From 012d9258384831a469407317110414f43cb5e8f4 Mon Sep 17 00:00:00 2001
From: Hinam Mehra <hmehra@gitlab.com>
Date: Thu, 15 Dec 2022 02:50:24 +0000
Subject: [PATCH] Revert "Merge branch 'hide-merge-requests-from-banned-users'
 into 'master'"

This reverts merge request !105370
---
 .../admin/users/components/actions/ban.vue    |  4 +-
 .../components/issuable_header_warnings.vue   |  6 +-
 .../merge_requests/application_controller.rb  |  4 --
 app/finders/issuable_finder.rb                |  5 +-
 app/finders/issuable_finder/params.rb         |  5 --
 app/finders/issues_finder.rb                  |  2 +-
 app/finders/issues_finder/params.rb           |  8 ++-
 .../concerns/resolves_merge_requests.rb       |  2 +-
 app/helpers/issuables_helper.rb               | 16 +----
 app/helpers/issues_helper.rb                  | 12 ++++
 app/models/concerns/issuable.rb               | 12 ----
 app/models/issue.rb                           | 12 ++++
 app/policies/issuable_policy.rb               |  3 -
 app/policies/issue_policy.rb                  |  3 +
 app/policies/merge_request_policy.rb          |  4 --
 app/views/projects/issues/_issue.html.haml    |  2 +-
 .../merge_requests/_merge_request.html.haml   |  1 -
 .../merge_requests/_mr_title.html.haml        |  2 +-
 .../issue_type/_details_header.html.haml      |  2 +-
 doc/user/admin_area/moderate_users.md         |  2 +-
 ee/spec/finders/merge_requests_finder_spec.rb | 17 -----
 locale/gitlab.pot                             |  5 +-
 .../admin_views_hidden_merge_request_spec.rb  | 26 --------
 .../admin_views_hidden_merge_requests_spec.rb | 26 --------
 .../issuable_header_warnings_spec.js          |  3 +-
 spec/helpers/issuables_helper_spec.rb         | 62 -------------------
 spec/helpers/issues_helper_spec.rb            | 51 +++++++++++++++
 spec/models/concerns/issuable_spec.rb         | 47 --------------
 spec/models/issue_spec.rb                     | 20 ++++++
 spec/policies/merge_request_policy_spec.rb    | 16 -----
 .../merge_requests_controller_spec.rb         | 26 ++------
 31 files changed, 123 insertions(+), 283 deletions(-)
 delete mode 100644 spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
 delete mode 100644 spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb

diff --git a/app/assets/javascripts/admin/users/components/actions/ban.vue b/app/assets/javascripts/admin/users/components/actions/ban.vue
index 898a688c203f07..55938832dce5d4 100644
--- a/app/assets/javascripts/admin/users/components/actions/ban.vue
+++ b/app/assets/javascripts/admin/users/components/actions/ban.vue
@@ -11,9 +11,7 @@ const messageHtml = `
   <ul>
     <li>${s__("AdminUsers|The user can't log in.")}</li>
     <li>${s__("AdminUsers|The user can't access git repositories.")}</li>
-    <li>${s__(
-      'AdminUsers|Issues and merge requests authored by this user are hidden from other users.',
-    )}</li>
+    <li>${s__('AdminUsers|Issues authored by this user are hidden from other users.')}</li>
   </ul>
   <p>${s__('AdminUsers|You can unban their account in the future. Their data remains intact.')}</p>
   <p>${sprintf(
diff --git a/app/assets/javascripts/issuable/components/issuable_header_warnings.vue b/app/assets/javascripts/issuable/components/issuable_header_warnings.vue
index a84187ab86b8b4..543dca0afe1f91 100644
--- a/app/assets/javascripts/issuable/components/issuable_header_warnings.vue
+++ b/app/assets/javascripts/issuable/components/issuable_header_warnings.vue
@@ -1,7 +1,7 @@
 <script>
 import { GlIcon, GlTooltipDirective } from '@gitlab/ui';
 import { mapGetters } from 'vuex';
-import { sprintf, __ } from '~/locale';
+import { __ } from '~/locale';
 import { IssuableType, WorkspaceType } from '~/issues/constants';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import ConfidentialityBadge from '~/vue_shared/components/confidentiality_badge.vue';
@@ -40,9 +40,7 @@ export default {
           iconName: 'spam',
           visible: this.hidden,
           dataTestId: 'hidden',
-          tooltip: sprintf(__('This %{issuable} is hidden because its author has been banned'), {
-            issuable: this.getNoteableData.targetType.replace('_', ' '),
-          }),
+          tooltip: __('This issue is hidden because its author has been banned'),
         },
       ];
     },
diff --git a/app/controllers/projects/merge_requests/application_controller.rb b/app/controllers/projects/merge_requests/application_controller.rb
index 76b06b2ce9db12..d8da448a3239b7 100644
--- a/app/controllers/projects/merge_requests/application_controller.rb
+++ b/app/controllers/projects/merge_requests/application_controller.rb
@@ -13,10 +13,6 @@ def merge_request
     @issuable =
       @merge_request ||=
         merge_request_includes(@project.merge_requests).find_by_iid!(params[:id])
-
-    return render_404 unless can?(current_user, :read_merge_request, @issuable)
-
-    @issuable
   end
 
