diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 279bc462d71..eeccecafb8b 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -38,7 +38,7 @@ review-docs-cleanup:
   script:
     - ./scripts/trigger-build docs cleanup
 
-docs lint:
+docs-lint markdown:
   extends:
     - .default-retry
     - .docs:rules:docs-lint
@@ -47,6 +47,15 @@ docs lint:
   needs: []
   script:
     - scripts/lint-doc.sh
+
+docs-lint links:
+  extends:
+    - .default-retry
+    - .docs:rules:docs-lint
+  image: "registry.gitlab.com/gitlab-org/gitlab-docs/lint:ruby-2.7.2-alpine-3.12-vale-2.4.3-markdownlint-0.24.0"
+  stage: test
+  needs: []
+  script:
     # Prepare docs for build
     # The path must be 'ee/' because we have hardcoded links relying on it
     # https://gitlab.com/gitlab-org/gitlab-docs/-/blob/887850752fc0e72856da6632db132f005ba77f16/content/index.erb#L44-63
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 920d7f9bf9c..9524711e948 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-0926b9f8ff2215874eef0e22f750a74da5fe4321
+194a9f58926793ade53152de90b474d66804e21e
diff --git a/app/assets/javascripts/environments/components/delete_environment_modal.vue b/app/assets/javascripts/environments/components/delete_environment_modal.vue
index 29aab268fd3..2eb2be351b3 100644
--- a/app/assets/javascripts/environments/components/delete_environment_modal.vue
+++ b/app/assets/javascripts/environments/components/delete_environment_modal.vue
@@ -1,29 +1,35 @@
 <script>
-import { GlTooltipDirective } from '@gitlab/ui';
-import GlModal from '~/vue_shared/components/gl_modal.vue';
+import { GlTooltipDirective, GlModal } from '@gitlab/ui';
 import { s__, sprintf } from '~/locale';
 import eventHub from '../event_hub';
 
 export default {
   id: 'delete-environment-modal',
   name: 'DeleteEnvironmentModal',
-
   components: {
     GlModal,
   },
-
   directives: {
     GlTooltip: GlTooltipDirective,
   },
-
   props: {
     environment: {
       type: Object,
       required: true,
     },
   },
-
   computed: {
+    primaryProps() {
+      return {
+        text: s__('Environments|Delete environment'),
+        attributes: [{ variant: 'danger' }],
+      };
+    },
+    cancelProps() {
+      return {
+        text: s__('Cancel'),
+      };
+    },
     confirmDeleteMessage() {
       return sprintf(
         s__(
@@ -35,8 +41,12 @@ export default {
         false,
       );
     },
+    modalTitle() {
+      return sprintf(s__(`Environments|Delete '%{environmentName}'?`), {
+        environmentName: this.environment.name,
+      });
+    },
   },
-
   methods: {
     onSubmit() {
       eventHub.$emit('deleteEnvironment', this.environment);
@@ -47,20 +57,12 @@ export default {
 
 <template>
   <gl-modal
-    :id="$options.id"
-    :footer-primary-button-text="s__('Environments|Delete environment')"
-    footer-primary-button-variant="danger"
-    @submit="onSubmit"
+    :modal-id="$options.id"
+    :action-primary="primaryProps"
+    :action-cancel="cancelProps"
+    :title="modalTitle"
+    @primary="onSubmit"
   >
-    <template #header>
-      <h4 class="modal-title d-flex mw-100">
-        {{ __('Delete') }}
-        <span v-gl-tooltip :title="environment.name" class="text-truncate mx-1 flex-fill">
-          {{ environment.name }}?
-        </span>
-      </h4>
-    </template>
-
     <p>{{ confirmDeleteMessage }}</p>
   </gl-modal>
 </template>
diff --git a/app/assets/javascripts/environments/components/environment_delete.vue b/app/assets/javascripts/environments/components/environment_delete.vue
index 9f46609eecf..75d92d3295d 100644
--- a/app/assets/javascripts/environments/components/environment_delete.vue
+++ b/app/assets/javascripts/environments/components/environment_delete.vue
@@ -4,7 +4,7 @@
  * Used in the environments table.
  */
 
-import { GlTooltipDirective, GlButton } from '@gitlab/ui';
+import { GlTooltipDirective, GlButton, GlModalDirective } from '@gitlab/ui';
 import { s__ } from '~/locale';
 import eventHub from '../event_hub';
 
@@ -14,6 +14,7 @@ export default {
   },
   directives: {
     GlTooltip: GlTooltipDirective,
+    GlModalDirective,
   },
   props: {
     environment: {
@@ -54,6 +55,7 @@ export default {
 <template>
   <gl-button
     v-gl-tooltip="{ id: $options.deleteEnvironmentTooltipId }"
+    v-gl-modal-directive="'delete-environment-modal'"
     :loading="isLoading"
     :title="title"
     :aria-label="title"
@@ -61,8 +63,6 @@ export default {
     variant="danger"
     category="primary"
     icon="remove"
-    data-toggle="modal"
-    data-target="#delete-environment-modal"
     @click="onClick"
   />
 </template>
diff --git a/app/assets/javascripts/importer_status.js b/app/assets/javascripts/importer_status.js
index 349ca14b4e8..078c50ee9c6 100644
--- a/app/assets/javascripts/importer_status.js
+++ b/app/assets/javascripts/importer_status.js
@@ -3,7 +3,7 @@ import { escape } from 'lodash';
 import { __, sprintf } from './locale';
 import axios from './lib/utils/axios_utils';
 import { deprecatedCreateFlash as flash } from './flash';
-import { parseBoolean } from './lib/utils/common_utils';
+import { parseBoolean, spriteIcon } from './lib/utils/common_utils';
 
 class ImporterStatus {
   constructor({ jobsUrl, importUrl, ciCdOnly }) {
@@ -108,7 +108,7 @@ class ImporterStatus {
         switch (job.import_status) {
           case 'finished':
             jobItem.removeClass('table-active').addClass('table-success');
-            statusField.html(`<span><i class="fa fa-check"></i> ${__('Done')}</span>`);
+            statusField.html(`<span>${spriteIcon('check', 's16')} ${__('Done')}</span>`);
             break;
           case 'scheduled':
             statusField.html(`${spinner} ${__('Scheduled')}`);
diff --git a/app/assets/javascripts/performance/vue_performance_plugin.js b/app/assets/javascripts/performance/vue_performance_plugin.js
new file mode 100644
index 00000000000..7329b83b1d1
--- /dev/null
+++ b/app/assets/javascripts/performance/vue_performance_plugin.js
@@ -0,0 +1,53 @@
+const ComponentPerformancePlugin = {
+  install(Vue, options) {
+    Vue.mixin({
+      beforeCreate() {
+        /** Make sure the component you want to measure has `name` option defined
+         * and it matches the one you pass as the plugin option. Example:
+         *
+         * my_component.vue:
+         *
+         * ```
+         * export default {
+         *   name: 'MyComponent'
+         *   ...
+         * }
+         * ```
+         *
+         * index.js (where you initialize your Vue app containing <my-component>):
+         *
+         * ```
+         * Vue.use(PerformancePlugin, {
+         *   components: [
+         *     'MyComponent',
+         *   ]
+         * });
+         * ```
+         */
+        const componentName = this.$options.name;
+        if (options?.components?.indexOf(componentName) !== -1) {
+          const tagName = `<${componentName}>`;
+          if (!performance.getEntriesByName(`${tagName}-start`).length) {
+            performance.mark(`${tagName}-start`);
+          }
+        }
+      },
+      mounted() {
+        const componentName = this.$options.name;
+        if (options?.components?.indexOf(componentName) !== -1) {
+          this.$nextTick(() => {
+            window.requestAnimationFrame(() => {
+              const tagName = `<${componentName}>`;
+              if (!performance.getEntriesByName(`${tagName}-end`).length) {
+                performance.mark(`${tagName}-end`);
+                performance.measure(`${tagName}`, `${tagName}-start`);
+              }
+            });
+          });
+        }
+      },
+    });
+  },
+};
+
+export default ComponentPerformancePlugin;
diff --git a/app/assets/javascripts/set_status_modal/set_status_modal_wrapper.vue b/app/assets/javascripts/set_status_modal/set_status_modal_wrapper.vue
index 09e893ff285..dcb76b4ab21 100644
--- a/app/assets/javascripts/set_status_modal/set_status_modal_wrapper.vue
+++ b/app/assets/javascripts/set_status_modal/set_status_modal_wrapper.vue
@@ -179,7 +179,7 @@ export default {
           <span class="input-group-prepend">
             <button
               ref="toggleEmojiMenuButton"
-              v-gl-tooltip.bottom
+              v-gl-tooltip.bottom.hover
               :title="s__('SetStatusModal|Add status emoji')"
               :aria-label="s__('SetStatusModal|Add status emoji')"
               name="button"
diff --git a/app/assets/stylesheets/fontawesome_custom.scss b/app/assets/stylesheets/fontawesome_custom.scss
index d2a2aee3f93..8a955cffc49 100644
--- a/app/assets/stylesheets/fontawesome_custom.scss
+++ b/app/assets/stylesheets/fontawesome_custom.scss
@@ -92,10 +92,6 @@
   content: '\f0d7';
 }
 
-.fa-check::before {
-  content: '\f00c';
-}
-
 .fa-warning::before,
 .fa-exclamation-triangle::before {
   content: '\f071';
diff --git a/app/finders/packages/npm/package_finder.rb b/app/finders/packages/npm/package_finder.rb
index 8599fd07e7f..2854226e178 100644
--- a/app/finders/packages/npm/package_finder.rb
+++ b/app/finders/packages/npm/package_finder.rb
@@ -12,6 +12,8 @@ module Packages
       end
 
       def execute
+        return Packages::Package.none unless project
+
         packages
       end
 
diff --git a/app/graphql/types/issue_type.rb b/app/graphql/types/issue_type.rb
index e9217501db3..e53fbfec624 100644
--- a/app/graphql/types/issue_type.rb
+++ b/app/graphql/types/issue_type.rb
@@ -118,6 +118,12 @@ module Types
     field :severity, Types::IssuableSeverityEnum, null: true,
           description: 'Severity level of the incident'
 
+    field :moved, GraphQL::BOOLEAN_TYPE, method: :moved?, null: true,
+          description: 'Indicates if issue got moved from other project'
+
+    field :moved_to, Types::IssueType, null: true,
+          description: 'Updated Issue after it got moved to another project'
+
     def user_notes_count
       BatchLoader::GraphQL.for(object.id).batch(key: :issue_user_notes_count) do |ids, loader, args|
         counts = Note.count_for_collection(ids, 'Issue').index_by(&:noteable_id)
@@ -150,6 +156,10 @@ module Types
       Gitlab::Graphql::Loaders::BatchModelLoader.new(Milestone, object.milestone_id).find
     end
 
+    def moved_to
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Issue, object.moved_to_id).find
+    end
+
     def discussion_locked
       !!object.discussion_locked
     end
diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index e6c61c674d3..9924d1a26f3 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -311,6 +311,8 @@ class MergeRequest < ApplicationRecord
     includes(:metrics)
   end
 
+  scope :with_jira_issue_keys, -> { where('title ~ :regex OR merge_requests.description ~ :regex', regex: Gitlab::Regex.jira_issue_key_regex.source) }
+
   after_save :keep_around_commit, unless: :importing?
 
   alias_attribute :project, :target_project
diff --git a/app/models/project.rb b/app/models/project.rb
index fea860e9de8..d3a389056fb 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -602,7 +602,7 @@ class Project < ApplicationRecord
   # Returns a collection of projects that is either public or visible to the
   # logged in user.
   def self.public_or_visible_to_user(user = nil, min_access_level = nil)
-    min_access_level = nil if user&.admin?
+    min_access_level = nil if user&.can_read_all_resources?
 
     return public_to_user unless user
 
@@ -628,7 +628,7 @@ class Project < ApplicationRecord
   def self.with_feature_available_for_user(feature, user)
     visible = [ProjectFeature::ENABLED, ProjectFeature::PUBLIC]
 
-    if user&.admin?
+    if user&.can_read_all_resources?
       with_feature_enabled(feature)
     elsif user
       min_access_level = ProjectFeature.required_minimum_access_level(feature)
diff --git a/app/policies/concerns/policy_actor.rb b/app/policies/concerns/policy_actor.rb
index 3073a2e5d10..7eca6f4c6c8 100644
--- a/app/policies/concerns/policy_actor.rb
+++ b/app/policies/concerns/policy_actor.rb
@@ -72,6 +72,10 @@ module PolicyActor
   def try_obtain_ldap_lease
     nil
   end
+
+  def can_read_all_resources?
+    false
+  end
 end
 
 PolicyActor.prepend_if_ee('EE::PolicyActor')
diff --git a/app/serializers/move_to_project_entity.rb b/app/serializers/move_to_project_entity.rb
index dac1124b0b3..fb1d1a64abd 100644
--- a/app/serializers/move_to_project_entity.rb
+++ b/app/serializers/move_to_project_entity.rb
@@ -3,4 +3,5 @@
 class MoveToProjectEntity < Grape::Entity
   expose :id
   expose :name_with_namespace
+  expose :full_path
 end
diff --git a/app/services/jira_connect_subscriptions/create_service.rb b/app/services/jira_connect_subscriptions/create_service.rb
index 8e794d3acf7..781eaaf0efb 100644
--- a/app/services/jira_connect_subscriptions/create_service.rb
+++ b/app/services/jira_connect_subscriptions/create_service.rb
@@ -3,6 +3,8 @@
 module JiraConnectSubscriptions
   class CreateService < ::JiraConnectSubscriptions::BaseService
     include Gitlab::Utils::StrongMemoize
+    MERGE_REQUEST_SYNC_BATCH_SIZE = 20
+    MERGE_REQUEST_SYNC_BATCH_delay = 1.minute.freeze
 
     def execute
       unless namespace && can?(current_user, :create_jira_connect_subscription, namespace)
@@ -18,6 +20,8 @@ module JiraConnectSubscriptions
       subscription = JiraConnectSubscription.new(installation: jira_connect_installation, namespace: namespace)
 
       if subscription.save
+        schedule_sync_project_jobs
+
         success
       else
         error(subscription.errors.full_messages.join(', '), 422)
@@ -29,5 +33,18 @@ module JiraConnectSubscriptions
         Namespace.find_by_full_path(params[:namespace_path])
       end
     end
+
+    def schedule_sync_project_jobs
+      return unless Feature.enabled?(:jira_connect_full_namespace_sync)
+
+      namespace.all_projects.each_batch(of: MERGE_REQUEST_SYNC_BATCH_SIZE) do |projects, index|
+        JiraConnect::SyncProjectWorker.bulk_perform_in_with_contexts(
+          index * MERGE_REQUEST_SYNC_BATCH_delay,
+          projects,
+          arguments_proc: -> (project) { [project.id, Atlassian::JiraConnect::Client.generate_update_sequence_id] },
+          context_proc: -> (project) { { project: project } }
+        )
+      end
+    end
   end
 end
diff --git a/app/views/projects/_remove.html.haml b/app/views/projects/_remove.html.haml
index 05eab3b3245..c246c45d0f7 100644
--- a/app/views/projects/_remove.html.haml
+++ b/app/views/projects/_remove.html.haml
@@ -1,5 +1,4 @@
 - return unless can?(current_user, :remove_project, project)
-- confirm_phrase = s_('DeleteProject|Delete %{name}') % { name: project.full_name }
 
 .sub-section
   %h4.danger-title= _('Delete project')
@@ -7,4 +6,4 @@
     %strong= _('Deleting the project will delete its repository and all related resources including issues, merge requests etc.')
   %p
     %strong= _('Deleted projects cannot be restored!')
-  #js-project-delete-button{ data: { form_path: project_path(project), confirm_phrase: confirm_phrase } }
+  #js-project-delete-button{ data: { form_path: project_path(project), confirm_phrase: project.path } }
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index f7ba8eb09a0..7a84bb2a620 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -827,6 +827,14 @@
   :weight: 1
   :idempotent:
   :tags: []
+- :name: jira_connect:jira_connect_sync_project
+  :feature_category: :integrations
+  :has_external_dependencies: true
+  :urgency: :low
+  :resource_boundary: :unknown
+  :weight: 1
+  :idempotent: true
+  :tags: []
 - :name: jira_importer:jira_import_advance_stage
   :feature_category: :importers
   :has_external_dependencies:
diff --git a/app/workers/jira_connect/sync_project_worker.rb b/app/workers/jira_connect/sync_project_worker.rb
new file mode 100644
index 00000000000..4d52705f207
--- /dev/null
+++ b/app/workers/jira_connect/sync_project_worker.rb
@@ -0,0 +1,30 @@
+# frozen_string_literal: true
+
+module JiraConnect
+  class SyncProjectWorker
+    include ApplicationWorker
+
+    queue_namespace :jira_connect
+    feature_category :integrations
+    idempotent!
+    worker_has_external_dependencies!
+
+    MERGE_REQUEST_LIMIT = 400
+
+    def perform(project_id, update_sequence_id)
+      project = Project.find_by_id(project_id)
+
+      return if project.nil?
+
+      JiraConnect::SyncService.new(project).execute(merge_requests: merge_requests_to_sync(project), update_sequence_id: update_sequence_id)
+    end
+
+    private
+
+    # rubocop: disable CodeReuse/ActiveRecord
+    def merge_requests_to_sync(project)
+      project.merge_requests.with_jira_issue_keys.preload(:author).limit(MERGE_REQUEST_LIMIT).order(id: :desc)
+    end
+    # rubocop: enable CodeReuse/ActiveRecord
+  end
+end
diff --git a/changelogs/unreleased/220985-add-npm-project-level-manager-api.yml b/changelogs/unreleased/220985-add-npm-project-level-manager-api.yml
new file mode 100644
index 00000000000..9aedb1cde29
--- /dev/null
+++ b/changelogs/unreleased/220985-add-npm-project-level-manager-api.yml
@@ -0,0 +1,5 @@
+---
+title: NPM project level API
+merge_request: 46867
+author:
+type: added
diff --git a/changelogs/unreleased/233479-add-test-case-move-support.yml b/changelogs/unreleased/233479-add-test-case-move-support.yml
new file mode 100644
index 00000000000..b989124a64f
--- /dev/null
+++ b/changelogs/unreleased/233479-add-test-case-move-support.yml
@@ -0,0 +1,5 @@
+---
+title: Expose moved and movedTo attributes in Issues query
+merge_request: 46447
+author:
+type: added
diff --git a/changelogs/unreleased/255970-confirmation-panels-for-significant-actions-are-inconsistent-in-te.yml b/changelogs/unreleased/255970-confirmation-panels-for-significant-actions-are-inconsistent-in-te.yml
new file mode 100644
index 00000000000..2b829c521e4
--- /dev/null
+++ b/changelogs/unreleased/255970-confirmation-panels-for-significant-actions-are-inconsistent-in-te.yml
@@ -0,0 +1,5 @@
+---
+title: Make delete repo prompts consistent
+merge_request: 47117
+author:
+type: fixed
diff --git a/changelogs/unreleased/chore-disable-admin-mode-in-services.yml b/changelogs/unreleased/chore-disable-admin-mode-in-services.yml
new file mode 100644
index 00000000000..868d2b43a9a
--- /dev/null
+++ b/changelogs/unreleased/chore-disable-admin-mode-in-services.yml
@@ -0,0 +1,5 @@
+---
+title: Migrate services specs to consider admin mode
+merge_request: 45988
+author: Diego Louzán
+type: other
diff --git a/changelogs/unreleased/ek-fix-set-status-modal-tooltip-trigger.yml b/changelogs/unreleased/ek-fix-set-status-modal-tooltip-trigger.yml
new file mode 100644
index 00000000000..e923e4b0f63
--- /dev/null
+++ b/changelogs/unreleased/ek-fix-set-status-modal-tooltip-trigger.yml
@@ -0,0 +1,5 @@
+---
+title: Fix status emoji tooltip trigger
+merge_request: 47378
+author:
+type: fixed
diff --git a/changelogs/unreleased/jira_connect_sync_namespace_worker.yml b/changelogs/unreleased/jira_connect_sync_namespace_worker.yml
new file mode 100644
index 00000000000..ac57e060afc
--- /dev/null
+++ b/changelogs/unreleased/jira_connect_sync_namespace_worker.yml
@@ -0,0 +1,5 @@
+---
+title: Jira Connect automatically synchronizes up to 400 existing merge requests per project when a namespace is connected.
+merge_request: 43880
+author:
+type: added
diff --git a/changelogs/unreleased/mw-replace-fa-check-in-importer-status.yml b/changelogs/unreleased/mw-replace-fa-check-in-importer-status.yml
new file mode 100644
index 00000000000..4c149ee41a7
--- /dev/null
+++ b/changelogs/unreleased/mw-replace-fa-check-in-importer-status.yml
@@ -0,0 +1,5 @@
+---
+title: Replace fa-check icon in importer status
+merge_request: 47373
+author:
+type: changed
diff --git a/config/feature_flags/development/jira_connect_full_namespace_sync.yml b/config/feature_flags/development/jira_connect_full_namespace_sync.yml
new file mode 100644
index 00000000000..90fe97be409
--- /dev/null
+++ b/config/feature_flags/development/jira_connect_full_namespace_sync.yml
@@ -0,0 +1,7 @@
+---
+name: jira_connect_full_namespace_sync
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/43880
+rollout_issue_url: 
+type: development
+group: group::ecosystem
+default_enabled: false
diff --git a/db/post_migrate/20201106082723_add_merge_request_jira_reference_indexes.rb b/db/post_migrate/20201106082723_add_merge_request_jira_reference_indexes.rb
new file mode 100644
index 00000000000..d69f57c6088
--- /dev/null
+++ b/db/post_migrate/20201106082723_add_merge_request_jira_reference_indexes.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+class AddMergeRequestJiraReferenceIndexes < ActiveRecord::Migration[6.0]
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  DESCRIPTION_INDEX_NAME = 'index_merge_requests_on_target_project_id_iid_jira_description'
+  TITLE_INDEX_NAME = 'index_merge_requests_on_target_project_id_and_iid_jira_title'
+
+  JIRA_KEY_REGEX = '[A-Z][A-Z_0-9]+-\d+'
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index(
+      :merge_requests,
+      [:target_project_id, :iid],
+      name: TITLE_INDEX_NAME,
+      using: :btree,
+      where: "(merge_requests.title)::text ~ '#{JIRA_KEY_REGEX}'::text"
+    )
+
+    add_concurrent_index(
+      :merge_requests,
+      [:target_project_id, :iid],
+      name: DESCRIPTION_INDEX_NAME,
+      using: :btree,
+      where: "(merge_requests.description)::text ~ '#{JIRA_KEY_REGEX}'::text"
+    )
+  end
+
+  def down
+    remove_concurrent_index_by_name(
+      :merge_requests,
+      TITLE_INDEX_NAME
+    )
+
+    remove_concurrent_index_by_name(
+      :merge_requests,
+      DESCRIPTION_INDEX_NAME
+    )
+  end
+end
diff --git a/db/schema_migrations/20201106082723 b/db/schema_migrations/20201106082723
new file mode 100644
index 00000000000..0bb6a3b85b8
--- /dev/null
+++ b/db/schema_migrations/20201106082723
@@ -0,0 +1 @@
+a2dc0d31af6834adf6634f6051d7d451fc48d31492d96efe57547c3e9d61a64d
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index f9f57d321f8..2f6524ff0f9 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -21150,8 +21150,12 @@ CREATE UNIQUE INDEX index_merge_requests_on_target_project_id_and_iid ON merge_r
 
 CREATE INDEX index_merge_requests_on_target_project_id_and_iid_and_state_id ON merge_requests USING btree (target_project_id, iid, state_id);
 
+CREATE INDEX index_merge_requests_on_target_project_id_and_iid_jira_title ON merge_requests USING btree (target_project_id, iid) WHERE ((title)::text ~ '[A-Z][A-Z_0-9]+-\d+'::text);
+
 CREATE INDEX index_merge_requests_on_target_project_id_and_target_branch ON merge_requests USING btree (target_project_id, target_branch) WHERE ((state_id = 1) AND (merge_when_pipeline_succeeds = true));
 
+CREATE INDEX index_merge_requests_on_target_project_id_iid_jira_description ON merge_requests USING btree (target_project_id, iid) WHERE (description ~ '[A-Z][A-Z_0-9]+-\d+'::text);
+
 CREATE INDEX index_merge_requests_on_title ON merge_requests USING btree (title);
 
 CREATE INDEX index_merge_requests_on_title_trigram ON merge_requests USING gin (title gin_trgm_ops);
diff --git a/doc/README.md b/doc/README.md
index df7ad597334..08b76e58fc6 100644
--- a/doc/README.md
+++ b/doc/README.md
@@ -260,9 +260,9 @@ The following documentation relates to the DevOps **Verify** stage:
 
 ### Package
 
-GitLab Packages allows organizations to utilize GitLab as a private repository
+GitLab Packages allows organizations to use GitLab as a private repository
 for a variety of common package managers. Users are able to build and publish
-packages, which can be easily consumed as a dependency in downstream projects.
+packages, which can be consumed as a dependency in downstream projects.
 
 The following documentation relates to the DevOps **Package** stage:
 
diff --git a/doc/api/graphql/reference/gitlab_schema.graphql b/doc/api/graphql/reference/gitlab_schema.graphql
index c3fc5a712e5..b2d0f171f7f 100644
--- a/doc/api/graphql/reference/gitlab_schema.graphql
+++ b/doc/api/graphql/reference/gitlab_schema.graphql
@@ -7645,6 +7645,16 @@ type EpicIssue implements CurrentUserTodos & Noteable {
   """
   milestone: Milestone
 
+  """
+  Indicates if issue got moved from other project
+  """
+  moved: Boolean
+
+  """
+  Updated Issue after it got moved to another project
+  """
+  movedTo: Issue
+
   """
   All notes on this noteable
   """
@@ -10169,6 +10179,16 @@ type Issue implements CurrentUserTodos & Noteable {
   """
   milestone: Milestone
 
+  """
+  Indicates if issue got moved from other project
+  """
+  moved: Boolean
+
+  """
+  Updated Issue after it got moved to another project
+  """
+  movedTo: Issue
+
   """
   All notes on this noteable
   """
diff --git a/doc/api/graphql/reference/gitlab_schema.json b/doc/api/graphql/reference/gitlab_schema.json
index 6c9df6d0b48..27dbef6d1b2 100644
--- a/doc/api/graphql/reference/gitlab_schema.json
+++ b/doc/api/graphql/reference/gitlab_schema.json
@@ -21168,6 +21168,34 @@
               "isDeprecated": false,
               "deprecationReason": null
             },
+            {
+              "name": "moved",
+              "description": "Indicates if issue got moved from other project",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "SCALAR",
+                "name": "Boolean",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "movedTo",
+              "description": "Updated Issue after it got moved to another project",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "OBJECT",
+                "name": "Issue",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
             {
               "name": "notes",
               "description": "All notes on this noteable",
@@ -27821,6 +27849,34 @@
               "isDeprecated": false,
               "deprecationReason": null
             },
+            {
+              "name": "moved",
+              "description": "Indicates if issue got moved from other project",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "SCALAR",
+                "name": "Boolean",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "movedTo",
+              "description": "Updated Issue after it got moved to another project",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "OBJECT",
+                "name": "Issue",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
             {
               "name": "notes",
               "description": "All notes on this noteable",
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 23ba0f505fe..df89ed7a7a3 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1268,6 +1268,8 @@ Relationship between an epic and an issue.
 | `iteration` | Iteration | Iteration of the issue |
 | `labels` | LabelConnection | Labels of the issue |
 | `milestone` | Milestone | Milestone of the issue |
+| `moved` | Boolean | Indicates if issue got moved from other project |
+| `movedTo` | Issue | Updated Issue after it got moved to another project |
 | `notes` | NoteConnection! | All notes on this noteable |
 | `participants` | UserConnection | List of participants in the issue |
 | `reference` | String! | Internal reference of the issue. Returned in shortened format by default |
@@ -1534,6 +1536,8 @@ Represents a recorded measurement (object count) for the Admins.
 | `iteration` | Iteration | Iteration of the issue |
 | `labels` | LabelConnection | Labels of the issue |
 | `milestone` | Milestone | Milestone of the issue |
+| `moved` | Boolean | Indicates if issue got moved from other project |
+| `movedTo` | Issue | Updated Issue after it got moved to another project |
 | `notes` | NoteConnection! | All notes on this noteable |
 | `participants` | UserConnection | List of participants in the issue |
 | `reference` | String! | Internal reference of the issue. Returned in shortened format by default |
diff --git a/doc/development/integrations/secure.md b/doc/development/integrations/secure.md
index 94f1ccdb1e6..8dfdf70a7bb 100644
--- a/doc/development/integrations/secure.md
+++ b/doc/development/integrations/secure.md
@@ -289,8 +289,7 @@ You can find the schemas for these scanners here:
 
 ### Version
 
-This field specifies the version of the report schema you are using. Please reference individual scanner
-pages for the specific versions to use.
+This field specifies the version of the [Security Report Schemas](https://gitlab.com/gitlab-org/security-products/security-report-schemas) you are using. Please refer to the [releases](https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/releases) of the schemas for the specific versions to use.
 
