Merge branch 'master' into backstage/gb/build-stages-catch-up-migration

* master: (26 commits)

28 files changed, 807 insertions, 254 deletions

diff --git a/spec/controllers/import/bitbucket_controller_spec.rb b/spec/controllers/import/bitbucket_controller_spec.rb
index e8707760a5a..2be46049aab 100644
--- a/spec/controllers/import/bitbucket_controller_spec.rb
+++ b/spec/controllers/import/bitbucket_controller_spec.rb
@@ -84,20 +84,42 @@ describe Import::BitbucketController do
       double(slug: "vim", owner: bitbucket_username, name: 'vim')
     end
 
+    let(:project) { create(:project) }
+
     before do
       allow_any_instance_of(Bitbucket::Client).to receive(:repo).and_return(bitbucket_repo)
       allow_any_instance_of(Bitbucket::Client).to receive(:user).and_return(bitbucket_user)
       assign_session_tokens
     end
 
+    it 'returns 200 response when the project is imported successfully' do
+      allow(Gitlab::BitbucketImport::ProjectCreator)
+        .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
+        .and_return(double(execute: project))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'returns 422 response when the project could not be imported' do
+      allow(Gitlab::BitbucketImport::ProjectCreator)
+        .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
+        .and_return(double(execute: build(:project)))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(422)
+    end
+
     context "when the repository owner is the Bitbucket user" do
       context "when the Bitbucket user and GitLab user's usernames match" do
         it "takes the current user's namespace" do
           expect(Gitlab::BitbucketImport::ProjectCreator)
             .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -107,9 +129,9 @@ describe Import::BitbucketController do
         it "takes the current user's namespace" do
           expect(Gitlab::BitbucketImport::ProjectCreator)
             .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -120,7 +142,7 @@ describe Import::BitbucketController do
           allow(controller).to receive(:current_user).and_return(user)
           allow(user).to receive(:can?).and_return(false)
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
     end
@@ -143,9 +165,9 @@ describe Import::BitbucketController do
           it "takes the existing namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, existing_namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -154,7 +176,7 @@ describe Import::BitbucketController do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .not_to receive(:new)
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
@@ -163,17 +185,17 @@ describe Import::BitbucketController do
         context "when current user can create namespaces" do
           it "creates the namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.to change(Namespace, :count).by(1)
+            expect { post :create, format: :json }.to change(Namespace, :count).by(1)
           end
 
           it "takes the new namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, an_instance_of(Group), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -184,23 +206,23 @@ describe Import::BitbucketController do
 
           it "doesn't create the namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.not_to change(Namespace, :count)
+            expect { post :create, format: :json }.not_to change(Namespace, :count)
           end
 
           it "takes the current user's namespace" do
             expect(Gitlab::BitbucketImport::ProjectCreator)
               .to receive(:new).with(bitbucket_repo, bitbucket_repo.name, user.namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
     end
 
-    context 'user has chosen an existing nested namespace and name for the project' do
+    context 'user has chosen an existing nested namespace and name for the project', :postgresql do
       let(:parent_namespace) { create(:group, name: 'foo', owner: user) }
       let(:nested_namespace) { create(:group, name: 'bar', parent: parent_namespace) }
       let(:test_name) { 'test_name' }
@@ -212,63 +234,77 @@ describe Import::BitbucketController do
       it 'takes the selected namespace and name' do
         expect(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, nested_namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: nested_namespace.full_path, new_name: test_name, format: :js }
+        post :create, { target_namespace: nested_namespace.full_path, new_name: test_name, format: :json }
       end
     end
 
-    context 'user has chosen a non-existent nested namespaces and name for the project' do
+    context 'user has chosen a non-existent nested namespaces and name for the project', :postgresql do
       let(:test_name) { 'test_name' }
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json }
       end
 
       it 'creates the namespaces' do
         allow(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        expect { post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js } }
+        expect { post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json } }
           .to change { Namespace.count }.by(2)
       end
 
       it 'new namespace has the right parent' do
         allow(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json }
 
         expect(Namespace.find_by_path_or_name('bar').parent.path).to eq('foo')
       end
     end
 
-    context 'user has chosen existent and non-existent nested namespaces and name for the project' do
+    context 'user has chosen existent and non-existent nested namespaces and name for the project', :postgresql do
       let(:test_name) { 'test_name' }
       let!(:parent_namespace) { create(:group, name: 'foo', owner: user) }
 
+      before do
+        parent_namespace.add_owner(user)
+      end
+
       it 'takes the selected namespace and name' do
         expect(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :json }
       end
 
       it 'creates the namespaces' do
         allow(Gitlab::BitbucketImport::ProjectCreator)
           .to receive(:new).with(bitbucket_repo, test_name, kind_of(Namespace), user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js } }
+        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :json } }
           .to change { Namespace.count }.by(2)
       end
     end
+
+    context 'when user can not create projects in the chosen namespace' do
+      it 'returns 422 response' do
+        other_namespace = create(:group, name: 'other_namespace')
+
+        post :create, { target_namespace: other_namespace.name, format: :json }
+
+        expect(response).to have_gitlab_http_status(422)
+      end
+    end
   end
 end
diff --git a/spec/controllers/import/gitlab_controller_spec.rb b/spec/controllers/import/gitlab_controller_spec.rb
index faf1e6f63ea..e958be077c2 100644
--- a/spec/controllers/import/gitlab_controller_spec.rb
+++ b/spec/controllers/import/gitlab_controller_spec.rb
@@ -57,6 +57,7 @@ describe Import::GitlabController do
   end
 
   describe "POST create" do
+    let(:project) { create(:project) }
     let(:gitlab_username) { user.username }
     let(:gitlab_user) do
       { username: gitlab_username }.with_indifferent_access
@@ -75,14 +76,34 @@ describe Import::GitlabController do
       assign_session_token
     end
 
+    it 'returns 200 response when the project is imported successfully' do
+      allow(Gitlab::GitlabImport::ProjectCreator)
+        .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
+        .and_return(double(execute: project))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(200)
+    end
+
+    it 'returns 422 response when the project could not be imported' do
+      allow(Gitlab::GitlabImport::ProjectCreator)
+        .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
+        .and_return(double(execute: build(:project)))
+
+      post :create, format: :json
+
+      expect(response).to have_gitlab_http_status(422)
+    end
+
     context "when the repository owner is the GitLab.com user" do
       context "when the GitLab.com user and GitLab server user's usernames match" do
         it "takes the current user's namespace" do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -92,9 +113,9 @@ describe Import::GitlabController do
         it "takes the current user's namespace" do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
     end
@@ -118,9 +139,9 @@ describe Import::GitlabController do
           it "takes the existing namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .to receive(:new).with(gitlab_repo, existing_namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -129,7 +150,7 @@ describe Import::GitlabController do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .not_to receive(:new)
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
@@ -138,17 +159,17 @@ describe Import::GitlabController do
         context "when current user can create namespaces" do
           it "creates the namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.to change(Namespace, :count).by(1)
+            expect { post :create, format: :json }.to change(Namespace, :count).by(1)
           end
 
           it "takes the new namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .to receive(:new).with(gitlab_repo, an_instance_of(Group), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
 
@@ -159,22 +180,22 @@ describe Import::GitlabController do
 
           it "doesn't create the namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
-              .to receive(:new).and_return(double(execute: true))
+              .to receive(:new).and_return(double(execute: project))
 
-            expect { post :create, format: :js }.not_to change(Namespace, :count)
+            expect { post :create, format: :json }.not_to change(Namespace, :count)
           end
 
           it "takes the current user's namespace" do
             expect(Gitlab::GitlabImport::ProjectCreator)
               .to receive(:new).with(gitlab_repo, user.namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-            post :create, format: :js
+            post :create, format: :json
           end
         end
       end
 
-      context 'user has chosen an existing nested namespace for the project' do
+      context 'user has chosen an existing nested namespace for the project', :postgresql do
         let(:parent_namespace) { create(:group, name: 'foo', owner: user) }
         let(:nested_namespace) { create(:group, name: 'bar', parent: parent_namespace) }
 
@@ -185,64 +206,78 @@ describe Import::GitlabController do
         it 'takes the selected namespace and name' do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, nested_namespace, user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: nested_namespace.full_path, format: :js }
+          post :create, { target_namespace: nested_namespace.full_path, format: :json }
         end
       end
 
