Add latest changes from gitlab-org/gitlab@master

GITALY_SERVER_VERSION

@@ -1 +1 @@
-23975a577f6d405769e87726ba642ca7e3761230
+b98431224ef98fdd8186cc01c064708e4bceb419

app/assets/stylesheets/framework/typography.scss

@@ -41,6 +41,9 @@
 
   img {
     max-width: 100%;
+  }
+
+  img[width][height] {
     object-fit: contain;
     object-position: top;
     height: auto;

app/controllers/groups/dependency_proxies_controller.rb

@@ -6,7 +6,7 @@ module Groups
 
     before_action :verify_dependency_proxy_enabled!
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
 
     private

app/controllers/groups/dependency_proxy_auth_controller.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 class Groups::DependencyProxyAuthController < ::Groups::DependencyProxy::ApplicationController
-  feature_category :dependency_proxy
+  feature_category :virtual_registry
   urgency :low
 
   def authenticate

app/controllers/groups/dependency_proxy_for_containers_controller.rb

@@ -15,7 +15,7 @@ class Groups::DependencyProxyForContainersController < ::Groups::DependencyProxy
 
   attr_reader :token
 
-  feature_category :dependency_proxy
+  feature_category :virtual_registry
   urgency :low
 
   def manifest

app/finders/concerns/finder_with_group_hierarchy.rb

@@ -75,6 +75,11 @@ module FinderWithGroupHierarchy
   end
 
   def preload_associations(groups)
+    ActiveRecord::Associations::Preloader.new(
+      records: groups,
+      associations: [:organization]
+    ).call
+
     Preloaders::UserMaxAccessLevelInGroupsPreloader.new(groups, current_user).execute
   end
 end

app/models/group.rb

@@ -729,7 +729,7 @@ class Group < Namespace
 
     unless only_concrete_membership
       return GroupMember::OWNER if user.can_admin_all_resources?
-      return GroupMember::OWNER if user.can_admin_organization?(organization_id)
+      return GroupMember::OWNER if user.can_admin_organization?(organization)
     end
 
     max_member_access(user)

app/models/preloaders/group_policy_preloader.rb

@@ -8,6 +8,11 @@ module Preloaders
     end
 
     def execute
+      ActiveRecord::Associations::Preloader.new(
+        records: groups,
+        associations: [:organization]
+      ).call
+
       Preloaders::UserMaxAccessLevelInGroupsPreloader.new(groups, current_user).execute
     end
 

app/models/user.rb

@@ -2145,7 +2145,7 @@ class User < MainClusterwide::ApplicationRecord
   end
 
   def can_admin_organization?(organization)
-    owns_organization?(organization)
+    can?(:admin_organization, organization)
   end
 
   def update_two_factor_requirement

app/policies/group_policy.rb

@@ -34,13 +34,11 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
 
   desc "User owns the group's organization"
   condition(:organization_owner) do
-    if @user.is_a?(User)
-      @user.owns_organization?(@subject.organization_id)
-    else
-      false
-    end
+    owns_group_organization?
   end
 
+  rule { admin | organization_owner }.enable :admin_organization
+
   with_options scope: :subject, score: 0
   condition(:request_access_enabled) { @subject.request_access_enabled }
 
@@ -456,6 +454,21 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
   def valid_dependency_proxy_deploy_token
     @user.is_a?(DeployToken) && @user&.valid_for_dependency_proxy? && @user&.has_access_to_group?(@subject)
   end
+
+  # rubocop:disable Cop/UserAdmin -- specifically check the admin attribute
+  def owns_group_organization?
+    return false unless @user
+    return false unless user_is_user?
+    return false unless @subject.organization
+    # Ensure admins can't bypass admin mode.
+    return false if @user.admin? && !can?(:admin)
+
+    # Load the owners with a single query.
+    @subject.organization
+            .owner_user_ids
+            .include?(@user.id)
+  end
+  # rubocop:enable Cop/UserAdmin
 end
 