 ### Vulnerabilities
 
diff --git a/doc/user/application_security/dependency_list/img/yarn_dependency_path_v13_6.png b/doc/user/application_security/dependency_list/img/yarn_dependency_path_v13_6.png
new file mode 100644
index 00000000000..6f1f456ab72
Binary files /dev/null and b/doc/user/application_security/dependency_list/img/yarn_dependency_path_v13_6.png differ
diff --git a/doc/user/application_security/dependency_list/index.md b/doc/user/application_security/dependency_list/index.md
index 1f730e5f205..ddd059707d4 100644
--- a/doc/user/application_security/dependency_list/index.md
+++ b/doc/user/application_security/dependency_list/index.md
@@ -32,7 +32,7 @@ Dependencies are displayed with the following information:
 | --------- | ----------- |
 | Component | The dependency's name and version |
 | Packager  | The packager used to install the dependency |
-| Location  | A link to the packager-specific lock file in your project that declared the dependency |
+| Location  | A link to the packager-specific lock file in your project that declared the dependency. It also shows the [dependency path](#dependency-paths) to a top-level dependency, if any, and if supported. |
 | License   | Links to dependency's software licenses |
 
 Dependencies shown are initially sorted by the severity of their known vulnerabilities, if any. They
@@ -44,6 +44,18 @@ If a dependency has known vulnerabilities, you can view them by clicking the arr
 dependency's name or the badge that indicates how many known vulnerabilities exist. For each
 vulnerability, its severity and description then appears below it.
 
+### Dependency Paths
+
+The dependency list shows the path between a dependency and a top-level dependency it's connected
+to, if any. There are many possible paths connecting a transient dependency to top-level
+dependencies, but the UI only shows one of the shortest paths.
+
+![Dependency Path](img/yarn_dependency_path_v13_6.png)
+
+Dependency Paths are supported for the following package managers:
+
+- [NuGet](https://www.nuget.org/)
+
 ## Licenses
 
 > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/10536) in GitLab Ultimate 12.3.
diff --git a/doc/user/compliance/license_compliance/index.md b/doc/user/compliance/license_compliance/index.md
index 0d21b0f4444..b6a8e6defaf 100644
--- a/doc/user/compliance/license_compliance/index.md
+++ b/doc/user/compliance/license_compliance/index.md
@@ -62,7 +62,6 @@ The following languages and package managers are supported.
 | .NET       | [Nuget](https://www.nuget.org/) | The .NET Framework is supported via the [mono project](https://www.mono-project.com/). There are, however, some limitations. The scanner doesn't support Windows-specific dependencies and doesn't report dependencies of your project's listed dependencies. Also, the scanner always marks detected licenses for all dependencies as `unknown`. | [License Finder](https://github.com/pivotal/LicenseFinder) |
 | Python     | [pip](https://pip.pypa.io/en/stable/) | Python is supported through [requirements.txt](https://pip.pypa.io/en/stable/user_guide/#requirements-files) and [Pipfile.lock](https://github.com/pypa/pipfile#pipfilelock). | [License Finder](https://github.com/pivotal/LicenseFinder) |
 | Ruby       | [gem](https://rubygems.org/) |  | [License Finder](https://github.com/pivotal/LicenseFinder)|
-| Objective-C, Swift | [Carthage](https://github.com/Carthage/Carthage) |  | [License Finder](https://github.com/pivotal/LicenseFinder) |
 
 NOTE: **Note:**
 Java 8 and Gradle 1.x projects are not supported.
@@ -78,6 +77,7 @@ which means that the reported licenses might be incomplete or inaccurate.
 | JavaScript | [Yarn](https://yarnpkg.com/)|[License Finder](https://github.com/pivotal/LicenseFinder)|
 | Go         | go get, gvt, glide, dep, trash, govendor |[License Finder](https://github.com/pivotal/LicenseFinder)|
 | Erlang     | [Rebar](https://www.rebar3.org/) |[License Finder](https://github.com/pivotal/LicenseFinder)|
+| Objective-C, Swift | [Carthage](https://github.com/Carthage/Carthage) |  | [License Finder](https://github.com/pivotal/LicenseFinder) |
 | Objective-C, Swift | [CocoaPods](https://cocoapods.org/) v0.39 and below |[License Finder](https://github.com/pivotal/LicenseFinder)|
 | Elixir     | [Mix](https://elixir-lang.org/getting-started/mix-otp/introduction-to-mix.html) |[License Finder](https://github.com/pivotal/LicenseFinder)|
 | C++/C      | [Conan](https://conan.io/) |[License Finder](https://github.com/pivotal/LicenseFinder)|
@@ -144,7 +144,7 @@ License Compliance can be configured using environment variables.
 | `ASDF_PYTHON_VERSION`       | no       | Version of Python to use for the scan. |
 | `ASDF_RUBY_VERSION`         | no       | Version of Ruby to use for the scan. |
 | `GRADLE_CLI_OPTS`           | no       | Additional arguments for the gradle executable. If not supplied, defaults to `--exclude-task=test`. |
-| `LICENSE_FINDER_CLI_OPTS`   | no       | Additional arguments for the `license_finder` executable. For example, if your project has both Golang and Ruby code stored in different directories and you want to only scan the Ruby code, you can update your `.gitlab-ci-yml` template to specify which project directories to scan, like `LICENSE_FINDER_CLI_OPTS: '--debug --aggregate-paths=. ruby'`. |
+| `LICENSE_FINDER_CLI_OPTS`   | no       | Additional arguments for the `license_finder` executable. For example, if you have multiple projects in nested directories, you can update your `.gitlab-ci-yml` template to specify a recursive scan, like `LICENSE_FINDER_CLI_OPTS: '--recursive'`. |
 | `LM_JAVA_VERSION`           | no       | Version of Java. If set to `11`, Maven and Gradle use Java 11 instead of Java 8. |
 | `LM_PYTHON_VERSION`         | no       | Version of Python. If set to `3`, dependencies are installed using Python 3 instead of Python 2.7. |
 | `MAVEN_CLI_OPTS`            | no       | Additional arguments for the mvn executable. If not supplied, defaults to `-DskipTests`. |
diff --git a/doc/user/packages/npm_registry/index.md b/doc/user/packages/npm_registry/index.md
index 2ecc49dc665..feb797240f4 100644
--- a/doc/user/packages/npm_registry/index.md
+++ b/doc/user/packages/npm_registry/index.md
@@ -79,7 +79,18 @@ To create a project:
    the [naming convention](#package-naming-convention) and is scoped to the
    project or group where the registry exists.
 
-A `package.json` file is created. 
+A `package.json` file is created.
+
+## Use the GitLab endpoint for NPM packages
+
+To use the GitLab endpoint for NPM packages, choose an option:
+
+- **Project-level**: Use when you have few NPM packages and they are not in
+  the same GitLab group.
+- **Instance-level**: Use when you have many NPM packages in different
+  GitLab groups or in their own namespace. Be sure to comply with the [package naming convention](#package-naming-convention).
+
+Some features such as [publishing](#publish-an-npm-package) a package is only available on the project-level endpoint.
 
 ## Authenticate to the Package Registry
 
@@ -94,20 +105,19 @@ To authenticate to the Package Registry, you must use one of the following:
 
 ### Authenticate with a personal access token or deploy token
 
-To authenticate with a [personal access token](../../profile/personal_access_tokens.md) or [deploy token](../../project/deploy_tokens/index.md),
-set your NPM configuration:
+To authenticate with the Package Registry, you will need a [personal access token](../../profile/personal_access_tokens.md) or [deploy token](../../project/deploy_tokens/index.md).
+
+#### Project-level NPM endpoint
+
+To use the [project-level](#use-the-gitlab-endpoint-for-npm-packages) NPM endpoint, set your NPM configuration:
 
 ```shell
-# Set URL for your scoped packages
-# For example, a package named `@foo/bar` uses this URL for download
-npm config set @foo:registry https://gitlab.example.com/api/v4/packages/npm/
+# Set URL for your scoped packages.
+# For example package with name `@foo/bar` will use this URL for download
+npm config set @foo:registry https://gitlab.example.com/api/v4/projects/<your_project_id>/packages/npm/
 
-# Add the token for the scoped packages URL 
-# Use this to download `@foo/` packages from private projects
-npm config set '//gitlab.example.com/api/v4/packages/npm/:_authToken' "<your_token>"
-
-# Add token for to publish to the package registry
-# Replace <your_project_id> with the project you want to publish your package to
+# Add the token for the scoped packages URL. Replace <your_project_id>
+# with the project where your package is located.
 npm config set '//gitlab.example.com/api/v4/projects/<your_project_id>/packages/npm/:_authToken' "<your_token>"
 ```
 
@@ -120,6 +130,28 @@ You should now be able to publish and install NPM packages in your project.
 If you encounter an error with [Yarn](https://classic.yarnpkg.com/en/), view
 [troubleshooting steps](#troubleshooting).
 
+#### Instance-level NPM endpoint
+
+To use the [instance-level](#use-the-gitlab-endpoint-for-npm-packages) NPM endpoint, set your NPM configuration:
+
+```shell
+# Set URL for your scoped packages.
+# For example package with name `@foo/bar` will use this URL for download
+npm config set @foo:registry https://gitlab.example.com/api/v4/packages/npm/
+
+# Add the token for the scoped packages URL. This will allow you to download
+# `@foo/` packages from private projects.
+npm config set '//gitlab.example.com/api/v4/packages/npm/:_authToken' "<your_token>"
+```
+
+- `<your_token>` is your personal access token or deploy token.
+- Replace `gitlab.example.com` with your domain name.
+
+You should now be able to publish and install NPM packages in your project.
+
+If you encounter an error with [Yarn](https://classic.yarnpkg.com/en/), view
+[troubleshooting steps](#troubleshooting).
+
 ### Authenticate with a CI job token
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/9104) in GitLab Premium 12.5.
@@ -128,12 +160,22 @@ If you encounter an error with [Yarn](https://classic.yarnpkg.com/en/), view
 If you're using NPM with GitLab CI/CD, a CI job token can be used instead of a personal access token or deploy token.
 The token inherits the permissions of the user that generates the pipeline.
 
-Add a corresponding section to your `.npmrc` file:
+#### Project-level NPM endpoint
+
+To use the [project-level](#use-the-gitlab-endpoint-for-npm-packages) NPM endpoint, add a corresponding section to your `.npmrc` file:
+
+```ini
+@foo:registry=https://gitlab.example.com/api/v4/projects/${CI_PROJECT_ID}/packages/npm/
+//gitlab.example.com/api/v4/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}
+```
+
+#### Instance-level NPM endpoint
+
+To use the [instance-level](#use-the-gitlab-endpoint-for-npm-packages) NPM endpoint, add a corresponding section to your `.npmrc` file:
 
 ```ini
 @foo:registry=https://gitlab.example.com/api/v4/packages/npm/
 //gitlab.example.com/api/v4/packages/npm/:_authToken=${CI_JOB_TOKEN}
-//gitlab.example.com/api/v4/projects/${CI_PROJECT_ID}/packages/npm/:_authToken=${CI_JOB_TOKEN}
 ```
 
 #### Use variables to avoid hard-coding auth token values
@@ -184,37 +226,22 @@ In GitLab, this regex validates all package names from all package managers:
 This regex allows almost all of the characters that NPM allows, with a few exceptions (for example, `~` is not allowed).
 
 The regex also allows for capital letters, while NPM does not. Capital letters are needed because the scope must be
-identical to the root namespace of the project. 
+identical to the root namespace of the project.
 
 CAUTION: **Caution:**
 When you update the path of a user or group, or transfer a subgroup or project,
-you must remove any NPM packages first. You cannot update the root namespace 
+you must remove any NPM packages first. You cannot update the root namespace
 of a project with NPM packages. Make sure you update your `.npmrc` files to follow
 the naming convention and run `npm publish` if necessary.
 
 ## Publish an NPM package
 
-Before you can publish a package, you must specify the registry
-for NPM. To do this, add the following section to the bottom of `package.json`:
+Prerequisites:
 
-```json
-"publishConfig": {
-  "@foo:registry":"https://gitlab.example.com/api/v4/projects/<your_project_id>/packages/npm/"
-}
-```
+- [Authenticate](#authenticate-to-the-package-registry) to the Package Registry.
+- Set a [project-level NPM endpoint](#use-the-gitlab-endpoint-for-npm-packages).
 
-- `<your_project_id>` is your project ID, found on the project's home page.
-- `@foo` is your scope.
-- Replace `gitlab.example.com` with your domain name.
-
-DANGER: **Warning:**
-The `publishConfig` entry in the `package.json` file is not respected, because of a
-[bug in NPM](https://github.com/npm/cli/issues/1994) version `7.x` and later. You must
-use an earlier version of NPM, or temporarily set your `.npmrc` scope to
-`@foo:registry=https://gitlab.example.com/api/v4/projects/<project_id>/packages/npm`.
-
-After you have set up [authentication](#authenticate-to-the-package-registry),
-you can upload an NPM package to your project:
+To upload an NPM package to your project, run this command:
 
 ```shell
 npm publish
@@ -227,6 +254,11 @@ a given scope, you get a `403 Forbidden!` error.
 
 ## Publish an NPM package by using CI/CD
 
+Prerequisites:
+
+- [Authenticate](#authenticate-to-the-package-registry) to the Package Registry.
+- Set a [project-level NPM endpoint](#use-the-gitlab-endpoint-for-npm-packages).
+
 To work with NPM commands within [GitLab CI/CD](../../../ci/README.md), you can use
 `CI_JOB_TOKEN` in place of the personal access token or deploy token in your commands.
 
@@ -267,7 +299,7 @@ in a JavaScript project.
    Replace `@foo` with your scope.
 
 1. Ensure [authentication](#authenticate-to-the-package-registry) is configured.
-   
+
 1. In your project, to install a package, run:
 
    ```shell
@@ -390,9 +422,6 @@ should look like:
   "name": "@foo/my-package",
   "version": "1.0.0",
   "description": "Example package for GitLab NPM registry",
-  "publishConfig": {
-    "@foo:registry":"https://gitlab.example.com/api/v4/projects/<your_project_id>/packages/npm/"
-  }
 }
 ```
 
diff --git a/lib/api/api.rb b/lib/api/api.rb
index 6a459292045..0dafbe492b5 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -218,7 +218,8 @@ module API
       mount ::API::DebianGroupPackages
       mount ::API::DebianProjectPackages
       mount ::API::MavenPackages
-      mount ::API::NpmPackages
+      mount ::API::NpmProjectPackages
+      mount ::API::NpmInstancePackages
       mount ::API::GenericPackages
       mount ::API::GoProxy
       mount ::API::Pages
diff --git a/lib/api/concerns/packages/npm_endpoints.rb b/lib/api/concerns/packages/npm_endpoints.rb
new file mode 100644
index 00000000000..a91db93b182
--- /dev/null
+++ b/lib/api/concerns/packages/npm_endpoints.rb
@@ -0,0 +1,134 @@
+# frozen_string_literal: true
+
+# NPM Package Manager Client API
+#
+# These API endpoints are not consumed directly by users, so there is no documentation for the
+# individual endpoints. They are called by the NPM package manager client when users run commands
+# like `npm install` or `npm publish`. The usage of the GitLab NPM registry is documented here:
+# https://docs.gitlab.com/ee/user/packages/npm_registry/
+#
+# Technical debt: https://gitlab.com/gitlab-org/gitlab/issues/35798
+#
+# Caution: This Concern has to be included at the end of the API class
+# The last route of this Concern has a globbing wildcard that will match all urls.
+# As such, routes declared after the last route of this Concern will not match any url.
+module API
+  module Concerns
+    module Packages
+      module NpmEndpoints
+        extend ActiveSupport::Concern
+
+        included do
+          helpers ::API::Helpers::Packages::DependencyProxyHelpers
+
+          before do
+            require_packages_enabled!
+            authenticate_non_get!
+          end
+
+          params do
+            requires :package_name, type: String, desc: 'Package name'
+          end
+          namespace '-/package/*package_name' do
+            desc 'Get all tags for a given an NPM package' do
+              detail 'This feature was introduced in GitLab 12.7'
+              success ::API::Entities::NpmPackageTag
+            end
+            get 'dist-tags', format: false, requirements: ::API::Helpers::Packages::Npm::NPM_ENDPOINT_REQUIREMENTS do
+              package_name = params[:package_name]
+
+              bad_request!('Package Name') if package_name.blank?
+
+              authorize_read_package!(project)
+
+              packages = ::Packages::Npm::PackageFinder.new(project, package_name)
+                                                      .execute
+
+              not_found! if packages.empty?
+
+              present ::Packages::Npm::PackagePresenter.new(package_name, packages),
+                      with: ::API::Entities::NpmPackageTag
+            end
+
+            params do
+              requires :tag, type: String, desc: "Package dist-tag"
+            end
+            namespace 'dist-tags/:tag', requirements: ::API::Helpers::Packages::Npm::NPM_ENDPOINT_REQUIREMENTS do
+              desc 'Create or Update the given tag for the given NPM package and version' do
+                detail 'This feature was introduced in GitLab 12.7'
+              end
+              put format: false do
+                package_name = params[:package_name]
+                version = env['api.request.body']
+                tag = params[:tag]
+
+                bad_request!('Package Name') if package_name.blank?
+                bad_request!('Version') if version.blank?
+                bad_request!('Tag') if tag.blank?
+
+                authorize_create_package!(project)
+
+                package = ::Packages::Npm::PackageFinder
+                  .new(project, package_name)
+                  .find_by_version(version)
+                not_found!('Package') unless package
+
+                ::Packages::Npm::CreateTagService.new(package, tag).execute
+
+                no_content!
+              end
+
+              desc 'Deletes the given tag' do
+                detail 'This feature was introduced in GitLab 12.7'
+              end
+              delete format: false do
+                package_name = params[:package_name]
+                tag = params[:tag]
+
+                bad_request!('Package Name') if package_name.blank?
+                bad_request!('Tag') if tag.blank?
+
+                authorize_destroy_package!(project)
+
+                package_tag = ::Packages::TagsFinder
+                  .new(project, package_name, package_type: :npm)
+                  .find_by_name(tag)
+
+                not_found!('Package tag') unless package_tag
+
+                ::Packages::RemoveTagService.new(package_tag).execute
+
+                no_content!
+              end
+            end
+          end
+
+          desc 'NPM registry metadata endpoint' do
+            detail 'This feature was introduced in GitLab 11.8'
+          end
+          params do
+            requires :package_name, type: String, desc: 'Package name'
+          end
+          route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
+          get '*package_name', format: false, requirements: ::API::Helpers::Packages::Npm::NPM_ENDPOINT_REQUIREMENTS do
+            package_name = params[:package_name]
+
+            packages = ::Packages::Npm::PackageFinder.new(project_or_nil, package_name)
+                                                    .execute
+
+            redirect_request = project_or_nil.blank? || packages.empty?
+
+            redirect_registry_request(redirect_request, :npm, package_name: package_name) do
+              authorize_read_package!(project)
+
+              not_found!('Packages') if packages.empty?
+
+              present ::Packages::Npm::PackagePresenter.new(package_name, packages),
+                with: ::API::Entities::NpmPackage
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/helpers/packages/npm.rb b/lib/api/helpers/packages/npm.rb
new file mode 100644
index 00000000000..c1f6a001201
--- /dev/null
+++ b/lib/api/helpers/packages/npm.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+module API
+  module Helpers
+    module Packages
+      module Npm
+        include Gitlab::Utils::StrongMemoize
+        include ::API::Helpers::PackagesHelpers
+
+        NPM_ENDPOINT_REQUIREMENTS = {
+          package_name: API::NO_SLASH_URL_PART_REGEX
+        }.freeze
+
+        def endpoint_scope
+          params[:id].present? ? :project : :instance
+        end
+
+        def project
+          strong_memoize(:project) do
+            case endpoint_scope
+            when :project
+              user_project
+            when :instance
+              # Simulate the same behavior as #user_project by re-using #find_project!
+              # but take care if the project_id is nil as #find_project! is not designed
+              # to handle it.
+              project_id = project_id_or_nil
+
+              not_found!('Project') unless project_id
+
+              find_project!(project_id)
+            end
+          end
+        end
+
+        def project_or_nil
+          # mainly used by the metadata endpoint where we need to get a project
+          # and return nil if not found (no errors should be raised)
+          strong_memoize(:project_or_nil) do
+            next unless project_id_or_nil
+
+            find_project(project_id_or_nil)
+          end
+        end
+
+        def project_id_or_nil
+          strong_memoize(:project_id_or_nil) do
+            case endpoint_scope
+            when :project
+              params[:id]
+            when :instance
+              ::Packages::Package.npm
+                                .with_name(params[:package_name])
+                                .first
+                                &.project_id
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/npm_instance_packages.rb b/lib/api/npm_instance_packages.rb
new file mode 100644
index 00000000000..12fc008e00f
--- /dev/null
+++ b/lib/api/npm_instance_packages.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+module API
+  class NpmInstancePackages < ::API::Base
+    helpers ::API::Helpers::Packages::Npm
+
+    feature_category :package_registry
+
+    rescue_from ActiveRecord::RecordInvalid do |e|
+      render_api_error!(e.message, 400)
+    end
+
+    namespace 'packages/npm' do
+      include ::API::Concerns::Packages::NpmEndpoints
+    end
+  end
+end
diff --git a/lib/api/npm_packages.rb b/lib/api/npm_packages.rb
deleted file mode 100644
index e0c20fe3cc4..00000000000
--- a/lib/api/npm_packages.rb
+++ /dev/null
@@ -1,175 +0,0 @@
-# frozen_string_literal: true
-module API
-  class NpmPackages < ::API::Base
-    helpers ::API::Helpers::PackagesHelpers
-    helpers ::API::Helpers::Packages::DependencyProxyHelpers
-
-    feature_category :package_registry
-
-    NPM_ENDPOINT_REQUIREMENTS = {
-      package_name: API::NO_SLASH_URL_PART_REGEX
-    }.freeze
-
-    rescue_from ActiveRecord::RecordInvalid do |e|
-      render_api_error!(e.message, 400)
-    end
-
-    before do
-      require_packages_enabled!
-      authenticate_non_get!
-    end
-
-    helpers do
-      def project_by_package_name
-        strong_memoize(:project_by_package_name) do
-          ::Packages::Package.npm.with_name(params[:package_name]).first&.project
-        end
-      end
-    end
-
-    desc 'Get all tags for a given an NPM package' do
-      detail 'This feature was introduced in GitLab 12.7'
-      success ::API::Entities::NpmPackageTag
-    end
-    params do
-      requires :package_name, type: String, desc: 'Package name'
-    end
-    get 'packages/npm/-/package/*package_name/dist-tags', format: false, requirements: NPM_ENDPOINT_REQUIREMENTS do
-      package_name = params[:package_name]
-
-      bad_request!('Package Name') if package_name.blank?
-
-      authorize_read_package!(project_by_package_name)
-
-      packages = ::Packages::Npm::PackageFinder.new(project_by_package_name, package_name)
-                                              .execute
-
-      present ::Packages::Npm::PackagePresenter.new(package_name, packages),
-              with: ::API::Entities::NpmPackageTag
-    end
-
-    params do
-      requires :package_name, type: String, desc: 'Package name'
-      requires :tag, type: String, desc: "Package dist-tag"
-    end
-    namespace 'packages/npm/-/package/*package_name/dist-tags/:tag', requirements: NPM_ENDPOINT_REQUIREMENTS do
-      desc 'Create or Update the given tag for the given NPM package and version' do
-        detail 'This feature was introduced in GitLab 12.7'
-      end
-      put format: false do
-        package_name = params[:package_name]
-        version = env['api.request.body']
-        tag = params[:tag]
-
-        bad_request!('Package Name') if package_name.blank?
-        bad_request!('Version') if version.blank?
-        bad_request!('Tag') if tag.blank?
-
-        authorize_create_package!(project_by_package_name)
-
-        package = ::Packages::Npm::PackageFinder
-          .new(project_by_package_name, package_name)
-          .find_by_version(version)
-        not_found!('Package') unless package
-
-        ::Packages::Npm::CreateTagService.new(package, tag).execute
-
-        no_content!
-      end
-
-      desc 'Deletes the given tag' do
-        detail 'This feature was introduced in GitLab 12.7'
-      end
-      delete format: false do
-        package_name = params[:package_name]
-        tag = params[:tag]
-
-        bad_request!('Package Name') if package_name.blank?
-        bad_request!('Tag') if tag.blank?
-
-        authorize_destroy_package!(project_by_package_name)
-
-        package_tag = ::Packages::TagsFinder
-          .new(project_by_package_name, package_name, package_type: :npm)
-          .find_by_name(tag)
-
-        not_found!('Package tag') unless package_tag
-
-        ::Packages::RemoveTagService.new(package_tag).execute
-
-        no_content!
-      end
-    end
-
-    desc 'NPM registry endpoint at instance level' do
-      detail 'This feature was introduced in GitLab 11.8'
-    end
-    params do
-      requires :package_name, type: String, desc: 'Package name'
-    end
-    route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
-    get 'packages/npm/*package_name', format: false, requirements: NPM_ENDPOINT_REQUIREMENTS do
-      package_name = params[:package_name]
-
-      redirect_registry_request(project_by_package_name.blank?, :npm, package_name: package_name) do
-        authorize_read_package!(project_by_package_name)
-
-        packages = ::Packages::Npm::PackageFinder
-          .new(project_by_package_name, package_name).execute
-
-        present ::Packages::Npm::PackagePresenter.new(package_name, packages),
-          with: ::API::Entities::NpmPackage
-      end
-    end
-
-    params do
-      requires :id, type: String, desc: 'The ID of a project'
-    end
-    resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
-      desc 'Download the NPM tarball' do
-        detail 'This feature was introduced in GitLab 11.8'
-      end
-      params do
-        requires :package_name, type: String, desc: 'Package name'
-        requires :file_name, type: String, desc: 'Package file name'
-      end
-      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
-      get ':id/packages/npm/*package_name/-/*file_name', format: false do
-        authorize_read_package!(user_project)
-
-        package = user_project.packages.npm
-          .by_name_and_file_name(params[:package_name], params[:file_name])
-
-        package_file = ::Packages::PackageFileFinder
-          .new(package, params[:file_name]).execute!
-
-        track_package_event('pull_package', package)
-
-        present_carrierwave_file!(package_file.file)
-      end
-
-      desc 'Create NPM package' do
-        detail 'This feature was introduced in GitLab 11.8'
-      end
-      params do
-        requires :package_name, type: String, desc: 'Package name'
-        requires :versions, type: Hash, desc: 'Package version info'
-      end
-      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
-      put ':id/packages/npm/:package_name', requirements: NPM_ENDPOINT_REQUIREMENTS do
-        authorize_create_package!(user_project)
-
-        track_package_event('push_package', :npm)
-
-        created_package = ::Packages::Npm::CreatePackageService
-          .new(user_project, current_user, params.merge(build: current_authenticated_job)).execute
-
-        if created_package[:status] == :error
-          render_api_error!(created_package[:message], created_package[:http_status])
-        else
-          created_package
-        end
-      end
-    end
-  end
-end
diff --git a/lib/api/npm_project_packages.rb b/lib/api/npm_project_packages.rb
new file mode 100644
index 00000000000..887084dc9ae
--- /dev/null
+++ b/lib/api/npm_project_packages.rb
@@ -0,0 +1,66 @@
+# frozen_string_literal: true
+module API
+  class NpmProjectPackages < ::API::Base
+    helpers ::API::Helpers::Packages::Npm
+
+    feature_category :package_registry
+
+    rescue_from ActiveRecord::RecordInvalid do |e|
+      render_api_error!(e.message, 400)
+    end
+
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    namespace 'projects/:id/packages/npm' do
+      desc 'Download the NPM tarball' do
+        detail 'This feature was introduced in GitLab 11.8'
+      end
+      params do
+        requires :package_name, type: String, desc: 'Package name'
+        requires :file_name, type: String, desc: 'Package file name'
+      end
+      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
+      get '*package_name/-/*file_name', format: false do
+        authorize_read_package!(project)
+
+        package = project.packages.npm
+          .by_name_and_file_name(params[:package_name], params[:file_name])
+
+        not_found!('Package') unless package
+
+        package_file = ::Packages::PackageFileFinder
+          .new(package, params[:file_name]).execute!
+
+        track_package_event('pull_package', package, category: 'API::NpmPackages')
+
+        present_carrierwave_file!(package_file.file)
+      end
+
+      desc 'Create NPM package' do
+        detail 'This feature was introduced in GitLab 11.8'
+      end
+      params do
+        requires :package_name, type: String, desc: 'Package name'
+        requires :versions, type: Hash, desc: 'Package version info'
+      end
+      route_setting :authentication, job_token_allowed: true, deploy_token_allowed: true
+      put ':package_name', requirements: ::API::Helpers::Packages::Npm::NPM_ENDPOINT_REQUIREMENTS do
+        authorize_create_package!(project)
+
+        track_package_event('push_package', :npm, category: 'API::NpmPackages')
+
+        created_package = ::Packages::Npm::CreatePackageService
+          .new(project, current_user, params.merge(build: current_authenticated_job)).execute
+
+        if created_package[:status] == :error
+          render_api_error!(created_package[:message], created_package[:http_status])
+        else
+          created_package
+        end
+      end
+
+      include ::API::Concerns::Packages::NpmEndpoints
+    end
+  end
+end
diff --git a/lib/bulk_imports/common/loaders/entities_loader.rb b/lib/bulk_imports/common/loaders/entities_loader.rb
deleted file mode 100644
index 19926fa9a3e..00000000000
--- a/lib/bulk_imports/common/loaders/entities_loader.rb
+++ /dev/null
@@ -1,19 +0,0 @@
-# frozen_string_literal: true
-
-module BulkImports
-  module Common
-    module Loaders
-      class EntitiesLoader
-        def initialize(*args); end
-
-        def load(context, entities)
-          bulk_import = context.entity.bulk_import
-
-          entities.each do |entity|
-            bulk_import.entities.create!(entity)
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/lib/bulk_imports/common/loaders/entity_loader.rb b/lib/bulk_imports/common/loaders/entity_loader.rb
new file mode 100644
index 00000000000..4540b892c88
--- /dev/null
+++ b/lib/bulk_imports/common/loaders/entity_loader.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module BulkImports
+  module Common
+    module Loaders
+      class EntityLoader
+        def initialize(*args); end
+
+        def load(context, entity)
+          context.entity.bulk_import.entities.create!(entity)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/bulk_imports/groups/extractors/subgroups_extractor.rb b/lib/bulk_imports/groups/extractors/subgroups_extractor.rb
index c33bae6ada4..5c5e686cec5 100644
--- a/lib/bulk_imports/groups/extractors/subgroups_extractor.rb
+++ b/lib/bulk_imports/groups/extractors/subgroups_extractor.rb
@@ -9,12 +9,9 @@ module BulkImports
         def extract(context)
           encoded_parent_path = ERB::Util.url_encode(context.entity.source_full_path)
 
