
-    end
-  end
-
-  describe 'GET /projects/visible' do
-    shared_examples_for 'visible projects response' do
-      it 'returns the visible projects' do
-        get api('/projects/visible', current_user)
 
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
-        expect(json_response.map { |p| p['id'] }).to contain_exactly(*projects.map(&:id))
-      end
-    end
+      context 'and with all query parameters' do
+        # |         | project5 | project6 | project7 | project8 | project9 |
+        # |---------+----------+----------+----------+----------+----------|
+        # | search  | x        |          | x        | x        | x        |
+        # | starred | x        | x        |          | x        | x        |
+        # | public  | x        | x        | x        |          | x        |
+        # | owned   | x        | x        | x        | x        |          |
+        let!(:project5) { create(:empty_project, :public, path: 'gitlab5', namespace: user.namespace) }
+        let!(:project6) { create(:empty_project, :public, path: 'project6', namespace: user.namespace) }
+        let!(:project7) { create(:empty_project, :public, path: 'gitlab7', namespace: user.namespace) }
+        let!(:project8) { create(:empty_project, path: 'gitlab8', namespace: user.namespace) }
+        let!(:project9) { create(:empty_project, :public, path: 'gitlab9') }
 
-    let!(:public_project) { create(:empty_project, :public) }
-    before do
-      project
-      project2
-      project3
-      project4
-    end
+        before do
+          user.update_attributes(starred_projects: [project5, project6, project8, project9])
+        end
 
-    context 'when unauthenticated' do
-      it_behaves_like 'visible projects response' do
-        let(:current_user) { nil }
-        let(:projects) { [public_project] }
-      end
-    end
+        it 'returns only projects that satify all query parameters' do
+          get api('/projects', user), { visibility: 'public', owned: true, starred: true, search: 'gitlab' }
 
-    context 'when authenticated' do
-      it_behaves_like 'visible projects response' do
-        let(:current_user) { user }
-        let(:projects) { [public_project, project, project2, project3] }
+          expect(response).to have_http_status(200)
+          expect(json_response).to be_an Array
+          expect(json_response.size).to eq(1)
+          expect(json_response.first['id']).to eq(project5.id)
+        end
       end
     end
 
     context 'when authenticated as a different user' do
-      it_behaves_like 'visible projects response' do
+      it_behaves_like 'projects response' do
         let(:current_user) { user2 }
         let(:projects) { [public_project] }
       end
     end
-  end
-
-  describe 'GET /projects/starred' do
-    let(:public_project) { create(:empty_project, :public) }
-
-    before do
-      project_member2
-      user3.update_attributes(starred_projects: [project, project2, project3, public_project])
-    end
 
-    it 'returns the starred projects viewable by the user' do
-      get api('/projects/starred', user3)
-      expect(response).to have_http_status(200)
-      expect(json_response).to be_an Array
-      expect(json_response.map { |project| project['id'] }).to contain_exactly(project.id, public_project.id)
+    context 'when authenticated as admin' do
+      it_behaves_like 'projects response' do
+        let(:current_user) { admin }
+        let(:projects) { Project.all }
+      end
     end
   end
 
@@ -359,13 +305,6 @@ describe API::Projects, api: true  do
       expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PUBLIC)
     end
 
-    it 'sets a project as public using :public' do
-      project = attributes_for(:project, { public: true })
-      post api('/projects', user), project
-      expect(json_response['public']).to be_truthy
-      expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PUBLIC)
-    end
-
     it 'sets a project as internal' do
       project = attributes_for(:project, :internal)
       post api('/projects', user), project
@@ -373,13 +312,6 @@ describe API::Projects, api: true  do
       expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::INTERNAL)
     end
 
-    it 'sets a project as internal overriding :public' do
-      project = attributes_for(:project, :internal, { public: true })
-      post api('/projects', user), project
-      expect(json_response['public']).to be_falsey
-      expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::INTERNAL)
-    end
-
     it 'sets a project as private' do
       project = attributes_for(:project, :private)
       post api('/projects', user), project
@@ -387,13 +319,6 @@ describe API::Projects, api: true  do
       expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PRIVATE)
     end
 
-    it 'sets a project as private using :public' do
-      project = attributes_for(:project, { public: false })
-      post api('/projects', user), project
-      expect(json_response['public']).to be_falsey
-      expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PRIVATE)
-    end
-
     it 'sets a project as allowing merge even if build fails' do
       project = attributes_for(:project, { only_allow_merge_if_build_succeeds: false })
       post api('/projects', user), project
@@ -431,13 +356,14 @@ describe API::Projects, api: true  do
     end
 
     context 'when a visibility level is restricted' do
+      let(:project_param) { attributes_for(:project, :public) }
+
       before do
-        @project = attributes_for(:project, { public: true })
         stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
       end
 
       it 'does not allow a non-admin to use a restricted visibility level' do
-        post api('/projects', user), @project
+        post api('/projects', user), project_param
 
         expect(response).to have_http_status(400)
         expect(json_response['message']['visibility_level'].first).to(
@@ -446,7 +372,8 @@ describe API::Projects, api: true  do
       end
 
       it 'allows an admin to override restricted visibility settings' do
-        post api('/projects', admin), @project
+        post api('/projects', admin), project_param
+
         expect(json_response['public']).to be_truthy
         expect(json_response['visibility_level']).to(
           eq(Gitlab::VisibilityLevel::PUBLIC)
@@ -499,15 +426,6 @@ describe API::Projects, api: true  do
       expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PUBLIC)
     end
 
-    it 'sets a project as public using :public' do
-      project = attributes_for(:project, { public: true })
-      post api("/projects/user/#{user.id}", admin), project
-
-      expect(response).to have_http_status(201)
-      expect(json_response['public']).to be_truthy
-      expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PUBLIC)
-    end
-
     it 'sets a project as internal' do
       project = attributes_for(:project, :internal)
       post api("/projects/user/#{user.id}", admin), project
@@ -517,14 +435,6 @@ describe API::Projects, api: true  do
       expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::INTERNAL)
     end
 
-    it 'sets a project as internal overriding :public' do
-      project = attributes_for(:project, :internal, { public: true })
-      post api("/projects/user/#{user.id}", admin), project
-      expect(response).to have_http_status(201)
-      expect(json_response['public']).to be_falsey
-      expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::INTERNAL)
-    end
-
     it 'sets a project as private' do
       project = attributes_for(:project, :private)
       post api("/projects/user/#{user.id}", admin), project
@@ -532,13 +442,6 @@ describe API::Projects, api: true  do
       expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PRIVATE)
     end
 