-      context 'user has chosen a non-existent nested namespaces for the project' do
+      context 'user has chosen a non-existent nested namespaces for the project', :postgresql do
         let(:test_name) { 'test_name' }
 
         it 'takes the selected namespace and name' do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: 'foo/bar', format: :js }
+          post :create, { target_namespace: 'foo/bar', format: :json }
         end
 
         it 'creates the namespaces' do
           allow(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          expect { post :create, { target_namespace: 'foo/bar', format: :js } }
+          expect { post :create, { target_namespace: 'foo/bar', format: :json } }
             .to change { Namespace.count }.by(2)
         end
 
         it 'new namespace has the right parent' do
           allow(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: 'foo/bar', format: :js }
+          post :create, { target_namespace: 'foo/bar', format: :json }
 
           expect(Namespace.find_by_path_or_name('bar').parent.path).to eq('foo')
         end
       end
 
-      context 'user has chosen existent and non-existent nested namespaces and name for the project' do
+      context 'user has chosen existent and non-existent nested namespaces and name for the project', :postgresql do
         let(:test_name) { 'test_name' }
         let!(:parent_namespace) { create(:group, name: 'foo', owner: user) }
 
+        before do
+          parent_namespace.add_owner(user)
+        end
+
         it 'takes the selected namespace and name' do
           expect(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, { target_namespace: 'foo/foobar/bar', format: :js }
+          post :create, { target_namespace: 'foo/foobar/bar', format: :json }
         end
 
         it 'creates the namespaces' do
           allow(Gitlab::GitlabImport::ProjectCreator)
             .to receive(:new).with(gitlab_repo, kind_of(Namespace), user, access_params)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          expect { post :create, { target_namespace: 'foo/foobar/bar', format: :js } }
+          expect { post :create, { target_namespace: 'foo/foobar/bar', format: :json } }
             .to change { Namespace.count }.by(2)
         end
       end
+
+      context 'when user can not create projects in the chosen namespace' do
+        it 'returns 422 response' do
+          other_namespace = create(:group, name: 'other_namespace')
+
+          post :create, { target_namespace: other_namespace.name, format: :json }
+
+          expect(response).to have_gitlab_http_status(422)
+        end
+      end
     end
   end
 end
diff --git a/spec/features/copy_as_gfm_spec.rb b/spec/features/markdown/copy_as_gfm_spec.rb
index f82ed6300cc..f82ed6300cc 100644
--- a/spec/features/copy_as_gfm_spec.rb
+++ b/spec/features/markdown/copy_as_gfm_spec.rb
diff --git a/spec/features/gitlab_flavored_markdown_spec.rb b/spec/features/markdown/gitlab_flavored_markdown_spec.rb
index 3c2186b3598..3c2186b3598 100644
--- a/spec/features/gitlab_flavored_markdown_spec.rb
+++ b/spec/features/markdown/gitlab_flavored_markdown_spec.rb
diff --git a/spec/features/markdown_spec.rb b/spec/features/markdown/markdown_spec.rb
index f13d78d24e3..f13d78d24e3 100644
--- a/spec/features/markdown_spec.rb
+++ b/spec/features/markdown/markdown_spec.rb
diff --git a/spec/features/markdown/math_spec.rb b/spec/features/markdown/math_spec.rb
new file mode 100644
index 00000000000..6a23d6b78ab
--- /dev/null
+++ b/spec/features/markdown/math_spec.rb
@@ -0,0 +1,22 @@
+require 'spec_helper'
+
+describe 'Math rendering', :js do
+  it 'renders inline and display math correctly' do
+    description = <<~MATH
+      This math is inline $`a^2+b^2=c^2`$.
+
+      This is on a separate line
+      ```math
+      a^2+b^2=c^2
+      ```
+    MATH
+
+    project = create(:project, :public)
+    issue = create(:issue, project: project, description: description)
+
+    visit project_issue_path(project, issue)
+
+    expect(page).to have_selector('.katex .mord.mathit', text: 'b')
+    expect(page).to have_selector('.katex-display .mord.mathit', text: 'b')
+  end
+end
diff --git a/spec/features/markdown/mermaid_spec.rb b/spec/features/markdown/mermaid_spec.rb
new file mode 100644
index 00000000000..a25d701ee35
--- /dev/null
+++ b/spec/features/markdown/mermaid_spec.rb
@@ -0,0 +1,24 @@
+require 'spec_helper'
+
+describe 'Mermaid rendering', :js do
+  it 'renders Mermaid diagrams correctly' do
+    description = <<~MERMAID
+      ```mermaid
+      graph TD;
+        A-->B;
+        A-->C;
+        B-->D;
+        C-->D;
+      ```
+    MERMAID
+
+    project = create(:project, :public)
+    issue = create(:issue, project: project, description: description)
+
+    visit project_issue_path(project, issue)
+
+    %w[A B C D].each do |label|
+      expect(page).to have_selector('svg foreignObject', text: label)
+    end
+  end
+end
diff --git a/spec/finders/snippets_finder_spec.rb b/spec/finders/snippets_finder_spec.rb
index 0a018d2b417..54a07eccaba 100644
--- a/spec/finders/snippets_finder_spec.rb
+++ b/spec/finders/snippets_finder_spec.rb
@@ -1,57 +1,8 @@
 require 'spec_helper'
 
 describe SnippetsFinder do
-  let(:user) { create :user }
-  let(:user1) { create :user }
-  let(:group) { create :group, :public }
-
-  let(:project1) { create(:project, :public,  group: group) }
-  let(:project2) { create(:project, :private, group: group) }
-
-  context 'all snippets visible to a user' do
-    let!(:snippet1) { create(:personal_snippet, :private) }
-    let!(:snippet2) { create(:personal_snippet, :internal) }
-    let!(:snippet3) { create(:personal_snippet, :public) }
-    let!(:project_snippet1) { create(:project_snippet, :private) }
-    let!(:project_snippet2) { create(:project_snippet, :internal) }
-    let!(:project_snippet3) { create(:project_snippet, :public) }
-
-    it "returns all private and internal snippets" do
-      snippets = described_class.new(user, scope: :all).execute
-      expect(snippets).to include(snippet2, snippet3, project_snippet2, project_snippet3)
-      expect(snippets).not_to include(snippet1, project_snippet1)
-    end
-
-    it "returns all public snippets" do
-      snippets = described_class.new(nil, scope: :all).execute
-      expect(snippets).to include(snippet3, project_snippet3)
-      expect(snippets).not_to include(snippet1, snippet2, project_snippet1, project_snippet2)
-    end
-
-    it "returns all public and internal snippets for normal user" do
-      snippets = described_class.new(user).execute
-
-      expect(snippets).to include(snippet2, snippet3, project_snippet2, project_snippet3)
-      expect(snippets).not_to include(snippet1, project_snippet1)
-    end
-
-    it "returns all public snippets for non authorized user" do
-      snippets = described_class.new(nil).execute
-
-      expect(snippets).to include(snippet3, project_snippet3)
-      expect(snippets).not_to include(snippet1, snippet2, project_snippet1, project_snippet2)
-    end
-
-    it "returns all public and authored snippets for external user" do
-      external_user = create(:user, :external)
-      authored_snippet = create(:personal_snippet, :internal, author: external_user)
-
-      snippets = described_class.new(external_user).execute
-
-      expect(snippets).to include(snippet3, project_snippet3, authored_snippet)
-      expect(snippets).not_to include(snippet1, snippet2, project_snippet1, project_snippet2)
-    end
-  end
+  include Gitlab::Allowable
+  using RSpec::Parameterized::TableSyntax
 
   context 'filter by visibility' do
     let!(:snippet1) { create(:personal_snippet, :private) }
@@ -67,6 +18,7 @@ describe SnippetsFinder do
   end
 
   context 'filter by scope' do
+    let(:user) { create :user }
     let!(:snippet1) { create(:personal_snippet, :private, author: user) }
     let!(:snippet2) { create(:personal_snippet, :internal, author: user) }
     let!(:snippet3) { create(:personal_snippet, :public, author: user) }
@@ -84,7 +36,7 @@ describe SnippetsFinder do
       expect(snippets).not_to include(snippet2, snippet3)
     end
 