   def merge_request_includes(association)
diff --git a/app/finders/issuable_finder.rb b/app/finders/issuable_finder.rb
index c5a3293ad2f1f9..5fcb81949ee93f 100644
--- a/app/finders/issuable_finder.rb
+++ b/app/finders/issuable_finder.rb
@@ -248,10 +248,7 @@ def force_cte?
   end
 
   def init_collection
-    return klass.all if params.user_can_see_all_issuables?
-
-    # Only admins and auditors can see hidden issuables, for other users we filter out hidden issuables
-    klass.without_hidden
+    klass.all
   end
 
   def default_or_simple_sort?
diff --git a/app/finders/issuable_finder/params.rb b/app/finders/issuable_finder/params.rb
index 4e17f06e1c16a3..32d50802537cee 100644
--- a/app/finders/issuable_finder/params.rb
+++ b/app/finders/issuable_finder/params.rb
@@ -195,11 +195,6 @@ def parent
       project || group
     end
 
-    def user_can_see_all_issuables?
-      Ability.allowed?(current_user, :read_all_resources)
-    end
-    strong_memoize_attr :user_can_see_all_issuables?, :user_can_see_all_issuables
-
     private
 
     def projects_public_or_visible_to_user
diff --git a/app/finders/issues_finder.rb b/app/finders/issues_finder.rb
index bd81f06f93b156..e12dce744b5748 100644
--- a/app/finders/issues_finder.rb
+++ b/app/finders/issues_finder.rb
@@ -49,7 +49,7 @@ def params_class
 
   # rubocop: disable CodeReuse/ActiveRecord
   def with_confidentiality_access_check
-    return model_class.all if params.user_can_see_all_issuables?
+    return model_class.all if params.user_can_see_all_issues?
 
     # Only admins can see hidden issues, so for non-admins, we filter out any hidden issues
     issues = model_class.without_hidden
diff --git a/app/finders/issues_finder/params.rb b/app/finders/issues_finder/params.rb
index 786bfbd4113b84..7f8acb79ed688c 100644
--- a/app/finders/issues_finder/params.rb
+++ b/app/finders/issues_finder/params.rb
@@ -44,7 +44,7 @@ def user_can_see_all_confidential_issues?
         if parent
           Ability.allowed?(current_user, :read_confidential_issues, parent)
         else
-          user_can_see_all_issuables?
+          user_can_see_all_issues?
         end
       end
     end
@@ -54,6 +54,12 @@ def user_cannot_see_confidential_issues?
 
       current_user.blank?
     end
+
+    def user_can_see_all_issues?
+      strong_memoize(:user_can_see_all_issues) do
+        Ability.allowed?(current_user, :read_all_resources)
+      end
+    end
   end
 end
 
diff --git a/app/graphql/resolvers/concerns/resolves_merge_requests.rb b/app/graphql/resolvers/concerns/resolves_merge_requests.rb
index c68e120ee241fb..d56951bc8212e2 100644
--- a/app/graphql/resolvers/concerns/resolves_merge_requests.rb
+++ b/app/graphql/resolvers/concerns/resolves_merge_requests.rb
@@ -34,7 +34,7 @@ def mr_parent
   end
 
   def unconditional_includes
-    [:target_project, :author]
+    [:target_project]
   end
 