-    it 'sets a project as private using :public' do
-      project = attributes_for(:project, { public: false })
-      post api("/projects/user/#{user.id}", admin), project
-      expect(json_response['public']).to be_falsey
-      expect(json_response['visibility_level']).to eq(Gitlab::VisibilityLevel::PRIVATE)
-    end
-
     it 'sets a project as allowing merge even if build fails' do
       project = attributes_for(:project, { only_allow_merge_if_build_succeeds: false })
       post api("/projects/user/#{user.id}", admin), project
@@ -865,7 +768,7 @@ describe API::Projects, api: true  do
     it 'creates a new project snippet' do
       post api("/projects/#{project.id}/snippets", user),
         title: 'api test', file_name: 'sample.rb', code: 'test',
-        visibility_level: '0'
+        visibility_level: Gitlab::VisibilityLevel::PRIVATE
       expect(response).to have_http_status(201)
       expect(json_response['title']).to eq('api test')
     end
@@ -1114,7 +1017,7 @@ describe API::Projects, api: true  do
       end
 
       it 'updates visibility_level' do
-        project_param = { visibility_level: 20 }
+        project_param = { visibility_level: Gitlab::VisibilityLevel::PUBLIC }
         put api("/projects/#{project3.id}", user), project_param
         expect(response).to have_http_status(200)
         project_param.each_pair do |k, v|
@@ -1124,7 +1027,7 @@ describe API::Projects, api: true  do
 
       it 'updates visibility_level from public to private' do
         project3.update_attributes({ visibility_level: Gitlab::VisibilityLevel::PUBLIC })
-        project_param = { public: false }
+        project_param = { visibility_level: Gitlab::VisibilityLevel::PRIVATE }
         put api("/projects/#{project3.id}", user), project_param
         expect(response).to have_http_status(200)
         project_param.each_pair do |k, v|
@@ -1197,7 +1100,7 @@ describe API::Projects, api: true  do
       end
 
       it 'does not update visibility_level' do
-        project_param = { visibility_level: 20 }
+        project_param = { visibility_level: Gitlab::VisibilityLevel::PUBLIC }
         put api("/projects/#{project3.id}", user4), project_param
         expect(response).to have_http_status(403)
       end
@@ -1375,4 +1278,130 @@ describe API::Projects, api: true  do
       end
     end
   end
+
+  describe 'POST /projects/:id/fork' do
+    let(:project) do
+      create(:project, :repository, creator: user, namespace: user.namespace)
+    end
+    let(:group) { create(:group) }
+    let(:group2) do
+      group = create(:group, name: 'group2_name')
+      group.add_owner(user2)
+      group
+    end
+
+    before do
+      project.add_reporter(user2)
+    end
+
+    context 'when authenticated' do
+      it 'forks if user has sufficient access to project' do
+        post api("/projects/#{project.id}/fork", user2)
+
+        expect(response).to have_http_status(201)
+        expect(json_response['name']).to eq(project.name)
+        expect(json_response['path']).to eq(project.path)
+        expect(json_response['owner']['id']).to eq(user2.id)
+        expect(json_response['namespace']['id']).to eq(user2.namespace.id)
+        expect(json_response['forked_from_project']['id']).to eq(project.id)
+      end
+
+      it 'forks if user is admin' do
+        post api("/projects/#{project.id}/fork", admin)
+
+        expect(response).to have_http_status(201)
+        expect(json_response['name']).to eq(project.name)
+        expect(json_response['path']).to eq(project.path)
+        expect(json_response['owner']['id']).to eq(admin.id)
+        expect(json_response['namespace']['id']).to eq(admin.namespace.id)
+        expect(json_response['forked_from_project']['id']).to eq(project.id)
+      end
+
+      it 'fails on missing project access for the project to fork' do
+        new_user = create(:user)
+        post api("/projects/#{project.id}/fork", new_user)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 Project Not Found')
+      end
+
+      it 'fails if forked project exists in the user namespace' do
+        post api("/projects/#{project.id}/fork", user)
+
+        expect(response).to have_http_status(409)
+        expect(json_response['message']['name']).to eq(['has already been taken'])
+        expect(json_response['message']['path']).to eq(['has already been taken'])
+      end
+
+      it 'fails if project to fork from does not exist' do
+        post api('/projects/424242/fork', user)
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 Project Not Found')
+      end
+
+      it 'forks with explicit own user namespace id' do
+        post api("/projects/#{project.id}/fork", user2), namespace: user2.namespace.id
+
+        expect(response).to have_http_status(201)
+        expect(json_response['owner']['id']).to eq(user2.id)
+      end
+
+      it 'forks with explicit own user name as namespace' do
+        post api("/projects/#{project.id}/fork", user2), namespace: user2.username
+
+        expect(response).to have_http_status(201)
+        expect(json_response['owner']['id']).to eq(user2.id)
+      end
+
+      it 'forks to another user when admin' do
+        post api("/projects/#{project.id}/fork", admin), namespace: user2.username
+
+        expect(response).to have_http_status(201)
+        expect(json_response['owner']['id']).to eq(user2.id)
+      end
+
+      it 'fails if trying to fork to another user when not admin' do
+        post api("/projects/#{project.id}/fork", user2), namespace: admin.namespace.id
+
+        expect(response).to have_http_status(404)
+      end
+
+      it 'fails if trying to fork to non-existent namespace' do
+        post api("/projects/#{project.id}/fork", user2), namespace: 42424242
+
+        expect(response).to have_http_status(404)
+        expect(json_response['message']).to eq('404 Target Namespace Not Found')
+      end
+
+      it 'forks to owned group' do
+        post api("/projects/#{project.id}/fork", user2), namespace: group2.name
+
+        expect(response).to have_http_status(201)
+        expect(json_response['namespace']['name']).to eq(group2.name)
+      end
+
+      it 'fails to fork to not owned group' do
+        post api("/projects/#{project.id}/fork", user2), namespace: group.name
+
+        expect(response).to have_http_status(404)
+      end
+
+      it 'forks to not owned group when admin' do
+        post api("/projects/#{project.id}/fork", admin), namespace: group.name
+
+        expect(response).to have_http_status(201)
+        expect(json_response['namespace']['name']).to eq(group.name)
+      end
+    end
+
+    context 'when unauthenticated' do
+      it 'returns authentication error' do
+        post api("/projects/#{project.id}/fork")
+
+        expect(response).to have_http_status(401)
+        expect(json_response['message']).to eq('401 Unauthorized')
+      end
+    end
+  end
 end
diff --git a/spec/requests/api/templates_spec.rb b/spec/requests/api/templates_spec.rb
index d32ba60fc4c..c0a8c0832bb 100644
--- a/spec/requests/api/templates_spec.rb
+++ b/spec/requests/api/templates_spec.rb
@@ -3,23 +3,23 @@ require 'spec_helper'
 describe API::Templates, api: true  do
   include ApiHelpers
 