 GroupPolicy.prepend_mod_with('GroupPolicy')

app/workers/all_queues.yml

@@ -464,7 +464,7 @@
   :tags: []
 - :name: cronjob:dependency_proxy_cleanup_dependency_proxy
   :worker_name: DependencyProxy::CleanupDependencyProxyWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -473,7 +473,7 @@
   :tags: []
 - :name: cronjob:dependency_proxy_image_ttl_group_policy
   :worker_name: DependencyProxy::ImageTtlGroupPolicyWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -1004,7 +1004,7 @@
   :tags: []
 - :name: dependency_proxy:purge_dependency_proxy_cache
   :worker_name: PurgeDependencyProxyCacheWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -1013,7 +1013,7 @@
   :tags: []
 - :name: dependency_proxy_blob:dependency_proxy_cleanup_blob
   :worker_name: DependencyProxy::CleanupBlobWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown
@@ -1022,7 +1022,7 @@
   :tags: []
 - :name: dependency_proxy_manifest:dependency_proxy_cleanup_manifest
   :worker_name: DependencyProxy::CleanupManifestWorker
-  :feature_category: :dependency_proxy
+  :feature_category: :virtual_registry
   :has_external_dependencies: false
   :urgency: :low
   :resource_boundary: :unknown

app/workers/dependency_proxy/cleanup_blob_worker.rb

@@ -11,7 +11,7 @@ module DependencyProxy
     sidekiq_options retry: 3
 
     queue_namespace :dependency_proxy_blob
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
     worker_resource_boundary :unknown
     idempotent!

app/workers/dependency_proxy/cleanup_dependency_proxy_worker.rb

@@ -8,7 +8,7 @@ module DependencyProxy
     data_consistency :always
     idempotent!
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
 
     def perform
       enqueue_blob_cleanup_job if DependencyProxy::Blob.pending_destruction.any?

app/workers/dependency_proxy/cleanup_manifest_worker.rb

@@ -11,7 +11,7 @@ module DependencyProxy
     sidekiq_options retry: 3
 
     queue_namespace :dependency_proxy_manifest
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
     worker_resource_boundary :unknown
     idempotent!

app/workers/dependency_proxy/image_ttl_group_policy_worker.rb

@@ -8,7 +8,7 @@ module DependencyProxy
 
     data_consistency :always
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
 
     def perform
       DependencyProxy::ImageTtlGroupPolicy.enabled.each do |policy|

app/workers/purge_dependency_proxy_cache_worker.rb

@@ -11,7 +11,7 @@ class PurgeDependencyProxyCacheWorker
   idempotent!
 
   queue_namespace :dependency_proxy
-  feature_category :dependency_proxy
+  feature_category :virtual_registry
 
   def perform(current_user_id, group_id)
     @current_user = User.find_by_id(current_user_id)

config/bounded_contexts.yml

@@ -112,7 +112,7 @@ domains:
   DependencyProxy:
     description:
     feature_categories:
-      - dependency_proxy
+      - virtual_registry
       - package_registry
 
   DesignManagement:
@@ -137,10 +137,8 @@ domains:
     description:
     feature_categories:
       - seat_cost_management
-      - saas_provisioning
-      - sm_provisioning
+      - plan_provisioning
       - subscription_management
-      - purchase
 
   Import:
     description:

config/feature_categories.yml

@@ -9,6 +9,7 @@
 ---
 - acquisition
 - activation
+- add-on_provisioning
 - advisory_database
 - ai_abstraction_layer
 - ai_agents
@@ -33,7 +34,6 @@
 - code_search
 - code_suggestions
 - code_testing
-- commerce_integrations
 - compliance_management
 - consumables_cost_management
 - container_registry
@@ -41,14 +41,13 @@
 - continuous_delivery
 - continuous_integration
 - custom_models
-- customersdot_application
+- customersdot_and_quote_to_cash_integrations
 - database
 - dataops
 - dedicated
 - delivery
 - dependency_firewall
 - dependency_management
-- dependency_proxy
 - deployment_management
 - design_management
 - design_system
@@ -64,13 +63,12 @@
 - feature_flags
 - five_minute_production_app
 - fleet_visibility
-- fulfillment_admin_tooling
-- fulfillment_infrastructure
+- fulfillment_infradev
+- fulfillment_internal_admin_tooling
 - fuzz_testing
 - geo_replication
 - gitaly
 - gitlab_cli
-- gitlab_docs
 - global_search
 - groups_and_projects
 - helm_chart_registry
@@ -89,6 +87,7 @@
 - mlops
 - mobile_devops
 - navigation
+- notifications
 - okr_management
 - omnibus_package
 - on_call_schedule_management
@@ -98,11 +97,11 @@
 - pages
 - permissions
 - pipeline_composition
+- plan_provisioning
 - portfolio_management
 - product_analytics_data_management
 - product_analytics_visualization
 - pubsec_services
-- purchase
 - quality_management
 - rate_limiting
 - redis
@@ -112,7 +111,6 @@
 - requirements_management
 - review_apps
 - runner
-- saas_provisioning
 - sbom
 - scalability
 - seat_cost_management
@@ -121,7 +119,7 @@
 - security_policy_management
 - service_desk
 - service_ping
-- sm_provisioning
+- settings
 - software_composition_analysis
 - source_code_management
 - static_application_security_testing
@@ -133,6 +131,7 @@
 - user_management
 - user_profile
 - value_stream_management
+- virtual_registry
 - vulnerability_management
 - web_ide
 - webhooks

db/docs/ci_minutes_additional_packs.yml

@@ -3,7 +3,6 @@ table_name: ci_minutes_additional_packs
 classes:
 - Ci::Minutes::AdditionalPack
 feature_categories:
-- purchase
 - consumables_cost_management
 description: Stores CI minutes purchases for a given namespace with fields for synchronizing
   and expiring available minutes between Customers Portal and GitLab.

db/docs/dependency_proxy_blobs.yml

@@ -3,7 +3,7 @@ table_name: dependency_proxy_blobs
 classes:
 - DependencyProxy::Blob
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Dependency proxy blob files
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/10676
 milestone: '11.11'

db/docs/dependency_proxy_group_settings.yml

@@ -3,7 +3,7 @@ table_name: dependency_proxy_group_settings
 classes:
 - DependencyProxy::GroupSetting
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Group-level settings for the dependency proxy
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/10676
 milestone: '11.11'

db/docs/dependency_proxy_image_ttl_group_policies.yml

@@ -3,7 +3,7 @@ table_name: dependency_proxy_image_ttl_group_policies
 classes:
 - DependencyProxy::ImageTtlGroupPolicy
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Group-level settings for dependency proxy cleanup policies
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68809
 milestone: '14.3'

db/docs/dependency_proxy_manifests.yml

@@ -3,7 +3,7 @@ table_name: dependency_proxy_manifests
 classes:
 - DependencyProxy::Manifest
 feature_categories:
-- dependency_proxy
+- virtual_registry
 description: Dependency proxy manifest files
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/48535
 milestone: '13.7'

db/docs/gitlab_subscription_histories.yml

@@ -3,7 +3,7 @@ table_name: gitlab_subscription_histories
 classes:
 - GitlabSubscriptionHistory
 feature_categories:
-- purchase
+- subscription_management
 description: History log for the gitlab_subscriptions table
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/19694
 milestone: '12.6'

db/docs/gitlab_subscriptions.yml

@@ -3,7 +3,7 @@ table_name: gitlab_subscriptions
 classes:
 - GitlabSubscription
 feature_categories:
-- purchase
+- subscription_management
 description: Used to store information related to GitLab subscriptions
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/7885
 milestone: '11.6'

db/docs/historical_data.yml

@@ -3,7 +3,7 @@ table_name: historical_data
 classes:
 - HistoricalData
 feature_categories:
-- sm_provisioning
+- plan_provisioning
 - seat_cost_management
 description: Stores seat usage data as active_user_count. Used in service ping analytics, cloud licensing, user limits, and renewal workflows.
 introduced_by_url: https://dev.gitlab.org/gitlab/gitlab-ee/-/merge_requests/390

db/docs/licenses.yml

@@ -3,7 +3,7 @@ table_name: licenses
 classes:
 - License
 feature_categories:
-- purchase
+- subscription_management
 description: Used to store information related to the instance's license
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/d1f2b09fadcfba210c5121bd214b910b9f9809fd
 milestone: '7.11'