   def preloads
diff --git a/app/helpers/issuables_helper.rb b/app/helpers/issuables_helper.rb
index 7d99b0da89003b..2b21d8c51e6921 100644
--- a/app/helpers/issuables_helper.rb
+++ b/app/helpers/issuables_helper.rb
@@ -275,7 +275,7 @@ def issue_only_initial_data(issuable)
       zoomMeetingUrl: ZoomMeeting.canonical_meeting_url(issuable),
       sentryIssueIdentifier: SentryIssue.find_by(issue: issuable)&.sentry_issue_identifier, # rubocop:disable CodeReuse/ActiveRecord
       iid: issuable.iid.to_s,
-      isHidden: issuable_hidden?(issuable),
+      isHidden: issue_hidden?(issuable),
       canCreateIncident: create_issue_type_allowed?(issuable.project, :incident)
     }
   end
@@ -372,20 +372,6 @@ def state_name_with_icon(issuable)
     end
   end
 
-  def issuable_hidden?(issuable)
-    Feature.enabled?(:ban_user_feature_flag) && issuable.hidden?
-  end
-
-  def hidden_issuable_icon(issuable)
-    return unless issuable_hidden?(issuable)
-
-    title = format(_('This %{issuable} is hidden because its author has been banned'),
-                   issuable: issuable.human_class_name)
-    content_tag(:span, class: 'has-tooltip', title: title) do
-      sprite_icon('spam', css_class: 'gl-vertical-align-text-bottom')
-    end
-  end
-
   private
 
   def sidebar_gutter_collapsed?
diff --git a/app/helpers/issues_helper.rb b/app/helpers/issues_helper.rb
index 101df8cdd41f0c..1d68dccc741d9b 100644
--- a/app/helpers/issues_helper.rb
+++ b/app/helpers/issues_helper.rb
@@ -70,6 +70,18 @@ def confidential_icon(issue)
     sprite_icon('eye-slash', css_class: 'gl-vertical-align-text-bottom') if issue.confidential?
   end
 
+  def issue_hidden?(issue)
+    Feature.enabled?(:ban_user_feature_flag) && issue.hidden?
+  end
+
+  def hidden_issue_icon(issue)
+    return unless issue_hidden?(issue)
+
+    content_tag(:span, class: 'has-tooltip', title: _('This issue is hidden because its author has been banned')) do
+      sprite_icon('spam', css_class: 'gl-vertical-align-text-bottom')
+    end
+  end
+
   def award_user_list(awards, current_user, limit: 10)
     names = awards.map do |award|
       award.user == current_user ? 'You' : award.user.name
diff --git a/app/models/concerns/issuable.rb b/app/models/concerns/issuable.rb
index 1a50ebde0a39e5..9f0cd96a8f899a 100644
--- a/app/models/concerns/issuable.rb
+++ b/app/models/concerns/issuable.rb
@@ -144,14 +144,6 @@ def system_note_metadata_loaded?
       includes(*associations)
     end
 
-    scope :without_hidden, -> {
-      if Feature.enabled?(:ban_user_feature_flag)
-        where.not(author_id: Users::BannedUser.all.select(:user_id))
-      else
-        all
-      end
-    }
-
     attr_mentionable :title, pipeline: :single_line
     attr_mentionable :description
 
@@ -235,10 +227,6 @@ def severity
       issuable_severity&.severity || IssuableSeverity::DEFAULT
     end
 
-    def hidden?
-      author&.banned?
-    end
-
     private
 
     def description_max_length_for_new_records_is_valid
diff --git a/app/models/issue.rb b/app/models/issue.rb
index f517f42d6ba27d..b338ecfce88e7f 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -178,6 +178,14 @@ def most_recent
 
   scope :confidential_only, -> { where(confidential: true) }
 
+  scope :without_hidden, -> {
+    if Feature.enabled?(:ban_user_feature_flag)
+      where.not(author_id: Users::BannedUser.all.select(:user_id))
+    else
+      all
+    end
+  }
+
   scope :counts_by_state, -> { reorder(nil).group(:state_id).count }
 
   scope :service_desk, -> { where(author: ::User.support_bot) }
@@ -650,6 +658,10 @@ def readable_by?(user)
     end
   end
 