-  shared_examples_for 'the Template Entity' do |path|
-    before { get api(path) }
+  context 'the Template Entity' do
+    before { get api('/templates/gitignores/Ruby') }
 
     it { expect(json_response['name']).to eq('Ruby') }
     it { expect(json_response['content']).to include('*.gem') }
   end
-  
-  shared_examples_for 'the TemplateList Entity' do |path|
-    before { get api(path) }
+
+  context 'the TemplateList Entity' do
+    before { get api('/templates/gitignores') }
 
     it { expect(json_response.first['name']).not_to be_nil }
     it { expect(json_response.first['content']).to be_nil }
   end
 
-  shared_examples_for 'requesting gitignores' do |path|
+  context 'requesting gitignores' do
     it 'returns a list of available gitignore templates' do
-      get api(path)
+      get api('/templates/gitignores')
 
       expect(response).to have_http_status(200)
       expect(json_response).to be_an Array
@@ -27,9 +27,9 @@ describe API::Templates, api: true  do
     end
   end
 
-  shared_examples_for 'requesting gitlab-ci-ymls' do |path|
+  context 'requesting gitlab-ci-ymls' do
     it 'returns a list of available gitlab_ci_ymls' do
-      get api(path)
+      get api('/templates/gitlab_ci_ymls')
 
       expect(response).to have_http_status(200)
       expect(json_response).to be_an Array
@@ -37,17 +37,17 @@ describe API::Templates, api: true  do
     end
   end
 
-  shared_examples_for 'requesting gitlab-ci-yml for Ruby' do |path|
+  context 'requesting gitlab-ci-yml for Ruby' do
     it 'adds a disclaimer on the top' do
-      get api(path)
+      get api('/templates/gitlab_ci_ymls/Ruby')
 
       expect(response).to have_http_status(200)
       expect(json_response['content']).to start_with("# This file is a template,")
     end
   end
 
-  shared_examples_for 'the License Template Entity' do |path|
-    before { get api(path) }
+  context 'the License Template Entity' do
+    before { get api('/templates/licenses/mit') }
 
     it 'returns a license template' do
       expect(json_response['key']).to eq('mit')
@@ -64,9 +64,9 @@ describe API::Templates, api: true  do
     end
   end
 
-  shared_examples_for 'GET licenses' do |path|
+  context 'GET templates/licenses' do
     it 'returns a list of available license templates' do
-      get api(path)
+      get api('/templates/licenses')
 
       expect(response).to have_http_status(200)
       expect(json_response).to be_an Array
@@ -77,7 +77,7 @@ describe API::Templates, api: true  do
     describe 'the popular parameter' do
       context 'with popular=1' do
         it 'returns a list of available popular license templates' do
-          get api("#{path}?popular=1")
+          get api('/templates/licenses?popular=1')
 
           expect(response).to have_http_status(200)
           expect(json_response).to be_an Array
@@ -88,10 +88,10 @@ describe API::Templates, api: true  do
     end
   end
 
-  shared_examples_for 'GET licenses/:name' do |path|
+  context 'GET templates/licenses/:name' do
     context 'with :project and :fullname given' do
       before do
-        get api("#{path}/#{license_type}?project=My+Awesome+Project&fullname=Anton+#{license_type.upcase}")
+        get api("/templates/licenses/#{license_type}?project=My+Awesome+Project&fullname=Anton+#{license_type.upcase}")
       end
 
       context 'for the mit license' do
@@ -178,26 +178,4 @@ describe API::Templates, api: true  do
       end
     end
   end
-
-  describe 'with /templates namespace' do
-    it_behaves_like 'the Template Entity', '/templates/gitignores/Ruby'
-    it_behaves_like 'the TemplateList Entity', '/templates/gitignores'
-    it_behaves_like 'requesting gitignores', '/templates/gitignores'
-    it_behaves_like 'requesting gitlab-ci-ymls', '/templates/gitlab_ci_ymls'
-    it_behaves_like 'requesting gitlab-ci-yml for Ruby', '/templates/gitlab_ci_ymls/Ruby'
-    it_behaves_like 'the License Template Entity', '/templates/licenses/mit'
-    it_behaves_like 'GET licenses', '/templates/licenses'
-    it_behaves_like 'GET licenses/:name', '/templates/licenses'
-  end
-
-  describe 'without /templates namespace' do
-    it_behaves_like 'the Template Entity', '/gitignores/Ruby'
-    it_behaves_like 'the TemplateList Entity', '/gitignores'
-    it_behaves_like 'requesting gitignores', '/gitignores'
-    it_behaves_like 'requesting gitlab-ci-ymls', '/gitlab_ci_ymls'
-    it_behaves_like 'requesting gitlab-ci-yml for Ruby', '/gitlab_ci_ymls/Ruby'
-    it_behaves_like 'the License Template Entity', '/licenses/mit'
-    it_behaves_like 'GET licenses', '/licenses'
-    it_behaves_like 'GET licenses/:name', '/licenses'
-  end
 end
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 8692f9da976..5958012672e 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -190,6 +190,18 @@ describe API::Users, api: true  do
       expect(new_user.external).to be_truthy
     end
 