-    it "returns all snippets for 'are_interna;' scope" do
+    it "returns all snippets for 'are_internal' scope" do
       snippets = described_class.new(user, scope: :are_internal).execute
 
       expect(snippets).to include(snippet2)
@@ -100,6 +52,8 @@ describe SnippetsFinder do
   end
 
   context 'filter by author' do
+    let(:user) { create :user }
+    let(:user1) { create :user }
     let!(:snippet1) { create(:personal_snippet, :private, author: user) }
     let!(:snippet2) { create(:personal_snippet, :internal, author: user) }
     let!(:snippet3) { create(:personal_snippet, :public, author: user) }
@@ -147,6 +101,10 @@ describe SnippetsFinder do
   end
 
   context 'filter by project' do
+    let(:user) { create :user }
+    let(:group) { create :group, :public }
+    let(:project1) { create(:project, :public,  group: group) }
+
     before do
       @snippet1 = create(:project_snippet, :private,  project: project1)
       @snippet2 = create(:project_snippet, :internal, project: project1)
@@ -203,4 +161,9 @@ describe SnippetsFinder do
       expect(snippets).to include(@snippet1)
     end
   end
+
+  describe "#execute" do
+    # Snippet visibility scenarios are included in more details in spec/support/snippet_visibility.rb
+    include_examples 'snippet visibility', described_class
+  end
 end
diff --git a/spec/javascripts/ci_variable_list/ci_variable_list_spec.js b/spec/javascripts/ci_variable_list/ci_variable_list_spec.js
index 6ab7b50e035..8acb346901f 100644
--- a/spec/javascripts/ci_variable_list/ci_variable_list_spec.js
+++ b/spec/javascripts/ci_variable_list/ci_variable_list_spec.js
@@ -126,7 +126,7 @@ describe('VariableList', () => {
 
           // Check for the correct default in the new row
           const $protectedInput = $wrapper.find('.js-row:last-child').find('.js-ci-variable-input-protected');
-          expect($protectedInput.val()).toBe('true');
+          expect($protectedInput.val()).toBe('false');
         })
         .then(done)
         .catch(done.fail);
diff --git a/spec/javascripts/importer_status_spec.js b/spec/javascripts/importer_status_spec.js
new file mode 100644
index 00000000000..bb49c576e91
--- /dev/null
+++ b/spec/javascripts/importer_status_spec.js
@@ -0,0 +1,47 @@
+import { ImporterStatus } from '~/importer_status';
+import axios from '~/lib/utils/axios_utils';
+import MockAdapter from 'axios-mock-adapter';
+
+describe('Importer Status', () => {
+  describe('addToImport', () => {
+    let instance;
+    let mock;
+    const importUrl = '/import_url';
+
+    beforeEach(() => {
+      setFixtures(`
+        <tr id="repo_123">
+          <td class="import-target"></td>
+          <td class="import-actions job-status">
+            <button name="button" type="submit" class="btn btn-import js-add-to-import">
+            </button>
+          </td>
+        </tr>
+      `);
+      spyOn(ImporterStatus.prototype, 'initStatusPage').and.callFake(() => {});
+      spyOn(ImporterStatus.prototype, 'setAutoUpdate').and.callFake(() => {});
+      instance = new ImporterStatus('', importUrl);
+      mock = new MockAdapter(axios);
+    });
+
+    afterEach(() => {
+      mock.restore();
+    });
+
+    it('sets table row to active after post request', (done) => {
+      mock.onPost(importUrl).reply(200, {
+        id: 1,
+        full_path: '/full_path',
+      });
+
+      instance.addToImport({
+        currentTarget: document.querySelector('.js-add-to-import'),
+      })
+      .then(() => {
+        expect(document.querySelector('tr').classList.contains('active')).toEqual(true);
+        done();
+      })
+      .catch(done.fail);
+    });
+  });
+});
diff --git a/spec/javascripts/issuable_time_tracker_spec.js b/spec/javascripts/issuable_time_tracker_spec.js
index 8ff93c4f918..365e9fe6a4b 100644
--- a/spec/javascripts/issuable_time_tracker_spec.js
+++ b/spec/javascripts/issuable_time_tracker_spec.js
@@ -2,7 +2,7 @@
 
 import Vue from 'vue';
 
-import timeTracker from '~/sidebar/components/time_tracking/time_tracker';
+import timeTracker from '~/sidebar/components/time_tracking/time_tracker.vue';
 
 function initTimeTrackingComponent(opts) {
   setFixtures(`
diff --git a/spec/javascripts/vue_mr_widget/components/states/mr_widget_missing_branch_spec.js b/spec/javascripts/vue_mr_widget/components/states/mr_widget_missing_branch_spec.js
index 720effb5c1c..3d7f4abd420 100644
--- a/spec/javascripts/vue_mr_widget/components/states/mr_widget_missing_branch_spec.js
+++ b/spec/javascripts/vue_mr_widget/components/states/mr_widget_missing_branch_spec.js
@@ -1,38 +1,22 @@
 import Vue from 'vue';
-import missingBranchComponent from '~/vue_merge_request_widget/components/states/mr_widget_missing_branch';
-
-const createComponent = () => {
-  const Component = Vue.extend(missingBranchComponent);
-  const mr = {
-    sourceBranchRemoved: true,
-  };
-
-  return new Component({
-    el: document.createElement('div'),
-    propsData: { mr },
-  });
-};
+import missingBranchComponent from '~/vue_merge_request_widget/components/states/mr_widget_missing_branch.vue';
+import mountComponent from '../../../helpers/vue_mount_component_helper';
 
 describe('MRWidgetMissingBranch', () => {
-  describe('props', () => {
-    it('should have props', () => {
-      const mrProp = missingBranchComponent.props.mr;
+  let vm;
 
-      expect(mrProp.type instanceof Object).toBeTruthy();
-      expect(mrProp.required).toBeTruthy();
-    });
+  beforeEach(() => {
+    const Component = Vue.extend(missingBranchComponent);
+    vm = mountComponent(Component, { mr: { sourceBranchRemoved: true } });
   });
 
-  describe('components', () => {
-    it('should have components added', () => {
-      expect(missingBranchComponent.components['mr-widget-merge-help']).toBeDefined();
-    });
+  afterEach(() => {
+    vm.$destroy();
   });
 
   describe('computed', () => {
     describe('missingBranchName', () => {
       it('should return proper branch name', () => {
-        const vm = createComponent();
         expect(vm.missingBranchName).toEqual('source');
 
         vm.mr.sourceBranchRemoved = false;
@@ -43,7 +27,7 @@ describe('MRWidgetMissingBranch', () => {
 
   describe('template', () => {
     it('should have correct elements', () => {
-      const el = createComponent().$el;
+      const el = vm.$el;
       const content = el.textContent.replace(/\n(\s)+/g, ' ').trim();
 