db/docs/plan_limits.yml

@@ -3,7 +3,7 @@ table_name: plan_limits
 classes:
 - PlanLimits
 feature_categories:
-- purchase
+- plan_provisioning
 description: Contains Plan specific limits (CI minute quantities for example)
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/19438
 milestone: '12.5'

db/docs/plans.yml

@@ -3,7 +3,7 @@ table_name: plans
 classes:
 - Plan
 feature_categories:
-- purchase
+- plan_provisioning
 description: Contains information about purchasable Plans for GitLab namespaces
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/commit/39ca951a0f28d147d4689379bbe48a9c14d55d9f
 milestone: '9.5'

db/docs/upcoming_reconciliations.yml

@@ -3,7 +3,7 @@ table_name: upcoming_reconciliations
 classes:
 - GitlabSubscriptions::UpcomingReconciliation
 feature_categories:
-- purchase
+- subscription_management
 description: Stores the data needed to notify a user of an upcoming reconciliation
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/63054
 milestone: '14.0'

db/docs/user_credit_card_validations.yml

@@ -3,7 +3,7 @@ table_name: user_credit_card_validations
 classes:
 - Users::CreditCardValidation
 feature_categories:
-- purchase
+- subscription_management
 description: Stores whether the user has completed a first time validation to run CI pipelines
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/60626
 milestone: '13.12'

doc/user/project/integrations/webhooks.md

@@ -136,6 +136,13 @@ with the data for the current event. The template must render as valid JSON.
 You can use any field from the [payload of any event](webhook_events.md), such as `{{build_name}}` for a job event and `{{deployable_url}}`
 for a deployment event. To access properties nested in objects, specify the path segments separated with `.`. For example:
 
+#### Known issue
+
+Custom webhook templates can't access properties in arrays. Support for accessing properties in arrays is proposed in
+[issue 463332](https://gitlab.com/gitlab-org/gitlab/-/issues/463332).
+
+#### Example
+
 Given this custom payload template:
 
 ```json
@@ -154,9 +161,6 @@ You'll have this request payload that combines the template with a `push` event:
 }
 ```
 
-Custom webhook templates do not support accessing properties that are in arrays. Support for this is proposed in
-[issue 463332](https://gitlab.com/gitlab-org/gitlab/-/issues/463332).
-
 ### Filter push events by branch
 
 You can filter push events by branch. Use one of the following options to filter which push events are sent to your webhook endpoint:

lib/api/dependency_proxy.rb

@@ -4,7 +4,7 @@ module API
   class DependencyProxy < ::API::Base
     helpers ::API::Helpers::PackagesHelpers
 
-    feature_category :dependency_proxy
+    feature_category :virtual_registry
     urgency :low
 
     after_validation do

lib/api/users.rb

@@ -1249,7 +1249,7 @@ module API
 
         optional :zuora_payment_method_xid, type: String, desc: 'The Zuora payment method ID'
       end
-      put ":user_id/credit_card_validation", urgency: :low, feature_category: :purchase do
+      put ":user_id/credit_card_validation", urgency: :low, feature_category: :subscription_management do
         authenticated_as_admin!
 
         user = find_user(params[:user_id])

spec/controllers/groups/dependency_proxy_for_containers_controller_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Groups::DependencyProxyForContainersController, feature_category: :dependency_proxy do
+RSpec.describe Groups::DependencyProxyForContainersController, feature_category: :virtual_registry do
   include HttpBasicAuthHelpers
   include DependencyProxyHelpers
   include WorkhorseHelpers

spec/controllers/groups_controller_spec.rb

@@ -11,7 +11,7 @@ RSpec.describe GroupsController, factory_default: :keep, feature_category: :code
   let_it_be_with_refind(:project) { create(:project, namespace: group) }
   let_it_be(:user) { create(:user) }
   let_it_be(:admin_with_admin_mode) { create(:admin) }
-  let_it_be(:admin_without_admin_mode) { create(:admin, :without_default_org) }
+  let_it_be(:admin_without_admin_mode) { create(:admin) }
   let_it_be(:group_member) { create(:group_member, group: group, user: user) }
   let_it_be(:owner) { group.add_owner(create(:user)).user }
   let_it_be(:maintainer) { group.add_maintainer(create(:user)).user }