+    it "creates user with reset password" do
+      post api('/users', admin), attributes_for(:user, reset_password: true).except(:password)
+
+      expect(response).to have_http_status(201)
+
+      user_id = json_response['id']
+      new_user = User.find(user_id)
+
+      expect(new_user).not_to eq(nil)
+      expect(new_user.recently_sent_password_reset?).to eq(true)
+    end
+
     it "does not create user with invalid email" do
       post api('/users', admin),
         email: 'invalid email',
diff --git a/spec/requests/api/v3/deploy_keys_spec.rb b/spec/requests/api/v3/deploy_keys_spec.rb
new file mode 100644
index 00000000000..f5bdf408c5e
--- /dev/null
+++ b/spec/requests/api/v3/deploy_keys_spec.rb
@@ -0,0 +1,172 @@
+require 'spec_helper'
+
+describe API::V3::DeployKeys, api: true  do
+  include ApiHelpers
+
+  let(:user)        { create(:user) }
+  let(:admin)       { create(:admin) }
+  let(:project)     { create(:empty_project, creator_id: user.id) }
+  let(:project2)    { create(:empty_project, creator_id: user.id) }
+  let(:deploy_key)  { create(:deploy_key, public: true) }
+
+  let!(:deploy_keys_project) do
+    create(:deploy_keys_project, project: project, deploy_key: deploy_key)
+  end
+
+  describe 'GET /deploy_keys' do
+    context 'when unauthenticated' do
+      it 'should return authentication error' do
+        get v3_api('/deploy_keys')
+
+        expect(response.status).to eq(401)
+      end
+    end
+
+    context 'when authenticated as non-admin user' do
+      it 'should return a 403 error' do
+        get v3_api('/deploy_keys', user)
+
+        expect(response.status).to eq(403)
+      end
+    end
+
+    context 'when authenticated as admin' do
+      it 'should return all deploy keys' do
+        get v3_api('/deploy_keys', admin)
+
+        expect(response.status).to eq(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first['id']).to eq(deploy_keys_project.deploy_key.id)
+      end
+    end
+  end
+
+  %w(deploy_keys keys).each do |path|
+    describe "GET /projects/:id/#{path}" do
+      before { deploy_key }
+
+      it 'should return array of ssh keys' do
+        get v3_api("/projects/#{project.id}/#{path}", admin)
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+        expect(json_response.first['title']).to eq(deploy_key.title)
+      end
+    end
+
+    describe "GET /projects/:id/#{path}/:key_id" do
+      it 'should return a single key' do
+        get v3_api("/projects/#{project.id}/#{path}/#{deploy_key.id}", admin)
+
+        expect(response).to have_http_status(200)
+        expect(json_response['title']).to eq(deploy_key.title)
+      end
+
+      it 'should return 404 Not Found with invalid ID' do
+        get v3_api("/projects/#{project.id}/#{path}/404", admin)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    describe "POST /projects/:id/deploy_keys" do
+      it 'should not create an invalid ssh key' do
+        post v3_api("/projects/#{project.id}/#{path}", admin), { title: 'invalid key' }
+
+        expect(response).to have_http_status(400)
+        expect(json_response['error']).to eq('key is missing')
+      end
+
+      it 'should not create a key without title' do
+        post v3_api("/projects/#{project.id}/#{path}", admin), key: 'some key'
+
+        expect(response).to have_http_status(400)
+        expect(json_response['error']).to eq('title is missing')
+      end
+
+      it 'should create new ssh key' do
+        key_attrs = attributes_for :another_key
+
+        expect do
+          post v3_api("/projects/#{project.id}/#{path}", admin), key_attrs
+        end.to change{ project.deploy_keys.count }.by(1)
+      end
+
+      it 'returns an existing ssh key when attempting to add a duplicate' do
+        expect do
+          post v3_api("/projects/#{project.id}/#{path}", admin), { key: deploy_key.key, title: deploy_key.title }
+        end.not_to change { project.deploy_keys.count }
+
+        expect(response).to have_http_status(201)
+      end
+
+      it 'joins an existing ssh key to a new project' do
+        expect do
+          post v3_api("/projects/#{project2.id}/#{path}", admin), { key: deploy_key.key, title: deploy_key.title }
+        end.to change { project2.deploy_keys.count }.by(1)
+
+        expect(response).to have_http_status(201)
+      end
+    end
+
+    describe "DELETE /projects/:id/#{path}/:key_id" do
+      before { deploy_key }
+
+      it 'should delete existing key' do
+        expect do
+          delete v3_api("/projects/#{project.id}/#{path}/#{deploy_key.id}", admin)
+        end.to change{ project.deploy_keys.count }.by(-1)
+      end
+
+      it 'should return 404 Not Found with invalid ID' do
+        delete v3_api("/projects/#{project.id}/#{path}/404", admin)
+
+        expect(response).to have_http_status(404)
+      end
+    end
+
+    describe "POST /projects/:id/#{path}/:key_id/enable" do
+      let(:project2) { create(:empty_project) }
+
+      context 'when the user can admin the project' do
+        it 'enables the key' do
+          expect do
+            post v3_api("/projects/#{project2.id}/#{path}/#{deploy_key.id}/enable", admin)
+          end.to change { project2.deploy_keys.count }.from(0).to(1)
+
+          expect(response).to have_http_status(201)
+          expect(json_response['id']).to eq(deploy_key.id)
+        end
+      end
+
+      context 'when authenticated as non-admin user' do
+        it 'should return a 404 error' do
+          post v3_api("/projects/#{project2.id}/#{path}/#{deploy_key.id}/enable", user)
+
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+
+    describe "DELETE /projects/:id/deploy_keys/:key_id/disable" do
+      context 'when the user can admin the project' do
+        it 'disables the key' do
+          expect do
+            delete v3_api("/projects/#{project.id}/#{path}/#{deploy_key.id}/disable", admin)
+          end.to change { project.deploy_keys.count }.from(1).to(0)
+
+          expect(response).to have_http_status(200)
+          expect(json_response['id']).to eq(deploy_key.id)
+        end
+      end
+
+      context 'when authenticated as non-admin user' do
+        it 'should return a 404 error' do
+          delete v3_api("/projects/#{project.id}/#{path}/#{deploy_key.id}/disable", user)
+
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/v3/members_spec.rb b/spec/requests/api/v3/members_spec.rb
new file mode 100644
index 00000000000..28c3ca03960
--- /dev/null
+++ b/spec/requests/api/v3/members_spec.rb
@@ -0,0 +1,342 @@
+require 'spec_helper'
+
+describe API::Members, api: true  do
+  include ApiHelpers
+
+  let(:master) { create(:user) }
+  let(:developer) { create(:user) }
+  let(:access_requester) { create(:user) }
+  let(:stranger) { create(:user) }
+
+  let(:project) do