       expect(el.classList.contains('mr-widget-body')).toBeTruthy();
diff --git a/spec/javascripts/vue_shared/components/confirmation_input_spec.js b/spec/javascripts/vue_shared/components/confirmation_input_spec.js
deleted file mode 100644
index a6a12614e77..00000000000
--- a/spec/javascripts/vue_shared/components/confirmation_input_spec.js
+++ /dev/null
@@ -1,63 +0,0 @@
-import Vue from 'vue';
-import confirmationInput from '~/vue_shared/components/confirmation_input.vue';
-import mountComponent from '../../helpers/vue_mount_component_helper';
-
-describe('Confirmation input component', () => {
-  const Component = Vue.extend(confirmationInput);
-  const props = {
-    inputId: 'dummy-id',
-    confirmationKey: 'confirmation-key',
-    confirmationValue: 'confirmation-value',
-  };
-  let vm;
-
-  afterEach(() => {
-    vm.$destroy();
-  });
-
-  describe('props', () => {
-    beforeEach(() => {
-      vm = mountComponent(Component, props);
-    });
-
-    it('sets id of the input field to inputId', () => {
-      expect(vm.$refs.enteredValue.id).toBe(props.inputId);
-    });
-
-    it('sets name of the input field to confirmationKey', () => {
-      expect(vm.$refs.enteredValue.name).toBe(props.confirmationKey);
-    });
-  });
-
-  describe('computed', () => {
-    describe('inputLabel', () => {
-      it('escapes confirmationValue by default', () => {
-        vm = mountComponent(Component, { ...props, confirmationValue: 'n<e></e>ds escap"ng' });
-        expect(vm.inputLabel).toBe('Type <code>n&lt;e&gt;&lt;/e&gt;ds escap&quot;ng</code> to confirm:');
-      });
-
-      it('does not escape confirmationValue if escapeValue is false', () => {
-        vm = mountComponent(Component, { ...props, confirmationValue: 'n<e></e>ds escap"ng', shouldEscapeConfirmationValue: false });
-        expect(vm.inputLabel).toBe('Type <code>n<e></e>ds escap"ng</code> to confirm:');
-      });
-    });
-  });
-
-  describe('methods', () => {
-    describe('hasCorrectValue', () => {
-      beforeEach(() => {
-        vm = mountComponent(Component, props);
-      });
-
-      it('returns false if entered value is incorrect', () => {
-        vm.$refs.enteredValue.value = 'incorrect';
-        expect(vm.hasCorrectValue()).toBe(false);
-      });
-
-      it('returns true if entered value is correct', () => {
-        vm.$refs.enteredValue.value = props.confirmationValue;
-        expect(vm.hasCorrectValue()).toBe(true);
-      });
-    });
-  });
-});
diff --git a/spec/lib/banzai/filter/syntax_highlight_filter_spec.rb b/spec/lib/banzai/filter/syntax_highlight_filter_spec.rb
index 9f2efa05a01..ef52c572898 100644
--- a/spec/lib/banzai/filter/syntax_highlight_filter_spec.rb
+++ b/spec/lib/banzai/filter/syntax_highlight_filter_spec.rb
@@ -3,35 +3,86 @@ require 'spec_helper'
 describe Banzai::Filter::SyntaxHighlightFilter do
   include FilterSpecHelper
 
+  shared_examples "XSS prevention" do |lang|
+    it "escapes HTML tags" do
+      # This is how a script tag inside a code block is presented to this filter
+      # after Markdown rendering.
+      result = filter(%{<pre lang="#{lang}"><code>&lt;script&gt;alert(1)&lt;/script&gt;</code></pre>})
+
+      expect(result.to_html).not_to include("<script>alert(1)</script>")
+      expect(result.to_html).to include("alert(1)")
+    end
+  end
+
   context "when no language is specified" do
     it "highlights as plaintext" do
       result = filter('<pre><code>def fun end</code></pre>')
+
       expect(result.to_html).to eq('<pre class="code highlight js-syntax-highlight plaintext" lang="plaintext" v-pre="true"><code><span id="LC1" class="line" lang="plaintext">def fun end</span></code></pre>')
     end
+
+    include_examples "XSS prevention", ""
   end
 
   context "when a valid language is specified" do
     it "highlights as that language" do
       result = filter('<pre><code lang="ruby">def fun end</code></pre>')
+
       expect(result.to_html).to eq('<pre class="code highlight js-syntax-highlight ruby" lang="ruby" v-pre="true"><code><span id="LC1" class="line" lang="ruby"><span class="k">def</span> <span class="nf">fun</span> <span class="k">end</span></span></code></pre>')
     end
+
+    include_examples "XSS prevention", "ruby"
   end
 
   context "when an invalid language is specified" do
     it "highlights as plaintext" do
       result = filter('<pre><code lang="gnuplot">This is a test</code></pre>')
+
       expect(result.to_html).to eq('<pre class="code highlight js-syntax-highlight plaintext" lang="plaintext" v-pre="true"><code><span id="LC1" class="line" lang="plaintext">This is a test</span></code></pre>')
     end
+
+    include_examples "XSS prevention", "gnuplot"
   end
 
-  context "when Rouge formatting fails" do
+  context "languages that should be passed through" do
+    %w(math mermaid plantuml).each do |lang|
+      context "when #{lang} is specified" do
+        it "highlights as plaintext but with the correct language attribute and class" do
+          result = filter(%{<pre><code lang="#{lang}">This is a test</code></pre>})
+
+          expect(result.to_html).to eq(%{<pre class="code highlight js-syntax-highlight #{lang}" lang="#{lang}" v-pre="true"><code><span id="LC1" class="line" lang="#{lang}">This is a test</span></code></pre>})
+        end
+
+        include_examples "XSS prevention", lang
+      end
+    end
+  end
+
+  context "when Rouge lexing fails" do
     before do
-      allow_any_instance_of(Rouge::Formatter).to receive(:format).and_raise(StandardError)
+      allow_any_instance_of(Rouge::Lexers::Ruby).to receive(:stream_tokens).and_raise(StandardError)
     end
 
     it "highlights as plaintext" do
       result = filter('<pre><code lang="ruby">This is a test</code></pre>')
-      expect(result.to_html).to eq('<pre class="code highlight js-syntax-highlight" lang="" v-pre="true"><code>This is a test</code></pre>')
+
+      expect(result.to_html).to eq('<pre class="code highlight js-syntax-highlight" lang="" v-pre="true"><code><span id="LC1" class="line" lang="">This is a test</span></code></pre>')
+    end
+
+    include_examples "XSS prevention", "ruby"
+  end
+
+  context "when Rouge lexing fails after a retry" do
+    before do
+      allow_any_instance_of(Rouge::Lexers::PlainText).to receive(:stream_tokens).and_raise(StandardError)
+    end
+
+    it "does not add highlighting classes" do
+      result = filter('<pre><code>This is a test</code></pre>')
+
+      expect(result.to_html).to eq('<pre><code>This is a test</code></pre>')
     end
+
+    include_examples "XSS prevention", "ruby"
   end
 end
diff --git a/spec/lib/gitlab/encoding_helper_spec.rb b/spec/lib/gitlab/encoding_helper_spec.rb
index 4e9367323cb..83d431a7458 100644
--- a/spec/lib/gitlab/encoding_helper_spec.rb
+++ b/spec/lib/gitlab/encoding_helper_spec.rb
@@ -24,6 +24,11 @@ describe Gitlab::EncodingHelper do
         'removes invalid bytes from ASCII-8bit encoded multibyte string. This can occur when a git diff match line truncates in the middle of a multibyte character. This occurs after the second word in this example. The test string is as short as we can get while still triggering the error condition when not looking at `detect[:confidence]`.',
         "mu ns\xC3\n Lorem ipsum dolor sit amet, consectetur adipisicing ut\xC3\xA0y\xC3\xB9abcd\xC3\xB9efg kia elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non p\n {: .normal_pn}\n \n-Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in\n# *Lorem ipsum\xC3\xB9l\xC3\xB9l\xC3\xA0 dolor\xC3\xB9k\xC3\xB9 sit\xC3\xA8b\xC3\xA8 N\xC3\xA8 amet b\xC3\xA0d\xC3\xAC*\n+# *consectetur\xC3\xB9l\xC3\xB9l\xC3\xA0 adipisicing\xC3\xB9k\xC3\xB9 elit\xC3\xA8b\xC3\xA8 N\xC3\xA8 sed do\xC3\xA0d\xC3\xAC*{: .italic .smcaps}\n \n \xEF\x9B\xA1 eiusmod tempor incididunt, ut\xC3\xAAn\xC3\xB9 labore et dolore. Tw\xC4\x83nj\xC3\xAC magna aliqua. Ut enim ad minim veniam\n {: .normal}\n@@ -9,5 +9,5 @@ quis nostrud\xC3\xAAt\xC3\xB9 exercitiation ullamco laboris m\xC3\xB9s\xC3\xB9k\xC3\xB9abc\xC3\xB9 nisi ".force_encoding('ASCII-8BIT'),
         "mu ns\n Lorem ipsum dolor sit amet, consectetur adipisicing ut\xC3\xA0y\xC3\xB9abcd\xC3\xB9efg kia elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in voluptate velit esse cillum dolore eu fugiat nulla pariatur. Excepteur sint occaecat cupidatat non p\n {: .normal_pn}\n \n-Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed do eiusmod tempor incididunt ut labore et dolore magna aliqua. Ut enim ad minim veniam, quis nostrud exercitation ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis aute irure dolor in reprehenderit in\n# *Lorem ipsum\xC3\xB9l\xC3\xB9l\xC3\xA0 dolor\xC3\xB9k\xC3\xB9 sit\xC3\xA8b\xC3\xA8 N\xC3\xA8 amet b\xC3\xA0d\xC3\xAC*\n+# *consectetur\xC3\xB9l\xC3\xB9l\xC3\xA0 adipisicing\xC3\xB9k\xC3\xB9 elit\xC3\xA8b\xC3\xA8 N\xC3\xA8 sed do\xC3\xA0d\xC3\xAC*{: .italic .smcaps}\n \n \xEF\x9B\xA1 eiusmod tempor incididunt, ut\xC3\xAAn\xC3\xB9 labore et dolore. Tw\xC4\x83nj\xC3\xAC magna aliqua. Ut enim ad minim veniam\n {: .normal}\n@@ -9,5 +9,5 @@ quis nostrud\xC3\xAAt\xC3\xB9 exercitiation ullamco laboris m\xC3\xB9s\xC3\xB9k\xC3\xB9abc\xC3\xB9 nisi "
+      ],
+      [
+        'string with detected encoding that is not supported in Ruby',
+        "\xFFe,i\xFF,\xB8oi,'\xB8,\xFF,-",
+        "--broken encoding: IBM420_ltr"
       ]
     ].each do |description, test_string, xpect|
       it description do
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 9e159c3f1fe..78fcbf6d47e 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -1590,7 +1590,7 @@ describe Ci::Build do
 