+  def hidden?
+    author&.banned?
+  end
+
   # Necessary until all issues are backfilled and we add a NOT NULL constraint on the DB
   def work_item_type
     super || WorkItems::Type.default_by_type(issue_type)
diff --git a/app/policies/issuable_policy.rb b/app/policies/issuable_policy.rb
index 779384ee3fe9c0..aa07bb7dc5fefb 100644
--- a/app/policies/issuable_policy.rb
+++ b/app/policies/issuable_policy.rb
@@ -16,9 +16,6 @@ class IssuablePolicy < BasePolicy
 
   condition(:is_incident) { @subject.incident? }
 
-  desc "Issuable is hidden"
-  condition(:hidden, scope: :subject) { @subject.hidden? }
-
   rule { can?(:guest_access) & assignee_or_author & ~is_incident }.policy do
     enable :read_issue
     enable :update_issue
diff --git a/app/policies/issue_policy.rb b/app/policies/issue_policy.rb
index 7d4e42580b8601..491eebe9dafa07 100644
--- a/app/policies/issue_policy.rb
+++ b/app/policies/issue_policy.rb
@@ -21,6 +21,9 @@ class IssuePolicy < IssuablePolicy
   desc "Issue is confidential"
   condition(:confidential, scope: :subject) { @subject.confidential? }
 
+  desc "Issue is hidden"
+  condition(:hidden, scope: :subject) { @subject.hidden? }
+
   desc "Issue is persisted"
   condition(:persisted, scope: :subject) { @subject.persisted? }
 
diff --git a/app/policies/merge_request_policy.rb b/app/policies/merge_request_policy.rb
index 49f9225a1d36ca..1759cf057e401b 100644
--- a/app/policies/merge_request_policy.rb
+++ b/app/policies/merge_request_policy.rb
@@ -29,10 +29,6 @@ class MergeRequestPolicy < IssuablePolicy
     enable :update_subscription
   end
 
-  rule { hidden & ~admin }.policy do
-    prevent :read_merge_request
-  end
-
   condition(:can_merge) { @subject.can_be_merged_by?(@user) }
 
   rule { can_merge }.policy do
diff --git a/app/views/projects/issues/_issue.html.haml b/app/views/projects/issues/_issue.html.haml
index a34ed332fcf697..1d3320e4f82280 100644
--- a/app/views/projects/issues/_issue.html.haml
+++ b/app/views/projects/issues/_issue.html.haml
@@ -6,7 +6,7 @@
           - if issue.confidential?
             %span.has-tooltip{ title: _('Confidential') }
               = confidential_icon(issue)
-          = hidden_issuable_icon(issue)
+          = hidden_issue_icon(issue)
           = link_to issue.title, issue_path(issue), class: 'js-prefetch-document'
         = render_if_exists 'projects/issues/subepic_flag', issue: issue
         - if issue.tasks?
diff --git a/app/views/projects/merge_requests/_merge_request.html.haml b/app/views/projects/merge_requests/_merge_request.html.haml
index d7e26da5f514af..71f8e4c32f5eb6 100644
--- a/app/views/projects/merge_requests/_merge_request.html.haml
+++ b/app/views/projects/merge_requests/_merge_request.html.haml
@@ -12,7 +12,6 @@
     .issuable-main-info
       .merge-request-title.title
         %span.merge-request-title-text.js-onboarding-mr-item
-          = hidden_issuable_icon(merge_request)
           = link_to merge_request.title, merge_request_path(merge_request), class: 'js-prefetch-document'
         - if merge_request.tasks?
           %span.task-status.d-none.d-sm-inline-block
diff --git a/app/views/projects/merge_requests/_mr_title.html.haml b/app/views/projects/merge_requests/_mr_title.html.haml
index 6129e349df384d..a73d2aa5cc4c11 100644
--- a/app/views/projects/merge_requests/_mr_title.html.haml
+++ b/app/views/projects/merge_requests/_mr_title.html.haml
@@ -16,7 +16,7 @@
   .detail-page-header.border-bottom-0.pt-0.pb-0.gl-display-block{ class: "gl-md-display-flex! #{'is-merge-request' if moved_mr_sidebar_enabled? && !fluid_layout}" }
     .detail-page-header-body
       .issuable-meta.gl-display-flex
-        #js-issuable-header-warnings{ data: { hidden: issuable_hidden?(@merge_request).to_s } }
+        #js-issuable-header-warnings
         %h1.title.page-title.gl-font-size-h-display.gl-my-0.gl-display-inline-block{ data: { qa_selector: 'title_content' } }
           = markdown_field(@merge_request, :title)
 
diff --git a/app/views/shared/issue_type/_details_header.html.haml b/app/views/shared/issue_type/_details_header.html.haml
index c8762f8e060edd..ccb501dae11329 100644
--- a/app/views/shared/issue_type/_details_header.html.haml
+++ b/app/views/shared/issue_type/_details_header.html.haml
@@ -13,7 +13,7 @@
       %span.gl-display-none.gl-sm-display-block.gl-ml-2
         = _('Open')
 