+    create(:empty_project, :public, :access_requestable, creator_id: master.id, namespace: master.namespace) do |project|
+      project.team << [developer, :developer]
+      project.team << [master, :master]
+      project.request_access(access_requester)
+    end
+  end
+
+  let!(:group) do
+    create(:group, :public, :access_requestable) do |group|
+      group.add_developer(developer)
+      group.add_owner(master)
+      group.request_access(access_requester)
+    end
+  end
+
+  shared_examples 'GET /:sources/:id/members' do |source_type|
+    context "with :sources == #{source_type.pluralize}" do
+      it_behaves_like 'a 404 response when source is private' do
+        let(:route) { get v3_api("/#{source_type.pluralize}/#{source.id}/members", stranger) }
+      end
+
+      %i[master developer access_requester stranger].each do |type|
+        context "when authenticated as a #{type}" do
+          it 'returns 200' do
+            user = public_send(type)
+            get v3_api("/#{source_type.pluralize}/#{source.id}/members", user)
+
+            expect(response).to have_http_status(200)
+            expect(json_response.size).to eq(2)
+            expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
+          end
+        end
+      end
+
+      it 'does not return invitees' do
+        create(:"#{source_type}_member", invite_token: '123', invite_email: 'test@abc.com', source: source, user: nil)
+
+        get v3_api("/#{source_type.pluralize}/#{source.id}/members", developer)
+
+        expect(response).to have_http_status(200)
+        expect(json_response.size).to eq(2)
+        expect(json_response.map { |u| u['id'] }).to match_array [master.id, developer.id]
+      end
+
+      it 'finds members with query string' do
+        get v3_api("/#{source_type.pluralize}/#{source.id}/members", developer), query: master.username
+
+        expect(response).to have_http_status(200)
+        expect(json_response.count).to eq(1)
+        expect(json_response.first['username']).to eq(master.username)
+      end
+    end
+  end
+
+  shared_examples 'GET /:sources/:id/members/:user_id' do |source_type|
+    context "with :sources == #{source_type.pluralize}" do
+      it_behaves_like 'a 404 response when source is private' do
+        let(:route) { get v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger) }
+      end
+
+      context 'when authenticated as a non-member' do
+        %i[access_requester stranger].each do |type|
+          context "as a #{type}" do
+            it 'returns 200' do
+              user = public_send(type)
+              get v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user)
+
+              expect(response).to have_http_status(200)
+              # User attributes
+              expect(json_response['id']).to eq(developer.id)
+              expect(json_response['name']).to eq(developer.name)
+              expect(json_response['username']).to eq(developer.username)
+              expect(json_response['state']).to eq(developer.state)
+              expect(json_response['avatar_url']).to eq(developer.avatar_url)
+              expect(json_response['web_url']).to eq(Gitlab::Routing.url_helpers.user_url(developer))
+
+              # Member attributes
+              expect(json_response['access_level']).to eq(Member::DEVELOPER)
+            end
+          end
+        end
+      end
+    end
+  end
+
+  shared_examples 'POST /:sources/:id/members' do |source_type|
+    context "with :sources == #{source_type.pluralize}" do
+      it_behaves_like 'a 404 response when source is private' do
+        let(:route) do
+          post v3_api("/#{source_type.pluralize}/#{source.id}/members", stranger),
+               user_id: access_requester.id, access_level: Member::MASTER
+        end
+      end
+
+      context 'when authenticated as a non-member or member with insufficient rights' do
+        %i[access_requester stranger developer].each do |type|
+          context "as a #{type}" do
+            it 'returns 403' do
+              user = public_send(type)
+              post v3_api("/#{source_type.pluralize}/#{source.id}/members", user),
+                   user_id: access_requester.id, access_level: Member::MASTER
+
+              expect(response).to have_http_status(403)
+            end
+          end
+        end
+      end
+
+      context 'when authenticated as a master/owner' do
+        context 'and new member is already a requester' do
+          it 'transforms the requester into a proper member' do
+            expect do
+              post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
+                   user_id: access_requester.id, access_level: Member::MASTER
+
+              expect(response).to have_http_status(201)
+            end.to change { source.members.count }.by(1)
+            expect(source.requesters.count).to eq(0)
+            expect(json_response['id']).to eq(access_requester.id)
+            expect(json_response['access_level']).to eq(Member::MASTER)
+          end
+        end
+
+        it 'creates a new member' do
+          expect do
+            post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
+                 user_id: stranger.id, access_level: Member::DEVELOPER, expires_at: '2016-08-05'
+
+            expect(response).to have_http_status(201)
+          end.to change { source.members.count }.by(1)
+          expect(json_response['id']).to eq(stranger.id)
+          expect(json_response['access_level']).to eq(Member::DEVELOPER)
+          expect(json_response['expires_at']).to eq('2016-08-05')
+        end
+      end
+
+      it "returns #{source_type == 'project' ? 201 : 409} if member already exists" do
+        post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
+             user_id: master.id, access_level: Member::MASTER
+
+        expect(response).to have_http_status(source_type == 'project' ? 201 : 409)
+      end
+
+      it 'returns 400 when user_id is not given' do
+        post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
+             access_level: Member::MASTER
+
+        expect(response).to have_http_status(400)
+      end
+
+      it 'returns 400 when access_level is not given' do
+        post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
+             user_id: stranger.id
+
+        expect(response).to have_http_status(400)
+      end
+
+      it 'returns 422 when access_level is not valid' do
+        post v3_api("/#{source_type.pluralize}/#{source.id}/members", master),
+             user_id: stranger.id, access_level: 1234
+
+        expect(response).to have_http_status(422)
+      end
+    end
+  end
+
+  shared_examples 'PUT /:sources/:id/members/:user_id' do |source_type|
+    context "with :sources == #{source_type.pluralize}" do