spec/features/groups/dependency_proxy_for_containers_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Group Dependency Proxy for containers', :js, feature_category: :dependency_proxy do
+RSpec.describe 'Group Dependency Proxy for containers', :js, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   include_context 'file upload requests helpers'

spec/features/groups/dependency_proxy_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Group Dependency Proxy', feature_category: :dependency_proxy do
+RSpec.describe 'Group Dependency Proxy', feature_category: :virtual_registry do
   let(:owner) { create(:user) }
   let(:reporter) { create(:user) }
   let(:group) { create(:group) }

spec/features/groups_spec.rb

@@ -248,7 +248,7 @@ RSpec.describe 'Group', feature_category: :groups_and_projects do
     let_it_be(:group) { create(:group, path: 'foo') }
 
     context 'as admin' do
-      let(:user) { create(:admin, :without_default_org) }
+      let(:user) { create(:admin) }
 
       before do
         visit new_group_path(parent_id: group.id, anchor: 'create-group-pane')

spec/features/projects/new_project_spec.rb

@@ -92,7 +92,7 @@ RSpec.describe 'New project', :js, feature_category: :groups_and_projects do
   end
 
   context 'as an admin' do
-    let(:user) { create(:admin, :without_default_org) }
+    let(:user) { create(:admin) }
 
     it_behaves_like 'shows correct navigation'
 

spec/features/users/bizible_csp_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Bizible content security policy', feature_category: :purchase do
+RSpec.describe 'Bizible content security policy', feature_category: :subscription_management do
   before do
     stub_config(extra: { one_trust_id: SecureRandom.uuid })
   end

spec/graphql/mutations/dependency_proxy/group_settings/update_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Mutations::DependencyProxy::GroupSettings::Update, feature_category: :dependency_proxy do
+RSpec.describe Mutations::DependencyProxy::GroupSettings::Update, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }

spec/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Mutations::DependencyProxy::ImageTtlGroupPolicy::Update, feature_category: :dependency_proxy do
+RSpec.describe Mutations::DependencyProxy::ImageTtlGroupPolicy::Update, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }

spec/graphql/types/dependency_proxy/image_ttl_group_policy_type_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe GitlabSchema.types['DependencyProxyImageTtlGroupPolicy'], feature_category: :dependency_proxy do
+RSpec.describe GitlabSchema.types['DependencyProxyImageTtlGroupPolicy'], feature_category: :virtual_registry do
   it { expect(described_class.graphql_name).to eq('DependencyProxyImageTtlGroupPolicy') }
 
   it { expect(described_class.description).to eq('Group-level Dependency Proxy TTL policy settings') }

spec/lib/gitlab/import_export/project/relation_factory_spec.rb

@@ -6,7 +6,7 @@ RSpec.describe Gitlab::ImportExport::Project::RelationFactory, :use_clean_rails_
   let(:group) { create(:group, maintainers: importer_user) }
   let(:project) { create(:project, :repository, group: group) }
   let(:members_mapper) { double('members_mapper').as_null_object }
-  let(:admin) { create(:admin, :without_default_org) }
+  let(:admin) { create(:admin) }
   let(:importer_user) { admin }
   let(:excluded_keys) { [] }
   let(:additional_relation_attributes) { {} }

spec/lib/gitlab/import_export/project/tree_saver_spec.rb

@@ -393,7 +393,7 @@ RSpec.describe Gitlab::ImportExport::Project::TreeSaver, :with_license, feature_
         end
 
         context 'as admin' do
-          let(:user) { create(:admin, :without_default_org) }
+          let(:user) { create(:admin) }
 
           before do
             project_tree_saver.save # rubocop:disable Rails/SaveBang

spec/models/group_spec.rb

@@ -1983,7 +1983,7 @@ RSpec.describe Group, feature_category: :groups_and_projects do
     end
 
     context 'evaluating admin access level' do
-      let_it_be(:admin) { create(:admin, :without_default_org) }
+      let_it_be(:admin) { create(:admin) }
 
       context 'when admin mode is enabled', :enable_admin_mode do
         it 'returns OWNER by default' do
@@ -2006,8 +2006,16 @@ RSpec.describe Group, feature_category: :groups_and_projects do
     context 'when organization owner' do
       let_it_be(:admin) { create(:admin) }
 