-          subgroups = []
           http_client(context.entity.bulk_import.configuration)
-            .each_page(:get, "groups/#{encoded_parent_path}/subgroups") do |page|
-              subgroups << page
-            end
-          subgroups
+            .each_page(:get, "groups/#{encoded_parent_path}/subgroups")
+            .flat_map(&:itself)
         end
 
         private
diff --git a/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline.rb b/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline.rb
index 30b46a3fa24..6384e9d5972 100644
--- a/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline.rb
+++ b/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline.rb
@@ -7,8 +7,8 @@ module BulkImports
         include Pipeline
 
         extractor BulkImports::Groups::Extractors::SubgroupsExtractor
-        transformer BulkImports::Groups::Transformers::SubgroupsToEntitiesTransformer
-        loader BulkImports::Common::Loaders::EntitiesLoader
+        transformer BulkImports::Groups::Transformers::SubgroupToEntityTransformer
+        loader BulkImports::Common::Loaders::EntityLoader
       end
     end
   end
diff --git a/lib/bulk_imports/groups/transformers/subgroup_to_entity_transformer.rb b/lib/bulk_imports/groups/transformers/subgroup_to_entity_transformer.rb
new file mode 100644
index 00000000000..6c3c299c2d2
--- /dev/null
+++ b/lib/bulk_imports/groups/transformers/subgroup_to_entity_transformer.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module BulkImports
+  module Groups
+    module Transformers
+      class SubgroupToEntityTransformer
+        def initialize(*args); end
+
+        def transform(context, entry)
+          {
+            source_type: :group_entity,
+            source_full_path: entry['full_path'],
+            destination_name: entry['name'],
+            destination_namespace: context.entity.group.full_path,
+            parent_id: context.entity.id
+          }
+        end
+      end
+    end
+  end
+end
diff --git a/lib/bulk_imports/groups/transformers/subgroups_to_entities_transformer.rb b/lib/bulk_imports/groups/transformers/subgroups_to_entities_transformer.rb
deleted file mode 100644
index 090b3552338..00000000000
--- a/lib/bulk_imports/groups/transformers/subgroups_to_entities_transformer.rb
+++ /dev/null
@@ -1,23 +0,0 @@
-# frozen_string_literal: true
-
-module BulkImports
-  module Groups
-    module Transformers
-      class SubgroupsToEntitiesTransformer
-        def initialize(*args); end
-
-        def transform(context, data)
-          data.map do |entry|
-            {
-              source_type: :group_entity,
-              source_full_path: entry['full_path'],
-              destination_name: entry['name'],
-              destination_namespace: context.entity.group.full_path,
-              parent_id: context.entity.id
-            }
-          end
-        end
-      end
-    end
-  end
-end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 60a987778d5..1b7b42bf09c 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3546,6 +3546,9 @@ msgstr ""
 msgid "Archived"
 msgstr ""
 
+msgid "Archived (%{movedToStart}moved%{movedToEnd})"
+msgstr ""
+
 msgid "Archived in this version"
 msgstr ""
 
@@ -5327,6 +5330,9 @@ msgstr ""
 msgid "Choose labels"
 msgstr ""
 
+msgid "Choose specific groups or storage shards"
+msgstr ""
+
 msgid "Choose the top-level group for your repository imports."
 msgstr ""
 
@@ -7156,7 +7162,7 @@ msgstr ""
 msgid "Container repositories"
 msgstr ""
 
-msgid "Container repositories sync capacity"
+msgid "Container repositories synchronization concurrency limit"
 msgstr ""
 
 msgid "Container repository"
@@ -8810,9 +8816,6 @@ msgstr ""
 msgid "Delete variable"
 msgstr ""
 
-msgid "DeleteProject|Delete %{name}"
-msgstr ""
-
 msgid "DeleteProject|Failed to remove project repository. Please try again or contact administrator."
 msgstr ""
 
@@ -10423,6 +10426,9 @@ msgstr ""
 msgid "Environments|Delete"
 msgstr ""
 
+msgid "Environments|Delete '%{environmentName}'?"
+msgstr ""
+
 msgid "Environments|Delete environment"
 msgstr ""
 
@@ -11754,7 +11760,7 @@ msgstr ""
 msgid "File renamed with no changes."
 msgstr ""
 
-msgid "File sync capacity"
+msgid "File synchronization concurrency limit"
 msgstr ""
 
 msgid "File templates"
@@ -16053,6 +16059,9 @@ msgstr ""
 msgid "Limit namespaces and projects that can be indexed"
 msgstr ""
 
+msgid "Limit the number of concurrent operations this secondary node can run in the background."
+msgstr ""
+
 msgid "Limited to showing %d event at most"
 msgid_plural "Limited to showing %d events at most"
 msgstr[0] ""
@@ -17685,6 +17694,9 @@ msgstr ""
 msgid "Move selection up"
 msgstr ""
 
+msgid "Move test case"
+msgstr ""
+
 msgid "Move this issue to another project."
 msgstr ""
 
@@ -22856,7 +22868,7 @@ msgstr ""
 msgid "Repository storage"
 msgstr ""
 
-msgid "Repository sync capacity"
+msgid "Repository synchronization concurrency limit"
 msgstr ""
 
 msgid "Repository: %{counter_repositories} / Wikis: %{counter_wikis} / Build Artifacts: %{counter_build_artifacts} / LFS: %{counter_lfs_objects} / Snippets: %{counter_snippets}"
@@ -24559,12 +24571,6 @@ msgstr ""
 msgid "Set the milestone to %{milestone_reference}."
 msgstr ""
 
-msgid "Set the number of concurrent requests this secondary node will make to the primary node while backfilling."
-msgstr ""
-
-msgid "Set the synchronization and verification capacity for the secondary node."
-msgstr ""
-
 msgid "Set the timeout in seconds to send a secondary node status to the primary and IPs allowed for the secondary nodes."
 msgstr ""
 
@@ -24607,13 +24613,16 @@ msgstr ""
 msgid "Set up your project to automatically push and/or pull changes to/from another repository. Branches, tags, and commits will be synced automatically."
 msgstr ""
 
+msgid "Set verification limit and frequency."
+msgstr ""
+
 msgid "Set weight"
 msgstr ""
 
 msgid "Set weight to %{weight}."
 msgstr ""
 
-msgid "Set what should be replicated by choosing specific projects or groups by the secondary node."
+msgid "Set what should be replicated by this secondary node."
 msgstr ""
 
 msgid "SetPasswordToCloneLink|set a password"
@@ -26210,6 +26219,9 @@ msgstr ""
 msgid "Synchronization disabled"
 msgstr ""
 
+msgid "Synchronization settings"
+msgstr ""
+
 msgid "Syncing…"
 msgstr ""
 
@@ -26489,6 +26501,12 @@ msgstr[1] ""
 msgid "Test settings"
 msgstr ""
 
+msgid "TestCases|Move test case"
+msgstr ""
+
+msgid "TestCases|Moving test case"
+msgstr ""
+
 msgid "TestCases|New Test Case"
 msgstr ""
 
@@ -26516,6 +26534,9 @@ msgstr ""
 msgid "TestCases|Something went wrong while marking test case todo as done."
 msgstr ""
 
+msgid "TestCases|Something went wrong while moving test case."
+msgstr ""
+
 msgid "TestCases|Something went wrong while updating the test case labels."
 msgstr ""
 
@@ -29632,7 +29653,7 @@ msgstr ""
 msgid "Various settings that affect GitLab performance."
 msgstr ""
 
-msgid "Verification capacity"
+msgid "Verification concurrency limit"
 msgstr ""
 
 msgid "Verification information"
diff --git a/spec/features/projects_spec.rb b/spec/features/projects_spec.rb
index 6baeb4ce368..9b5f4ca6d48 100644
--- a/spec/features/projects_spec.rb
+++ b/spec/features/projects_spec.rb
@@ -279,7 +279,7 @@ RSpec.describe 'Project' do
     end
 
     it 'deletes a project', :sidekiq_might_not_need_inline do
-      expect { remove_with_confirm('Delete project', "Delete #{project.full_name}", 'Yes, delete project') }.to change { Project.count }.by(-1)
+      expect { remove_with_confirm('Delete project', project.path, 'Yes, delete project') }.to change { Project.count }.by(-1)
       expect(page).to have_content "Project '#{project.full_name}' is in the process of being deleted."
       expect(Project.all.count).to be_zero
       expect(project.issues).to be_empty
diff --git a/spec/finders/packages/npm/package_finder_spec.rb b/spec/finders/packages/npm/package_finder_spec.rb
index be54b1f8b18..78c23971f92 100644
--- a/spec/finders/packages/npm/package_finder_spec.rb
+++ b/spec/finders/packages/npm/package_finder_spec.rb
@@ -16,6 +16,12 @@ RSpec.describe ::Packages::Npm::PackageFinder do
 
       it { is_expected.to be_empty }
     end
+
+    context 'with nil project' do
+      let(:project) { nil }
+
+      it { is_expected.to be_empty }
+    end
   end
 
   describe '#find_by_version' do
diff --git a/spec/graphql/types/issue_type_spec.rb b/spec/graphql/types/issue_type_spec.rb
index e1afa4e3cc2..9133143cf56 100644
--- a/spec/graphql/types/issue_type_spec.rb
+++ b/spec/graphql/types/issue_type_spec.rb
@@ -17,7 +17,7 @@ RSpec.describe GitlabSchema.types['Issue'] do
     fields = %i[id iid title description state reference author assignees updated_by participants labels milestone due_date
                 confidential discussion_locked upvotes downvotes user_notes_count user_discussions_count web_path web_url relative_position
                 emails_disabled subscribed time_estimate total_time_spent human_time_estimate human_total_time_spent closed_at created_at updated_at task_completion_status
-                designs design_collection alert_management_alert severity current_user_todos]
+                designs design_collection alert_management_alert severity current_user_todos moved moved_to]
 
     fields.each do |field_name|
       expect(described_class).to have_graphql_field(field_name)
diff --git a/spec/lib/bulk_imports/common/loaders/entities_loader_spec.rb b/spec/lib/bulk_imports/common/loaders/entity_loader_spec.rb
similarity index 92%
rename from spec/lib/bulk_imports/common/loaders/entities_loader_spec.rb
rename to spec/lib/bulk_imports/common/loaders/entity_loader_spec.rb
index 9699fc00074..4de7d95172f 100644
--- a/spec/lib/bulk_imports/common/loaders/entities_loader_spec.rb
+++ b/spec/lib/bulk_imports/common/loaders/entity_loader_spec.rb
@@ -2,20 +2,20 @@
 
 require 'spec_helper'
 
-RSpec.describe BulkImports::Common::Loaders::EntitiesLoader do
+RSpec.describe BulkImports::Common::Loaders::EntityLoader do
   describe '#load' do
     it "creates entities for the given data" do
       group = create(:group, path: "imported-group")
       parent_entity = create(:bulk_import_entity, group: group, bulk_import: create(:bulk_import))
       context = instance_double(BulkImports::Pipeline::Context, entity: parent_entity)
 
-      data = [{
+      data = {
         source_type: :group_entity,
         source_full_path: "parent/subgroup",
         destination_name: "subgroup",
         destination_namespace: parent_entity.group.full_path,
         parent_id: parent_entity.id
-      }]
+      }
 
       expect { subject.load(context, data) }.to change(BulkImports::Entity, :count).by(1)
 
diff --git a/spec/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline_spec.rb b/spec/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline_spec.rb
index 98ae8d9c53e..60a4a796682 100644
--- a/spec/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline_spec.rb
+++ b/spec/lib/bulk_imports/groups/pipelines/subgroup_entities_pipeline_spec.rb
@@ -35,7 +35,7 @@ RSpec.describe BulkImports::Groups::Pipelines::SubgroupEntitiesPipeline do
 
     before do
       allow_next_instance_of(BulkImports::Groups::Extractors::SubgroupsExtractor) do |extractor|
-        allow(extractor).to receive(:extract).and_return([subgroup_data])
+        allow(extractor).to receive(:extract).and_return(subgroup_data)
       end
 
       parent.add_owner(user)
@@ -67,14 +67,14 @@ RSpec.describe BulkImports::Groups::Pipelines::SubgroupEntitiesPipeline do
 
     it 'has transformers' do
       expect(described_class.transformers).to contain_exactly(
-        klass: BulkImports::Groups::Transformers::SubgroupsToEntitiesTransformer,
+        klass: BulkImports::Groups::Transformers::SubgroupToEntityTransformer,
         options: nil
       )
     end
 
     it 'has loaders' do
       expect(described_class.loaders).to contain_exactly(
-        klass: BulkImports::Common::Loaders::EntitiesLoader,
+        klass: BulkImports::Common::Loaders::EntityLoader,
         options: nil
       )
     end
diff --git a/spec/lib/bulk_imports/groups/transformers/subgroups_to_entities_transformer_spec.rb b/spec/lib/bulk_imports/groups/transformers/subgroup_to_entity_transformer_spec.rb
similarity index 65%
rename from spec/lib/bulk_imports/groups/transformers/subgroups_to_entities_transformer_spec.rb
rename to spec/lib/bulk_imports/groups/transformers/subgroup_to_entity_transformer_spec.rb
index bcd65e218f6..2f97a5721e7 100644
--- a/spec/lib/bulk_imports/groups/transformers/subgroups_to_entities_transformer_spec.rb
+++ b/spec/lib/bulk_imports/groups/transformers/subgroup_to_entity_transformer_spec.rb
@@ -2,20 +2,18 @@
 
 require 'spec_helper'
 
-RSpec.describe BulkImports::Groups::Transformers::SubgroupsToEntitiesTransformer do
+RSpec.describe BulkImports::Groups::Transformers::SubgroupToEntityTransformer do
   describe "#transform" do
     it "transforms subgroups data in entity params" do
       parent = create(:group)
       parent_entity = instance_double(BulkImports::Entity, group: parent, id: 1)
       context = instance_double(BulkImports::Pipeline::Context, entity: parent_entity)
-      subgroup_data = [
-        {
-          "name" => "subgroup",
-          "full_path" => "parent/subgroup"
-        }
-      ]
+      subgroup_data = {
+        "name" => "subgroup",
+        "full_path" => "parent/subgroup"
+      }
 
-      expect(subject.transform(context, subgroup_data)).to contain_exactly(
+      expect(subject.transform(context, subgroup_data)).to eq(
         source_type: :group_entity,
         source_full_path: "parent/subgroup",
         destination_name: "subgroup",
diff --git a/spec/lib/gitlab/git_access_snippet_spec.rb b/spec/lib/gitlab/git_access_snippet_spec.rb
index 8c481cdee08..f5d8758a78a 100644
--- a/spec/lib/gitlab/git_access_snippet_spec.rb
+++ b/spec/lib/gitlab/git_access_snippet_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe Gitlab::GitAccessSnippet do
   include ProjectHelpers
   include TermsHelper
+  include AdminModeHelper
   include_context 'ProjectPolicyTable context'
   using RSpec::Parameterized::TableSyntax
 
@@ -207,12 +208,13 @@ RSpec.describe Gitlab::GitAccessSnippet do
     let(:snippet) { create(:personal_snippet, snippet_level, :repository) }
     let(:user) { membership == :author ? snippet.author : create_user_from_membership(nil, membership) }
 
-    where(:snippet_level, :membership, :_expected_count) do
+    where(:snippet_level, :membership, :admin_mode, :_expected_count) do
       permission_table_for_personal_snippet_access
     end
 
     with_them do
       it "respects accessibility" do
+        enable_admin_mode!(user) if admin_mode
         error_class = described_class::ForbiddenError
 
         if Ability.allowed?(user, :update_snippet, snippet)
diff --git a/spec/models/merge_request_spec.rb b/spec/models/merge_request_spec.rb
index ddb3ffdda2f..f2b2a7461ec 100644
--- a/spec/models/merge_request_spec.rb
+++ b/spec/models/merge_request_spec.rb
@@ -79,6 +79,18 @@ RSpec.describe MergeRequest, factory_default: :keep do
     end
   end
 
+  describe '.with_jira_issue_keys' do
+    let_it_be(:mr_with_jira_title) { create(:merge_request, :unique_branches, title: 'Fix TEST-123') }
+    let_it_be(:mr_with_jira_description) { create(:merge_request, :unique_branches, description: 'this closes TEST-321') }
+    let_it_be(:mr_without_jira_reference) { create(:merge_request, :unique_branches) }
+
+    subject { described_class.with_jira_issue_keys }
+
+    it { is_expected.to contain_exactly(mr_with_jira_title, mr_with_jira_description) }
+
+    it { is_expected.not_to include(mr_without_jira_reference) }
+  end
+
   describe '#squash_in_progress?' do
     let(:repo_path) do
       Gitlab::GitalyClient::StorageSettings.allow_disk_access do
diff --git a/spec/models/project_spec.rb b/spec/models/project_spec.rb
index 858bbcd7580..46dd93ce5b6 100644
--- a/spec/models/project_spec.rb
+++ b/spec/models/project_spec.rb
@@ -3996,8 +3996,16 @@ RSpec.describe Project, factory_default: :keep do
       context 'when feature is private' do
         let(:project) { create(:project, :public, :merge_requests_private) }
 
-        it 'returns projects with the project feature private' do
-          is_expected.to include(project)
+        context 'when admin mode is enabled', :enable_admin_mode do
+          it 'returns projects with the project feature private' do
+            is_expected.to include(project)
+          end
+        end
+
+        context 'when admin mode is disabled' do
+          it 'does not return projects with the project feature private' do
+            is_expected.not_to include(project)
+          end
         end
       end
     end
@@ -4020,7 +4028,7 @@ RSpec.describe Project, factory_default: :keep do
     end
   end
 
-  describe '.filter_by_feature_visibility', :enable_admin_mode do
+  describe '.filter_by_feature_visibility' do
     include_context 'ProjectPolicyTable context'
     include ProjectHelpers
     using RSpec::Parameterized::TableSyntax
@@ -4032,12 +4040,13 @@ RSpec.describe Project, factory_default: :keep do
     context 'reporter level access' do
       let(:feature) { MergeRequest }
 
-      where(:project_level, :feature_access_level, :membership, :expected_count) do
+      where(:project_level, :feature_access_level, :membership, :admin_mode, :expected_count) do
         permission_table_for_reporter_feature_access
       end
 
       with_them do
         it "respects visibility" do
+          enable_admin_mode!(user) if admin_mode
           update_feature_access_level(project, feature_access_level)
 
           expected_objects = expected_count == 1 ? [project] : []
@@ -4052,12 +4061,13 @@ RSpec.describe Project, factory_default: :keep do
     context 'issues' do
       let(:feature) { Issue }
 
-      where(:project_level, :feature_access_level, :membership, :expected_count) do
+      where(:project_level, :feature_access_level, :membership, :admin_mode, :expected_count) do
         permission_table_for_guest_feature_access
       end
 
       with_them do
         it "respects visibility" do
+          enable_admin_mode!(user) if admin_mode
           update_feature_access_level(project, feature_access_level)
 
           expected_objects = expected_count == 1 ? [project] : []
@@ -4072,12 +4082,13 @@ RSpec.describe Project, factory_default: :keep do
     context 'wiki' do
       let(:feature) { :wiki }
 
-      where(:project_level, :feature_access_level, :membership, :expected_count) do
+      where(:project_level, :feature_access_level, :membership, :admin_mode, :expected_count) do
         permission_table_for_guest_feature_access
       end
 
       with_them do
         it "respects visibility" do
+          enable_admin_mode!(user) if admin_mode
           update_feature_access_level(project, feature_access_level)
 
           expected_objects = expected_count == 1 ? [project] : []
@@ -4092,12 +4103,13 @@ RSpec.describe Project, factory_default: :keep do
     context 'code' do
       let(:feature) { :repository }
 
-      where(:project_level, :feature_access_level, :membership, :expected_count) do
+      where(:project_level, :feature_access_level, :membership, :admin_mode, :expected_count) do
         permission_table_for_guest_feature_access_and_non_private_project_only
       end
 
       with_them do
         it "respects visibility" do
+          enable_admin_mode!(user) if admin_mode
           update_feature_access_level(project, feature_access_level)
 
           expected_objects = expected_count == 1 ? [project] : []
diff --git a/spec/policies/blob_policy_spec.rb b/spec/policies/blob_policy_spec.rb
index fc46b25f25c..daabcd844af 100644
--- a/spec/policies/blob_policy_spec.rb
+++ b/spec/policies/blob_policy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe BlobPolicy, :enable_admin_mode do
+RSpec.describe BlobPolicy do
   include_context 'ProjectPolicyTable context'
   include ProjectHelpers
   using RSpec::Parameterized::TableSyntax
@@ -13,12 +13,13 @@ RSpec.describe BlobPolicy, :enable_admin_mode do
 
   subject(:policy) { described_class.new(user, blob) }
 
-  where(:project_level, :feature_access_level, :membership, :expected_count) do
+  where(:project_level, :feature_access_level, :membership, :admin_mode, :expected_count) do
     permission_table_for_guest_feature_access_and_non_private_project_only
   end
 
   with_them do
     it "grants permission" do
+      enable_admin_mode!(user) if admin_mode
       update_feature_access_level(project, feature_access_level)
 
       if expected_count == 1
diff --git a/spec/policies/wiki_page_policy_spec.rb b/spec/policies/wiki_page_policy_spec.rb
index 093db9f8374..a2fa7f29135 100644
--- a/spec/policies/wiki_page_policy_spec.rb
+++ b/spec/policies/wiki_page_policy_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe WikiPagePolicy, :enable_admin_mode do
+RSpec.describe WikiPagePolicy do
   include_context 'ProjectPolicyTable context'
   include ProjectHelpers
   using RSpec::Parameterized::TableSyntax
@@ -13,12 +13,13 @@ RSpec.describe WikiPagePolicy, :enable_admin_mode do
 
   subject(:policy) { described_class.new(user, wiki_page) }
 
-  where(:project_level, :feature_access_level, :membership, :expected_count) do
+  where(:project_level, :feature_access_level, :membership, :admin_mode, :expected_count) do
     permission_table_for_guest_feature_access
   end
 
   with_them do
     it "grants permission" do
+      enable_admin_mode!(user) if admin_mode
       update_feature_access_level(project, feature_access_level)
 
       if expected_count == 1
diff --git a/spec/requests/api/graphql/issue/issue_spec.rb b/spec/requests/api/graphql/issue/issue_spec.rb
index e68f7937abf..d7fa680d29b 100644
--- a/spec/requests/api/graphql/issue/issue_spec.rb
+++ b/spec/requests/api/graphql/issue/issue_spec.rb
@@ -83,6 +83,25 @@ RSpec.describe 'Query.issue(id)' do
       end
     end
 