+      it_behaves_like 'a 404 response when source is private' do
+        let(:route) do
+          put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger),
+              access_level: Member::MASTER
+        end
+      end
+
+      context 'when authenticated as a non-member or member with insufficient rights' do
+        %i[access_requester stranger developer].each do |type|
+          context "as a #{type}" do
+            it 'returns 403' do
+              user = public_send(type)
+              put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user),
+                  access_level: Member::MASTER
+
+              expect(response).to have_http_status(403)
+            end
+          end
+        end
+      end
+
+      context 'when authenticated as a master/owner' do
+        it 'updates the member' do
+          put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master),
+              access_level: Member::MASTER, expires_at: '2016-08-05'
+
+          expect(response).to have_http_status(200)
+          expect(json_response['id']).to eq(developer.id)
+          expect(json_response['access_level']).to eq(Member::MASTER)
+          expect(json_response['expires_at']).to eq('2016-08-05')
+        end
+      end
+
+      it 'returns 409 if member does not exist' do
+        put v3_api("/#{source_type.pluralize}/#{source.id}/members/123", master),
+            access_level: Member::MASTER
+
+        expect(response).to have_http_status(404)
+      end
+
+      it 'returns 400 when access_level is not given' do
+        put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master)
+
+        expect(response).to have_http_status(400)
+      end
+
+      it 'returns 422 when access level is not valid' do
+        put v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master),
+            access_level: 1234
+
+        expect(response).to have_http_status(422)
+      end
+    end
+  end
+
+  shared_examples 'DELETE /:sources/:id/members/:user_id' do |source_type|
+    context "with :sources == #{source_type.pluralize}" do
+      it_behaves_like 'a 404 response when source is private' do
+        let(:route) { delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", stranger) }
+      end
+
+      context 'when authenticated as a non-member or member with insufficient rights' do
+        %i[access_requester stranger].each do |type|
+          context "as a #{type}" do
+            it 'returns 403' do
+              user = public_send(type)
+              delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", user)
+
+              expect(response).to have_http_status(403)
+            end
+          end
+        end
+      end
+
+      context 'when authenticated as a member and deleting themself' do
+        it 'deletes the member' do
+          expect do
+            delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", developer)
+
+            expect(response).to have_http_status(200)
+          end.to change { source.members.count }.by(-1)
+        end
+      end
+
+      context 'when authenticated as a master/owner' do
+        context 'and member is a requester' do
+          it "returns #{source_type == 'project' ? 200 : 404}" do
+            expect do
+              delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{access_requester.id}", master)
+
+              expect(response).to have_http_status(source_type == 'project' ? 200 : 404)
+            end.not_to change { source.requesters.count }
+          end
+        end
+
+        it 'deletes the member' do
+          expect do
+            delete v3_api("/#{source_type.pluralize}/#{source.id}/members/#{developer.id}", master)
+
+            expect(response).to have_http_status(200)
+          end.to change { source.members.count }.by(-1)
+        end
+      end
+
+      it "returns #{source_type == 'project' ? 200 : 404} if member does not exist" do
+        delete v3_api("/#{source_type.pluralize}/#{source.id}/members/123", master)
+
+        expect(response).to have_http_status(source_type == 'project' ? 200 : 404)
+      end
+    end
+  end
+
+  it_behaves_like 'GET /:sources/:id/members', 'project' do
+    let(:source) { project }
+  end
+
+  it_behaves_like 'GET /:sources/:id/members', 'group' do
+    let(:source) { group }
+  end
+
+  it_behaves_like 'GET /:sources/:id/members/:user_id', 'project' do
+    let(:source) { project }
+  end
+
+  it_behaves_like 'GET /:sources/:id/members/:user_id', 'group' do
+    let(:source) { group }
+  end
+
+  it_behaves_like 'POST /:sources/:id/members', 'project' do
+    let(:source) { project }
+  end
+
+  it_behaves_like 'POST /:sources/:id/members', 'group' do
+    let(:source) { group }
+  end
+
+  it_behaves_like 'PUT /:sources/:id/members/:user_id', 'project' do
+    let(:source) { project }
+  end
+
+  it_behaves_like 'PUT /:sources/:id/members/:user_id', 'group' do
+    let(:source) { group }
+  end
+
+  it_behaves_like 'DELETE /:sources/:id/members/:user_id', 'project' do
+    let(:source) { project }
+  end
+
+  it_behaves_like 'DELETE /:sources/:id/members/:user_id', 'group' do
+    let(:source) { group }
+  end
+
+  context 'Adding owner to project' do
+    it 'returns 403' do
+      expect do
+        post v3_api("/projects/#{project.id}/members", master),
+             user_id: stranger.id, access_level: Member::OWNER
+
+        expect(response).to have_http_status(422)
+      end.to change { project.members.count }.by(0)
+    end
+  end
+end
diff --git a/spec/requests/api/v3/project_snippets_spec.rb b/spec/requests/api/v3/project_snippets_spec.rb
new file mode 100644
index 00000000000..3700477f0db
--- /dev/null
+++ b/spec/requests/api/v3/project_snippets_spec.rb
@@ -0,0 +1,188 @@
+require 'rails_helper'
+
+describe API::ProjectSnippets, api: true do
+  include ApiHelpers
+
+  let(:project) { create(:empty_project, :public) }
+  let(:user) { create(:user) }
+  let(:admin) { create(:admin) }
+
+  describe 'GET /projects/:project_id/snippets/:id' do
+    # TODO (rspeicher): Deprecated; remove in 9.0
+    it 'always exposes expires_at as nil' do
+      snippet = create(:project_snippet, author: admin)
+
+      get v3_api("/projects/#{snippet.project.id}/snippets/#{snippet.id}", admin)
+
+      expect(json_response).to have_key('expires_at')
+      expect(json_response['expires_at']).to be_nil
+    end
+  end
+
+  describe 'GET /projects/:project_id/snippets/' do
+    let(:user) { create(:user) }
+
+    it 'returns all snippets available to team member' do
+      project.add_developer(user)
+      public_snippet = create(:project_snippet, :public, project: project)
+      internal_snippet = create(:project_snippet, :internal, project: project)
+      private_snippet = create(:project_snippet, :private, project: project)