-      it 'returns OWNER by default' do
-        expect(group.max_member_access_for_user(admin)).to eq(Gitlab::Access::OWNER)
+      context 'when admin mode is enabled', :enable_admin_mode do
+        it 'returns OWNER by default' do
+          expect(group.max_member_access_for_user(admin)).to eq(Gitlab::Access::OWNER)
+        end
+      end
+
+      context 'when admin mode is disabled' do
+        it 'returns NO_ACCESS by default' do
+          expect(group.max_member_access_for_user(admin)).to eq(Gitlab::Access::NO_ACCESS)
+        end
       end
 
       context 'when only concrete members' do

spec/models/user_highest_role_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe UserHighestRole, feature_category: :sm_provisioning do
+RSpec.describe UserHighestRole, feature_category: :plan_provisioning do
   describe 'associations' do
     it { is_expected.to belong_to(:user).required }
   end

spec/policies/group_policy_spec.rb

@@ -253,6 +253,18 @@ RSpec.describe GroupPolicy, feature_category: :system_access do
       expect_allowed(*owner_permissions)
       expect_allowed(*admin_permissions)
     end
+
+    context 'when user is also an admin' do
+      before do
+        organization_owner.update!(admin: true)
+      end
+
+      it { expect_disallowed(:admin_organization) }
+
+      context 'with admin mode', :enable_admin_mode do
+        it { expect_allowed(:admin_organization) }
+      end
+    end
   end
 
   context 'migration bot' do

spec/policies/upload_policy_spec.rb

@@ -9,7 +9,7 @@ RSpec.describe UploadPolicy do
   let_it_be(:developer) { create(:user, developer_of: group) }
   let_it_be(:maintainer) { create(:user, maintainer_of: group) }
   let_it_be(:owner) { create(:user, owner_of: group) }
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:non_member_user) { create(:user) }
 
   let(:upload_permissions) { [:read_upload, :destroy_upload] }

spec/presenters/projects/import_export/project_export_presenter_spec.rb

@@ -84,7 +84,7 @@ RSpec.describe Projects::ImportExport::ProjectExportPresenter do
     end
 
     context 'as admin' do
-      let(:user) { create(:admin, :without_default_org) }
+      let(:user) { create(:admin) }
 
       context 'when admin mode is enabled', :enable_admin_mode do
         it 'exports group members as admin' do

spec/requests/api/dependency_proxy_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe API::DependencyProxy, api: true, feature_category: :dependency_proxy do
+RSpec.describe API::DependencyProxy, api: true, feature_category: :virtual_registry do
   let_it_be(:user) { create(:user) }
   let_it_be(:blob) { create(:dependency_proxy_blob) }
   let_it_be(:group, reload: true) { blob.group }

spec/requests/api/graphql/group/dependency_proxy_blobs_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy blobs in a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy blobs in a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 

spec/requests/api/graphql/group/dependency_proxy_group_setting_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy settings for a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy settings for a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 

spec/requests/api/graphql/group/dependency_proxy_image_ttl_policy_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy image ttl policy for a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy image ttl policy for a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 

spec/requests/api/graphql/group/dependency_proxy_manifests_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe 'getting dependency proxy manifests in a group', feature_category: :dependency_proxy do
+RSpec.describe 'getting dependency proxy manifests in a group', feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
   include GraphqlHelpers
 

spec/requests/api/graphql/mutations/dependency_proxy/group_settings/update_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Updating the dependency proxy group settings', feature_category: :dependency_proxy do
+RSpec.describe 'Updating the dependency proxy group settings', feature_category: :virtual_registry do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }

spec/requests/api/graphql/mutations/dependency_proxy/image_ttl_group_policy/update_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe 'Updating the dependency proxy image ttl policy', feature_category: :dependency_proxy do
+RSpec.describe 'Updating the dependency proxy image ttl policy', feature_category: :virtual_registry do
   include GraphqlHelpers
 