-    #js-issuable-header-warnings{ data: { hidden: issuable_hidden?(issuable).to_s } }
+    #js-issuable-header-warnings{ data: { hidden: issue_hidden?(issuable).to_s } }
     = issuable_meta(issuable, @project)
 
     %a.btn.gl-button.btn-default.btn-icon.float-right.gl-display-block.d-sm-none.gutter-toggle.issuable-gutter-toggle.js-sidebar-toggle{ href: "#" }
diff --git a/doc/user/admin_area/moderate_users.md b/doc/user/admin_area/moderate_users.md
index 117781f72223d2..c0daf029b1f4ae 100644
--- a/doc/user/admin_area/moderate_users.md
+++ b/doc/user/admin_area/moderate_users.md
@@ -223,7 +223,7 @@ On self-managed GitLab, by default this feature is available.
 To hide the feature, ask an administrator to [disable the feature flag](../../administration/feature_flags.md) named `ban_user_feature_flag`.
 On GitLab.com, this feature is available to GitLab.com administrators only.
 
-GitLab administrators can ban and unban users. Banned users are blocked, and their issues and merge requests are hidden.
+GitLab administrators can ban and unban users. Banned users are blocked, and their issues are hidden.
 The banned user's comments are still displayed. Hiding a banned user's comments is [tracked in this issue](https://gitlab.com/gitlab-org/gitlab/-/issues/327356).
 
 ### Ban a user
diff --git a/ee/spec/finders/merge_requests_finder_spec.rb b/ee/spec/finders/merge_requests_finder_spec.rb
index e54488f84c4ae7..46e52bc6a4e99c 100644
--- a/ee/spec/finders/merge_requests_finder_spec.rb
+++ b/ee/spec/finders/merge_requests_finder_spec.rb
@@ -94,22 +94,5 @@
         expect(merge_requests).to contain_exactly(scoped_labeled_merge_request_1, scoped_labeled_merge_request_2)
       end
     end
-
-    context 'when the author of a merge request is banned' do
-      let_it_be(:banned_user) { create(:user, :banned) }
-      let_it_be(:banned_merge_request) do
-        create(:merge_request, :simple, author: banned_user, source_project: project1)
-      end
-
-      subject(:merge_requests) { described_class.new(user).execute }
-
-      it { is_expected.not_to include(banned_merge_request) }
-
-      context 'when the user is an auditor' do
-        let_it_be(:user) { create(:user, :auditor) }
-
-        it { is_expected.to include(banned_merge_request) }
-      end
-    end
   end
 end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 26a07c17c27a2d..16af76e0238607 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -3298,7 +3298,7 @@ msgstr ""
 msgid "AdminUsers|Is using seat"
 msgstr ""
 
-msgid "AdminUsers|Issues and merge requests authored by this user are hidden from other users."
+msgid "AdminUsers|Issues authored by this user are hidden from other users."
 msgstr ""
 
 msgid "AdminUsers|It's you!"
@@ -42070,9 +42070,6 @@ msgstr ""
 msgid "This %{issuableDisplayName} is locked. Only project members can comment."
 msgstr ""
 
-msgid "This %{issuable} is hidden because its author has been banned"
-msgstr ""
-
 msgid "This %{issuable} is locked. Only %{strong_open}project members%{strong_close} can comment."
 msgstr ""
 