       context 'when the branch is protected' do
         before do
-          create(:protected_branch, project: build.project, name: build.ref)
+          allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true)
         end
 
         it { is_expected.to include(protected_variable) }
@@ -1598,7 +1598,7 @@ describe Ci::Build do
 
       context 'when the tag is protected' do
         before do
-          create(:protected_tag, project: build.project, name: build.ref)
+          allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true)
         end
 
         it { is_expected.to include(protected_variable) }
@@ -1635,7 +1635,7 @@ describe Ci::Build do
 
       context 'when the branch is protected' do
         before do
-          create(:protected_branch, project: build.project, name: build.ref)
+          allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true)
         end
 
         it { is_expected.to include(protected_variable) }
@@ -1643,7 +1643,7 @@ describe Ci::Build do
 
       context 'when the tag is protected' do
         before do
-          create(:protected_tag, project: build.project, name: build.ref)
+          allow(build.project).to receive(:protected_for?).with(build.ref).and_return(true)
         end
 
         it { is_expected.to include(protected_variable) }
diff --git a/spec/models/group_spec.rb b/spec/models/group_spec.rb
index 338fb314ee9..4f16b73ef38 100644
--- a/spec/models/group_spec.rb
+++ b/spec/models/group_spec.rb
@@ -549,7 +549,7 @@ describe Group do
 
     context 'when the ref is a protected branch' do
       before do
-        create(:protected_branch, name: 'ref', project: project)
+        allow(project).to receive(:protected_for?).with('ref').and_return(true)
       end
 
       it_behaves_like 'ref is protected'
@@ -557,7 +557,7 @@ describe Group do
 
     context 'when the ref is a protected tag' do
       before do
-        create(:protected_tag, name: 'ref', project: project)
+        allow(project).to receive(:protected_for?).with('ref').and_return(true)
       end
 
       it_behaves_like 'ref is protected'
@@ -571,6 +571,10 @@ describe Group do
       let(:variable_child_2) { create(:ci_group_variable, group: group_child_2) }
       let(:variable_child_3) { create(:ci_group_variable, group: group_child_3) }
 
+      before do
+        allow(project).to receive(:protected_for?).with('ref').and_return(true)
+      end
+
       it 'returns all variables belong to the group and parent groups' do
         expected_array1 = [protected_variable, secret_variable]
         expected_array2 = [variable_child, variable_child_2, variable_child_3]
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 50b8bb7acb3..ee04d74d848 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -2092,7 +2092,7 @@ describe Project do
 
     context 'when the ref is a protected branch' do
       before do
-        create(:protected_branch, name: 'ref', project: project)
+        allow(project).to receive(:protected_for?).with('ref').and_return(true)
       end
 
       it_behaves_like 'ref is protected'
@@ -2100,7 +2100,7 @@ describe Project do
 
     context 'when the ref is a protected tag' do
       before do
-        create(:protected_tag, name: 'ref', project: project)
+        allow(project).to receive(:protected_for?).with('ref').and_return(true)
       end
 
       it_behaves_like 'ref is protected'
@@ -2125,6 +2125,8 @@ describe Project do
 
     context 'when the ref is a protected branch' do
       before do
+        allow(project).to receive(:repository).and_call_original
+        allow(project).to receive_message_chain(:repository, :branch_exists?).and_return(true)
         create(:protected_branch, name: 'ref', project: project)
       end
 
@@ -2135,6 +2137,8 @@ describe Project do
 
     context 'when the ref is a protected tag' do
       before do
+        allow(project).to receive_message_chain(:repository, :branch_exists?).and_return(false)
+        allow(project).to receive_message_chain(:repository, :tag_exists?).and_return(true)
         create(:protected_tag, name: 'ref', project: project)
       end
 
diff --git a/spec/policies/personal_snippet_policy_spec.rb b/spec/policies/personal_snippet_policy_spec.rb
index b70c8646a3d..50bb0899eba 100644
--- a/spec/policies/personal_snippet_policy_spec.rb
+++ b/spec/policies/personal_snippet_policy_spec.rb
@@ -1,5 +1,6 @@
 require 'spec_helper'
 
+# Snippet visibility scenarios are included in more details in spec/support/snippet_visibility.rb
 describe PersonalSnippetPolicy do
   let(:regular_user) { create(:user) }
   let(:external_user) { create(:user, :external) }
diff --git a/spec/policies/project_snippet_policy_spec.rb b/spec/policies/project_snippet_policy_spec.rb
index cdba1b09fc1..4d32e06b553 100644
--- a/spec/policies/project_snippet_policy_spec.rb
+++ b/spec/policies/project_snippet_policy_spec.rb
@@ -1,5 +1,6 @@
 require 'spec_helper'
 
+# Snippet visibility scenarios are included in more details in spec/support/snippet_visibility.rb
 describe ProjectSnippetPolicy do
   let(:regular_user) { create(:user) }
   let(:external_user) { create(:user, :external) }
diff --git a/spec/requests/api/search_spec.rb b/spec/requests/api/search_spec.rb
index a0026c6e11c..ddda5752f0c 100644
--- a/spec/requests/api/search_spec.rb
+++ b/spec/requests/api/search_spec.rb
@@ -180,6 +180,18 @@ describe API::Search do
 
         it_behaves_like 'response is correct', schema: 'public_api/v4/milestones'
       end
+
+      context 'for milestones scope with group path as id' do
+        before do
+          another_project = create(:project, :public)
+          create(:milestone, project: project, title: 'awesome milestone')
+          create(:milestone, project: another_project, title: 'awesome milestone other project')
+
+          get api("/groups/#{CGI.escape(group.full_path)}/-/search", user), scope: 'milestones', search: 'awesome'
+        end
+
+        it_behaves_like 'response is correct', schema: 'public_api/v4/milestones'
+      end
     end
   end
 
@@ -286,6 +298,14 @@ describe API::Search do
         it_behaves_like 'response is correct', schema: 'public_api/v4/commits'
       end
 