   let_it_be(:user) { create(:user) }

spec/requests/api/user_runners_spec.rb

@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe API::UserRunners, :aggregate_failures, feature_category: :fleet_visibility do
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:user, reload: true) { create(:user, username: 'user.withdot') }
 
   describe 'POST /user/runners' do

spec/services/auth/dependency_proxy_authentication_service_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :dependency_proxy do
+RSpec.describe Auth::DependencyProxyAuthenticationService, feature_category: :virtual_registry do
   let_it_be(:user) { create(:user) }
   let_it_be(:params) { {} }
 

spec/services/ci/runners/create_runner_service_spec.rb

@@ -7,7 +7,7 @@ RSpec.describe ::Ci::Runners::CreateRunnerService, "#execute", feature_category:
 
   let(:runner) { execute.payload[:runner] }
 
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:non_admin_user) { create(:user) }
   let_it_be(:anonymous) { nil }
   let_it_be(:group_owner) { create(:user) }

spec/services/dependency_proxy/auth_token_service_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::AuthTokenService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::AuthTokenService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let_it_be(:user) { create(:user) }

spec/services/dependency_proxy/find_cached_manifest_service_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::FindCachedManifestService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::FindCachedManifestService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let_it_be(:image) { 'alpine' }

spec/services/dependency_proxy/group_settings/update_service_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe ::DependencyProxy::GroupSettings::UpdateService, feature_category: :dependency_proxy do
+RSpec.describe ::DependencyProxy::GroupSettings::UpdateService, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }

spec/services/dependency_proxy/head_manifest_service_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::HeadManifestService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::HeadManifestService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let(:image) { 'alpine' }

spec/services/dependency_proxy/image_ttl_group_policies/update_service_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe ::DependencyProxy::ImageTtlGroupPolicies::UpdateService, feature_category: :dependency_proxy do
+RSpec.describe ::DependencyProxy::ImageTtlGroupPolicies::UpdateService, feature_category: :virtual_registry do
   using RSpec::Parameterized::TableSyntax
 
   let_it_be_with_reload(:group) { create(:group) }

spec/services/dependency_proxy/request_token_service_spec.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::RequestTokenService, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::RequestTokenService, feature_category: :virtual_registry do
   include DependencyProxyHelpers
 
   let(:image) { 'alpine:3.9' }

spec/services/resource_access_tokens/create_service_spec.rb

@@ -62,7 +62,7 @@ RSpec.describe ResourceAccessTokens::CreateService, feature_category: :system_ac
         end
 
         context 'when created by an admin' do
-          let(:user) { create(:admin, :without_default_org) }
+          let(:user) { create(:admin) }
 
           context 'when admin mode is enabled', :enable_admin_mode do
             it_behaves_like 'creates a user that has their email confirmed'

spec/support/matchers/access_matchers.rb

@@ -11,9 +11,7 @@ module AccessMatchers
 
   def emulate_user(user_type_or_trait, membership = nil)
     case user_type_or_trait
-    when :admin
-      login_as(create(user_type_or_trait, :without_default_org))
-    when :user
+    when :user, :admin
       login_as(create(user_type_or_trait))
     when :external, :auditor
       login_as(create(:user, user_type_or_trait))

spec/support/matchers/access_matchers_for_controller.rb

@@ -13,7 +13,7 @@ module AccessMatchersForController
   def emulate_user(role, membership = nil)
     case role
     when :admin
-      user = create(:admin, :without_default_org)
+      user = create(:admin)
       sign_in(user)
     when :user
       user = create(:user)

spec/support/shared_contexts/graphql/resolvers/runners_resolver_shared_context.rb

@@ -3,7 +3,7 @@
 require 'spec_helper'
 
 RSpec.shared_context 'runners resolver setup' do
-  let_it_be(:user) { create_default(:user, :admin, :without_default_org) }
+  let_it_be(:user) { create_default(:user, :admin) }
   let_it_be(:group) { create(:group, :public) }
   let_it_be(:subgroup) { create(:group, :public, parent: group) }
   let_it_be(:project) { create(:project, :public, group: group) }

spec/support/shared_contexts/policies/group_policy_shared_context.rb

@@ -12,7 +12,7 @@ RSpec.shared_context 'GroupPolicy context' do
   let_it_be(:developer) { create(:user, developer_of: group) }
   let_it_be(:maintainer) { create(:user, maintainer_of: group) }
   let_it_be(:owner) { create(:user, owner_of: group) }
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:non_group_member) { create(:user) }
 
   let_it_be(:organization_owner) { create(:organization_user, :owner, organization: organization).user }
@@ -94,7 +94,7 @@ RSpec.shared_context 'GroupPolicy context' do
     ]
   end
 