+    context 'when issue got moved' do
+      let_it_be(:issue_fields) { ['moved', 'movedTo { title }'] }
+      let_it_be(:new_issue) { create(:issue) }
+      let_it_be(:issue) { create(:issue, project: project, moved_to: new_issue) }
+      let_it_be(:issue_params) { { 'id' => issue.to_global_id.to_s } }
+
+      before_all do
+        new_issue.project.add_developer(current_user)
+      end
+
+      it 'returns correct attributes' do
+        post_graphql(query, current_user: current_user)
+
+        expect(issue_data.keys).to eq( %w(moved movedTo) )
+        expect(issue_data['moved']).to eq(true)
+        expect(issue_data['movedTo']['title']).to eq(new_issue.title)
+      end
+    end
+
     context 'when passed a non-Issue gid' do
       let(:mr) {create(:merge_request)}
 
diff --git a/spec/requests/api/npm_instance_packages_spec.rb b/spec/requests/api/npm_instance_packages_spec.rb
new file mode 100644
index 00000000000..8299717b5c7
--- /dev/null
+++ b/spec/requests/api/npm_instance_packages_spec.rb
@@ -0,0 +1,31 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::NpmInstancePackages do
+  include_context 'npm api setup'
+
+  describe 'GET /api/v4/packages/npm/*package_name' do
+    it_behaves_like 'handling get metadata requests' do
+      let(:url) { api("/packages/npm/#{package_name}") }
+    end
+  end
+
+  describe 'GET /api/v4/packages/npm/-/package/*package_name/dist-tags' do
+    it_behaves_like 'handling get dist tags requests', scope: :instance do
+      let(:url) { api("/packages/npm/-/package/#{package_name}/dist-tags") }
+    end
+  end
+
+  describe 'PUT /api/v4/packages/npm/-/package/*package_name/dist-tags/:tag' do
+    it_behaves_like 'handling create dist tag requests', scope: :instance do
+      let(:url) { api("/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}") }
+    end
+  end
+
+  describe 'DELETE /api/v4/packages/npm/-/package/*package_name/dist-tags/:tag' do
+    it_behaves_like 'handling delete dist tag requests', scope: :instance do
+      let(:url) { api("/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}") }
+    end
+  end
+end
diff --git a/spec/requests/api/npm_packages_spec.rb b/spec/requests/api/npm_packages_spec.rb
deleted file mode 100644
index 8a3ccd7c6e3..00000000000
--- a/spec/requests/api/npm_packages_spec.rb
+++ /dev/null
@@ -1,556 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe API::NpmPackages do
-  include PackagesManagerApiSpecHelpers
-  include HttpBasicAuthHelpers
-
-  let_it_be(:user) { create(:user) }
-  let_it_be(:group) { create(:group) }
-  let_it_be(:project, reload: true) { create(:project, :public, namespace: group) }
-  let_it_be(:package, reload: true) { create(:npm_package, project: project) }
-  let_it_be(:token) { create(:oauth_access_token, scopes: 'api', resource_owner: user) }
-  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
-  let_it_be(:job, reload: true) { create(:ci_build, user: user, status: :running) }
-  let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
-  let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
-
-  before do
-    project.add_developer(user)
-  end
-
-  shared_examples 'a package that requires auth' do
-    it 'returns the package info with oauth token' do
-      get_package_with_token(package)
-
-      expect_a_valid_package_response
-    end
-
-    it 'returns the package info with running job token' do
-      get_package_with_job_token(package)
-
-      expect_a_valid_package_response
-    end
-
-    it 'denies request without running job token' do
-      job.update!(status: :success)
-      get_package_with_job_token(package)
-
-      expect(response).to have_gitlab_http_status(:unauthorized)
-    end
-
-    it 'denies request without oauth token' do
-      get_package(package)
-
-      expect(response).to have_gitlab_http_status(:forbidden)
-    end
-
-    it 'returns the package info with deploy token' do
-      get_package_with_deploy_token(package)
-
-      expect_a_valid_package_response
-    end
-  end
-
-  describe 'GET /api/v4/packages/npm/*package_name' do
-    let_it_be(:package_dependency_link1) { create(:packages_dependency_link, package: package, dependency_type: :dependencies) }
-    let_it_be(:package_dependency_link2) { create(:packages_dependency_link, package: package, dependency_type: :devDependencies) }
-    let_it_be(:package_dependency_link3) { create(:packages_dependency_link, package: package, dependency_type: :bundleDependencies) }
-    let_it_be(:package_dependency_link4) { create(:packages_dependency_link, package: package, dependency_type: :peerDependencies) }
-
-    shared_examples 'returning the npm package info' do
-      it 'returns the package info' do
-        get_package(package)
-
-        expect_a_valid_package_response
-      end
-    end
-
-    shared_examples 'returning forbidden for unknown package' do
-      context 'with an unknown package' do
-        it 'returns forbidden' do
-          get api("/packages/npm/unknown")
-
-          expect(response).to have_gitlab_http_status(:forbidden)
-        end
-      end
-    end
-
-    context 'a public project' do
-      it_behaves_like 'returning the npm package info'
-
-      context 'with application setting enabled' do
-        before do
-          stub_application_setting(npm_package_requests_forwarding: true)
-        end
-
-        it_behaves_like 'returning the npm package info'
-
-        context 'with unknown package' do
-          subject { get api("/packages/npm/unknown") }
-
-          it 'returns a redirect' do
-            subject
-
-            expect(response).to have_gitlab_http_status(:found)
-            expect(response.headers['Location']).to eq('https://registry.npmjs.org/unknown')
-          end
-
-          it_behaves_like 'a gitlab tracking event', described_class.name, 'npm_request_forward'
-        end
-      end
-
-      context 'with application setting disabled' do
-        before do
-          stub_application_setting(npm_package_requests_forwarding: false)
-        end
-
-        it_behaves_like 'returning the npm package info'
-
-        it_behaves_like 'returning forbidden for unknown package'
-      end
-
-      context 'project path with a dot' do
-        before do
-          project.update!(path: 'foo.bar')
-        end
-
-        it_behaves_like 'returning the npm package info'
-      end
-    end
-
-    context 'internal project' do
-      before do
-        project.team.truncate
-        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
-      end
-
-      it_behaves_like 'a package that requires auth'
-    end
-
-    context 'private project' do
-      before do
-        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
-      end
-
-      it_behaves_like 'a package that requires auth'
-
-      it 'denies request when not enough permissions' do
-        project.add_guest(user)
-
-        get_package_with_token(package)
-
-        expect(response).to have_gitlab_http_status(:forbidden)
-      end
-    end
-
-    def get_package(package, params = {}, headers = {})
-      get api("/packages/npm/#{package.name}"), params: params, headers: headers
-    end
-
-    def get_package_with_token(package, params = {})
-      get_package(package, params.merge(access_token: token.token))
-    end
-
-    def get_package_with_job_token(package, params = {})
-      get_package(package, params.merge(job_token: job.token))
-    end
-
-    def get_package_with_deploy_token(package, params = {})
-      get_package(package, {}, build_token_auth_header(deploy_token.token))
-    end
-  end
-
-  describe 'GET /api/v4/projects/:id/packages/npm/*package_name/-/*file_name' do
-    let_it_be(:package_file) { package.package_files.first }
-
-    shared_examples 'a package file that requires auth' do
-      it 'returns the file with an access token' do
-        get_file_with_token(package_file)
-
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(response.media_type).to eq('application/octet-stream')
-      end
-
-      it 'returns the file with a job token' do
-        get_file_with_job_token(package_file)
-
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(response.media_type).to eq('application/octet-stream')
-      end
-
-      it 'denies download with no token' do
-        get_file(package_file)
-
-        expect(response).to have_gitlab_http_status(:not_found)
-      end
-    end
-
-    context 'a public project' do
-      subject { get_file(package_file) }
-
-      it 'returns the file with no token needed' do
-        subject
-
-        expect(response).to have_gitlab_http_status(:ok)
-        expect(response.media_type).to eq('application/octet-stream')
-      end
-
-      it_behaves_like 'a package tracking event', described_class.name, 'pull_package'
-    end
-
-    context 'private project' do
-      before do
-        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
-      end
-
-      it_behaves_like 'a package file that requires auth'
-
-      it 'denies download when not enough permissions' do
-        project.add_guest(user)
-
-        get_file_with_token(package_file)
-
-        expect(response).to have_gitlab_http_status(:forbidden)
-      end
-    end
-
-    context 'internal project' do
-      before do
-        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
-      end
-
-      it_behaves_like 'a package file that requires auth'
-    end
-
-    def get_file(package_file, params = {})
-      get api("/projects/#{project.id}/packages/npm/" \
-              "#{package_file.package.name}/-/#{package_file.file_name}"), params: params
-    end
-
-    def get_file_with_token(package_file, params = {})
-      get_file(package_file, params.merge(access_token: token.token))
-    end
-
-    def get_file_with_job_token(package_file, params = {})
-      get_file(package_file, params.merge(job_token: job.token))
-    end
-  end
-
-  describe 'PUT /api/v4/projects/:id/packages/npm/:package_name' do
-    RSpec.shared_examples 'handling invalid record with 400 error' do
-      it 'handles an ActiveRecord::RecordInvalid exception with 400 error' do
-        expect { upload_package_with_token(package_name, params) }
-          .not_to change { project.packages.count }
-
-        expect(response).to have_gitlab_http_status(:bad_request)
-      end
-    end
-
-    context 'when params are correct' do
-      context 'invalid package record' do
-        context 'unscoped package' do
-          let(:package_name) { 'my_unscoped_package' }
-          let(:params) { upload_params(package_name: package_name) }
-
-          it_behaves_like 'handling invalid record with 400 error'
-
-          context 'with empty versions' do
-            let(:params) { upload_params(package_name: package_name).merge!(versions: {}) }
-
-            it 'throws a 400 error' do
-              expect { upload_package_with_token(package_name, params) }
-              .not_to change { project.packages.count }
-
-              expect(response).to have_gitlab_http_status(:bad_request)
-            end
-          end
-        end
-
-        context 'invalid package name' do
-          let(:package_name) { "@#{group.path}/my_inv@@lid_package_name" }
-          let(:params) { upload_params(package_name: package_name) }
-
-          it_behaves_like 'handling invalid record with 400 error'
-        end
-
-        context 'invalid package version' do
-          using RSpec::Parameterized::TableSyntax
-
-          let(:package_name) { "@#{group.path}/my_package_name" }
-
-          where(:version) do
-            [
-              '1',
-              '1.2',
-              '1./2.3',
-              '../../../../../1.2.3',
-              '%2e%2e%2f1.2.3'
-            ]
-          end
-
-          with_them do
-            let(:params) { upload_params(package_name: package_name, package_version: version) }
-
-            it_behaves_like 'handling invalid record with 400 error'
-          end
-        end
-      end
-
-      context 'scoped package' do
-        let(:package_name) { "@#{group.path}/my_package_name" }
-        let(:params) { upload_params(package_name: package_name) }
-
-        context 'with access token' do
-          subject { upload_package_with_token(package_name, params) }
-
-          it_behaves_like 'a package tracking event', described_class.name, 'push_package'
-
-          it 'creates npm package with file' do
-            expect { subject }
-              .to change { project.packages.count }.by(1)
-              .and change { Packages::PackageFile.count }.by(1)
-              .and change { Packages::Tag.count }.by(1)
-
-            expect(response).to have_gitlab_http_status(:ok)
-          end
-        end
-
-        it 'creates npm package with file with job token' do
-          expect { upload_package_with_job_token(package_name, params) }
-            .to change { project.packages.count }.by(1)
-            .and change { Packages::PackageFile.count }.by(1)
-
-          expect(response).to have_gitlab_http_status(:ok)
-        end
-
-        context 'with an authenticated job token' do
-          let!(:job) { create(:ci_build, user: user) }
-
-          before do
-            Grape::Endpoint.before_each do |endpoint|
-              expect(endpoint).to receive(:current_authenticated_job) { job }
-            end
-          end
-
-          after do
-            Grape::Endpoint.before_each nil
-          end
-
-          it 'creates the package metadata' do
-            upload_package_with_token(package_name, params)
-
-            expect(response).to have_gitlab_http_status(:ok)
-            expect(project.reload.packages.find(json_response['id']).build_info.pipeline).to eq job.pipeline
-          end
-        end
-      end
-
-      context 'package creation fails' do
-        let(:package_name) { "@#{group.path}/my_package_name" }
-        let(:params) { upload_params(package_name: package_name) }
-
-        it 'returns an error if the package already exists' do
-          create(:npm_package, project: project, version: '1.0.1', name: "@#{group.path}/my_package_name")
-          expect { upload_package_with_token(package_name, params) }
-            .not_to change { project.packages.count }
-
-          expect(response).to have_gitlab_http_status(:forbidden)
-        end
-      end
-
-      context 'with dependencies' do
-        let(:package_name) { "@#{group.path}/my_package_name" }
-        let(:params) { upload_params(package_name: package_name, file: 'npm/payload_with_duplicated_packages.json') }
-
-        it 'creates npm package with file and dependencies' do
-          expect { upload_package_with_token(package_name, params) }
-            .to change { project.packages.count }.by(1)
-            .and change { Packages::PackageFile.count }.by(1)
-            .and change { Packages::Dependency.count}.by(4)
-            .and change { Packages::DependencyLink.count}.by(6)
-
-          expect(response).to have_gitlab_http_status(:ok)
-        end
-
-        context 'with existing dependencies' do
-          before do
-            name = "@#{group.path}/existing_package"
-            upload_package_with_token(name, upload_params(package_name: name, file: 'npm/payload_with_duplicated_packages.json'))
-          end
-
-          it 'reuses them' do
-            expect { upload_package_with_token(package_name, params) }
-              .to change { project.packages.count }.by(1)
-              .and change { Packages::PackageFile.count }.by(1)
-              .and not_change { Packages::Dependency.count}
-              .and change { Packages::DependencyLink.count}.by(6)
-          end
-        end
-      end
-    end
-
-    def upload_package(package_name, params = {})
-      put api("/projects/#{project.id}/packages/npm/#{package_name.sub('/', '%2f')}"), params: params
-    end
-
-    def upload_package_with_token(package_name, params = {})
-      upload_package(package_name, params.merge(access_token: token.token))
-    end
-
-    def upload_package_with_job_token(package_name, params = {})
-      upload_package(package_name, params.merge(job_token: job.token))
-    end
-
-    def upload_params(package_name:, package_version: '1.0.1', file: 'npm/payload.json')
-      Gitlab::Json.parse(fixture_file("packages/#{file}")
-          .gsub('@root/npm-test', package_name)
-          .gsub('1.0.1', package_version))
-    end
-  end
-
-  describe 'GET /api/v4/packages/npm/-/package/*package_name/dist-tags' do
-    let_it_be(:package_tag1) { create(:packages_tag, package: package) }
-    let_it_be(:package_tag2) { create(:packages_tag, package: package) }
-
-    let(:package_name) { package.name }
-    let(:url) { "/packages/npm/-/package/#{package_name}/dist-tags" }
-
-    subject { get api(url) }
-
-    context 'with public project' do
-      context 'with authenticated user' do
-        subject { get api(url, personal_access_token: personal_access_token) }
-
-        it_behaves_like 'returns package tags', :maintainer
-        it_behaves_like 'returns package tags', :developer
-        it_behaves_like 'returns package tags', :reporter
-        it_behaves_like 'returns package tags', :guest
-      end
-
-      context 'with unauthenticated user' do
-        it_behaves_like 'returns package tags', :no_type
-      end
-    end
-
-    context 'with private project' do
-      before do
-        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
-      end
-
-      context 'with authenticated user' do
-        subject { get api(url, personal_access_token: personal_access_token) }
-
-        it_behaves_like 'returns package tags', :maintainer
-        it_behaves_like 'returns package tags', :developer
-        it_behaves_like 'returns package tags', :reporter
-        it_behaves_like 'rejects package tags access', :guest, :forbidden
-      end
-
-      context 'with unauthenticated user' do
-        it_behaves_like 'rejects package tags access', :no_type, :forbidden
-      end
-    end
-  end
-
-  describe 'PUT /api/v4/packages/npm/-/package/*package_name/dist-tags/:tag' do
-    let_it_be(:tag_name) { 'test' }
-
-    let(:package_name) { package.name }
-    let(:version) { package.version }
-    let(:url) { "/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}" }
-
-    subject { put api(url), env: { 'api.request.body': version } }
-
-    context 'with public project' do
-      context 'with authenticated user' do
-        subject { put api(url, personal_access_token: personal_access_token), env: { 'api.request.body': version } }
-
-        it_behaves_like 'create package tag', :maintainer
-        it_behaves_like 'create package tag', :developer
-        it_behaves_like 'rejects package tags access', :reporter, :forbidden
-        it_behaves_like 'rejects package tags access', :guest, :forbidden
-      end
-
-      context 'with unauthenticated user' do
-        it_behaves_like 'rejects package tags access', :no_type, :unauthorized
-      end
-    end
-
-    context 'with private project' do
-      before do
-        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
-      end
-
-      context 'with authenticated user' do
-        subject { put api(url, personal_access_token: personal_access_token), env: { 'api.request.body': version } }
-
-        it_behaves_like 'create package tag', :maintainer
-        it_behaves_like 'create package tag', :developer
-        it_behaves_like 'rejects package tags access', :reporter, :forbidden
-        it_behaves_like 'rejects package tags access', :guest, :forbidden
-      end
-
-      context 'with unauthenticated user' do
-        it_behaves_like 'rejects package tags access', :no_type, :unauthorized
-      end
-    end
-  end
-
-  describe 'DELETE /api/v4/packages/npm/-/package/*package_name/dist-tags/:tag' do
-    let_it_be(:package_tag) { create(:packages_tag, package: package) }
-
-    let(:package_name) { package.name }
-    let(:tag_name) { package_tag.name }
-    let(:url) { "/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}" }
-
-    subject { delete api(url) }
-
-    context 'with public project' do
-      context 'with authenticated user' do
-        subject { delete api(url, personal_access_token: personal_access_token) }
-
-        it_behaves_like 'delete package tag', :maintainer
-        it_behaves_like 'rejects package tags access', :developer, :forbidden
-        it_behaves_like 'rejects package tags access', :reporter, :forbidden
-        it_behaves_like 'rejects package tags access', :guest, :forbidden
-      end
-
-      context 'with unauthenticated user' do
-        it_behaves_like 'rejects package tags access', :no_type, :unauthorized
-      end
-    end
-
-    context 'with private project' do
-      before do
-        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
-      end
-
-      context 'with authenticated user' do
-        subject { delete api(url, personal_access_token: personal_access_token) }
-
-        it_behaves_like 'delete package tag', :maintainer
-        it_behaves_like 'rejects package tags access', :developer, :forbidden
-        it_behaves_like 'rejects package tags access', :reporter, :forbidden
-        it_behaves_like 'rejects package tags access', :guest, :forbidden
-      end
-
-      context 'with unauthenticated user' do
-        it_behaves_like 'rejects package tags access', :no_type, :unauthorized
-      end
-    end
-  end
-
-  def expect_a_valid_package_response
-    expect(response).to have_gitlab_http_status(:ok)
-    expect(response.media_type).to eq('application/json')
-    expect(response).to match_response_schema('public_api/v4/packages/npm_package')
-    expect(json_response['name']).to eq(package.name)
-    expect(json_response['versions'][package.version]).to match_schema('public_api/v4/packages/npm_package_version')
-    ::Packages::Npm::PackagePresenter::NPM_VALID_DEPENDENCY_TYPES.each do |dependency_type|
-      expect(json_response.dig('versions', package.version, dependency_type.to_s)).to be_any
-    end
-    expect(json_response['dist-tags']).to match_schema('public_api/v4/packages/npm_package_tags')
-  end
-end
diff --git a/spec/requests/api/npm_project_packages_spec.rb b/spec/requests/api/npm_project_packages_spec.rb
new file mode 100644
index 00000000000..8b3decc5971
--- /dev/null
+++ b/spec/requests/api/npm_project_packages_spec.rb
@@ -0,0 +1,281 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe API::NpmProjectPackages do
+  include_context 'npm api setup'
+
+  describe 'GET /api/v4/projects/:id/packages/npm/*package_name' do
+    it_behaves_like 'handling get metadata requests' do
+      let(:url) { api("/projects/#{project.id}/packages/npm/#{package_name}") }
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/npm/-/package/*package_name/dist-tags' do
+    it_behaves_like 'handling get dist tags requests' do
+      let(:url) { api("/projects/#{project.id}/packages/npm/-/package/#{package_name}/dist-tags") }
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/npm/-/package/*package_name/dist-tags/:tag' do
+    it_behaves_like 'handling create dist tag requests' do
+      let(:url) { api("/projects/#{project.id}/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}") }
+    end
+  end
+
+  describe 'DELETE /api/v4/projects/:id/packages/npm/-/package/*package_name/dist-tags/:tag' do
+    it_behaves_like 'handling delete dist tag requests' do
+      let(:url) { api("/projects/#{project.id}/packages/npm/-/package/#{package_name}/dist-tags/#{tag_name}") }
+    end
+  end
+
+  describe 'GET /api/v4/projects/:id/packages/npm/*package_name/-/*file_name' do
+    let_it_be(:package_file) { package.package_files.first }
+
+    let(:params) { {} }
+    let(:url) { api("/projects/#{project.id}/packages/npm/#{package_file.package.name}/-/#{package_file.file_name}") }
+
+    subject { get(url, params: params) }
+
+    shared_examples 'a package file that requires auth' do
+      it 'denies download with no token' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:not_found)
+      end
+
+      context 'with access token' do
+        let(:params) { { access_token: token.token } }
+
+        it 'returns the file' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response.media_type).to eq('application/octet-stream')
+        end
+      end
+
+      context 'with job token' do
+        let(:params) { { job_token: job.token } }
+
+        it 'returns the file' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response.media_type).to eq('application/octet-stream')
+        end
+      end
+    end
+
+    context 'a public project' do
+      it 'returns the file with no token needed' do
+        subject
+
+        expect(response).to have_gitlab_http_status(:ok)
+        expect(response.media_type).to eq('application/octet-stream')
+      end
+
+      it_behaves_like 'a package tracking event', 'API::NpmPackages', 'pull_package'
+    end
+
+    context 'private project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+      end
+
+      it_behaves_like 'a package file that requires auth'
+
+      context 'with guest' do
+        let(:params) { { access_token: token.token } }
+
+        it 'denies download when not enough permissions' do
+          project.add_guest(user)
+
+          subject
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+    end
+
+    context 'internal project' do
+      before do
+        project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+      end
+
+      it_behaves_like 'a package file that requires auth'
+    end
+  end
+
+  describe 'PUT /api/v4/projects/:id/packages/npm/:package_name' do
+    RSpec.shared_examples 'handling invalid record with 400 error' do
+      it 'handles an ActiveRecord::RecordInvalid exception with 400 error' do
+        expect { upload_package_with_token(package_name, params) }
+          .not_to change { project.packages.count }
+
+        expect(response).to have_gitlab_http_status(:bad_request)
+      end
+    end
+
+    context 'when params are correct' do
+      context 'invalid package record' do
+        context 'unscoped package' do
+          let(:package_name) { 'my_unscoped_package' }
+          let(:params) { upload_params(package_name: package_name) }
+
+          it_behaves_like 'handling invalid record with 400 error'
+
+          context 'with empty versions' do
+            let(:params) { upload_params(package_name: package_name).merge!(versions: {}) }
+
+            it 'throws a 400 error' do
+              expect { upload_package_with_token(package_name, params) }
+              .not_to change { project.packages.count }
+
+              expect(response).to have_gitlab_http_status(:bad_request)
+            end
+          end
+        end
+
+        context 'invalid package name' do
+          let(:package_name) { "@#{group.path}/my_inv@@lid_package_name" }
+          let(:params) { upload_params(package_name: package_name) }
+
+          it_behaves_like 'handling invalid record with 400 error'
+        end
+
+        context 'invalid package version' do
+          using RSpec::Parameterized::TableSyntax
+
+          let(:package_name) { "@#{group.path}/my_package_name" }
+
+          where(:version) do
+            [
+              '1',
+              '1.2',
+              '1./2.3',
+              '../../../../../1.2.3',
+              '%2e%2e%2f1.2.3'
+            ]
+          end
+
+          with_them do
+            let(:params) { upload_params(package_name: package_name, package_version: version) }
+
+            it_behaves_like 'handling invalid record with 400 error'
+          end
+        end
+      end
+
+      context 'scoped package' do
+        let(:package_name) { "@#{group.path}/my_package_name" }
+        let(:params) { upload_params(package_name: package_name) }
+
+        context 'with access token' do
+          subject { upload_package_with_token(package_name, params) }
+
+          it_behaves_like 'a package tracking event', 'API::NpmPackages', 'push_package'
+
+          it 'creates npm package with file' do
+            expect { subject }
+              .to change { project.packages.count }.by(1)
+              .and change { Packages::PackageFile.count }.by(1)
+              .and change { Packages::Tag.count }.by(1)
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
+
+        it 'creates npm package with file with job token' do
+          expect { upload_package_with_job_token(package_name, params) }
+            .to change { project.packages.count }.by(1)
+            .and change { Packages::PackageFile.count }.by(1)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        context 'with an authenticated job token' do
+          let!(:job) { create(:ci_build, user: user) }
+
+          before do
+            Grape::Endpoint.before_each do |endpoint|
+              expect(endpoint).to receive(:current_authenticated_job) { job }
+            end
+          end
+
+          after do
+            Grape::Endpoint.before_each nil
+          end
+
+          it 'creates the package metadata' do
+            upload_package_with_token(package_name, params)
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(project.reload.packages.find(json_response['id']).build_info.pipeline).to eq job.pipeline
+          end
+        end
+      end
+
+      context 'package creation fails' do
+        let(:package_name) { "@#{group.path}/my_package_name" }
+        let(:params) { upload_params(package_name: package_name) }
+
+        it 'returns an error if the package already exists' do
+          create(:npm_package, project: project, version: '1.0.1', name: "@#{group.path}/my_package_name")
+          expect { upload_package_with_token(package_name, params) }
+            .not_to change { project.packages.count }
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
+      context 'with dependencies' do
+        let(:package_name) { "@#{group.path}/my_package_name" }
+        let(:params) { upload_params(package_name: package_name, file: 'npm/payload_with_duplicated_packages.json') }
+
+        it 'creates npm package with file and dependencies' do
+          expect { upload_package_with_token(package_name, params) }
+            .to change { project.packages.count }.by(1)
+            .and change { Packages::PackageFile.count }.by(1)
+            .and change { Packages::Dependency.count}.by(4)
+            .and change { Packages::DependencyLink.count}.by(6)
+
+          expect(response).to have_gitlab_http_status(:ok)
+        end
+
+        context 'with existing dependencies' do
+          before do
+            name = "@#{group.path}/existing_package"
+            upload_package_with_token(name, upload_params(package_name: name, file: 'npm/payload_with_duplicated_packages.json'))
+          end
+
+          it 'reuses them' do
+            expect { upload_package_with_token(package_name, params) }
+              .to change { project.packages.count }.by(1)
+              .and change { Packages::PackageFile.count }.by(1)
+              .and not_change { Packages::Dependency.count}
+              .and change { Packages::DependencyLink.count}.by(6)
+          end
+        end
+      end
+    end
+
+    def upload_package(package_name, params = {})
+      put api("/projects/#{project.id}/packages/npm/#{package_name.sub('/', '%2f')}"), params: params
+    end
+
+    def upload_package_with_token(package_name, params = {})
+      upload_package(package_name, params.merge(access_token: token.token))
+    end
+
+    def upload_package_with_job_token(package_name, params = {})
+      upload_package(package_name, params.merge(job_token: job.token))
+    end
+
+    def upload_params(package_name:, package_version: '1.0.1', file: 'npm/payload.json')
+      Gitlab::Json.parse(fixture_file("packages/#{file}")
+          .gsub('@root/npm-test', package_name)
+          .gsub('1.0.1', package_version))
+    end
+  end
+end
diff --git a/spec/serializers/move_to_project_entity_spec.rb b/spec/serializers/move_to_project_entity_spec.rb
index a14bc3ae622..fad49ceb067 100644
--- a/spec/serializers/move_to_project_entity_spec.rb
+++ b/spec/serializers/move_to_project_entity_spec.rb
@@ -12,8 +12,12 @@ RSpec.describe MoveToProjectEntity do
       expect(subject[:id]).to eq(project.id)
     end
 