diff --git a/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb b/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
deleted file mode 100644
index 99344d2cf32b0a..00000000000000
--- a/spec/features/merge_request/admin_views_hidden_merge_request_spec.rb
+++ /dev/null
@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe 'Admin views hidden merge request', feature_category: :code_review do
-  context 'when signed in as admin and viewing a hidden merge request', :js do
-    let_it_be(:admin) { create(:admin) }
-    let_it_be(:author) { create(:user, :banned) }
-    let_it_be(:project) { create(:project, :repository) }
-    let!(:merge_request) { create(:merge_request, source_project: project, author: author) }
-
-    before do
-      sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
-      visit(project_merge_request_path(project, merge_request))
-    end
-
-    it 'shows a hidden merge request icon' do
-      page.within('.detail-page-header-body') do
-        tooltip = format(_('This %{issuable} is hidden because its author has been banned'), issuable: 'merge request')
-        expect(page).to have_css("div[data-testid='hidden'][title='#{tooltip}']")
-        expect(page).to have_css('svg[data-testid="spam-icon"]')
-      end
-    end
-  end
-end
diff --git a/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb b/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
deleted file mode 100644
index bc5ec1248618fd..00000000000000
--- a/spec/features/merge_requests/admin_views_hidden_merge_requests_spec.rb
+++ /dev/null
@@ -1,26 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe 'Admin views hidden merge requests', feature_category: :code_review do
-  context 'when signed in as admin and viewing a hidden merge request' do
-    let_it_be(:admin) { create(:admin) }
-    let_it_be(:author) { create(:user, :banned) }
-    let_it_be(:project) { create(:project) }
-    let!(:merge_request) { create(:merge_request, source_project: project, author: author) }
-
-    before do
-      sign_in(admin)
-      gitlab_enable_admin_mode_sign_in(admin)
-      visit(project_merge_requests_path(project))
-    end
-
-    it 'shows a hidden merge request icon' do
-      page.within("#merge_request_#{merge_request.id}") do
-        tooltip = format(_('This %{issuable} is hidden because its author has been banned'), issuable: 'merge request')
-        expect(page).to have_css("span[title='#{tooltip}']")
-        expect(page).to have_css('svg[data-testid="spam-icon"]')
-      end
-    end
-  end
-end
diff --git a/spec/frontend/issuable/components/issuable_header_warnings_spec.js b/spec/frontend/issuable/components/issuable_header_warnings_spec.js
index 98a81478cb6d6b..e3a36dc8820b49 100644
--- a/spec/frontend/issuable/components/issuable_header_warnings_spec.js
+++ b/spec/frontend/issuable/components/issuable_header_warnings_spec.js
@@ -57,7 +57,6 @@ describe('IssuableHeaderWarnings', () => {
         beforeEach(() => {
           store.getters.getNoteableData.confidential = confidentialStatus;
           store.getters.getNoteableData.discussion_locked = lockStatus;
-          store.getters.getNoteableData.targetType = issuableType;
 
           createComponent({ store, provide: { hidden: hiddenStatus } });
         });
@@ -85,7 +84,7 @@ describe('IssuableHeaderWarnings', () => {
 