-  let(:admin_permissions) { %i[read_confidential_issues read_internal_note] }
+  let(:admin_permissions) { %i[admin_organization read_confidential_issues read_internal_note] }
 
   subject { described_class.new(current_user, group) }
 end

spec/support/shared_examples/models/member_shared_examples.rb

@@ -112,7 +112,7 @@ RSpec.shared_examples '#valid_level_roles' do |entity_name|
 end
 
 RSpec.shared_examples_for "member creation" do
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
 
   it 'returns a Member object', :aggregate_failures do
     member = described_class.add_member(source, user, :maintainer)
@@ -385,7 +385,7 @@ RSpec.shared_examples_for "member creation" do
 end
 
 RSpec.shared_examples_for "bulk member creation" do
-  let_it_be(:admin) { create(:admin, :without_default_org) }
+  let_it_be(:admin) { create(:admin) }
   let_it_be(:user1) { create(:user, email: 'bob@example.com') }
   let_it_be(:user2) { create(:user) }
 

spec/support/shared_examples/requests/admin_mode_shared_examples.rb

@@ -55,7 +55,7 @@ RSpec.shared_examples 'when user' do
 end
 
 RSpec.shared_examples 'when admin' do
-  let_it_be(:current_user) { create(:admin, :without_default_org) }
+  let_it_be(:current_user) { create(:admin) }
 
   it_behaves_like 'makes request' do
     let(:status) { success_status_code }

spec/support_specs/license_metadata_tags_spec.rb

@@ -4,7 +4,7 @@ require 'spec_helper'
 
 # These specs only make sense if ee/spec/spec_helper is loaded
 # In FOSS_ONLY=1 mode, nothing should happen
-RSpec.describe 'license metadata tags', feature_category: :sm_provisioning, if: Gitlab.ee? do
+RSpec.describe 'license metadata tags', feature_category: :plan_provisioning, if: Gitlab.ee? do
   it 'applies the without_license metadata tag by default' do |example|
     expect(example.metadata[:without_license]).to eq(true)
   end

spec/workers/dependency_proxy/cleanup_blob_worker_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::CleanupBlobWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::CleanupBlobWorker, feature_category: :virtual_registry do
   let_it_be(:factory_type) { :dependency_proxy_blob }
 
   it_behaves_like 'dependency_proxy_cleanup_worker'

spec/workers/dependency_proxy/cleanup_dependency_proxy_worker_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::CleanupDependencyProxyWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::CleanupDependencyProxyWorker, feature_category: :virtual_registry do
   describe '#perform' do
     subject { described_class.new.perform }
 

spec/workers/dependency_proxy/cleanup_manifest_worker_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::CleanupManifestWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::CleanupManifestWorker, feature_category: :virtual_registry do
   let_it_be(:factory_type) { :dependency_proxy_manifest }
 
   it_behaves_like 'dependency_proxy_cleanup_worker'

spec/workers/dependency_proxy/image_ttl_group_policy_worker_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe DependencyProxy::ImageTtlGroupPolicyWorker, feature_category: :dependency_proxy do
+RSpec.describe DependencyProxy::ImageTtlGroupPolicyWorker, feature_category: :virtual_registry do
   let(:worker) { described_class.new }
 
   describe '#perform' do

spec/workers/purge_dependency_proxy_cache_worker_spec.rb

@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe PurgeDependencyProxyCacheWorker, feature_category: :dependency_proxy do
+RSpec.describe PurgeDependencyProxyCacheWorker, feature_category: :virtual_registry do
   let_it_be(:user) { create(:admin) }
   let_it_be_with_refind(:blob) { create(:dependency_proxy_blob ) }
   let_it_be_with_reload(:group) { blob.group }