+
+      get v3_api("/projects/#{project.id}/snippets/", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response.size).to eq(3)
+      expect(json_response.map{ |snippet| snippet['id']} ).to include(public_snippet.id, internal_snippet.id, private_snippet.id)
+      expect(json_response.last).to have_key('web_url')
+    end
+
+    it 'hides private snippets from regular user' do
+      create(:project_snippet, :private, project: project)
+
+      get v3_api("/projects/#{project.id}/snippets/", user)
+      expect(response).to have_http_status(200)
+      expect(json_response.size).to eq(0)
+    end
+  end
+
+  describe 'POST /projects/:project_id/snippets/' do
+    let(:params) do
+      {
+        title: 'Test Title',
+        file_name: 'test.rb',
+        code: 'puts "hello world"',
+        visibility_level: Snippet::PUBLIC
+      }
+    end
+
+    it 'creates a new snippet' do
+      post v3_api("/projects/#{project.id}/snippets/", admin), params
+
+      expect(response).to have_http_status(201)
+      snippet = ProjectSnippet.find(json_response['id'])
+      expect(snippet.content).to eq(params[:code])
+      expect(snippet.title).to eq(params[:title])
+      expect(snippet.file_name).to eq(params[:file_name])
+      expect(snippet.visibility_level).to eq(params[:visibility_level])
+    end
+
+    it 'returns 400 for missing parameters' do
+      params.delete(:title)
+
+      post v3_api("/projects/#{project.id}/snippets/", admin), params
+
+      expect(response).to have_http_status(400)
+    end
+
+    context 'when the snippet is spam' do
+      def create_snippet(project, snippet_params = {})
+        project.add_developer(user)
+
+        post v3_api("/projects/#{project.id}/snippets", user), params.merge(snippet_params)
+      end
+
+      before do
+        allow_any_instance_of(AkismetService).to receive(:is_spam?).and_return(true)
+      end
+
+      context 'when the project is private' do
+        let(:private_project) { create(:project_empty_repo, :private) }
+
+        context 'when the snippet is public' do
+          it 'creates the snippet' do
+            expect { create_snippet(private_project, visibility_level: Snippet::PUBLIC) }.
+              to change { Snippet.count }.by(1)
+          end
+        end
+      end
+
+      context 'when the project is public' do
+        context 'when the snippet is private' do
+          it 'creates the snippet' do
+            expect { create_snippet(project, visibility_level: Snippet::PRIVATE) }.
+              to change { Snippet.count }.by(1)
+          end
+        end
+
+        context 'when the snippet is public' do
+          it 'rejects the shippet' do
+            expect { create_snippet(project, visibility_level: Snippet::PUBLIC) }.
+              not_to change { Snippet.count }
+            expect(response).to have_http_status(400)
+          end
+
+          it 'creates a spam log' do
+            expect { create_snippet(project, visibility_level: Snippet::PUBLIC) }.
+              to change { SpamLog.count }.by(1)
+          end
+        end
+      end
+    end
+  end
+
+  describe 'PUT /projects/:project_id/snippets/:id/' do
+    let(:snippet) { create(:project_snippet, author: admin) }
+
+    it 'updates snippet' do
+      new_content = 'New content'
+
+      put v3_api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/", admin), code: new_content
+
+      expect(response).to have_http_status(200)
+      snippet.reload
+      expect(snippet.content).to eq(new_content)
+    end
+
+    it 'returns 404 for invalid snippet id' do
+      put v3_api("/projects/#{snippet.project.id}/snippets/1234", admin), title: 'foo'
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 Snippet Not Found')
+    end
+
+    it 'returns 400 for missing parameters' do
+      put v3_api("/projects/#{project.id}/snippets/1234", admin)
+
+      expect(response).to have_http_status(400)
+    end
+  end
+
+  describe 'DELETE /projects/:project_id/snippets/:id/' do
+    let(:snippet) { create(:project_snippet, author: admin) }
+
+    it 'deletes snippet' do
+      admin = create(:admin)
+      snippet = create(:project_snippet, author: admin)
+
+      delete v3_api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/", admin)
+
+      expect(response).to have_http_status(200)
+    end
+
+    it 'returns 404 for invalid snippet id' do
+      delete v3_api("/projects/#{snippet.project.id}/snippets/1234", admin)
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 Snippet Not Found')
+    end
+  end
+
+  describe 'GET /projects/:project_id/snippets/:id/raw' do
+    let(:snippet) { create(:project_snippet, author: admin) }
+
+    it 'returns raw text' do
+      get v3_api("/projects/#{snippet.project.id}/snippets/#{snippet.id}/raw", admin)
+
+      expect(response).to have_http_status(200)
+      expect(response.content_type).to eq 'text/plain'
+      expect(response.body).to eq(snippet.content)
+    end
+
+    it 'returns 404 for invalid snippet id' do
+      delete v3_api("/projects/#{snippet.project.id}/snippets/1234", admin)
+
+      expect(response).to have_http_status(404)
+      expect(json_response['message']).to eq('404 Snippet Not Found')
+    end
+  end
+end
diff --git a/spec/requests/api/v3/templates_spec.rb b/spec/requests/api/v3/templates_spec.rb
new file mode 100644
index 00000000000..4fd4e70bedd
--- /dev/null
+++ b/spec/requests/api/v3/templates_spec.rb
@@ -0,0 +1,203 @@
+require 'spec_helper'
+
+describe API::V3::Templates, api: true  do
+  include ApiHelpers
+
+  shared_examples_for 'the Template Entity' do |path|
+    before { get v3_api(path) }
+
+    it { expect(json_response['name']).to eq('Ruby') }
+    it { expect(json_response['content']).to include('*.gem') }
+  end
+
+  shared_examples_for 'the TemplateList Entity' do |path|
+    before { get v3_api(path) }
+
+    it { expect(json_response.first['name']).not_to be_nil }
+    it { expect(json_response.first['content']).to be_nil }
+  end
+
+  shared_examples_for 'requesting gitignores' do |path|
+    it 'returns a list of available gitignore templates' do
+      get v3_api(path)
+
+      expect(response).to have_http_status(200)
+      expect(json_response).to be_an Array
+      expect(json_response.size).to be > 15
+    end
+  end
+
+  shared_examples_for 'requesting gitlab-ci-ymls' do |path|
+    it 'returns a list of available gitlab_ci_ymls' do
+      get v3_api(path)
+
+      expect(response).to have_http_status(200)
+      expect(json_response).to be_an Array
+      expect(json_response.first['name']).not_to be_nil
+    end
+  end
+
+  shared_examples_for 'requesting gitlab-ci-yml for Ruby' do |path|
+    it 'adds a disclaimer on the top' do
+      get v3_api(path)
+
+      expect(response).to have_http_status(200)