+      context 'for commits scope with project path as id' do
+        before do
+          get api("/projects/#{CGI.escape(repo_project.full_path)}/-/search", user), scope: 'commits', search: '498214de67004b1da3d820901307bed2a68a8ef6'
+        end
+
+        it_behaves_like 'response is correct', schema: 'public_api/v4/commits'
+      end
+
       context 'for blobs scope' do
         before do
           get api("/projects/#{repo_project.id}/-/search", user), scope: 'blobs', search: 'monitors'
diff --git a/spec/requests/api/snippets_spec.rb b/spec/requests/api/snippets_spec.rb
index 74198c8eb4f..b3e253befc6 100644
--- a/spec/requests/api/snippets_spec.rb
+++ b/spec/requests/api/snippets_spec.rb
@@ -32,6 +32,27 @@ describe API::Snippets do
       expect(json_response).to be_an Array
       expect(json_response.size).to eq(0)
     end
+
+    it 'returns 404 for non-authenticated' do
+      create(:personal_snippet, :internal)
+
+      get api("/snippets/")
+
+      expect(response).to have_gitlab_http_status(401)
+    end
+
+    it 'does not return snippets related to a project with disable feature visibility' do
+      project = create(:project)
+      create(:project_member, project: project, user: user)
+      public_snippet = create(:personal_snippet, :public, author: user, project: project)
+      project.project_feature.update_attribute(:snippets_access_level, 0)
+
+      get api("/snippets/", user)
+
+      json_response.each do |snippet|
+        expect(snippet["id"]).not_to eq(public_snippet.id)
+      end
+    end
   end
 
   describe 'GET /snippets/public' do
diff --git a/spec/requests/api/todos_spec.rb b/spec/requests/api/todos_spec.rb
index fb3a33cadff..2ee8d150dc8 100644
--- a/spec/requests/api/todos_spec.rb
+++ b/spec/requests/api/todos_spec.rb
@@ -129,6 +129,12 @@ describe API::Todos do
 
         post api("/todos/#{pending_1.id}/mark_as_done", john_doe)
       end
+
+      it 'returns 404 if the todo does not belong to the current user' do
+        post api("/todos/#{pending_1.id}/mark_as_done", author_1)
+
+        expect(response.status).to eq(404)
+      end
     end
   end
 
diff --git a/spec/requests/api/v3/todos_spec.rb b/spec/requests/api/v3/todos_spec.rb
index 53fd962272a..ea648e3917f 100644
--- a/spec/requests/api/v3/todos_spec.rb
+++ b/spec/requests/api/v3/todos_spec.rb
@@ -38,6 +38,12 @@ describe API::V3::Todos do
 
         delete v3_api("/todos/#{pending_1.id}", john_doe)
       end
+
+      it 'returns 404 if the todo does not belong to the current user' do
+        delete v3_api("/todos/#{pending_1.id}", author_1)
+
+        expect(response.status).to eq(404)
+      end
     end
   end
 
diff --git a/spec/services/search/snippet_service_spec.rb b/spec/services/search/snippet_service_spec.rb
index bc7885b03d9..8ad162ad66e 100644
--- a/spec/services/search/snippet_service_spec.rb
+++ b/spec/services/search/snippet_service_spec.rb
@@ -2,7 +2,7 @@ require 'spec_helper'
 
 describe Search::SnippetService do
   let(:author) { create(:author) }
-  let(:project) { create(:project) }
+  let(:project) { create(:project, :public) }
 
   let!(:public_snippet)   { create(:snippet, :public, content: 'password: XXX') }
   let!(:internal_snippet) { create(:snippet, :internal, content: 'password: XXX') }
diff --git a/spec/support/controllers/githubish_import_controller_shared_examples.rb b/spec/support/controllers/githubish_import_controller_shared_examples.rb
index a0839eefe6c..3321f920666 100644
--- a/spec/support/controllers/githubish_import_controller_shared_examples.rb
+++ b/spec/support/controllers/githubish_import_controller_shared_examples.rb
@@ -92,6 +92,7 @@ end
 
 shared_examples 'a GitHub-ish import controller: POST create' do
   let(:user) { create(:user) }
+  let(:project) { create(:project) }
   let(:provider_username) { user.username }
   let(:provider_user) { OpenStruct.new(login: provider_username) }
   let(:provider_repo) do
@@ -107,14 +108,34 @@ shared_examples 'a GitHub-ish import controller: POST create' do
     assign_session_token(provider)
   end
 
+  it 'returns 200 response when the project is imported successfully' do
+    allow(Gitlab::LegacyGithubImport::ProjectCreator)
+      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+        .and_return(double(execute: project))
+
+    post :create, format: :json
+
+    expect(response).to have_gitlab_http_status(200)
+  end
+
+  it 'returns 422 response when the project could not be imported' do
+    allow(Gitlab::LegacyGithubImport::ProjectCreator)
+      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+        .and_return(double(execute: build(:project)))
+
+    post :create, format: :json
+
+    expect(response).to have_gitlab_http_status(422)
+  end
+
   context "when the repository owner is the provider user" do
     context "when the provider user and GitLab user's usernames match" do
       it "takes the current user's namespace" do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, format: :js
+        post :create, format: :json
       end
     end
 
@@ -124,9 +145,9 @@ shared_examples 'a GitHub-ish import controller: POST create' do
       it "takes the current user's namespace" do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, format: :js
+        post :create, format: :json
       end
     end
   end
@@ -151,9 +172,9 @@ shared_examples 'a GitHub-ish import controller: POST create' do
         it "takes the existing namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
             .to receive(:new).with(provider_repo, provider_repo.name, existing_namespace, user, access_params, type: provider)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
 
@@ -163,9 +184,9 @@ shared_examples 'a GitHub-ish import controller: POST create' do
 
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
             .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
     end
@@ -174,17 +195,17 @@ shared_examples 'a GitHub-ish import controller: POST create' do
       context "when current user can create namespaces" do
         it "creates the namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
-            .to receive(:new).and_return(double(execute: true))
+            .to receive(:new).and_return(double(execute: project))
 
-          expect { post :create, target_namespace: provider_repo.name, format: :js }.to change(Namespace, :count).by(1)
+          expect { post :create, target_namespace: provider_repo.name, format: :json }.to change(Namespace, :count).by(1)
         end
 
         it "takes the new namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
             .to receive(:new).with(provider_repo, provider_repo.name, an_instance_of(Group), user, access_params, type: provider)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, target_namespace: provider_repo.name, format: :js
+          post :create, target_namespace: provider_repo.name, format: :json
         end
       end
 
@@ -195,17 +216,17 @@ shared_examples 'a GitHub-ish import controller: POST create' do
 
         it "doesn't create the namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
-            .to receive(:new).and_return(double(execute: true))
+            .to receive(:new).and_return(double(execute: project))
 
-          expect { post :create, format: :js }.not_to change(Namespace, :count)
+          expect { post :create, format: :json }.not_to change(Namespace, :count)
         end
 
         it "takes the current user's namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
             .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
-              .and_return(double(execute: true))
+              .and_return(double(execute: project))
 
-          post :create, format: :js
+          post :create, format: :json
         end
       end
     end
@@ -221,21 +242,21 @@ shared_examples 'a GitHub-ish import controller: POST create' do
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, test_namespace, user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: test_namespace.name, new_name: test_name, format: :js }
+        post :create, { target_namespace: test_namespace.name, new_name: test_name, format: :json }
       end
 
       it 'takes the selected name and default namespace' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, user.namespace, user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { new_name: test_name, format: :js }
+        post :create, { new_name: test_name, format: :json }
       end
     end
 
-    context 'user has chosen an existing nested namespace and name for the project' do
+    context 'user has chosen an existing nested namespace and name for the project', :postgresql do
       let(:parent_namespace) { create(:group, name: 'foo', owner: user) }
       let(:nested_namespace) { create(:group, name: 'bar', parent: parent_namespace) }
       let(:test_name) { 'test_name' }
@@ -247,63 +268,124 @@ shared_examples 'a GitHub-ish import controller: POST create' do
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, nested_namespace, user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: nested_namespace.full_path, new_name: test_name, format: :js }
+        post :create, { target_namespace: nested_namespace.full_path, new_name: test_name, format: :json }
       end
     end
 
-    context 'user has chosen a non-existent nested namespaces and name for the project' do
+    context 'user has chosen a non-existent nested namespaces and name for the project', :postgresql do
       let(:test_name) { 'test_name' }
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json }
       end
 
       it 'creates the namespaces' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        expect { post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js } }
+        expect { post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json } }
           .to change { Namespace.count }.by(2)
       end
 
       it 'new namespace has the right parent' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/bar', new_name: test_name, format: :json }
 
         expect(Namespace.find_by_path_or_name('bar').parent.path).to eq('foo')
       end
     end
 
-    context 'user has chosen existent and non-existent nested namespaces and name for the project' do
+    context 'user has chosen existent and non-existent nested namespaces and name for the project', :postgresql do
       let(:test_name) { 'test_name' }
       let!(:parent_namespace) { create(:group, name: 'foo', owner: user) }
 
+      before do
+        parent_namespace.add_owner(user)
+      end
+
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js }
+        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :json }
       end
 
       it 'creates the namespaces' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
           .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
-            .and_return(double(execute: true))
+            .and_return(double(execute: project))
 