           if (hiddenStatus) {
             expect(hiddenIcon.attributes('title')).toBe(
-              `This ${issuableType} is hidden because its author has been banned`,
+              'This issue is hidden because its author has been banned',
             );
             expect(getBinding(hiddenIcon.element, 'gl-tooltip')).not.toBeUndefined();
           }
diff --git a/spec/helpers/issuables_helper_spec.rb b/spec/helpers/issuables_helper_spec.rb
index 2a61b38337bd8e..15b57a4c9eb034 100644
--- a/spec/helpers/issuables_helper_spec.rb
+++ b/spec/helpers/issuables_helper_spec.rb
@@ -629,66 +629,4 @@
       expect(helper.sidebar_milestone_tooltip_label(milestone)).to eq('&lt;img onerror=alert(1)&gt;<br/>Milestone')
     end
   end
-
-  describe '#issuable_hidden?' do
-    let_it_be(:issuable) { build(:issue) }
-
-    context 'when issuable is hidden' do
-      let_it_be(:banned_user) { build(:user, :banned) }
-      let_it_be(:hidden_issuable) { build(:issue, author: banned_user) }
-
-      context 'when `ban_user_feature_flag` feature flag is enabled' do
-        it 'returns `true`' do
-          expect(helper.issuable_hidden?(hidden_issuable)).to eq(true)
-        end
-      end
-
-      context 'when `ban_user_feature_flag` feature flag is disabled' do
-        before do
-          stub_feature_flags(ban_user_feature_flag: false)
-        end
-
-        it 'returns `false`' do
-          expect(helper.issuable_hidden?(hidden_issuable)).to eq(false)
-        end
-      end
-    end
-
-    context 'when issuable is not hidden' do
-      it 'returns `false`' do
-        expect(helper.issuable_hidden?(issuable)).to eq(false)
-      end
-    end
-  end
-
-  describe '#hidden_issuable_icon' do
-    let_it_be(:banned_user) { build(:user, :banned) }
-    let_it_be(:hidden_issuable) { build(:issue, author: banned_user) }
-    let_it_be(:issuable) { build(:issue) }
-    let_it_be(:mock_svg) { '<svg></svg>'.html_safe }
-
-    before do
-      allow(helper).to receive(:sprite_icon).and_return(mock_svg)
-    end
-
-    context 'when issuable is hidden' do
-      it 'returns icon with tooltip' do
-        expect(helper.hidden_issuable_icon(hidden_issuable)).to eq("<span class=\"has-tooltip\" title=\"This issue is hidden because its author has been banned\">#{mock_svg}</span>")
-      end
-
-      context 'when issuable is a merge request' do
-        let_it_be(:hidden_issuable) { build(:merge_request, author: banned_user) }
-
-        it 'returns icon with tooltip' do
-          expect(helper.hidden_issuable_icon(hidden_issuable)).to eq("<span class=\"has-tooltip\" title=\"This merge request is hidden because its author has been banned\">#{mock_svg}</span>")
-        end
-      end
-    end
-
-    context 'when issuable is not hidden' do
-      it 'returns `nil`' do
-        expect(helper.hidden_issuable_icon(issuable)).to be_nil
-      end
-    end
-  end
 end
diff --git a/spec/helpers/issues_helper_spec.rb b/spec/helpers/issues_helper_spec.rb
index 39e50070169666..ed363268cdfcdd 100644
--- a/spec/helpers/issues_helper_spec.rb
+++ b/spec/helpers/issues_helper_spec.rb
@@ -508,4 +508,55 @@
       end
     end
   end
+
+  describe '#issue_hidden?' do
+    context 'when issue is hidden' do
+      let_it_be(:banned_user) { build(:user, :banned) }
+      let_it_be(:hidden_issue) { build(:issue, author: banned_user) }
+
+      context 'when `ban_user_feature_flag` feature flag is enabled' do
+        it 'returns `true`' do
+          expect(helper.issue_hidden?(hidden_issue)).to eq(true)
+        end
+      end
+
+      context 'when `ban_user_feature_flag` feature flag is disabled' do
+        before do
+          stub_feature_flags(ban_user_feature_flag: false)
+        end
+
+        it 'returns `false`' do
+          expect(helper.issue_hidden?(hidden_issue)).to eq(false)
+        end
+      end
+    end
+
+    context 'when issue is not hidden' do
+      it 'returns `false`' do
+        expect(helper.issue_hidden?(issue)).to eq(false)
+      end
+    end
+  end
+
+  describe '#hidden_issue_icon' do
+    let_it_be(:banned_user) { build(:user, :banned) }
+    let_it_be(:hidden_issue) { build(:issue, author: banned_user) }
+    let_it_be(:mock_svg) { '<svg></svg>'.html_safe }
+
+    before do
+      allow(helper).to receive(:sprite_icon).and_return(mock_svg)
+    end
+
+    context 'when issue is hidden' do
+      it 'returns icon with tooltip' do
+        expect(helper.hidden_issue_icon(hidden_issue)).to eq("<span class=\"has-tooltip\" title=\"This issue is hidden because its author has been banned\">#{mock_svg}</span>")
+      end
+    end
+
+    context 'when issue is not hidden' do
+      it 'returns `nil`' do
+        expect(helper.hidden_issue_icon(issue)).to be_nil
+      end
+    end
+  end
 end
diff --git a/spec/models/concerns/issuable_spec.rb b/spec/models/concerns/issuable_spec.rb
index 88d44e48064b57..e553e34ab51192 100644
--- a/spec/models/concerns/issuable_spec.rb
+++ b/spec/models/concerns/issuable_spec.rb
@@ -337,53 +337,6 @@
     it { expect(MergeRequest.to_ability_name).to eq("merge_request") }
   end
 
-  describe '.without_hidden' do
-    let_it_be(:banned_user) { create(:user, :banned) }
-
-    where(issuable_type: [:issue, :merge_request])
-
-    with_them do
-      let!(:public_issuable) { create(issuable_type, :closed) }
-      let!(:hidden_issuable) { create(issuable_type, :closed, author: banned_user) }
-
-      subject { issuable_type.to_s.classify.constantize.without_hidden }
-
-      it 'only returns public issuables' do
-        expect(subject).to contain_exactly(public_issuable)
-      end
-
-      context 'when feature flag is disabled' do
-        before do
-          stub_feature_flags(ban_user_feature_flag: false)
-        end
-
-        it 'returns public and hidden issuables' do
-          expect(subject).to contain_exactly(public_issuable, hidden_issuable)
-        end
-      end
-    end
-  end
-
-  describe '#hidden?' do
-    let_it_be(:author) { create(:user) }
-
-    where(issuable_type: [:issue, :merge_request])
-
-    with_them do
-      let(:issuable) { build_stubbed(issuable_type, author: author) }
-
-      subject { issuable.hidden? }
-
-      it { is_expected.to eq(false) }
-
-      context 'when the author is banned' do
-        let_it_be(:author) { create(:user, :banned) }
-
-        it { is_expected.to eq(true) }
-      end
-    end
-  end
-
   describe "#sort_by_attribute" do
     let(:project) { create(:project) }
 