-    it 'includes the full path' do
+    it 'includes the human-readable full path' do
       expect(subject[:name_with_namespace]).to eq(project.name_with_namespace)
     end
+
+    it 'includes the full path' do
+      expect(subject[:full_path]).to eq(project.full_path)
+    end
   end
 end
diff --git a/spec/services/auth/container_registry_authentication_service_spec.rb b/spec/services/auth/container_registry_authentication_service_spec.rb
index 41c96c0989b..90ef32f1c5c 100644
--- a/spec/services/auth/container_registry_authentication_service_spec.rb
+++ b/spec/services/auth/container_registry_authentication_service_spec.rb
@@ -3,6 +3,8 @@
 require 'spec_helper'
 
 RSpec.describe Auth::ContainerRegistryAuthenticationService do
+  include AdminModeHelper
+
   let(:current_project) { nil }
   let(:current_user) { nil }
   let(:current_params) { {} }
@@ -696,6 +698,10 @@ RSpec.describe Auth::ContainerRegistryAuthenticationService do
     context 'user has access to all projects' do
       let_it_be(:current_user) { create(:user, :admin) }
 
+      before do
+        enable_admin_mode!(current_user)
+      end
+
       it_behaves_like 'a browsable' do
         let(:access) do
           [
diff --git a/spec/services/ci/create_pipeline_service/cache_spec.rb b/spec/services/ci/create_pipeline_service/cache_spec.rb
index 1438c2e4aa0..5f74c2f1cef 100644
--- a/spec/services/ci/create_pipeline_service/cache_spec.rb
+++ b/spec/services/ci/create_pipeline_service/cache_spec.rb
@@ -4,13 +4,13 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   context 'cache' do
-    let(:user)     { create(:admin) }
+    let(:project)  { create(:project, :custom_repo, files: files) }
+    let(:user)     { project.owner }
     let(:ref)      { 'refs/heads/master' }
     let(:source)   { :push }
     let(:service)  { described_class.new(project, user, { ref: ref }) }
     let(:pipeline) { service.execute(source) }
     let(:job)      { pipeline.builds.find_by(name: 'job') }
-    let(:project)  { create(:project, :custom_repo, files: files) }
 
     before do
       stub_ci_pipeline_yaml_file(config)
diff --git a/spec/services/ci/create_pipeline_service/creation_errors_and_warnings_spec.rb b/spec/services/ci/create_pipeline_service/creation_errors_and_warnings_spec.rb
index b5b3832ac00..9ccf289df7c 100644
--- a/spec/services/ci/create_pipeline_service/creation_errors_and_warnings_spec.rb
+++ b/spec/services/ci/create_pipeline_service/creation_errors_and_warnings_spec.rb
@@ -4,8 +4,8 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   describe 'creation errors and warnings' do
-    let_it_be(:user)    { create(:admin) }
-    let_it_be(:project) { create(:project, :repository, creator: user) }
+    let_it_be(:project) { create(:project, :repository) }
+    let_it_be(:user)    { project.owner }
 
     let(:ref)      { 'refs/heads/master' }
     let(:source)   { :push }
diff --git a/spec/services/ci/create_pipeline_service/custom_config_content_spec.rb b/spec/services/ci/create_pipeline_service/custom_config_content_spec.rb
index 122870e0f3a..6320a16d646 100644
--- a/spec/services/ci/create_pipeline_service/custom_config_content_spec.rb
+++ b/spec/services/ci/create_pipeline_service/custom_config_content_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:user) { create(:admin) }
+  let_it_be(:user) { project.owner }
   let(:ref) { 'refs/heads/master' }
   let(:service) { described_class.new(project, user, { ref: ref }) }
 
diff --git a/spec/services/ci/create_pipeline_service/dry_run_spec.rb b/spec/services/ci/create_pipeline_service/dry_run_spec.rb
index 93378df80f0..60c56ed0f67 100644
--- a/spec/services/ci/create_pipeline_service/dry_run_spec.rb
+++ b/spec/services/ci/create_pipeline_service/dry_run_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:user) { create(:admin) }
+  let_it_be(:user) { project.owner }
   let(:ref) { 'refs/heads/master' }
   let(:service) { described_class.new(project, user, { ref: ref }) }
 
diff --git a/spec/services/ci/create_pipeline_service/needs_spec.rb b/spec/services/ci/create_pipeline_service/needs_spec.rb
index 915dc46d664..512091035a2 100644
--- a/spec/services/ci/create_pipeline_service/needs_spec.rb
+++ b/spec/services/ci/create_pipeline_service/needs_spec.rb
@@ -4,8 +4,8 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   context 'needs' do
-    let_it_be(:user)    { create(:admin) }
-    let_it_be(:project) { create(:project, :repository, creator: user) }
+    let_it_be(:project) { create(:project, :repository) }
+    let_it_be(:user)    { project.owner }
 
     let(:ref)      { 'refs/heads/master' }
     let(:source)   { :push }
@@ -14,6 +14,7 @@ RSpec.describe Ci::CreatePipelineService do
 
     before do
       stub_ci_pipeline_yaml_file(config)
+      project.add_developer(user)
     end
 
     context 'with a valid config' do
diff --git a/spec/services/ci/create_pipeline_service/parameter_content_spec.rb b/spec/services/ci/create_pipeline_service/parameter_content_spec.rb
index f656ad52ac8..90b8baa23a7 100644
--- a/spec/services/ci/create_pipeline_service/parameter_content_spec.rb
+++ b/spec/services/ci/create_pipeline_service/parameter_content_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:user) { create(:admin) }
+  let_it_be(:user) { project.owner }
   let(:service) { described_class.new(project, user, { ref: 'refs/heads/master' }) }
   let(:content) do
     <<~EOY
diff --git a/spec/services/ci/create_pipeline_service/pre_post_stages_spec.rb b/spec/services/ci/create_pipeline_service/pre_post_stages_spec.rb
index 00a2dd74968..c84d9a53973 100644
--- a/spec/services/ci/create_pipeline_service/pre_post_stages_spec.rb
+++ b/spec/services/ci/create_pipeline_service/pre_post_stages_spec.rb
@@ -3,8 +3,8 @@ require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
   describe '.pre/.post stages' do
-    let_it_be(:user)    { create(:admin) }
-    let_it_be(:project) { create(:project, :repository, creator: user) }
+    let_it_be(:project) { create(:project, :repository) }
+    let_it_be(:user)    { project.owner }
 
     let(:source)   { :push }
     let(:service)  { described_class.new(project, user, { ref: ref }) }
diff --git a/spec/services/ci/create_pipeline_service/rules_spec.rb b/spec/services/ci/create_pipeline_service/rules_spec.rb
index 1a1fa6e8f5d..a0ff2fff0ef 100644
--- a/spec/services/ci/create_pipeline_service/rules_spec.rb
+++ b/spec/services/ci/create_pipeline_service/rules_spec.rb
@@ -2,10 +2,10 @@
 require 'spec_helper'
 
 RSpec.describe Ci::CreatePipelineService do
-  let(:user)        { create(:admin) }
+  let(:project)     { create(:project, :repository) }
+  let(:user)        { project.owner }
   let(:ref)         { 'refs/heads/master' }
   let(:source)      { :push }
-  let(:project)     { create(:project, :repository) }
   let(:service)     { described_class.new(project, user, { ref: ref }) }
   let(:pipeline)    { service.execute(source) }
   let(:build_names) { pipeline.builds.pluck(:name) }
diff --git a/spec/services/ci/create_pipeline_service_spec.rb b/spec/services/ci/create_pipeline_service_spec.rb
index 7a9d88781a3..223b8d325cc 100644
--- a/spec/services/ci/create_pipeline_service_spec.rb
+++ b/spec/services/ci/create_pipeline_service_spec.rb
@@ -6,7 +6,7 @@ RSpec.describe Ci::CreatePipelineService do
   include ProjectForksHelper
 
   let_it_be(:project, reload: true) { create(:project, :repository) }
-  let(:user) { create(:admin) }
+  let_it_be(:user, reload: true) { project.owner }
   let(:ref_name) { 'refs/heads/master' }
 
   before do
@@ -155,6 +155,11 @@ RSpec.describe Ci::CreatePipelineService do
         context 'when merge request target project is different from source project' do
           let!(:project) { fork_project(target_project, nil, repository: true) }
           let!(:target_project) { create(:project, :repository) }
+          let!(:user) { create(:user) }
+
+          before do
+            project.add_developer(user)
+          end
 
           it 'updates head pipeline for merge request', :sidekiq_might_not_need_inline do
             merge_request = create(:merge_request, source_branch: 'feature',
@@ -1442,6 +1447,11 @@ RSpec.describe Ci::CreatePipelineService do
               let(:ref_name) { 'refs/heads/feature' }
               let!(:project) { fork_project(target_project, nil, repository: true) }
               let!(:target_project) { create(:project, :repository) }
+              let!(:user) { create(:user) }
+
+              before do
+                project.add_developer(user)
+              end
 
               it 'creates a legacy detached merge request pipeline in the forked project', :sidekiq_might_not_need_inline do
                 expect(pipeline).to be_persisted
diff --git a/spec/services/issues/move_service_spec.rb b/spec/services/issues/move_service_spec.rb
index ae1454ce9bb..9b8d21bb8eb 100644
--- a/spec/services/issues/move_service_spec.rb
+++ b/spec/services/issues/move_service_spec.rb
@@ -321,21 +321,40 @@ RSpec.describe Issues::MoveService do
 
     before do
       authorized_project.add_developer(user)
+      authorized_project.add_developer(admin)
       authorized_project2.add_developer(user)
+      authorized_project2.add_developer(admin)
     end
 
     context 'multiple related issues' do
-      it 'moves all related issues and retains permissions' do
-        new_issue = move_service.execute(old_issue, new_project)
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it 'moves all related issues and retains permissions' do
+          new_issue = move_service.execute(old_issue, new_project)
 
-        expect(new_issue.related_issues(admin))
-          .to match_array([authorized_issue_b, authorized_issue_c, authorized_issue_d, unauthorized_issue])
+          expect(new_issue.related_issues(admin))
+            .to match_array([authorized_issue_b, authorized_issue_c, authorized_issue_d, unauthorized_issue])
 
-        expect(new_issue.related_issues(user))
-          .to match_array([authorized_issue_b, authorized_issue_c, authorized_issue_d])
+          expect(new_issue.related_issues(user))
+            .to match_array([authorized_issue_b, authorized_issue_c, authorized_issue_d])
 
-        expect(authorized_issue_d.related_issues(user))
-          .to match_array([new_issue])
+          expect(authorized_issue_d.related_issues(user))
+            .to match_array([new_issue])
+        end
+      end
+
+      context 'when admin mode is disabled' do
+        it 'moves all related issues and retains permissions' do
+          new_issue = move_service.execute(old_issue, new_project)
+
+          expect(new_issue.related_issues(admin))
+              .to match_array([authorized_issue_b, authorized_issue_c, authorized_issue_d])
+
+          expect(new_issue.related_issues(user))
+              .to match_array([authorized_issue_b, authorized_issue_c, authorized_issue_d])
+
+          expect(authorized_issue_d.related_issues(user))
+              .to match_array([new_issue])
+        end
       end
     end
   end
diff --git a/spec/services/issues/related_branches_service_spec.rb b/spec/services/issues/related_branches_service_spec.rb
index 1780023803a..a8a1f95e800 100644
--- a/spec/services/issues/related_branches_service_spec.rb
+++ b/spec/services/issues/related_branches_service_spec.rb
@@ -74,8 +74,16 @@ RSpec.describe Issues::RelatedBranchesService do
       context 'the user has access to otherwise unreadable pipelines' do
         let(:user) { create(:admin) }
 
-        it 'returns info a developer could not see' do
-          expect(branch_info.pluck(:pipeline_status)).to include(an_instance_of(Gitlab::Ci::Status::Running))
+        context 'when admin mode is enabled', :enable_admin_mode do
+          it 'returns info a developer could not see' do
+            expect(branch_info.pluck(:pipeline_status)).to include(an_instance_of(Gitlab::Ci::Status::Running))
+          end
+        end
+
+        context 'when admin mode is disabled' do
+          it 'does not return info a developer could not see' do
+            expect(branch_info.pluck(:pipeline_status)).not_to include(an_instance_of(Gitlab::Ci::Status::Running))
+          end
         end
       end
 
diff --git a/spec/services/jira_connect_subscriptions/create_service_spec.rb b/spec/services/jira_connect_subscriptions/create_service_spec.rb
index 77e758cf6fe..9750c671fa2 100644
--- a/spec/services/jira_connect_subscriptions/create_service_spec.rb
+++ b/spec/services/jira_connect_subscriptions/create_service_spec.rb
@@ -32,6 +32,36 @@ RSpec.describe JiraConnectSubscriptions::CreateService do
     it 'returns success' do
       expect(subject[:status]).to eq(:success)
     end
+
+    context 'namespace has projects' do
+      let!(:project_1) { create(:project, group: group) }
+      let!(:project_2) { create(:project, group: group) }
+
+      before do
+        stub_const("#{described_class}::MERGE_REQUEST_SYNC_BATCH_SIZE", 1)
+      end
+
+      it 'starts workers to sync projects in batches with delay' do
+        allow(Atlassian::JiraConnect::Client).to receive(:generate_update_sequence_id).and_return(123)
+
+        expect(JiraConnect::SyncProjectWorker).to receive(:bulk_perform_in).with(1.minute, [[project_1.id, 123]])
+        expect(JiraConnect::SyncProjectWorker).to receive(:bulk_perform_in).with(2.minutes, [[project_2.id, 123]])
+
+        subject
+      end
+
+      context 'when the jira_connect_full_namespace_sync feature flag is disabled' do
+        before do
+          stub_feature_flags(jira_connect_full_namespace_sync: false)
+        end
+
+        specify do
+          expect(JiraConnect::SyncProjectWorker).not_to receive(:bulk_perform_in_with_contexts)
+
+          subject
+        end
+      end
+    end
   end
 
   context 'when path is invalid' do
diff --git a/spec/services/labels/transfer_service_spec.rb b/spec/services/labels/transfer_service_spec.rb
index 2c0c82ed976..18fd401f383 100644
--- a/spec/services/labels/transfer_service_spec.rb
+++ b/spec/services/labels/transfer_service_spec.rb
@@ -4,7 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Labels::TransferService do
   describe '#execute' do
-    let_it_be(:user) { create(:admin) }
+    let_it_be(:user) { create(:user) }
 
     let_it_be(:old_group_ancestor) { create(:group) }
     let_it_be(:old_group) { create(:group, parent: old_group_ancestor) }
@@ -15,6 +15,11 @@ RSpec.describe Labels::TransferService do
 
     subject(:service) { described_class.new(user, old_group, project) }
 
+    before do
+      old_group_ancestor.add_developer(user)
+      new_group.add_developer(user)
+    end
+
     it 'recreates missing group labels at project level and assigns them to the issuables' do
       old_group_label_1 = create(:group_label, group: old_group)
       old_group_label_2 = create(:group_label, group: old_group)
diff --git a/spec/services/merge_requests/add_context_service_spec.rb b/spec/services/merge_requests/add_context_service_spec.rb
index 58ed91218d1..27b46a9023c 100644
--- a/spec/services/merge_requests/add_context_service_spec.rb
+++ b/spec/services/merge_requests/add_context_service_spec.rb
@@ -12,10 +12,20 @@ RSpec.describe MergeRequests::AddContextService do
   subject(:service) { described_class.new(project, admin, merge_request: merge_request, commits: commits) }
 
   describe "#execute" do
-    it "adds context commit" do
-      service.execute
+    context "when admin mode is enabled", :enable_admin_mode do
+      it "adds context commit" do
+        service.execute
 
-      expect(merge_request.merge_request_context_commit_diff_files.length).to eq(2)
+        expect(merge_request.merge_request_context_commit_diff_files.length).to eq(2)
+      end
+    end
+
+    context "when admin mode is disabled" do
+      it "doesn't add context commit" do
+        subject.execute
+
+        expect(merge_request.merge_request_context_commit_diff_files.length).to eq(0)
+      end
     end
 
     context "when user doesn't have permission to update merge request" do
diff --git a/spec/services/notification_service_spec.rb b/spec/services/notification_service_spec.rb
index b6cbeea16ab..e4ec3e56c20 100644
--- a/spec/services/notification_service_spec.rb
+++ b/spec/services/notification_service_spec.rb
@@ -3099,12 +3099,26 @@ RSpec.describe NotificationService, :mailer do
         subject.new_issue(issue, member)
       end
 
-      it 'still delivers email to admins' do
-        member.update!(admin: true)
+      context 'with admin user' do
+        before do
+          member.update!(admin: true)
+        end
 
-        expect(Notify).to receive(:new_issue_email).at_least(:once).with(member.id, issue.id, nil).and_call_original
+        context 'when admin mode is enabled', :enable_admin_mode do
+          it 'still delivers email to admins' do
+            expect(Notify).to receive(:new_issue_email).at_least(:once).with(member.id, issue.id, nil).and_call_original
 
-        subject.new_issue(issue, member)
+            subject.new_issue(issue, member)
+          end
+        end
+
+        context 'when admin mode is disabled' do
+          it 'does not send an email' do
+            expect(Notify).not_to receive(:new_issue_email)
+
+            subject.new_issue(issue, member)
+          end
+        end
       end
     end
   end
diff --git a/spec/services/personal_access_tokens/create_service_spec.rb b/spec/services/personal_access_tokens/create_service_spec.rb
index 667ed337d83..842bebd13a1 100644
--- a/spec/services/personal_access_tokens/create_service_spec.rb
+++ b/spec/services/personal_access_tokens/create_service_spec.rb
@@ -38,7 +38,13 @@ RSpec.describe PersonalAccessTokens::CreateService do
     context 'when current_user is an administrator' do
       let(:current_user) { create(:admin) }
 
-      it_behaves_like 'a successfully created token'
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it_behaves_like 'a successfully created token'
+      end
+
+      context 'when admin mode is disabled' do
+        it_behaves_like 'an unsuccessfully created token'
+      end
     end
 
     context 'when current_user is not an administrator' do
diff --git a/spec/services/personal_access_tokens/revoke_service_spec.rb b/spec/services/personal_access_tokens/revoke_service_spec.rb
index b6563a6131b..a25484e218e 100644
--- a/spec/services/personal_access_tokens/revoke_service_spec.rb
+++ b/spec/services/personal_access_tokens/revoke_service_spec.rb
@@ -24,10 +24,19 @@ RSpec.describe PersonalAccessTokens::RevokeService do
     let(:service) { described_class.new(current_user, token: token) }
 
     context 'when current_user is an administrator' do
-      let_it_be(:current_user) { create(:admin) }
-      let_it_be(:token) { create(:personal_access_token) }
+      context 'when admin mode is enabled', :enable_admin_mode do
+        let_it_be(:current_user) { create(:admin) }
+        let_it_be(:token) { create(:personal_access_token) }
 
-      it_behaves_like 'a successfully revoked token'
+        it_behaves_like 'a successfully revoked token'
+      end
+
+      context 'when admin mode is disabled' do
+        let_it_be(:current_user) { create(:admin) }
+        let_it_be(:token) { create(:personal_access_token) }
+
+        it_behaves_like 'an unsuccessfully revoked token'
+      end
     end
 
     context 'when current_user is not an administrator' do
diff --git a/spec/services/projects/autocomplete_service_spec.rb b/spec/services/projects/autocomplete_service_spec.rb
index aff1aa41091..ef7741c2d0f 100644
--- a/spec/services/projects/autocomplete_service_spec.rb
+++ b/spec/services/projects/autocomplete_service_spec.rb
@@ -79,14 +79,28 @@ RSpec.describe Projects::AutocompleteService do
         expect(issues.count).to eq 3
       end
 
-      it 'lists all project issues for admin' do
-        autocomplete = described_class.new(project, admin)
-        issues = autocomplete.issues.map(&:iid)
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it 'lists all project issues for admin', :enable_admin_mode do
+          autocomplete = described_class.new(project, admin)
+          issues = autocomplete.issues.map(&:iid)
 
-        expect(issues).to include issue.iid
-        expect(issues).to include security_issue_1.iid
-        expect(issues).to include security_issue_2.iid
-        expect(issues.count).to eq 3
+          expect(issues).to include issue.iid
+          expect(issues).to include security_issue_1.iid
+          expect(issues).to include security_issue_2.iid
+          expect(issues.count).to eq 3
+        end
+      end
+
+      context 'when admin mode is disabled' do
+        it 'does not list project confidential issues for admin' do
+          autocomplete = described_class.new(project, admin)
+          issues = autocomplete.issues.map(&:iid)
+
+          expect(issues).to include issue.iid
+          expect(issues).not_to include security_issue_1.iid
+          expect(issues).not_to include security_issue_2.iid
+          expect(issues.count).to eq 1
+        end
       end
     end
   end
diff --git a/spec/services/projects/create_service_spec.rb b/spec/services/projects/create_service_spec.rb
index d959cc87901..6c0e6654622 100644
--- a/spec/services/projects/create_service_spec.rb
+++ b/spec/services/projects/create_service_spec.rb
@@ -72,14 +72,25 @@ RSpec.describe Projects::CreateService, '#execute' do
   end
 
   context "admin creates project with other user's namespace_id" do
-    it 'sets the correct permissions' do
-      admin = create(:admin)
-      project = create_project(admin, opts)
+    context 'when admin mode is enabled', :enable_admin_mode do
+      it 'sets the correct permissions' do
+        admin = create(:admin)
+        project = create_project(admin, opts)
 
-      expect(project).to be_persisted
-      expect(project.owner).to eq(user)
-      expect(project.team.maintainers).to contain_exactly(user)
-      expect(project.namespace).to eq(user.namespace)
+        expect(project).to be_persisted
+        expect(project.owner).to eq(user)
+        expect(project.team.maintainers).to contain_exactly(user)
+        expect(project.namespace).to eq(user.namespace)
+      end
+    end
+
+    context 'when admin mode is disabled' do
+      it 'is not allowed' do
+        admin = create(:admin)
+        project = create_project(admin, opts)
+
+        expect(project).not_to be_persisted
+      end
     end
   end
 
@@ -336,7 +347,15 @@ RSpec.describe Projects::CreateService, '#execute' do
         )
       end
 
-      it 'allows a restricted visibility level for admins' do
+      it 'does not allow a restricted visibility level for admins when admin mode is disabled' do
+        admin = create(:admin)
+        project = create_project(admin, opts)
+
+        expect(project.errors.any?).to be(true)
+        expect(project.saved?).to be_falsey
+      end
+
+      it 'allows a restricted visibility level for admins when admin mode is enabled', :enable_admin_mode do
         admin = create(:admin)
         project = create_project(admin, opts)
 
diff --git a/spec/services/projects/update_service_spec.rb b/spec/services/projects/update_service_spec.rb
index 989426fde8b..760cd85bf71 100644
--- a/spec/services/projects/update_service_spec.rb
+++ b/spec/services/projects/update_service_spec.rb
@@ -127,11 +127,22 @@ RSpec.describe Projects::UpdateService do
           end
 
           context 'when updated by an admin' do
-            it 'updates the project to public' do
-              result = update_project(project, admin, visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+            context 'when admin mode is enabled', :enable_admin_mode do
+              it 'updates the project to public' do
+                result = update_project(project, admin, visibility_level: Gitlab::VisibilityLevel::PUBLIC)
 
-              expect(result).to eq({ status: :success })
-              expect(project).to be_public
+                expect(result).to eq({ status: :success })
+                expect(project).to be_public
+              end
+            end
+
+            context 'when admin mode is disabled' do
+              it 'does not update the project to public' do
+                result = update_project(project, admin, visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+
+                expect(result).to eq({ status: :error, message: 'New visibility level not allowed!' })
+                expect(project).to be_private
+              end
             end
           end
         end
@@ -144,7 +155,7 @@ RSpec.describe Projects::UpdateService do
           project.update!(namespace: group, visibility_level: group.visibility_level)
         end
 
-        it 'does not update project visibility level' do
+        it 'does not update project visibility level even if admin', :enable_admin_mode do
           result = update_project(project, admin, visibility_level: Gitlab::VisibilityLevel::PUBLIC)
 
           expect(result).to eq({ status: :error, message: 'Visibility level public is not allowed in a internal group.' })
@@ -181,6 +192,7 @@ RSpec.describe Projects::UpdateService do
 
     describe 'when updating project that has forks' do
       let(:project) { create(:project, :internal) }
+      let(:user) { project.owner }
       let(:forked_project) { fork_project(project) }
 
       context 'and unlink forks feature flag is off' do
@@ -194,7 +206,7 @@ RSpec.describe Projects::UpdateService do
           expect(project).to be_internal
           expect(forked_project).to be_internal
 