-        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js } }
+        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :json } }
           .to change { Namespace.count }.by(2)
       end
+
+      it 'does not create a new namespace under the user namespace' do
+        expect(Gitlab::LegacyGithubImport::ProjectCreator)
+            .to receive(:new).with(provider_repo, test_name, user.namespace, user, access_params, type: provider)
+                    .and_return(double(execute: build_stubbed(:project)))
+
+        expect { post :create, { target_namespace: "#{user.namespace_path}/test_group", new_name: test_name, format: :js } }
+            .not_to change { Namespace.count }
+      end
+    end
+
+    context 'user cannot create a subgroup inside a group is not a member of' do
+      let(:test_name) { 'test_name' }
+      let!(:parent_namespace) { create(:group, name: 'foo') }
+
+      it 'does not take the selected namespace and name' do
+        expect(Gitlab::LegacyGithubImport::ProjectCreator)
+            .to receive(:new).with(provider_repo, test_name, user.namespace, user, access_params, type: provider)
+                    .and_return(double(execute: build_stubbed(:project)))
+
+        post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js }
+      end
+
+      it 'does not create the namespaces' do
+        allow(Gitlab::LegacyGithubImport::ProjectCreator)
+            .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+                    .and_return(double(execute: build_stubbed(:project)))
+
+        expect { post :create, { target_namespace: 'foo/foobar/bar', new_name: test_name, format: :js } }
+            .not_to change { Namespace.count }
+      end
+    end
+
+    context 'user can use a group without having permissions to create a group' do
+      let(:test_name) { 'test_name' }
+      let!(:group) { create(:group, name: 'foo') }
+
+      it 'takes the selected namespace and name' do
+        group.add_owner(user)
+        user.update!(can_create_group: false)
+
+        expect(Gitlab::LegacyGithubImport::ProjectCreator)
+            .to receive(:new).with(provider_repo, test_name, group, user, access_params, type: provider)
+                    .and_return(double(execute: build_stubbed(:project)))
+
+        post :create, { target_namespace: 'foo', new_name: test_name, format: :js }
+      end
+    end
+
+    context 'when user can not create projects in the chosen namespace' do
+      it 'returns 422 response' do
+        other_namespace = create(:group, name: 'other_namespace')
+
+        post :create, { target_namespace: other_namespace.name, format: :json }
+
+        expect(response).to have_gitlab_http_status(422)
+      end
     end
   end
 end
diff --git a/spec/support/features/variable_list_shared_examples.rb b/spec/support/features/variable_list_shared_examples.rb
index 83bf06b6727..4315bf5d037 100644
--- a/spec/support/features/variable_list_shared_examples.rb
+++ b/spec/support/features/variable_list_shared_examples.rb
@@ -41,13 +41,13 @@ shared_examples 'variable list' do
     end
   end
 
-  it 'adds new unprotected variable' do
+  it 'adds new protected variable' do
     page.within('.js-ci-variable-list-section .js-row:last-child') do
       find('.js-ci-variable-input-key').set('key')
       find('.js-ci-variable-input-value').set('key value')
       find('.ci-variable-protected-item .js-project-feature-toggle').click
 
-      expect(find('.js-ci-variable-input-protected', visible: false).value).to eq('false')
+      expect(find('.js-ci-variable-input-protected', visible: false).value).to eq('true')
     end
 
     click_button('Save variables')
@@ -59,7 +59,7 @@ shared_examples 'variable list' do
     page.within('.js-ci-variable-list-section .js-row:nth-child(1)') do
       expect(find('.js-ci-variable-input-key').value).to eq('key')
       expect(find('.js-ci-variable-input-value', visible: false).value).to eq('key value')
-      expect(find('.js-ci-variable-input-protected', visible: false).value).to eq('false')
+      expect(find('.js-ci-variable-input-protected', visible: false).value).to eq('true')
     end
   end
 
@@ -143,7 +143,6 @@ shared_examples 'variable list' do
     page.within('.js-ci-variable-list-section .js-row:last-child') do
       find('.js-ci-variable-input-key').set('unprotected_key')
       find('.js-ci-variable-input-value').set('unprotected_value')
-      find('.ci-variable-protected-item .js-project-feature-toggle').click
 
       expect(find('.js-ci-variable-input-protected', visible: false).value).to eq('false')
     end
@@ -178,6 +177,7 @@ shared_examples 'variable list' do
     page.within('.js-ci-variable-list-section .js-row:last-child') do
       find('.js-ci-variable-input-key').set('protected_key')
       find('.js-ci-variable-input-value').set('protected_value')
+      find('.ci-variable-protected-item .js-project-feature-toggle').click
 