diff --git a/spec/models/issue_spec.rb b/spec/models/issue_spec.rb
index c8904519629147..82ee062aef037f 100644
--- a/spec/models/issue_spec.rb
+++ b/spec/models/issue_spec.rb
@@ -1432,6 +1432,26 @@
     end
   end
 
+  describe '.without_hidden' do
+    let_it_be(:banned_user) { create(:user, :banned) }
+    let_it_be(:public_issue) { create(:issue, project: reusable_project) }
+    let_it_be(:hidden_issue) { create(:issue, project: reusable_project, author: banned_user) }
+
+    it 'only returns without_hidden issues' do
+      expect(described_class.without_hidden).to eq([public_issue])
+    end
+
+    context 'when feature flag is disabled' do
+      before do
+        stub_feature_flags(ban_user_feature_flag: false)
+      end
+
+      it 'returns public and hidden issues' do
+        expect(described_class.without_hidden).to contain_exactly(public_issue, hidden_issue)
+      end
+    end
+  end
+
   describe '.by_project_id_and_iid' do
     let_it_be(:issue_a) { create(:issue, project: reusable_project) }
     let_it_be(:issue_b) { create(:issue, iid: issue_a.iid) }
diff --git a/spec/policies/merge_request_policy_spec.rb b/spec/policies/merge_request_policy_spec.rb
index 6c19590fcce321..741a0db300918e 100644
--- a/spec/policies/merge_request_policy_spec.rb
+++ b/spec/policies/merge_request_policy_spec.rb
@@ -461,20 +461,4 @@ def permissions(user, merge_request)
       end
     end
   end
-
-  context 'when the author of the merge request is banned' do
-    let_it_be(:user) { create(:user) }
-    let_it_be(:admin) { create(:user, :admin) }
-    let_it_be(:author) { create(:user, :banned) }
-    let_it_be(:project) { create(:project, :public) }
-    let_it_be(:hidden_merge_request) { create(:merge_request, source_project: project, author: author) }
-
-    it 'does not allow non-admin user to read the merge_request' do
-      expect(permissions(user, hidden_merge_request)).not_to be_allowed(:read_merge_request)
-    end
-
-    it 'allows admin to read the merge_request', :enable_admin_mode do
-      expect(permissions(admin, hidden_merge_request)).to be_allowed(:read_merge_request)
-    end
-  end
 end
diff --git a/spec/requests/projects/merge_requests_controller_spec.rb b/spec/requests/projects/merge_requests_controller_spec.rb
index 4d0e47b7f65598..f5f8b5c2d83ed5 100644
--- a/spec/requests/projects/merge_requests_controller_spec.rb
+++ b/spec/requests/projects/merge_requests_controller_spec.rb
@@ -8,30 +8,14 @@
   let_it_be(:user) { merge_request.author }
 
   describe 'GET #show' do
-    context 'when logged in' do
-      before do
-        login_as(user)
-      end
-
-      it_behaves_like "observability csp policy", described_class do
-        let(:tested_path) do
-          project_merge_request_path(project, merge_request)
-        end
-      end
+    before do
+      login_as(user)
     end
 
-    context 'when the author of the merge request is banned' do
-      let_it_be(:user) { create(:user, :banned) }
-      let_it_be(:project) { create(:project, :public) }
-      let_it_be(:merge_request) { create(:merge_request, source_project: project, author: user) }
-
-      subject { response }
-
-      before do
-        get project_merge_request_path(project, merge_request)
+    it_behaves_like "observability csp policy", described_class do
+      let(:tested_path) do
+        project_merge_request_path(project, merge_request)
       end
-
-      it { is_expected.to have_gitlab_http_status(:not_found) }
     end
   end
 
-- 
GitLab