+      expect(json_response['content']).to start_with("# This file is a template,")
+    end
+  end
+
+  shared_examples_for 'the License Template Entity' do |path|
+    before { get v3_api(path) }
+
+    it 'returns a license template' do
+      expect(json_response['key']).to eq('mit')
+      expect(json_response['name']).to eq('MIT License')
+      expect(json_response['nickname']).to be_nil
+      expect(json_response['popular']).to be true
+      expect(json_response['html_url']).to eq('http://choosealicense.com/licenses/mit/')
+      expect(json_response['source_url']).to eq('https://opensource.org/licenses/MIT')
+      expect(json_response['description']).to include('A permissive license that is short and to the point.')
+      expect(json_response['conditions']).to eq(%w[include-copyright])
+      expect(json_response['permissions']).to eq(%w[commercial-use modifications distribution private-use])
+      expect(json_response['limitations']).to eq(%w[no-liability])
+      expect(json_response['content']).to include('The MIT License (MIT)')
+    end
+  end
+
+  shared_examples_for 'GET licenses' do |path|
+    it 'returns a list of available license templates' do
+      get v3_api(path)
+
+      expect(response).to have_http_status(200)
+      expect(json_response).to be_an Array
+      expect(json_response.size).to eq(15)
+      expect(json_response.map { |l| l['key'] }).to include('agpl-3.0')
+    end
+
+    describe 'the popular parameter' do
+      context 'with popular=1' do
+        it 'returns a list of available popular license templates' do
+          get v3_api("#{path}?popular=1")
+
+          expect(response).to have_http_status(200)
+          expect(json_response).to be_an Array
+          expect(json_response.size).to eq(3)
+          expect(json_response.map { |l| l['key'] }).to include('apache-2.0')
+        end
+      end
+    end
+  end
+
+  shared_examples_for 'GET licenses/:name' do |path|
+    context 'with :project and :fullname given' do
+      before do
+        get v3_api("#{path}/#{license_type}?project=My+Awesome+Project&fullname=Anton+#{license_type.upcase}")
+      end
+
+      context 'for the mit license' do
+        let(:license_type) { 'mit' }
+
+        it 'returns the license text' do
+          expect(json_response['content']).to include('The MIT License (MIT)')
+        end
+
+        it 'replaces placeholder values' do
+          expect(json_response['content']).to include("Copyright (c) #{Time.now.year} Anton")
+        end
+      end
+
+      context 'for the agpl-3.0 license' do
+        let(:license_type) { 'agpl-3.0' }
+
+        it 'returns the license text' do
+          expect(json_response['content']).to include('GNU AFFERO GENERAL PUBLIC LICENSE')
+        end
+
+        it 'replaces placeholder values' do
+          expect(json_response['content']).to include('My Awesome Project')
+          expect(json_response['content']).to include("Copyright (C) #{Time.now.year}  Anton")
+        end
+      end
+
+      context 'for the gpl-3.0 license' do
+        let(:license_type) { 'gpl-3.0' }
+
+        it 'returns the license text' do
+          expect(json_response['content']).to include('GNU GENERAL PUBLIC LICENSE')
+        end
+
+        it 'replaces placeholder values' do
+          expect(json_response['content']).to include('My Awesome Project')
+          expect(json_response['content']).to include("Copyright (C) #{Time.now.year}  Anton")
+        end
+      end
+
+      context 'for the gpl-2.0 license' do
+        let(:license_type) { 'gpl-2.0' }
+
+        it 'returns the license text' do
+          expect(json_response['content']).to include('GNU GENERAL PUBLIC LICENSE')
+        end
+
+        it 'replaces placeholder values' do
+          expect(json_response['content']).to include('My Awesome Project')
+          expect(json_response['content']).to include("Copyright (C) #{Time.now.year}  Anton")
+        end
+      end
+
+      context 'for the apache-2.0 license' do
+        let(:license_type) { 'apache-2.0' }
+
+        it 'returns the license text' do
+          expect(json_response['content']).to include('Apache License')
+        end
+
+        it 'replaces placeholder values' do
+          expect(json_response['content']).to include("Copyright #{Time.now.year} Anton")
+        end
+      end
+
+      context 'for an uknown license' do
+        let(:license_type) { 'muth-over9000' }
+
+        it 'returns a 404' do
+          expect(response).to have_http_status(404)
+        end
+      end
+    end
+
+    context 'with no :fullname given' do
+      context 'with an authenticated user' do
+        let(:user) { create(:user) }
+
+        it 'replaces the copyright owner placeholder with the name of the current user' do
+          get v3_api('/templates/licenses/mit', user)
+
+          expect(json_response['content']).to include("Copyright (c) #{Time.now.year} #{user.name}")
+        end
+      end
+    end
+  end
+
+  describe 'with /templates namespace' do
+    it_behaves_like 'the Template Entity', '/templates/gitignores/Ruby'
+    it_behaves_like 'the TemplateList Entity', '/templates/gitignores'
+    it_behaves_like 'requesting gitignores', '/templates/gitignores'
+    it_behaves_like 'requesting gitlab-ci-ymls', '/templates/gitlab_ci_ymls'
+    it_behaves_like 'requesting gitlab-ci-yml for Ruby', '/templates/gitlab_ci_ymls/Ruby'
+    it_behaves_like 'the License Template Entity', '/templates/licenses/mit'
+    it_behaves_like 'GET licenses', '/templates/licenses'
+    it_behaves_like 'GET licenses/:name', '/templates/licenses'
+  end
+
+  describe 'without /templates namespace' do
+    it_behaves_like 'the Template Entity', '/gitignores/Ruby'
+    it_behaves_like 'the TemplateList Entity', '/gitignores'
+    it_behaves_like 'requesting gitignores', '/gitignores'
+    it_behaves_like 'requesting gitlab-ci-ymls', '/gitlab_ci_ymls'
+    it_behaves_like 'requesting gitlab-ci-yml for Ruby', '/gitlab_ci_ymls/Ruby'
+    it_behaves_like 'the License Template Entity', '/licenses/mit'
+    it_behaves_like 'GET licenses', '/licenses'
+    it_behaves_like 'GET licenses/:name', '/licenses'
+  end
+end
diff --git a/spec/requests/lfs_http_spec.rb b/spec/requests/lfs_http_spec.rb
index 9bfc84c7425..c0e7bab8199 100644
--- a/spec/requests/lfs_http_spec.rb
+++ b/spec/requests/lfs_http_spec.rb
@@ -600,6 +600,7 @@ describe 'Git LFS API and storage' do
             expect(json_response).to eq('objects' => [
               { 'oid' => sample_oid,
                 'size' => sample_size,
+                'authenticated' => true,
                 'actions' => {
                   'download' => {
                     'href' => "#{project.http_url_to_repo}/gitlab-lfs/objects/#{sample_oid}",