-          expect(update_project(project, admin, opts)).to eq({ status: :success })
+          expect(update_project(project, user, opts)).to eq({ status: :success })
 
           expect(project).to be_private
           expect(forked_project.reload).to be_private
@@ -206,7 +218,7 @@ RSpec.describe Projects::UpdateService do
           expect(project).to be_internal
           expect(forked_project).to be_internal
 
-          expect(update_project(project, admin, opts)).to eq({ status: :success })
+          expect(update_project(project, user, opts)).to eq({ status: :success })
 
           expect(project).to be_public
           expect(forked_project.reload).to be_internal
@@ -220,7 +232,7 @@ RSpec.describe Projects::UpdateService do
           expect(project).to be_internal
           expect(forked_project).to be_internal
 
-          expect(update_project(project, admin, opts)).to eq({ status: :success })
+          expect(update_project(project, user, opts)).to eq({ status: :success })
 
           expect(project).to be_private
           expect(forked_project.reload).to be_internal
@@ -576,15 +588,21 @@ RSpec.describe Projects::UpdateService do
       context 'authenticated as admin' do
         let(:user) { create(:admin) }
 
-        it 'schedules the transfer of the repository to the new storage and locks the project' do
-          update_project(project, admin, opts)
+        context 'when admin mode is enabled', :enable_admin_mode do
+          it 'schedules the transfer of the repository to the new storage and locks the project' do
+            update_project(project, admin, opts)
 
-          expect(project).to be_repository_read_only
-          expect(project.repository_storage_moves.last).to have_attributes(
-            state: ::ProjectRepositoryStorageMove.state_machines[:state].states[:scheduled].value,
-            source_storage_name: 'default',
-            destination_storage_name: 'test_second_storage'
-          )
+            expect(project).to be_repository_read_only
+            expect(project.repository_storage_moves.last).to have_attributes(
+              state: ::ProjectRepositoryStorageMove.state_machines[:state].states[:scheduled].value,
+              source_storage_name: 'default',
+              destination_storage_name: 'test_second_storage'
+            )
+          end
+        end
+
+        context 'when admin mode is disabled' do
+          it_behaves_like 'the transfer was not scheduled'
         end
 
         context 'the repository is read-only' do
diff --git a/spec/services/resource_access_tokens/create_service_spec.rb b/spec/services/resource_access_tokens/create_service_spec.rb
index f172db72a48..5cfa1ae93e6 100644
--- a/spec/services/resource_access_tokens/create_service_spec.rb
+++ b/spec/services/resource_access_tokens/create_service_spec.rb
@@ -46,8 +46,18 @@ RSpec.describe ResourceAccessTokens::CreateService do
         end
 
         context 'when created by an admin' do
-          it_behaves_like 'creates a user that has their email confirmed' do
-            let(:user) { create(:admin) }
+          let(:user) { create(:admin) }
+
+          context 'when admin mode is enabled', :enable_admin_mode do
+            it_behaves_like 'creates a user that has their email confirmed'
+          end
+
+          context 'when admin mode is disabled' do
+            it 'returns error' do
+              response = subject
+
+              expect(response.error?).to be true
+            end
           end
         end
 
diff --git a/spec/services/search/snippet_service_spec.rb b/spec/services/search/snippet_service_spec.rb
index ceaf3d055bf..d204f626635 100644
--- a/spec/services/search/snippet_service_spec.rb
+++ b/spec/services/search/snippet_service_spec.rb
@@ -49,12 +49,24 @@ RSpec.describe Search::SnippetService do
         expect(results.objects('snippet_titles')).to match_array [public_snippet, internal_snippet, private_snippet, project_public_snippet, project_internal_snippet]
       end
 
-      it 'returns all snippets when user is admin' do
-        admin = create(:admin)
-        search = described_class.new(admin, search: 'bar')
-        results = search.execute
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it 'returns all snippets when user is admin' do
+          admin = create(:admin)
+          search = described_class.new(admin, search: 'bar')
+          results = search.execute
 
-        expect(results.objects('snippet_titles')).to match_array [public_snippet, internal_snippet, private_snippet, project_public_snippet, project_internal_snippet, project_private_snippet]
+          expect(results.objects('snippet_titles')).to match_array [public_snippet, internal_snippet, private_snippet, project_public_snippet, project_internal_snippet, project_private_snippet]
+        end
+      end
+
+      context 'when admin mode is disabled' do
+        it 'returns only public & internal snippets when user is admin' do
+          admin = create(:admin)
+          search = described_class.new(admin, search: 'bar')
+          results = search.execute
+
+          expect(results.objects('snippet_titles')).to match_array [public_snippet, internal_snippet, project_public_snippet, project_internal_snippet]
+        end
       end
     end
   end
diff --git a/spec/services/todo_service_spec.rb b/spec/services/todo_service_spec.rb
index 748003a26d1..90325c564bc 100644
--- a/spec/services/todo_service_spec.rb
+++ b/spec/services/todo_service_spec.rb
@@ -150,7 +150,7 @@ RSpec.describe TodoService do
         service.new_issue(issue, author)
 
         should_create_todo(user: member, target: issue, action: Todo::DIRECTLY_ADDRESSED)
-        should_create_todo(user: admin, target: issue, action: Todo::MENTIONED)
+        should_not_create_todo(user: admin, target: issue, action: Todo::MENTIONED)
         should_create_todo(user: guest, target: issue, action: Todo::MENTIONED)
       end
 
@@ -160,7 +160,7 @@ RSpec.describe TodoService do
         should_create_todo(user: assignee, target: confidential_issue, author: john_doe, action: Todo::ASSIGNED)
         should_create_todo(user: author, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_create_todo(user: member, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
-        should_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
+        should_not_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_not_create_todo(user: guest, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_create_todo(user: john_doe, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
       end
@@ -171,7 +171,7 @@ RSpec.describe TodoService do
         should_create_todo(user: assignee, target: addressed_confident_issue, author: john_doe, action: Todo::ASSIGNED)
         should_create_todo(user: author, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_create_todo(user: member, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
-        should_create_todo(user: admin, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
+        should_not_create_todo(user: admin, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_not_create_todo(user: guest, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_create_todo(user: john_doe, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
       end
@@ -228,7 +228,7 @@ RSpec.describe TodoService do
 
         should_create_todo(user: member, target: issue, action: Todo::DIRECTLY_ADDRESSED)
         should_create_todo(user: guest, target: issue, action: Todo::MENTIONED)
-        should_create_todo(user: admin, target: issue, action: Todo::MENTIONED)
+        should_not_create_todo(user: admin, target: issue, action: Todo::MENTIONED)
         should_not_create_todo(user: skipped, target: issue)
       end
 
@@ -273,7 +273,7 @@ RSpec.describe TodoService do
         should_create_todo(user: author, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_create_todo(user: assignee, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_create_todo(user: member, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
-        should_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
+        should_not_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_not_create_todo(user: guest, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
         should_create_todo(user: john_doe, target: confidential_issue, author: john_doe, action: Todo::MENTIONED)
       end
@@ -284,7 +284,7 @@ RSpec.describe TodoService do
         should_create_todo(user: author, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_create_todo(user: assignee, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_create_todo(user: member, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
-        should_create_todo(user: admin, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
+        should_not_create_todo(user: admin, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_not_create_todo(user: guest, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
         should_create_todo(user: john_doe, target: addressed_confident_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED)
       end
@@ -432,7 +432,7 @@ RSpec.describe TodoService do
         service.new_note(note, john_doe)
 
         should_create_todo(user: member, target: issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: note)
-        should_create_todo(user: admin, target: issue, author: john_doe, action: Todo::MENTIONED, note: note)
+        should_not_create_todo(user: admin, target: issue, author: john_doe, action: Todo::MENTIONED, note: note)
         should_create_todo(user: guest, target: issue, author: john_doe, action: Todo::MENTIONED, note: note)
       end
 
@@ -452,7 +452,7 @@ RSpec.describe TodoService do
         should_create_todo(user: author, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
         should_create_todo(user: assignee, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
         should_create_todo(user: member, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
-        should_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
+        should_not_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
         should_not_create_todo(user: guest, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
         should_create_todo(user: john_doe, target: confidential_issue, author: john_doe, action: Todo::MENTIONED, note: note_on_confidential_issue)
       end
@@ -463,7 +463,7 @@ RSpec.describe TodoService do
         should_create_todo(user: author, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
         should_create_todo(user: assignee, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
         should_create_todo(user: member, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
-        should_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
+        should_not_create_todo(user: admin, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
         should_not_create_todo(user: guest, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
         should_create_todo(user: john_doe, target: confidential_issue, author: john_doe, action: Todo::DIRECTLY_ADDRESSED, note: addressed_note_on_confidential_issue)
       end
@@ -699,7 +699,7 @@ RSpec.describe TodoService do
         service.new_merge_request(mr_assigned, author)
 
         should_create_todo(user: member, target: mr_assigned, action: Todo::DIRECTLY_ADDRESSED)
-        should_create_todo(user: admin, target: mr_assigned, action: Todo::MENTIONED)
+        should_not_create_todo(user: admin, target: mr_assigned, action: Todo::MENTIONED)
       end
 
       it 'creates a directly addressed todo for each valid addressed user' do
@@ -731,7 +731,7 @@ RSpec.describe TodoService do
         service.update_merge_request(mr_assigned, author, skip_users)
 
         should_create_todo(user: member, target: mr_assigned, action: Todo::DIRECTLY_ADDRESSED)
-        should_create_todo(user: admin, target: mr_assigned, action: Todo::MENTIONED)
+        should_not_create_todo(user: admin, target: mr_assigned, action: Todo::MENTIONED)
         should_not_create_todo(user: skipped, target: mr_assigned)
       end
 
@@ -997,7 +997,7 @@ RSpec.describe TodoService do
 
       should_create_todo(user: member, target: noteable, action: Todo::DIRECTLY_ADDRESSED)
       should_create_todo(user: guest, target: noteable, action: Todo::MENTIONED)
-      should_create_todo(user: admin, target: noteable, action: Todo::MENTIONED)
+      should_not_create_todo(user: admin, target: noteable, action: Todo::MENTIONED)
       should_not_create_todo(user: skipped, target: noteable)
     end
 
diff --git a/spec/services/two_factor/destroy_service_spec.rb b/spec/services/two_factor/destroy_service_spec.rb
index 3df4d1593c6..30c189520fd 100644
--- a/spec/services/two_factor/destroy_service_spec.rb
+++ b/spec/services/two_factor/destroy_service_spec.rb
@@ -85,7 +85,7 @@ RSpec.describe TwoFactor::DestroyService do
           it_behaves_like 'disables two-factor authentication'
         end
 
-        context 'admin disables the two-factor authentication of another user' do
+        context 'admin disables the two-factor authentication of another user', :enable_admin_mode do
           let(:current_user) { create(:admin) }
           let(:user) { create(:user, :two_factor) }
 
diff --git a/spec/services/users/approve_service_spec.rb b/spec/services/users/approve_service_spec.rb
index 50f2b6b0827..c60e4c3b75e 100644
--- a/spec/services/users/approve_service_spec.rb
+++ b/spec/services/users/approve_service_spec.rb
@@ -19,85 +19,96 @@ RSpec.describe Users::ApproveService do
         end
       end
 
-      context 'when user is not in pending approval state' do
-        let(:user) { create(:user, state: 'active') }
-
+      context 'when the executor user is an admin not in admin mode' do
         it 'returns error result' do
           expect(subject[:status]).to eq(:error)
-          expect(subject[:message])
-            .to match(/The user you are trying to approve is not pending an approval/)
+          expect(subject[:message]).to match(/You are not allowed to approve a user/)
         end
       end
 
-      context 'when user cannot be activated' do
-        let(:user) do
-          build(:user, state: 'blocked_pending_approval', email: 'invalid email')
+      context 'when the executor user is an admin in admin mode', :enable_admin_mode do
+        context 'when user is not in pending approval state' do
+          let(:user) { create(:user, state: 'active') }
+
+          it 'returns error result' do
+            expect(subject[:status]).to eq(:error)
+            expect(subject[:message])
+              .to match(/The user you are trying to approve is not pending an approval/)
+          end
         end
 
-        it 'returns error result' do
-          expect(subject[:status]).to eq(:error)
-          expect(subject[:message]).to match(/Email is invalid/)
-        end
+        context 'when user cannot be activated' do
+          let(:user) do
+            build(:user, state: 'blocked_pending_approval', email: 'invalid email')
+          end
 
-        it 'does not change the state of the user' do
-          expect { subject }.not_to change { user.state }
+          it 'returns error result' do
+            expect(subject[:status]).to eq(:error)
+            expect(subject[:message]).to match(/Email is invalid/)
+          end
+
+          it 'does not change the state of the user' do
+            expect { subject }.not_to change { user.state }
+          end
         end
       end
     end
 
     context 'success' do
-      it 'activates the user' do
-        expect(subject[:status]).to eq(:success)
-        expect(user.reload).to be_active
-      end
+      context 'when the executor user is an admin in admin mode', :enable_admin_mode do
+        it 'activates the user' do
+          expect(subject[:status]).to eq(:success)
+          expect(user.reload).to be_active
+        end
 
-      context 'email confirmation status' do
-        context 'user is unconfirmed' do
-          let(:user) { create(:user, :blocked_pending_approval, :unconfirmed) }
+        context 'email confirmation status' do
+          context 'user is unconfirmed' do
+            let(:user) { create(:user, :blocked_pending_approval, :unconfirmed) }
 
-          it 'sends confirmation instructions' do
-            expect { subject }
-              .to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
+            it 'sends confirmation instructions' do
+              expect { subject }
+                .to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
+            end
+          end
+
+          context 'user is confirmed' do
+            it 'does not send a confirmation email' do
+              expect { subject }
+                .not_to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
+            end
           end
         end
 
-        context 'user is confirmed' do
-          it 'does not send a confirmation email' do
-            expect { subject }
-              .not_to have_enqueued_mail(DeviseMailer, :confirmation_instructions)
+        context 'pending invitations' do
+          let!(:project_member_invite) { create(:project_member, :invited, invite_email: user.email) }
+          let!(:group_member_invite) { create(:group_member, :invited, invite_email: user.email) }
+
+          context 'user is unconfirmed' do
+            let(:user) { create(:user, :blocked_pending_approval, :unconfirmed) }
+
+            it 'does not accept pending invites of the user' do
+              expect(subject[:status]).to eq(:success)
+
+              group_member_invite.reload
+              project_member_invite.reload
+
+              expect(group_member_invite).to be_invite
+              expect(project_member_invite).to be_invite
+            end
           end
-        end
-      end
 
-      context 'pending invitiations' do
-        let!(:project_member_invite) { create(:project_member, :invited, invite_email: user.email) }
-        let!(:group_member_invite) { create(:group_member, :invited, invite_email: user.email) }
+          context 'user is confirmed' do
+            it 'accepts pending invites of the user' do
+              expect(subject[:status]).to eq(:success)
 
-        context 'user is unconfirmed' do
-          let(:user) { create(:user, :blocked_pending_approval, :unconfirmed) }
+              group_member_invite.reload
+              project_member_invite.reload
 
-          it 'does not accept pending invites of the user' do
-            expect(subject[:status]).to eq(:success)
-
-            group_member_invite.reload
-            project_member_invite.reload
-
-            expect(group_member_invite).to be_invite
-            expect(project_member_invite).to be_invite
-          end
-        end
-
-        context 'user is confirmed' do
-          it 'accepts pending invites of the user' do
-            expect(subject[:status]).to eq(:success)
-
-            group_member_invite.reload
-            project_member_invite.reload
-
-            expect(group_member_invite).not_to be_invite
-            expect(project_member_invite).not_to be_invite
-            expect(group_member_invite.user).to eq(user)
-            expect(project_member_invite.user).to eq(user)
+              expect(group_member_invite).not_to be_invite
+              expect(project_member_invite).not_to be_invite
+              expect(group_member_invite.user).to eq(user)
+              expect(project_member_invite.user).to eq(user)
+            end
           end
         end
       end
diff --git a/spec/services/users/destroy_service_spec.rb b/spec/services/users/destroy_service_spec.rb
index 3dafc896b00..76b84e3b4ab 100644
--- a/spec/services/users/destroy_service_spec.rb
+++ b/spec/services/users/destroy_service_spec.rb
@@ -3,14 +3,14 @@
 require 'spec_helper'
 
 RSpec.describe Users::DestroyService do
-  describe "Deletes a user and all their personal projects" do
-    let!(:user)      { create(:user) }
-    let!(:admin)     { create(:admin) }
-    let!(:namespace) { user.namespace }
-    let!(:project)   { create(:project, namespace: namespace) }
-    let(:service)    { described_class.new(admin) }
-    let(:gitlab_shell) { Gitlab::Shell.new }
+  let!(:user)      { create(:user) }
+  let!(:admin)     { create(:admin) }
+  let!(:namespace) { user.namespace }
+  let!(:project)   { create(:project, namespace: namespace) }
+  let(:service)    { described_class.new(admin) }
+  let(:gitlab_shell) { Gitlab::Shell.new }
 
+  describe "Deletes a user and all their personal projects", :enable_admin_mode do
     context 'no options are given' do
       it 'deletes the user' do
         user_data = service.execute(user)
@@ -215,35 +215,6 @@ RSpec.describe Users::DestroyService do
       end
     end
 
-    context "deletion permission checks" do
-      it 'does not delete the user when user is not an admin' do
-        other_user = create(:user)
-
-        expect { described_class.new(other_user).execute(user) }.to raise_error(Gitlab::Access::AccessDeniedError)
-        expect(User.exists?(user.id)).to be(true)
-      end
-
-      it 'allows admins to delete anyone' do
-        described_class.new(admin).execute(user)
-
-        expect(User.exists?(user.id)).to be(false)
-      end
-
-      it 'allows users to delete their own account' do
-        described_class.new(user).execute(user)
-
-        expect(User.exists?(user.id)).to be(false)
-      end
-
-      it 'allows user to be deleted if skip_authorization: true' do
-        other_user = create(:user)
-
-        described_class.new(user).execute(other_user, skip_authorization: true)
-
-        expect(User.exists?(other_user.id)).to be(false)
-      end
-    end
-
     context "migrating associated records" do
       let!(:issue)     { create(:issue, author: user) }
 
@@ -320,4 +291,43 @@ RSpec.describe Users::DestroyService do
       end
     end
   end
+
+  describe "Deletion permission checks" do
+    it 'does not delete the user when user is not an admin' do
+      other_user = create(:user)
+
+      expect { described_class.new(other_user).execute(user) }.to raise_error(Gitlab::Access::AccessDeniedError)
+      expect(User.exists?(user.id)).to be(true)
+    end
+
+    context 'when admin mode is enabled', :enable_admin_mode do
+      it 'allows admins to delete anyone' do
+        described_class.new(admin).execute(user)
+
+        expect(User.exists?(user.id)).to be(false)
+      end
+    end
+
+    context 'when admin mode is disabled' do
+      it 'disallows admins to delete anyone' do
+        expect { described_class.new(admin).execute(user) }.to raise_error(Gitlab::Access::AccessDeniedError)
+
+        expect(User.exists?(user.id)).to be(true)
+      end
+    end
+
+    it 'allows users to delete their own account' do
+      described_class.new(user).execute(user)
+
+      expect(User.exists?(user.id)).to be(false)
+    end
+
+    it 'allows user to be deleted if skip_authorization: true' do
+      other_user = create(:user)
+
+      described_class.new(user).execute(other_user, skip_authorization: true)
+
+      expect(User.exists?(other_user.id)).to be(false)
+    end
+  end
 end
diff --git a/spec/services/users/set_status_service_spec.rb b/spec/services/users/set_status_service_spec.rb
index 319723b5201..69cd647eaeb 100644
--- a/spec/services/users/set_status_service_spec.rb
+++ b/spec/services/users/set_status_service_spec.rb
@@ -52,7 +52,7 @@ RSpec.describe Users::SetStatusService do
           { emoji: 'taurus', message: 'a random status', user: target_user }
         end
 
-        context 'the current user is admin' do
+        context 'the current user is admin', :enable_admin_mode do
           let(:current_user) { create(:admin) }
 
           it 'changes the status when the current user is allowed to do that' do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index ad84e274c5f..3953193c3a7 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -283,12 +283,10 @@ RSpec.configure do |config|
       ./ee/spec/lib
       ./ee/spec/requests/admin
       ./ee/spec/serializers
-      ./ee/spec/services
       ./ee/spec/support/protected_tags
       ./ee/spec/support/shared_examples/features
       ./ee/spec/support/shared_examples/finders/geo
       ./ee/spec/support/shared_examples/graphql/geo
-      ./ee/spec/support/shared_examples/services
       ./spec/features
       ./spec/finders
       ./spec/frontend
@@ -296,7 +294,6 @@ RSpec.configure do |config|
       ./spec/lib
       ./spec/requests
       ./spec/serializers
-      ./spec/services
       ./spec/support/protected_tags
       ./spec/support/shared_examples/features
       ./spec/support/shared_examples/requests
diff --git a/spec/support/helpers/admin_mode_helpers.rb b/spec/support/helpers/admin_mode_helpers.rb
index 36ed262f8ae..a6e31791127 100644
--- a/spec/support/helpers/admin_mode_helpers.rb
+++ b/spec/support/helpers/admin_mode_helpers.rb
@@ -13,6 +13,8 @@ module AdminModeHelper
   def enable_admin_mode!(user)
     fake_user_mode = instance_double(Gitlab::Auth::CurrentUserMode)
 
+    allow(Gitlab::Auth::CurrentUserMode).to receive(:new).and_call_original
+
     allow(Gitlab::Auth::CurrentUserMode).to receive(:new).with(user).and_return(fake_user_mode)
     allow(fake_user_mode).to receive(:admin_mode?).and_return(user&.admin?)
   end
diff --git a/spec/support/shared_contexts/policies/project_policy_table_shared_context.rb b/spec/support/shared_contexts/policies/project_policy_table_shared_context.rb
index efd82ecb15a..8c9a60fa703 100644
--- a/spec/support/shared_contexts/policies/project_policy_table_shared_context.rb
+++ b/spec/support/shared_contexts/policies/project_policy_table_shared_context.rb
@@ -3,6 +3,8 @@
 RSpec.shared_context 'ProjectPolicyTable context' do
   using RSpec::Parameterized::TableSyntax
 
+  include AdminModeHelper
+
   let(:pendings) { {} }
   let(:pending?) do
     pendings.include?(
@@ -10,106 +12,117 @@ RSpec.shared_context 'ProjectPolicyTable context' do
         project_level: project_level,
         feature_access_level: feature_access_level,
         membership: membership,
+        admin_mode: admin_mode,
         expected_count: expected_count
       }
     )
   end
 
   # rubocop:disable Metrics/AbcSize
-  # project_level, :feature_access_level, :membership, :expected_count
+  # project_level, :feature_access_level, :membership, :admin_mode, :expected_count
   def permission_table_for_reporter_feature_access
-    :public   | :enabled  | :admin      | 1
-    :public   | :enabled  | :reporter   | 1
-    :public   | :enabled  | :guest      | 1
-    :public   | :enabled  | :non_member | 1
-    :public   | :enabled  | :anonymous  | 1
+    :public   | :enabled  | :admin      | true  | 1
+    :public   | :enabled  | :admin      | false | 1
+    :public   | :enabled  | :reporter   | nil   | 1
+    :public   | :enabled  | :guest      | nil   | 1
+    :public   | :enabled  | :non_member | nil   | 1
+    :public   | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :private  | :admin      | 1
-    :public   | :private  | :reporter   | 1
-    :public   | :private  | :guest      | 0
-    :public   | :private  | :non_member | 0
-    :public   | :private  | :anonymous  | 0
+    :public   | :private  | :admin      | true  | 1
+    :public   | :private  | :admin      | false | 0
+    :public   | :private  | :reporter   | nil   | 1
+    :public   | :private  | :guest      | nil   | 0
+    :public   | :private  | :non_member | nil   | 0
+    :public   | :private  | :anonymous  | nil   | 0
 
-    :public   | :disabled | :reporter   | 0
-    :public   | :disabled | :guest      | 0
-    :public   | :disabled | :non_member | 0
-    :public   | :disabled | :anonymous  | 0
+    :public   | :disabled | :reporter   | nil   | 0
+    :public   | :disabled | :guest      | nil   | 0
+    :public   | :disabled | :non_member | nil   | 0
+    :public   | :disabled | :anonymous  | nil   | 0
 
-    :internal | :enabled  | :admin      | 1
-    :internal | :enabled  | :reporter   | 1
-    :internal | :enabled  | :guest      | 1
-    :internal | :enabled  | :non_member | 1
-    :internal | :enabled  | :anonymous  | 0
+    :internal | :enabled  | :admin      | true  | 1
+    :internal | :enabled  | :admin      | false | 1
+    :internal | :enabled  | :reporter   | nil   | 1
+    :internal | :enabled  | :guest      | nil   | 1
+    :internal | :enabled  | :non_member | nil   | 1
+    :internal | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :private  | :admin      | 1
-    :internal | :private  | :reporter   | 1
-    :internal | :private  | :guest      | 0
-    :internal | :private  | :non_member | 0
-    :internal | :private  | :anonymous  | 0
+    :internal | :private  | :admin      | true  | 1
+    :internal | :private  | :admin      | false | 0
+    :internal | :private  | :reporter   | nil   | 1
+    :internal | :private  | :guest      | nil   | 0
+    :internal | :private  | :non_member | nil   | 0
+    :internal | :private  | :anonymous  | nil   | 0
 
-    :internal | :disabled | :reporter   | 0
-    :internal | :disabled | :guest      | 0
-    :internal | :disabled | :non_member | 0
-    :internal | :disabled | :anonymous  | 0
+    :internal | :disabled | :reporter   | nil   | 0
+    :internal | :disabled | :guest      | nil   | 0
+    :internal | :disabled | :non_member | nil   | 0
+    :internal | :disabled | :anonymous  | nil   | 0
 
-    :private  | :private  | :admin      | 1
-    :private  | :private  | :reporter   | 1
-    :private  | :private  | :guest      | 0
-    :private  | :private  | :non_member | 0
-    :private  | :private  | :anonymous  | 0
+    :private  | :private  | :admin      | true  | 1
+    :private  | :private  | :admin      | false | 0
+    :private  | :private  | :reporter   | nil   | 1
+    :private  | :private  | :guest      | nil   | 0
+    :private  | :private  | :non_member | nil   | 0
+    :private  | :private  | :anonymous  | nil   | 0
 
-    :private  | :disabled | :reporter   | 0
-    :private  | :disabled | :guest      | 0
-    :private  | :disabled | :non_member | 0
-    :private  | :disabled | :anonymous  | 0
+    :private  | :disabled | :reporter   | nil   | 0
+    :private  | :disabled | :guest      | nil   | 0
+    :private  | :disabled | :non_member | nil   | 0
+    :private  | :disabled | :anonymous  | nil   | 0
   end
 