       expect(find('.js-ci-variable-input-protected', visible: false).value).to eq('true')
     end
diff --git a/spec/support/snippet_visibility.rb b/spec/support/snippet_visibility.rb
new file mode 100644
index 00000000000..1cb904823d2
--- /dev/null
+++ b/spec/support/snippet_visibility.rb
@@ -0,0 +1,304 @@
+RSpec.shared_examples 'snippet visibility' do
+  let!(:author) { create(:user) }
+  let!(:member) { create(:user) }
+  let!(:external) { create(:user, :external) }
+
+  let!(:snippet_type_visibilities) do
+    {
+      public: Snippet::PUBLIC,
+      internal: Snippet::INTERNAL,
+      private: Snippet::PRIVATE
+    }
+  end
+
+  context "For project snippets" do
+    let!(:users) do
+      {
+        unauthenticated: nil,
+        external: external,
+        non_member: create(:user),
+        member: member,
+        author: author
+      }
+    end
+
+    let!(:project_type_visibilities) do
+      {
+        public: Gitlab::VisibilityLevel::PUBLIC,
+        internal: Gitlab::VisibilityLevel::INTERNAL,
+        private: Gitlab::VisibilityLevel::PRIVATE
+      }
+    end
+
+    let(:project_feature_visibilities) do
+      {
+        enabled: ProjectFeature::ENABLED,
+        private: ProjectFeature::PRIVATE,
+        disabled: ProjectFeature::DISABLED
+      }
+    end
+
+    where(:project_type, :feature_visibility, :user_type, :snippet_type, :outcome) do
+      [
+        # Public projects
+        [:public, :enabled, :unauthenticated,    :public,   true],
+        [:public, :enabled, :unauthenticated,    :internal, false],
+        [:public, :enabled, :unauthenticated,    :private,  false],
+
+        [:public, :enabled, :external,           :public,   true],
+        [:public, :enabled, :external,           :internal, false],
+        [:public, :enabled, :external,           :private,  false],
+
+        [:public, :enabled, :non_member,         :public,   true],
+        [:public, :enabled, :non_member,         :internal, true],
+        [:public, :enabled, :non_member,         :private,  false],
+
+        [:public, :enabled, :member,             :public,   true],
+        [:public, :enabled, :member,             :internal, true],
+        [:public, :enabled, :member,             :private,  true],
+
+        [:public, :enabled, :author,             :public,   true],
+        [:public, :enabled, :author,             :internal, true],
+        [:public, :enabled, :author,             :private,  true],
+
+        [:public, :private, :unauthenticated,    :public,   false],
+        [:public, :private, :unauthenticated,    :internal, false],
+        [:public, :private, :unauthenticated,    :private,  false],
+
+        [:public, :private, :external,           :public,   false],
+        [:public, :private, :external,           :internal, false],
+        [:public, :private, :external,           :private,  false],
+
+        [:public, :private, :non_member,         :public,   false],
+        [:public, :private, :non_member,         :internal, false],
+        [:public, :private, :non_member,         :private,  false],
+
+        [:public, :private, :member,             :public,   true],
+        [:public, :private, :member,             :internal, true],
+        [:public, :private, :member,             :private,  true],
+
+        [:public, :private, :author,             :public,   true],
+        [:public, :private, :author,             :internal, true],
+        [:public, :private, :author,             :private,  true],
+
+        [:public, :disabled, :unauthenticated,   :public,   false],
+        [:public, :disabled, :unauthenticated,   :internal, false],
+        [:public, :disabled, :unauthenticated,   :private,  false],
+
+        [:public, :disabled, :external,          :public,   false],
+        [:public, :disabled, :external,          :internal, false],
+        [:public, :disabled, :external,          :private,  false],
+
+        [:public, :disabled, :non_member,        :public,   false],
+        [:public, :disabled, :non_member,        :internal, false],
+        [:public, :disabled, :non_member,        :private,  false],
+
+        [:public, :disabled, :member,            :public,   false],
+        [:public, :disabled, :member,            :internal, false],
+        [:public, :disabled, :member,            :private,  false],
+
+        [:public, :disabled, :author,            :public,   false],
+        [:public, :disabled, :author,            :internal, false],
+        [:public, :disabled, :author,            :private,  false],
+
+        # Internal projects
+        [:internal, :enabled, :unauthenticated,  :public,   false],
+        [:internal, :enabled, :unauthenticated,  :internal, false],
+        [:internal, :enabled, :unauthenticated,  :private,  false],
+
+        [:internal, :enabled, :external,         :public,   false],
+        [:internal, :enabled, :external,         :internal, false],
+        [:internal, :enabled, :external,         :private,  false],
+
+        [:internal, :enabled, :non_member,       :public,   true],
+        [:internal, :enabled, :non_member,       :internal, true],
+        [:internal, :enabled, :non_member,       :private,  false],
+
+        [:internal, :enabled, :member,           :public,   true],
+        [:internal, :enabled, :member,           :internal, true],
+        [:internal, :enabled, :member,           :private,  true],
+
+        [:internal, :enabled, :author,           :public,   true],
+        [:internal, :enabled, :author,           :internal, true],
+        [:internal, :enabled, :author,           :private,  true],
+
+        [:internal, :private, :unauthenticated,  :public,   false],
+        [:internal, :private, :unauthenticated,  :internal, false],
+        [:internal, :private, :unauthenticated,  :private,  false],
+
+        [:internal, :private, :external,         :public,   false],
+        [:internal, :private, :external,         :internal, false],
+        [:internal, :private, :external,         :private,  false],
+
+        [:internal, :private, :non_member,       :public,   false],
+        [:internal, :private, :non_member,       :internal, false],
+        [:internal, :private, :non_member,       :private,  false],
+
+        [:internal, :private, :member,           :public,   true],
+        [:internal, :private, :member,           :internal, true],
+        [:internal, :private, :member,           :private,  true],
+
+        [:internal, :private, :author,           :public,   true],
+        [:internal, :private, :author,           :internal, true],
+        [:internal, :private, :author,           :private,  true],
+
+        [:internal, :disabled, :unauthenticated, :public,   false],
+        [:internal, :disabled, :unauthenticated, :internal, false],
+        [:internal, :disabled, :unauthenticated, :private,  false],
+
+        [:internal, :disabled, :external,        :public,   false],
+        [:internal, :disabled, :external,        :internal, false],
+        [:internal, :disabled, :external,        :private,  false],
+
+        [:internal, :disabled, :non_member,      :public,   false],
+        [:internal, :disabled, :non_member,      :internal, false],
+        [:internal, :disabled, :non_member,      :private,  false],
+
+        [:internal, :disabled, :member,          :public,   false],
+        [:internal, :disabled, :member,          :internal, false],
+        [:internal, :disabled, :member,          :private,  false],
+
+        [:internal, :disabled, :author,          :public,   false],
+        [:internal, :disabled, :author,          :internal, false],
+        [:internal, :disabled, :author,          :private,  false],
+
+        # Private projects
+        [:private, :enabled, :unauthenticated,   :public,   false],
+        [:private, :enabled, :unauthenticated,   :internal, false],
+        [:private, :enabled, :unauthenticated,   :private,  false],
+
+        [:private, :enabled, :external,          :public,   true],
+        [:private, :enabled, :external,          :internal, true],
+        [:private, :enabled, :external,          :private,  true],
+
+        [:private, :enabled, :non_member,        :public,   false],
+        [:private, :enabled, :non_member,        :internal, false],
+        [:private, :enabled, :non_member,        :private,  false],
+
+        [:private, :enabled, :member,            :public,   true],
+        [:private, :enabled, :member,            :internal, true],
+        [:private, :enabled, :member,            :private,  true],
+
+        [:private, :enabled, :author,            :public,   true],
+        [:private, :enabled, :author,            :internal, true],
+        [:private, :enabled, :author,            :private,  true],
+
+        [:private, :private, :unauthenticated,   :public,   false],
+        [:private, :private, :unauthenticated,   :internal, false],
+        [:private, :private, :unauthenticated,   :private,  false],
+
+        [:private, :private, :external,          :public,   true],
+        [:private, :private, :external,          :internal, true],
+        [:private, :private, :external,          :private,  true],
+
+        [:private, :private, :non_member,        :public,   false],
+        [:private, :private, :non_member,        :internal, false],
+        [:private, :private, :non_member,        :private,  false],
+
+        [:private, :private, :member,            :public,   true],
+        [:private, :private, :member,            :internal, true],
+        [:private, :private, :member,            :private,  true],
+
+        [:private, :private, :author,            :public,   true],
+        [:private, :private, :author,            :internal, true],
+        [:private, :private, :author,            :private,  true],
+
+        [:private, :disabled, :unauthenticated,  :public,   false],
+        [:private, :disabled, :unauthenticated,  :internal, false],
+        [:private, :disabled, :unauthenticated,  :private,  false],
+
+        [:private, :disabled, :external,         :public,   false],
+        [:private, :disabled, :external,         :internal, false],
+        [:private, :disabled, :external,         :private,  false],
+
+        [:private, :disabled, :non_member,       :public,   false],
+        [:private, :disabled, :non_member,       :internal, false],
+        [:private, :disabled, :non_member,       :private,  false],
+
+        [:private, :disabled, :member,           :public,   false],
+        [:private, :disabled, :member,           :internal, false],
+        [:private, :disabled, :member,           :private,  false],
+
+        [:private, :disabled, :author,           :public,   false],
+        [:private, :disabled, :author,           :internal, false],
+        [:private, :disabled, :author,           :private,  false]
+      ]
+    end
+
+    with_them do
+      let!(:project) { create(:project, visibility_level: project_type_visibilities[project_type]) }
+      let!(:project_feature) { project.project_feature.update_column(:snippets_access_level, project_feature_visibilities[feature_visibility]) }
+      let!(:user) { users[user_type] }
+      let!(:snippet) { create(:project_snippet, visibility_level: snippet_type_visibilities[snippet_type], project: project, author: author) }
+      let!(:members) do
+        project.add_developer(author)
+        project.add_developer(member)
+        project.add_developer(external) if project.private?
+      end
+
+      context "For #{params[:project_type]} project and #{params[:user_type]} users" do
+        it 'should agree with the read_project_snippet policy' do
+          expect(can?(user, :read_project_snippet, snippet)).to eq(outcome)
+        end
+
+        it 'should return proper outcome' do
+          results = described_class.new(user, project: project).execute
+          expect(results.include?(snippet)).to eq(outcome)
+        end
+      end
+
+      context "Without a given project and #{params[:user_type]} users" do
+        it 'should return proper outcome' do
+          results = described_class.new(user).execute
+          expect(results.include?(snippet)).to eq(outcome)
+        end
+      end
+    end
+  end
+
+  context 'For personal snippets' do
+    let!(:users) do
+      {
+        unauthenticated: nil,
+        external: external,
+        non_member: create(:user),
+        author: author
+      }
+    end
+
+    where(:snippet_visibility, :user_type, :outcome) do
+      [
+        [:public,   :unauthenticated, true],
+        [:public,   :external,        true],
+        [:public,   :non_member,      true],
+        [:public,   :author,          true],
+
+        [:internal, :unauthenticated, false],
+        [:internal, :external,        false],
+        [:internal, :non_member,      true],
+        [:internal, :author,          true],
+
+        [:private,  :unauthenticated, false],
+        [:private,  :external,        false],
+        [:private,  :non_member,      false],
+        [:private,  :author,          true]
+      ]
+    end
+
+    with_them do
+      let!(:user) { users[user_type] }
+      let!(:snippet) { create(:personal_snippet, visibility_level: snippet_type_visibilities[snippet_visibility], author: author) }
+
+      context "For personal and #{params[:snippet_visibility]} snippets with #{params[:user_type]} user" do
+        it 'should agree with read_personal_snippet policy' do
+          expect(can?(user, :read_personal_snippet, snippet)).to eq(outcome)
+        end
+
+        it 'should return proper outcome' do
+          results = described_class.new(user).execute
+          expect(results.include?(snippet)).to eq(outcome)
+        end
+      end
+    end
+  end
+end