-  # project_level, :feature_access_level, :membership, :expected_count
+  # project_level, :feature_access_level, :membership, :admin_mode, :expected_count
   def permission_table_for_guest_feature_access
-    :public   | :enabled  | :admin      | 1
-    :public   | :enabled  | :reporter   | 1
-    :public   | :enabled  | :guest      | 1
-    :public   | :enabled  | :non_member | 1
-    :public   | :enabled  | :anonymous  | 1
+    :public   | :enabled  | :admin      | true  | 1
+    :public   | :enabled  | :admin      | false | 1
+    :public   | :enabled  | :reporter   | nil   | 1
+    :public   | :enabled  | :guest      | nil   | 1
+    :public   | :enabled  | :non_member | nil   | 1
+    :public   | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :private  | :admin      | 1
-    :public   | :private  | :reporter   | 1
-    :public   | :private  | :guest      | 1
-    :public   | :private  | :non_member | 0
-    :public   | :private  | :anonymous  | 0
+    :public   | :private  | :admin      | true  | 1
+    :public   | :private  | :admin      | false | 0
+    :public   | :private  | :reporter   | nil   | 1
+    :public   | :private  | :guest      | nil   | 1
+    :public   | :private  | :non_member | nil   | 0
+    :public   | :private  | :anonymous  | nil   | 0
 
-    :public   | :disabled | :reporter   | 0
-    :public   | :disabled | :guest      | 0
-    :public   | :disabled | :non_member | 0
-    :public   | :disabled | :anonymous  | 0
+    :public   | :disabled | :reporter   | nil   | 0
+    :public   | :disabled | :guest      | nil   | 0
+    :public   | :disabled | :non_member | nil   | 0
+    :public   | :disabled | :anonymous  | nil   | 0
 
-    :internal | :enabled  | :admin      | 1
-    :internal | :enabled  | :reporter   | 1
-    :internal | :enabled  | :guest      | 1
-    :internal | :enabled  | :non_member | 1
-    :internal | :enabled  | :anonymous  | 0
+    :internal | :enabled  | :admin      | true  | 1
+    :internal | :enabled  | :admin      | false | 1
+    :internal | :enabled  | :reporter   | nil   | 1
+    :internal | :enabled  | :guest      | nil   | 1
+    :internal | :enabled  | :non_member | nil   | 1
+    :internal | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :private  | :admin      | 1
-    :internal | :private  | :reporter   | 1
-    :internal | :private  | :guest      | 1
-    :internal | :private  | :non_member | 0
-    :internal | :private  | :anonymous  | 0
+    :internal | :private  | :admin      | true  | 1
+    :internal | :private  | :admin      | false | 0
+    :internal | :private  | :reporter   | nil   | 1
+    :internal | :private  | :guest      | nil   | 1
+    :internal | :private  | :non_member | nil   | 0
+    :internal | :private  | :anonymous  | nil   | 0
 
-    :internal | :disabled | :reporter   | 0
-    :internal | :disabled | :guest      | 0
-    :internal | :disabled | :non_member | 0
-    :internal | :disabled | :anonymous  | 0
+    :internal | :disabled | :reporter   | nil   | 0
+    :internal | :disabled | :guest      | nil   | 0
+    :internal | :disabled | :non_member | nil   | 0
+    :internal | :disabled | :anonymous  | nil   | 0
 
-    :private  | :private  | :admin      | 1
-    :private  | :private  | :reporter   | 1
-    :private  | :private  | :guest      | 1
-    :private  | :private  | :non_member | 0
-    :private  | :private  | :anonymous  | 0
+    :private  | :private  | :admin      | true  | 1
+    :private  | :private  | :admin      | false | 0
+    :private  | :private  | :reporter   | nil   | 1
+    :private  | :private  | :guest      | nil   | 1
+    :private  | :private  | :non_member | nil   | 0
+    :private  | :private  | :anonymous  | nil   | 0
 
-    :private  | :disabled | :reporter   | 0
-    :private  | :disabled | :guest      | 0
-    :private  | :disabled | :non_member | 0
-    :private  | :disabled | :anonymous  | 0
+    :private  | :disabled | :reporter   | nil   | 0
+    :private  | :disabled | :guest      | nil   | 0
+    :private  | :disabled | :non_member | nil   | 0
+    :private  | :disabled | :anonymous  | nil   | 0
   end
 
   # This table is based on permission_table_for_guest_feature_access,
@@ -121,184 +134,208 @@ RSpec.shared_context 'ProjectPolicyTable context' do
   # e.g. `repository` feature has minimum requirement of GUEST,
   # but a GUEST are prohibited from reading code if project is private.
   #
-  # project_level, :feature_access_level, :membership, :expected_count
+  # project_level, :feature_access_level, :membership, :admin_mode, :expected_count
   def permission_table_for_guest_feature_access_and_non_private_project_only
-    :public   | :enabled  | :admin      | 1
-    :public   | :enabled  | :reporter   | 1
-    :public   | :enabled  | :guest      | 1
-    :public   | :enabled  | :non_member | 1
-    :public   | :enabled  | :anonymous  | 1
+    :public   | :enabled  | :admin      | true  | 1
+    :public   | :enabled  | :admin      | false | 1
+    :public   | :enabled  | :reporter   | nil   | 1
+    :public   | :enabled  | :guest      | nil   | 1
+    :public   | :enabled  | :non_member | nil   | 1
+    :public   | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :private  | :admin      | 1
-    :public   | :private  | :reporter   | 1
-    :public   | :private  | :guest      | 1
-    :public   | :private  | :non_member | 0
-    :public   | :private  | :anonymous  | 0
+    :public   | :private  | :admin      | true  | 1
+    :public   | :private  | :admin      | false | 0
+    :public   | :private  | :reporter   | nil   | 1
+    :public   | :private  | :guest      | nil   | 1
+    :public   | :private  | :non_member | nil   | 0
+    :public   | :private  | :anonymous  | nil   | 0
 
-    :public   | :disabled | :reporter   | 0
-    :public   | :disabled | :guest      | 0
-    :public   | :disabled | :non_member | 0
-    :public   | :disabled | :anonymous  | 0
+    :public   | :disabled | :reporter   | nil   | 0
+    :public   | :disabled | :guest      | nil   | 0
+    :public   | :disabled | :non_member | nil   | 0
+    :public   | :disabled | :anonymous  | nil   | 0
 
-    :internal | :enabled  | :admin      | 1
-    :internal | :enabled  | :reporter   | 1
-    :internal | :enabled  | :guest      | 1
-    :internal | :enabled  | :non_member | 1
-    :internal | :enabled  | :anonymous  | 0
+    :internal | :enabled  | :admin      | true  | 1
+    :internal | :enabled  | :admin      | false | 1
+    :internal | :enabled  | :reporter   | nil   | 1
+    :internal | :enabled  | :guest      | nil   | 1
+    :internal | :enabled  | :non_member | nil   | 1
+    :internal | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :private  | :admin      | 1
-    :internal | :private  | :reporter   | 1
-    :internal | :private  | :guest      | 1
-    :internal | :private  | :non_member | 0
-    :internal | :private  | :anonymous  | 0
+    :internal | :private  | :admin      | true  | 1
+    :internal | :private  | :admin      | false | 0
+    :internal | :private  | :reporter   | nil   | 1
+    :internal | :private  | :guest      | nil   | 1
+    :internal | :private  | :non_member | nil   | 0
+    :internal | :private  | :anonymous  | nil   | 0
 
-    :internal | :disabled | :reporter   | 0
-    :internal | :disabled | :guest      | 0
-    :internal | :disabled | :non_member | 0
-    :internal | :disabled | :anonymous  | 0
+    :internal | :disabled | :reporter   | nil   | 0
+    :internal | :disabled | :guest      | nil   | 0
+    :internal | :disabled | :non_member | nil   | 0
+    :internal | :disabled | :anonymous  | nil   | 0
 
-    :private  | :private  | :admin      | 1
-    :private  | :private  | :reporter   | 1
-    :private  | :private  | :guest      | 0
-    :private  | :private  | :non_member | 0
-    :private  | :private  | :anonymous  | 0
+    :private  | :private  | :admin      | true  | 1
+    :private  | :private  | :admin      | false | 0
+    :private  | :private  | :reporter   | nil   | 1
+    :private  | :private  | :guest      | nil   | 0
+    :private  | :private  | :non_member | nil   | 0
+    :private  | :private  | :anonymous  | nil   | 0
 
-    :private  | :disabled | :reporter   | 0
-    :private  | :disabled | :guest      | 0
-    :private  | :disabled | :non_member | 0
-    :private  | :disabled | :anonymous  | 0
+    :private  | :disabled | :reporter   | nil   | 0
+    :private  | :disabled | :guest      | nil   | 0
+    :private  | :disabled | :non_member | nil   | 0
+    :private  | :disabled | :anonymous  | nil   | 0
   end
 
-  # :project_level, :issues_access_level, :merge_requests_access_level, :membership, :expected_count
+  # :project_level, :issues_access_level, :merge_requests_access_level, :membership, :admin_mode, :expected_count
   def permission_table_for_milestone_access
-    :public   | :enabled  | :enabled  | :admin      | 1
-    :public   | :enabled  | :enabled  | :reporter   | 1
-    :public   | :enabled  | :enabled  | :guest      | 1
-    :public   | :enabled  | :enabled  | :non_member | 1
-    :public   | :enabled  | :enabled  | :anonymous  | 1
+    :public   | :enabled  | :enabled  | :admin      | true  | 1
+    :public   | :enabled  | :enabled  | :admin      | false | 1
+    :public   | :enabled  | :enabled  | :reporter   | nil   | 1
+    :public   | :enabled  | :enabled  | :guest      | nil   | 1
+    :public   | :enabled  | :enabled  | :non_member | nil   | 1
+    :public   | :enabled  | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :enabled  | :private  | :admin      | 1
-    :public   | :enabled  | :private  | :reporter   | 1
-    :public   | :enabled  | :private  | :guest      | 1
-    :public   | :enabled  | :private  | :non_member | 1
-    :public   | :enabled  | :private  | :anonymous  | 1
+    :public   | :enabled  | :private  | :admin      | true  | 1
+    :public   | :enabled  | :private  | :admin      | false | 1
+    :public   | :enabled  | :private  | :reporter   | nil   | 1
+    :public   | :enabled  | :private  | :guest      | nil   | 1
+    :public   | :enabled  | :private  | :non_member | nil   | 1
+    :public   | :enabled  | :private  | :anonymous  | nil   | 1
 
-    :public   | :enabled  | :disabled | :admin      | 1
-    :public   | :enabled  | :disabled | :reporter   | 1
-    :public   | :enabled  | :disabled | :guest      | 1
-    :public   | :enabled  | :disabled | :non_member | 1
-    :public   | :enabled  | :disabled | :anonymous  | 1
+    :public   | :enabled  | :disabled | :admin      | true  | 1
+    :public   | :enabled  | :disabled | :admin      | false | 1
+    :public   | :enabled  | :disabled | :reporter   | nil   | 1
+    :public   | :enabled  | :disabled | :guest      | nil   | 1
+    :public   | :enabled  | :disabled | :non_member | nil   | 1
+    :public   | :enabled  | :disabled | :anonymous  | nil   | 1
 
-    :public   | :private  | :enabled  | :admin      | 1
-    :public   | :private  | :enabled  | :reporter   | 1
-    :public   | :private  | :enabled  | :guest      | 1
-    :public   | :private  | :enabled  | :non_member | 1
-    :public   | :private  | :enabled  | :anonymous  | 1
+    :public   | :private  | :enabled  | :admin      | true  | 1
+    :public   | :private  | :enabled  | :admin      | false | 1
+    :public   | :private  | :enabled  | :reporter   | nil   | 1
+    :public   | :private  | :enabled  | :guest      | nil   | 1
+    :public   | :private  | :enabled  | :non_member | nil   | 1
+    :public   | :private  | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :private  | :private  | :admin      | 1
-    :public   | :private  | :private  | :reporter   | 1
-    :public   | :private  | :private  | :guest      | 1
-    :public   | :private  | :private  | :non_member | 0
-    :public   | :private  | :private  | :anonymous  | 0
+    :public   | :private  | :private  | :admin      | true  | 1
+    :public   | :private  | :private  | :admin      | false | 0
+    :public   | :private  | :private  | :reporter   | nil   | 1
+    :public   | :private  | :private  | :guest      | nil   | 1
+    :public   | :private  | :private  | :non_member | nil   | 0
+    :public   | :private  | :private  | :anonymous  | nil   | 0
 
-    :public   | :private  | :disabled | :admin      | 1
-    :public   | :private  | :disabled | :reporter   | 1
-    :public   | :private  | :disabled | :guest      | 1
-    :public   | :private  | :disabled | :non_member | 0
-    :public   | :private  | :disabled | :anonymous  | 0
+    :public   | :private  | :disabled | :admin      | true  | 1
+    :public   | :private  | :disabled | :admin      | false | 0
+    :public   | :private  | :disabled | :reporter   | nil   | 1
+    :public   | :private  | :disabled | :guest      | nil   | 1
+    :public   | :private  | :disabled | :non_member | nil   | 0
+    :public   | :private  | :disabled | :anonymous  | nil   | 0
 
-    :public   | :disabled | :enabled  | :admin      | 1
-    :public   | :disabled | :enabled  | :reporter   | 1
-    :public   | :disabled | :enabled  | :guest      | 1
-    :public   | :disabled | :enabled  | :non_member | 1
-    :public   | :disabled | :enabled  | :anonymous  | 1
+    :public   | :disabled | :enabled  | :admin      | true  | 1
+    :public   | :disabled | :enabled  | :admin      | false | 1
+    :public   | :disabled | :enabled  | :reporter   | nil   | 1
+    :public   | :disabled | :enabled  | :guest      | nil   | 1
+    :public   | :disabled | :enabled  | :non_member | nil   | 1
+    :public   | :disabled | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :disabled | :private  | :admin      | 1
-    :public   | :disabled | :private  | :reporter   | 1
-    :public   | :disabled | :private  | :guest      | 0
-    :public   | :disabled | :private  | :non_member | 0
-    :public   | :disabled | :private  | :anonymous  | 0
+    :public   | :disabled | :private  | :admin      | true  | 1
+    :public   | :disabled | :private  | :admin      | false | 0
+    :public   | :disabled | :private  | :reporter   | nil   | 1
+    :public   | :disabled | :private  | :guest      | nil   | 0
+    :public   | :disabled | :private  | :non_member | nil   | 0
+    :public   | :disabled | :private  | :anonymous  | nil   | 0
 
-    :public   | :disabled | :disabled | :reporter   | 0
-    :public   | :disabled | :disabled | :guest      | 0
-    :public   | :disabled | :disabled | :non_member | 0
-    :public   | :disabled | :disabled | :anonymous  | 0
+    :public   | :disabled | :disabled | :reporter   | nil   | 0
+    :public   | :disabled | :disabled | :guest      | nil   | 0
+    :public   | :disabled | :disabled | :non_member | nil   | 0
+    :public   | :disabled | :disabled | :anonymous  | nil   | 0
 
-    :internal | :enabled  | :enabled  | :admin      | 1
-    :internal | :enabled  | :enabled  | :reporter   | 1
-    :internal | :enabled  | :enabled  | :guest      | 1
-    :internal | :enabled  | :enabled  | :non_member | 1
-    :internal | :enabled  | :enabled  | :anonymous  | 0
+    :internal | :enabled  | :enabled  | :admin      | true  | 1
+    :internal | :enabled  | :enabled  | :admin      | false | 1
+    :internal | :enabled  | :enabled  | :reporter   | nil   | 1
+    :internal | :enabled  | :enabled  | :guest      | nil   | 1
+    :internal | :enabled  | :enabled  | :non_member | nil   | 1
+    :internal | :enabled  | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :enabled  | :private  | :admin      | 1
-    :internal | :enabled  | :private  | :reporter   | 1
-    :internal | :enabled  | :private  | :guest      | 1
-    :internal | :enabled  | :private  | :non_member | 1
-    :internal | :enabled  | :private  | :anonymous  | 0
+    :internal | :enabled  | :private  | :admin      | true  | 1
+    :internal | :enabled  | :private  | :admin      | false | 1
+    :internal | :enabled  | :private  | :reporter   | nil   | 1
+    :internal | :enabled  | :private  | :guest      | nil   | 1
+    :internal | :enabled  | :private  | :non_member | nil   | 1
+    :internal | :enabled  | :private  | :anonymous  | nil   | 0
 
-    :internal | :enabled  | :disabled | :admin      | 1
-    :internal | :enabled  | :disabled | :reporter   | 1
-    :internal | :enabled  | :disabled | :guest      | 1
-    :internal | :enabled  | :disabled | :non_member | 1
-    :internal | :enabled  | :disabled | :anonymous  | 0
+    :internal | :enabled  | :disabled | :admin      | true  | 1
+    :internal | :enabled  | :disabled | :admin      | false | 1
+    :internal | :enabled  | :disabled | :reporter   | nil   | 1
+    :internal | :enabled  | :disabled | :guest      | nil   | 1
+    :internal | :enabled  | :disabled | :non_member | nil   | 1
+    :internal | :enabled  | :disabled | :anonymous  | nil   | 0
 
-    :internal | :private  | :enabled  | :admin      | 1
-    :internal | :private  | :enabled  | :reporter   | 1
-    :internal | :private  | :enabled  | :guest      | 1
-    :internal | :private  | :enabled  | :non_member | 1
-    :internal | :private  | :enabled  | :anonymous  | 0
+    :internal | :private  | :enabled  | :admin      | true  | 1
+    :internal | :private  | :enabled  | :admin      | false | 1
+    :internal | :private  | :enabled  | :reporter   | nil   | 1
+    :internal | :private  | :enabled  | :guest      | nil   | 1
+    :internal | :private  | :enabled  | :non_member | nil   | 1
+    :internal | :private  | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :private  | :private  | :admin      | 1
-    :internal | :private  | :private  | :reporter   | 1
-    :internal | :private  | :private  | :guest      | 1
-    :internal | :private  | :private  | :non_member | 0
-    :internal | :private  | :private  | :anonymous  | 0
+    :internal | :private  | :private  | :admin      | true  | 1
+    :internal | :private  | :private  | :admin      | false | 0
+    :internal | :private  | :private  | :reporter   | nil   | 1
+    :internal | :private  | :private  | :guest      | nil   | 1
+    :internal | :private  | :private  | :non_member | nil   | 0
+    :internal | :private  | :private  | :anonymous  | nil   | 0
 
-    :internal | :private  | :disabled | :admin      | 1
-    :internal | :private  | :disabled | :reporter   | 1
-    :internal | :private  | :disabled | :guest      | 1
-    :internal | :private  | :disabled | :non_member | 0
-    :internal | :private  | :disabled | :anonymous  | 0
+    :internal | :private  | :disabled | :admin      | true  | 1
+    :internal | :private  | :disabled | :admin      | false | 0
+    :internal | :private  | :disabled | :reporter   | nil   | 1
+    :internal | :private  | :disabled | :guest      | nil   | 1
+    :internal | :private  | :disabled | :non_member | nil   | 0
+    :internal | :private  | :disabled | :anonymous  | nil   | 0
 
-    :internal | :disabled | :enabled  | :admin      | 1
-    :internal | :disabled | :enabled  | :reporter   | 1
-    :internal | :disabled | :enabled  | :guest      | 1
-    :internal | :disabled | :enabled  | :non_member | 1
-    :internal | :disabled | :enabled  | :anonymous  | 0
+    :internal | :disabled | :enabled  | :admin      | true  | 1
+    :internal | :disabled | :enabled  | :admin      | false | 1
+    :internal | :disabled | :enabled  | :reporter   | nil   | 1
+    :internal | :disabled | :enabled  | :guest      | nil   | 1
+    :internal | :disabled | :enabled  | :non_member | nil   | 1
+    :internal | :disabled | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :disabled | :private  | :admin      | 1
-    :internal | :disabled | :private  | :reporter   | 1
-    :internal | :disabled | :private  | :guest      | 0
-    :internal | :disabled | :private  | :non_member | 0
-    :internal | :disabled | :private  | :anonymous  | 0
+    :internal | :disabled | :private  | :admin      | true  | 1
+    :internal | :disabled | :private  | :admin      | false | 0
+    :internal | :disabled | :private  | :reporter   | nil   | 1
+    :internal | :disabled | :private  | :guest      | nil   | 0
+    :internal | :disabled | :private  | :non_member | nil   | 0
+    :internal | :disabled | :private  | :anonymous  | nil   | 0
 
-    :internal | :disabled | :disabled | :reporter   | 0
-    :internal | :disabled | :disabled | :guest      | 0
-    :internal | :disabled | :disabled | :non_member | 0
-    :internal | :disabled | :disabled | :anonymous  | 0
+    :internal | :disabled | :disabled | :reporter   | nil   | 0
+    :internal | :disabled | :disabled | :guest      | nil   | 0
+    :internal | :disabled | :disabled | :non_member | nil   | 0
+    :internal | :disabled | :disabled | :anonymous  | nil   | 0
 
-    :private  | :private  | :private  | :admin      | 1
-    :private  | :private  | :private  | :reporter   | 1
-    :private  | :private  | :private  | :guest      | 1
-    :private  | :private  | :private  | :non_member | 0
-    :private  | :private  | :private  | :anonymous  | 0
+    :private  | :private  | :private  | :admin      | true  | 1
+    :private  | :private  | :private  | :admin      | false | 0
+    :private  | :private  | :private  | :reporter   | nil   | 1
+    :private  | :private  | :private  | :guest      | nil   | 1
+    :private  | :private  | :private  | :non_member | nil   | 0
+    :private  | :private  | :private  | :anonymous  | nil   | 0
 
-    :private  | :private  | :disabled | :admin      | 1
-    :private  | :private  | :disabled | :reporter   | 1
-    :private  | :private  | :disabled | :guest      | 1
-    :private  | :private  | :disabled | :non_member | 0
-    :private  | :private  | :disabled | :anonymous  | 0
+    :private  | :private  | :disabled | :admin      | true  | 1
+    :private  | :private  | :disabled | :admin      | false | 0
+    :private  | :private  | :disabled | :reporter   | nil   | 1
+    :private  | :private  | :disabled | :guest      | nil   | 1
+    :private  | :private  | :disabled | :non_member | nil   | 0
+    :private  | :private  | :disabled | :anonymous  | nil   | 0
 
-    :private  | :disabled | :private  | :admin      | 1
-    :private  | :disabled | :private  | :reporter   | 1
-    :private  | :disabled | :private  | :guest      | 0
-    :private  | :disabled | :private  | :non_member | 0
-    :private  | :disabled | :private  | :anonymous  | 0
+    :private  | :disabled | :private  | :admin      | true  | 1
+    :private  | :disabled | :private  | :admin      | false | 0
+    :private  | :disabled | :private  | :reporter   | nil   | 1
+    :private  | :disabled | :private  | :guest      | nil   | 0
+    :private  | :disabled | :private  | :non_member | nil   | 0
+    :private  | :disabled | :private  | :anonymous  | nil   | 0
 
-    :private  | :disabled | :disabled | :reporter   | 0
-    :private  | :disabled | :disabled | :guest      | 0
-    :private  | :disabled | :disabled | :non_member | 0
-    :private  | :disabled | :disabled | :anonymous  | 0
+    :private  | :disabled | :disabled | :reporter   | nil   | 0
+    :private  | :disabled | :disabled | :guest      | nil   | 0
+    :private  | :disabled | :disabled | :non_member | nil   | 0
+    :private  | :disabled | :disabled | :anonymous  | nil   | 0
   end
 
   # :project_level, :membership, :expected_count
@@ -321,166 +358,192 @@ RSpec.shared_context 'ProjectPolicyTable context' do
 
   # :snippet_level, :project_level, :feature_access_level, :membership, :expected_count
   def permission_table_for_project_snippet_access
-    :public   | :public   | :enabled  | :admin      | 1
-    :public   | :public   | :enabled  | :reporter   | 1
-    :public   | :public   | :enabled  | :guest      | 1
-    :public   | :public   | :enabled  | :non_member | 1
-    :public   | :public   | :enabled  | :anonymous  | 1
+    :public   | :public   | :enabled  | :admin      | true  | 1
+    :public   | :public   | :enabled  | :admin      | false | 1
+    :public   | :public   | :enabled  | :reporter   | nil   | 1
+    :public   | :public   | :enabled  | :guest      | nil   | 1
+    :public   | :public   | :enabled  | :non_member | nil   | 1
+    :public   | :public   | :enabled  | :anonymous  | nil   | 1
 
-    :public   | :public   | :private  | :admin      | 1
-    :public   | :public   | :private  | :reporter   | 1
-    :public   | :public   | :private  | :guest      | 1
-    :public   | :public   | :private  | :non_member | 0
-    :public   | :public   | :private  | :anonymous  | 0
+    :public   | :public   | :private  | :admin      | true  | 1
+    :public   | :public   | :private  | :admin      | false | 0
+    :public   | :public   | :private  | :reporter   | nil   | 1
+    :public   | :public   | :private  | :guest      | nil   | 1
+    :public   | :public   | :private  | :non_member | nil   | 0
+    :public   | :public   | :private  | :anonymous  | nil   | 0
 
-    :public   | :public   | :disabled | :admin      | 1
-    :public   | :public   | :disabled | :reporter   | 0
-    :public   | :public   | :disabled | :guest      | 0
-    :public   | :public   | :disabled | :non_member | 0
-    :public   | :public   | :disabled | :anonymous  | 0
+    :public   | :public   | :disabled | :admin      | true  | 1
+    :public   | :public   | :disabled | :admin      | false | 0
+    :public   | :public   | :disabled | :reporter   | nil   | 0
+    :public   | :public   | :disabled | :guest      | nil   | 0
+    :public   | :public   | :disabled | :non_member | nil   | 0
+    :public   | :public   | :disabled | :anonymous  | nil   | 0
 
-    :public   | :internal | :enabled  | :admin      | 1
-    :public   | :internal | :enabled  | :reporter   | 1
-    :public   | :internal | :enabled  | :guest      | 1
-    :public   | :internal | :enabled  | :non_member | 1
-    :public   | :internal | :enabled  | :anonymous  | 0
+    :public   | :internal | :enabled  | :admin      | true  | 1
+    :public   | :internal | :enabled  | :admin      | false | 1
+    :public   | :internal | :enabled  | :reporter   | nil   | 1
+    :public   | :internal | :enabled  | :guest      | nil   | 1
+    :public   | :internal | :enabled  | :non_member | nil   | 1
+    :public   | :internal | :enabled  | :anonymous  | nil   | 0
 
-    :public   | :internal | :private  | :admin      | 1
-    :public   | :internal | :private  | :reporter   | 1
-    :public   | :internal | :private  | :guest      | 1
-    :public   | :internal | :private  | :non_member | 0
-    :public   | :internal | :private  | :anonymous  | 0
+    :public   | :internal | :private  | :admin      | true  | 1
+    :public   | :internal | :private  | :admin      | false | 0
+    :public   | :internal | :private  | :reporter   | nil   | 1
+    :public   | :internal | :private  | :guest      | nil   | 1
+    :public   | :internal | :private  | :non_member | nil   | 0
+    :public   | :internal | :private  | :anonymous  | nil   | 0
 
-    :public   | :internal | :disabled | :admin      | 1
-    :public   | :internal | :disabled | :reporter   | 0
-    :public   | :internal | :disabled | :guest      | 0
-    :public   | :internal | :disabled | :non_member | 0
-    :public   | :internal | :disabled | :anonymous  | 0
+    :public   | :internal | :disabled | :admin      | true  | 1
+    :public   | :internal | :disabled | :admin      | false | 0
+    :public   | :internal | :disabled | :reporter   | nil   | 0
+    :public   | :internal | :disabled | :guest      | nil   | 0
+    :public   | :internal | :disabled | :non_member | nil   | 0
+    :public   | :internal | :disabled | :anonymous  | nil   | 0
 
-    :public   | :private  | :private  | :admin      | 1
-    :public   | :private  | :private  | :reporter   | 1
-    :public   | :private  | :private  | :guest      | 1
-    :public   | :private  | :private  | :non_member | 0
-    :public   | :private  | :private  | :anonymous  | 0
+    :public   | :private  | :private  | :admin      | true  | 1
+    :public   | :private  | :private  | :admin      | false | 0
+    :public   | :private  | :private  | :reporter   | nil   | 1
+    :public   | :private  | :private  | :guest      | nil   | 1
+    :public   | :private  | :private  | :non_member | nil   | 0
+    :public   | :private  | :private  | :anonymous  | nil   | 0
 
-    :public   | :private  | :disabled | :reporter   | 0
-    :public   | :private  | :disabled | :guest      | 0
-    :public   | :private  | :disabled | :non_member | 0
-    :public   | :private  | :disabled | :anonymous  | 0
+    :public   | :private  | :disabled | :reporter   | nil   | 0
+    :public   | :private  | :disabled | :guest      | nil   | 0
+    :public   | :private  | :disabled | :non_member | nil   | 0
+    :public   | :private  | :disabled | :anonymous  | nil   | 0
 
-    :internal | :public   | :enabled  | :admin      | 1
-    :internal | :public   | :enabled  | :reporter   | 1
-    :internal | :public   | :enabled  | :guest      | 1
-    :internal | :public   | :enabled  | :non_member | 1
-    :internal | :public   | :enabled  | :anonymous  | 0
+    :internal | :public   | :enabled  | :admin      | true  | 1
+    :internal | :public   | :enabled  | :admin      | false | 1
+    :internal | :public   | :enabled  | :reporter   | nil   | 1
+    :internal | :public   | :enabled  | :guest      | nil   | 1
+    :internal | :public   | :enabled  | :non_member | nil   | 1
+    :internal | :public   | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :public   | :private  | :admin      | 1
-    :internal | :public   | :private  | :reporter   | 1
-    :internal | :public   | :private  | :guest      | 1
-    :internal | :public   | :private  | :non_member | 0
-    :internal | :public   | :private  | :anonymous  | 0
+    :internal | :public   | :private  | :admin      | true  | 1
+    :internal | :public   | :private  | :admin      | false | 0
+    :internal | :public   | :private  | :reporter   | nil   | 1
+    :internal | :public   | :private  | :guest      | nil   | 1
+    :internal | :public   | :private  | :non_member | nil   | 0
+    :internal | :public   | :private  | :anonymous  | nil   | 0
 
-    :internal | :public   | :disabled | :admin      | 1
-    :internal | :public   | :disabled | :reporter   | 0
-    :internal | :public   | :disabled | :guest      | 0
-    :internal | :public   | :disabled | :non_member | 0
-    :internal | :public   | :disabled | :anonymous  | 0
+    :internal | :public   | :disabled | :admin      | true  | 1
+    :internal | :public   | :disabled | :admin      | false | 0
+    :internal | :public   | :disabled | :reporter   | nil   | 0
+    :internal | :public   | :disabled | :guest      | nil   | 0
+    :internal | :public   | :disabled | :non_member | nil   | 0
+    :internal | :public   | :disabled | :anonymous  | nil   | 0
 
-    :internal | :internal | :enabled  | :admin      | 1
-    :internal | :internal | :enabled  | :reporter   | 1
-    :internal | :internal | :enabled  | :guest      | 1
-    :internal | :internal | :enabled  | :non_member | 1
-    :internal | :internal | :enabled  | :anonymous  | 0
+    :internal | :internal | :enabled  | :admin      | true  | 1
+    :internal | :internal | :enabled  | :admin      | false | 1
+    :internal | :internal | :enabled  | :reporter   | nil   | 1
+    :internal | :internal | :enabled  | :guest      | nil   | 1
+    :internal | :internal | :enabled  | :non_member | nil   | 1
+    :internal | :internal | :enabled  | :anonymous  | nil   | 0
 
-    :internal | :internal | :private  | :admin      | 1
-    :internal | :internal | :private  | :reporter   | 1
-    :internal | :internal | :private  | :guest      | 1
-    :internal | :internal | :private  | :non_member | 0
-    :internal | :internal | :private  | :anonymous  | 0
+    :internal | :internal | :private  | :admin      | true  | 1
+    :internal | :internal | :private  | :admin      | false | 0
+    :internal | :internal | :private  | :reporter   | nil   | 1
+    :internal | :internal | :private  | :guest      | nil   | 1
+    :internal | :internal | :private  | :non_member | nil   | 0
+    :internal | :internal | :private  | :anonymous  | nil   | 0
 
-    :internal | :internal | :disabled | :admin      | 1
-    :internal | :internal | :disabled | :reporter   | 0
-    :internal | :internal | :disabled | :guest      | 0
-    :internal | :internal | :disabled | :non_member | 0
-    :internal | :internal | :disabled | :anonymous  | 0
+    :internal | :internal | :disabled | :admin      | true  | 1
+    :internal | :internal | :disabled | :admin      | false | 0
+    :internal | :internal | :disabled | :reporter   | nil   | 0
+    :internal | :internal | :disabled | :guest      | nil   | 0
+    :internal | :internal | :disabled | :non_member | nil   | 0
+    :internal | :internal | :disabled | :anonymous  | nil   | 0
 
-    :internal | :private  | :private  | :admin      | 1
-    :internal | :private  | :private  | :reporter   | 1
-    :internal | :private  | :private  | :guest      | 1
-    :internal | :private  | :private  | :non_member | 0
-    :internal | :private  | :private  | :anonymous  | 0
+    :internal | :private  | :private  | :admin      | true  | 1
+    :internal | :private  | :private  | :admin      | false | 0
+    :internal | :private  | :private  | :reporter   | nil   | 1
+    :internal | :private  | :private  | :guest      | nil   | 1
+    :internal | :private  | :private  | :non_member | nil   | 0
+    :internal | :private  | :private  | :anonymous  | nil   | 0
 
-    :internal | :private  | :disabled | :admin      | 1
-    :internal | :private  | :disabled | :reporter   | 0
-    :internal | :private  | :disabled | :guest      | 0
-    :internal | :private  | :disabled | :non_member | 0
-    :internal | :private  | :disabled | :anonymous  | 0
+    :internal | :private  | :disabled | :admin      | true  | 1
+    :internal | :private  | :disabled | :admin      | false | 0
+    :internal | :private  | :disabled | :reporter   | nil   | 0
+    :internal | :private  | :disabled | :guest      | nil   | 0
+    :internal | :private  | :disabled | :non_member | nil   | 0
+    :internal | :private  | :disabled | :anonymous  | nil   | 0
 
-    :private  | :public   | :enabled  | :admin      | 1
-    :private  | :public   | :enabled  | :reporter   | 1
-    :private  | :public   | :enabled  | :guest      | 1
-    :private  | :public   | :enabled  | :non_member | 0
-    :private  | :public   | :enabled  | :anonymous  | 0
+    :private  | :public   | :enabled  | :admin      | true  | 1
+    :private  | :public   | :enabled  | :admin      | false | 0
+    :private  | :public   | :enabled  | :reporter   | nil   | 1
+    :private  | :public   | :enabled  | :guest      | nil   | 1
+    :private  | :public   | :enabled  | :non_member | nil   | 0
+    :private  | :public   | :enabled  | :anonymous  | nil   | 0
 
-    :private  | :public   | :private  | :admin      | 1
-    :private  | :public   | :private  | :reporter   | 1
-    :private  | :public   | :private  | :guest      | 1
-    :private  | :public   | :private  | :non_member | 0
-    :private  | :public   | :private  | :anonymous  | 0
+    :private  | :public   | :private  | :admin      | true  | 1
+    :private  | :public   | :private  | :admin      | false | 0
+    :private  | :public   | :private  | :reporter   | nil   | 1
+    :private  | :public   | :private  | :guest      | nil   | 1
+    :private  | :public   | :private  | :non_member | nil   | 0
+    :private  | :public   | :private  | :anonymous  | nil   | 0
 
-    :private  | :public   | :disabled | :admin      | 1
-    :private  | :public   | :disabled | :reporter   | 0
-    :private  | :public   | :disabled | :guest      | 0
-    :private  | :public   | :disabled | :non_member | 0
-    :private  | :public   | :disabled | :anonymous  | 0
+    :private  | :public   | :disabled | :admin      | true  | 1
+    :private  | :public   | :disabled | :admin      | false | 0
+    :private  | :public   | :disabled | :reporter   | nil   | 0
+    :private  | :public   | :disabled | :guest      | nil   | 0
+    :private  | :public   | :disabled | :non_member | nil   | 0
+    :private  | :public   | :disabled | :anonymous  | nil   | 0
 
-    :private  | :internal | :enabled  | :admin      | 1
-    :private  | :internal | :enabled  | :reporter   | 1
-    :private  | :internal | :enabled  | :guest      | 1
-    :private  | :internal | :enabled  | :non_member | 0
-    :private  | :internal | :enabled  | :anonymous  | 0
+    :private  | :internal | :enabled  | :admin      | true  | 1
+    :private  | :internal | :enabled  | :admin      | false | 0
+    :private  | :internal | :enabled  | :reporter   | nil   | 1
+    :private  | :internal | :enabled  | :guest      | nil   | 1
+    :private  | :internal | :enabled  | :non_member | nil   | 0
+    :private  | :internal | :enabled  | :anonymous  | nil   | 0
 
-    :private  | :internal | :private  | :admin      | 1
-    :private  | :internal | :private  | :reporter   | 1
-    :private  | :internal | :private  | :guest      | 1
-    :private  | :internal | :private  | :non_member | 0
-    :private  | :internal | :private  | :anonymous  | 0
+    :private  | :internal | :private  | :admin      | true  | 1
+    :private  | :internal | :private  | :admin      | false | 0
+    :private  | :internal | :private  | :reporter   | nil   | 1
+    :private  | :internal | :private  | :guest      | nil   | 1
+    :private  | :internal | :private  | :non_member | nil   | 0
+    :private  | :internal | :private  | :anonymous  | nil   | 0
 
-    :private  | :internal | :disabled | :admin      | 1
-    :private  | :internal | :disabled | :reporter   | 0
-    :private  | :internal | :disabled | :guest      | 0
-    :private  | :internal | :disabled | :non_member | 0
-    :private  | :internal | :disabled | :anonymous  | 0
+    :private  | :internal | :disabled | :admin      | true  | 1
+    :private  | :internal | :disabled | :admin      | false | 0
+    :private  | :internal | :disabled | :reporter   | nil   | 0
+    :private  | :internal | :disabled | :guest      | nil   | 0
+    :private  | :internal | :disabled | :non_member | nil   | 0
+    :private  | :internal | :disabled | :anonymous  | nil   | 0
 
-    :private  | :private  | :private  | :admin      | 1
-    :private  | :private  | :private  | :reporter   | 1
-    :private  | :private  | :private  | :guest      | 1
-    :private  | :private  | :private  | :non_member | 0
-    :private  | :private  | :private  | :anonymous  | 0
+    :private  | :private  | :private  | :admin      | true  | 1
+    :private  | :private  | :private  | :admin      | false | 0
+    :private  | :private  | :private  | :reporter   | nil   | 1
+    :private  | :private  | :private  | :guest      | nil   | 1
+    :private  | :private  | :private  | :non_member | nil   | 0
+    :private  | :private  | :private  | :anonymous  | nil   | 0
 
-    :private  | :private  | :disabled | :admin      | 1
-    :private  | :private  | :disabled | :reporter   | 0
-    :private  | :private  | :disabled | :guest      | 0
-    :private  | :private  | :disabled | :non_member | 0
-    :private  | :private  | :disabled | :anonymous  | 0
+    :private  | :private  | :disabled | :admin      | true  | 1
+    :private  | :private  | :disabled | :admin      | false | 0
+    :private  | :private  | :disabled | :reporter   | nil   | 0
+    :private  | :private  | :disabled | :guest      | nil   | 0
+    :private  | :private  | :disabled | :non_member | nil   | 0
+    :private  | :private  | :disabled | :anonymous  | nil   | 0
   end
 
   # :snippet_level, :membership, :expected_count
   def permission_table_for_personal_snippet_access
-    :public   | :admin      | 1
-    :public   | :author     | 1
-    :public   | :non_member | 1
-    :public   | :anonymous  | 1
+    :public   | :admin      | true  | 1
+    :public   | :admin      | false | 1
+    :public   | :author     | nil   | 1
+    :public   | :non_member | nil   | 1
+    :public   | :anonymous  | nil   | 1
 
-    :internal | :admin      | 1
-    :internal | :author     | 1
-    :internal | :non_member | 1
-    :internal | :anonymous  | 0
+    :internal | :admin      | true  | 1
+    :internal | :admin      | false | 1
+    :internal | :author     | nil   | 1
+    :internal | :non_member | nil   | 1
+    :internal | :anonymous  | nil   | 0
 
-    :private  | :admin      | 1
-    :private  | :author     | 1
-    :private  | :non_member | 0
-    :private  | :anonymous  | 0
+    :private  | :admin      | true  | 1
+    :private  | :admin      | false | 0
+    :private  | :author     | nil   | 1
+    :private  | :non_member | nil   | 0
+    :private  | :anonymous  | nil   | 0
   end
   # rubocop:enable Metrics/AbcSize
 end
diff --git a/spec/support/shared_contexts/requests/api/npm_packages_shared_context.rb b/spec/support/shared_contexts/requests/api/npm_packages_shared_context.rb
new file mode 100644
index 00000000000..7c23ec33cf8
--- /dev/null
+++ b/spec/support/shared_contexts/requests/api/npm_packages_shared_context.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+RSpec.shared_context 'npm api setup' do
+  include PackagesManagerApiSpecHelpers
+  include HttpBasicAuthHelpers
+
+  let_it_be(:user) { create(:user) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project, reload: true) { create(:project, :public, namespace: group) }
+  let_it_be(:package, reload: true) { create(:npm_package, project: project) }
+  let_it_be(:token) { create(:oauth_access_token, scopes: 'api', resource_owner: user) }
+  let_it_be(:personal_access_token) { create(:personal_access_token, user: user) }
+  let_it_be(:job, reload: true) { create(:ci_build, user: user, status: :running) }
+  let_it_be(:deploy_token) { create(:deploy_token, read_package_registry: true, write_package_registry: true) }
+  let_it_be(:project_deploy_token) { create(:project_deploy_token, deploy_token: deploy_token, project: project) }
+
+  let(:package_name) { package.name }
+
+  before do
+    project.add_developer(user)
+  end
+end
diff --git a/spec/support/shared_examples/requests/api/npm_packages_shared_examples.rb b/spec/support/shared_examples/requests/api/npm_packages_shared_examples.rb
new file mode 100644
index 00000000000..d3ad7aa0595
--- /dev/null
+++ b/spec/support/shared_examples/requests/api/npm_packages_shared_examples.rb
@@ -0,0 +1,270 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'handling get metadata requests' do
+  let_it_be(:package_dependency_link1) { create(:packages_dependency_link, package: package, dependency_type: :dependencies) }
+  let_it_be(:package_dependency_link2) { create(:packages_dependency_link, package: package, dependency_type: :devDependencies) }
+  let_it_be(:package_dependency_link3) { create(:packages_dependency_link, package: package, dependency_type: :bundleDependencies) }
+  let_it_be(:package_dependency_link4) { create(:packages_dependency_link, package: package, dependency_type: :peerDependencies) }
+
+  let(:params) { {} }
+  let(:headers) { {} }
+
+  subject { get(url, params: params, headers: headers) }
+
+  shared_examples 'returning the npm package info' do
+    it 'returns the package info' do
+      subject
+
+      expect_a_valid_package_response
+    end
+  end
+
+  shared_examples 'a package that requires auth' do
+    it 'denies request without oauth token' do
+      subject
+
+      expect(response).to have_gitlab_http_status(:not_found)
+    end
+
+    context 'with oauth token' do
+      let(:params) { { access_token: token.token } }
+
+      it 'returns the package info with oauth token' do
+        subject
+
+        expect_a_valid_package_response
+      end
+    end
+
+    context 'with job token' do
+      let(:params) { { job_token: job.token } }
+
+      it 'returns the package info with running job token' do
+        subject
+
+        expect_a_valid_package_response
+      end
+
+      it 'denies request without running job token' do
+        job.update!(status: :success)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:unauthorized)
+      end
+    end
+
+    context 'with deploy token' do
+      let(:headers) { build_token_auth_header(deploy_token.token) }
+
+      it 'returns the package info with deploy token' do
+        subject
+
+        expect_a_valid_package_response
+      end
+    end
+  end
+
+  context 'a public project' do
+    it_behaves_like 'returning the npm package info'
+
+    context 'project path with a dot' do
+      before do
+        project.update!(path: 'foo.bar')
+      end
+
+      it_behaves_like 'returning the npm package info'
+    end
+
+    context 'with request forward disabled' do
+      before do
+        stub_application_setting(npm_package_requests_forwarding: false)
+      end
+
+      it_behaves_like 'returning the npm package info'
+
+      context 'with unknown package' do
+        let(:package_name) { 'unknown' }
+
+        it 'returns the proper response' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'with request forward enabled' do
+      before do
+        stub_application_setting(npm_package_requests_forwarding: true)
+      end
+
+      it_behaves_like 'returning the npm package info'
+
+      context 'with unknown package' do
+        let(:package_name) { 'unknown' }
+
+        it 'returns a redirect' do
+          subject
+
+          expect(response).to have_gitlab_http_status(:found)
+          expect(response.headers['Location']).to eq('https://registry.npmjs.org/unknown')
+        end
+
+        it_behaves_like 'a gitlab tracking event', described_class.name, 'npm_request_forward'
+      end
+    end
+  end
+
+  context 'internal project' do
+    before do
+      project.update!(visibility_level: Gitlab::VisibilityLevel::INTERNAL)
+    end
+
+    it_behaves_like 'a package that requires auth'
+  end
+
+  context 'private project' do
+    before do
+      project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+    end
+
+    it_behaves_like 'a package that requires auth'
+
+    context 'with guest' do
+      let(:params) { { access_token: token.token } }
+
+      it 'denies request when not enough permissions' do
+        project.add_guest(user)
+
+        subject
+
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
+    end
+  end
+
+  def expect_a_valid_package_response
+    expect(response).to have_gitlab_http_status(:ok)
+    expect(response.media_type).to eq('application/json')
+    expect(response).to match_response_schema('public_api/v4/packages/npm_package')
+    expect(json_response['name']).to eq(package.name)
+    expect(json_response['versions'][package.version]).to match_schema('public_api/v4/packages/npm_package_version')
+    ::Packages::Npm::PackagePresenter::NPM_VALID_DEPENDENCY_TYPES.each do |dependency_type|
+      expect(json_response.dig('versions', package.version, dependency_type.to_s)).to be_any
+    end
+    expect(json_response['dist-tags']).to match_schema('public_api/v4/packages/npm_package_tags')
+  end
+end
+
+RSpec.shared_examples 'handling get dist tags requests' do
+  let_it_be(:package_tag1) { create(:packages_tag, package: package) }
+  let_it_be(:package_tag2) { create(:packages_tag, package: package) }
+
+  let(:params) { {} }
+
+  subject { get(url, params: params) }
+
+  context 'with public project' do
+    context 'with authenticated user' do
+      let(:params) { { private_token: personal_access_token.token } }
+
+      it_behaves_like 'returns package tags', :maintainer
+      it_behaves_like 'returns package tags', :developer
+      it_behaves_like 'returns package tags', :reporter
+      it_behaves_like 'returns package tags', :guest
+    end
+
+    context 'with unauthenticated user' do
+      it_behaves_like 'returns package tags', :no_type
+    end
+  end
+
+  context 'with private project' do
+    before do
+      project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+    end
+
+    context 'with authenticated user' do
+      let(:params) { { private_token: personal_access_token.token } }
+
+      it_behaves_like 'returns package tags', :maintainer
+      it_behaves_like 'returns package tags', :developer
+      it_behaves_like 'returns package tags', :reporter
+      it_behaves_like 'rejects package tags access', :guest, :forbidden
+    end
+
+    context 'with unauthenticated user' do
+      it_behaves_like 'rejects package tags access', :no_type, :not_found
+    end
+  end
+end
+
+RSpec.shared_examples 'handling create dist tag requests' do
+  let_it_be(:tag_name) { 'test' }
+
+  let(:params) { {} }
+  let(:env) { {} }
+  let(:version) { package.version }
+
+  subject { put(url, env: env, params: params) }
+
+  context 'with public project' do
+    context 'with authenticated user' do
+      let(:params) { { private_token: personal_access_token.token } }
+      let(:env) { { 'api.request.body': version } }
+
+      it_behaves_like 'create package tag', :maintainer
+      it_behaves_like 'create package tag', :developer
+      it_behaves_like 'rejects package tags access', :reporter, :forbidden
+      it_behaves_like 'rejects package tags access', :guest, :forbidden
+    end
+
+    context 'with unauthenticated user' do
+      it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+    end
+  end
+end
+
+RSpec.shared_examples 'handling delete dist tag requests' do
+  let_it_be(:package_tag) { create(:packages_tag, package: package) }
+
+  let(:params) { {} }
+  let(:tag_name) { package_tag.name }
+
+  subject { delete(url, params: params) }
+
+  context 'with public project' do
+    context 'with authenticated user' do
+      let(:params) { { private_token: personal_access_token.token } }
+
+      it_behaves_like 'delete package tag', :maintainer
+      it_behaves_like 'rejects package tags access', :developer, :forbidden
+      it_behaves_like 'rejects package tags access', :reporter, :forbidden
+      it_behaves_like 'rejects package tags access', :guest, :forbidden
+    end
+
+    context 'with unauthenticated user' do
+      it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+    end
+  end
+
+  context 'with private project' do
+    before do
+      project.update!(visibility_level: Gitlab::VisibilityLevel::PRIVATE)
+    end
+
+    context 'with authenticated user' do
+      let(:params) { { private_token: personal_access_token.token } }
+
+      it_behaves_like 'delete package tag', :maintainer
+      it_behaves_like 'rejects package tags access', :developer, :forbidden
+      it_behaves_like 'rejects package tags access', :reporter, :forbidden
+      it_behaves_like 'rejects package tags access', :guest, :forbidden
+    end
+
+    context 'with unauthenticated user' do
+      it_behaves_like 'rejects package tags access', :no_type, :unauthorized
+    end
+  end
+end
diff --git a/spec/support/shared_examples/requests/api/packages_tags_shared_examples.rb b/spec/support/shared_examples/requests/api/packages_tags_shared_examples.rb
index a371d380f47..2c203dc096e 100644
--- a/spec/support/shared_examples/requests/api/packages_tags_shared_examples.rb
+++ b/spec/support/shared_examples/requests/api/packages_tags_shared_examples.rb
@@ -40,7 +40,7 @@ RSpec.shared_examples 'returns package tags' do |user_type|
   context 'with invalid package name' do
     where(:package_name, :status) do
       '%20' | :bad_request
-      nil   | :forbidden
+      nil   | :not_found
     end
 
     with_them do
@@ -95,7 +95,7 @@ RSpec.shared_examples 'create package tag' do |user_type|
 
   context 'with invalid package name' do
     where(:package_name, :status) do
-      'unknown' | :forbidden
+      'unknown' | :not_found
       ''        | :not_found
       '%20'     | :bad_request
     end
@@ -160,7 +160,7 @@ RSpec.shared_examples 'delete package tag' do |user_type|
 
     context 'with invalid package name' do
       where(:package_name, :status) do
-        'unknown' | :forbidden
+        'unknown' | :not_found
         ''        | :not_found
         '%20'     | :bad_request
       end
diff --git a/spec/workers/jira_connect/sync_project_worker_spec.rb b/spec/workers/jira_connect/sync_project_worker_spec.rb
new file mode 100644
index 00000000000..25210de828c
--- /dev/null
+++ b/spec/workers/jira_connect/sync_project_worker_spec.rb
@@ -0,0 +1,77 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe JiraConnect::SyncProjectWorker, factory_default: :keep do
+  describe '#perform' do
+    let_it_be(:project) { create_default(:project) }
+    let!(:mr_with_jira_title) { create(:merge_request, :unique_branches, title: 'TEST-123') }
+    let!(:mr_with_jira_description) { create(:merge_request, :unique_branches, description: 'TEST-323') }
+    let!(:mr_with_other_title) { create(:merge_request, :unique_branches) }
+    let!(:jira_subscription) { create(:jira_connect_subscription, namespace: project.namespace) }
+
+    let(:jira_connect_sync_service) { JiraConnect::SyncService.new(project) }
+    let(:job_args) { [project.id, update_sequence_id] }
+    let(:update_sequence_id) { 1 }
+
+    before do
+      stub_request(:post, 'https://sample.atlassian.net/rest/devinfo/0.10/bulk').to_return(status: 200, body: '', headers: {})
+
+      jira_connect_sync_service
+      allow(JiraConnect::SyncService).to receive(:new) { jira_connect_sync_service }
+    end
+
+    context 'when the project is not found' do
+      it 'does not raise an error' do
+        expect { described_class.new.perform('non_existing_record_id', update_sequence_id) }.not_to raise_error
+      end
+    end
+
+    it 'avoids N+1 database queries' do
+      control_count = ActiveRecord::QueryRecorder.new { described_class.new.perform(project.id, update_sequence_id) }.count
+
+      create(:merge_request, :unique_branches, title: 'TEST-123')
+
+      expect { described_class.new.perform(project.id, update_sequence_id) }.not_to exceed_query_limit(control_count)
+    end
+
+    it_behaves_like 'an idempotent worker' do
+      let(:request_url) { 'https://sample.atlassian.net/rest/devinfo/0.10/bulk' }
+      let(:request_body) do
+        {
+          repositories: [
+            Atlassian::JiraConnect::Serializers::RepositoryEntity.represent(
+              project,
+              merge_requests: [mr_with_jira_description, mr_with_jira_title],
+              update_sequence_id: update_sequence_id
+            )
+          ]
+        }.to_json
+      end
+
+      it 'sends the request with custom update_sequence_id' do
+        expect(Atlassian::JiraConnect::Client).to receive(:post)
+          .exactly(IdempotentWorkerHelper::WORKER_EXEC_TIMES).times
+          .with(URI(request_url), headers: anything, body: request_body)
+
+        subject
+      end
+
+      context 'when the number of merge requests to sync is higher than the limit' do
+        let!(:most_recent_merge_request) { create(:merge_request, :unique_branches, description: 'TEST-323', title: 'TEST-123') }
+
+        before do
+          stub_const("#{described_class}::MERGE_REQUEST_LIMIT", 1)
+        end
+
+        it 'syncs only the most recent merge requests within the limit' do
+          expect(jira_connect_sync_service).to receive(:execute)
+            .exactly(IdempotentWorkerHelper::WORKER_EXEC_TIMES).times
+            .with(merge_requests: [most_recent_merge_request], update_sequence_id: update_sequence_id)
+
+          subject
+        end
+      end
+    end
+  end
+end