From 6aaa02561d084e98ed8bf8cc33a006130e62a756 Mon Sep 17 00:00:00 2001
From: Mireya Andres <mandres@gitlab.com>
Date: Sat, 8 Feb 2025 15:52:11 +0800
Subject: [PATCH 1/2] Show warning when adding auth logs exceeds the allowlist
 limit

This is developed under the
`authentication_logs_migration_for_allowlist` feature flag.
---
 .../autopopulate_allowlist_modal.vue          | 111 +++++++++++++-----
 .../components/inbound_token_access.vue       |  25 +++-
 .../queries/get_auth_log_count.query.graphql  |   8 ++
 app/assets/javascripts/token_access/index.js  |   6 +-
 app/views/ci/token_access/_index.html.haml    |   9 +-
 locale/gitlab.pot                             |  12 ++
 .../autopopulate_allowlist_modal_spec.js      |  29 ++++-
 .../token_access/inbound_token_access_spec.js |  59 ++++++++++
 spec/frontend/token_access/mock_data.js       |  13 ++
 9 files changed, 234 insertions(+), 38 deletions(-)
 create mode 100644 app/assets/javascripts/token_access/graphql/queries/get_auth_log_count.query.graphql

diff --git a/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue b/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue
index b664b3251fbd14..b5346bbe2a998a 100644
--- a/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue
+++ b/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue
@@ -1,20 +1,30 @@
 <script>
-import { GlAlert, GlModal, GlSprintf } from '@gitlab/ui';
-import { __, s__ } from '~/locale';
+import { GlAlert, GlLink, GlModal, GlSprintf } from '@gitlab/ui';
+import { __, s__, sprintf } from '~/locale';
 import autopopulateAllowlistMutation from '../graphql/mutations/autopopulate_allowlist.mutation.graphql';
 
 export default {
   name: 'AutopopulateAllowlistModal',
   components: {
     GlAlert,
+    GlLink,
     GlModal,
     GlSprintf,
   },
   inject: ['fullPath'],
   props: {
+    authLogExceedsLimit: {
+      type: Boolean,
+      required: true,
+    },
+    projectAllowlistLimit: {
+      type: Number,
+      required: true,
+    },
     projectName: {
       type: String,
-      required: true,
+      required: false,
+      default: '',
     },
     showModal: {
       type: Boolean,
@@ -29,6 +39,16 @@ export default {
     };
   },
   computed: {
+    authLogExceedsLimitMessage() {
+      return sprintf(
+        s__(
+          'CICD|The allowlist can contain a maximum of %{projectAllowlistLimit} groups and projects.',
+        ),
+        {
+          projectAllowlistLimit: this.projectAllowlistLimit,
+        },
+      );
+    },
     modalOptions() {
       return {
         actionPrimary: {
@@ -47,6 +67,13 @@ export default {
         },
       };
     },
+    modalTitle() {
+      if (this.authLogExceedsLimitMessage) {
+        return s__('CICD|Add log entries and compact the allowlist');
+      }
+
+      return s__('CICD|Add all authentication log entries to the allowlist');
+    },
   },
   methods: {
     async autopopulateAllowlist() {
@@ -95,7 +122,7 @@ export default {
 <template>
   <gl-modal
     :visible="showModal"
-    :title="s__('CICD|Add all authentication log entries to the allowlist')"
+    :title="modalTitle"
     :action-primary="modalOptions.actionPrimary"
     :action-secondary="modalOptions.actionSecondary"
     modal-id="autopopulate-allowlist-modal"
@@ -103,37 +130,57 @@ export default {
     @secondary="hideModal"
     @canceled="hideModal"
   >
-    <gl-alert v-if="errorMessage" variant="danger" class="gl-mb-3 gl-pb-0" :dismissible="false">
+    <gl-alert v-if="errorMessage" variant="danger" class="gl-mb-3" :dismissible="false">
+      {{ errorMessage }}
+    </gl-alert>
+    <div v-if="authLogExceedsLimit">
+      <gl-alert variant="warning" class="gl-mb-3" :dismissible="false">
+        {{ authLogExceedsLimitMessage }}
+      </gl-alert>
+      <p data-testid="modal-description">
+        <!-- TODO: Update documentation link -->
+        <!-- See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180827#note_2342623907 -->
+        <gl-sprintf
+          :message="
+            s__(
+              'CICD|Adding all entries from the authentication log would exceed this limit. GitLab can compact the allowlist with common groups until the entries are within the limit. %{linkStart}What is the compaction algorithm?%{linkEnd}',
+            )
+          "
+        >
+          <template #link="{ content }">
+            <gl-link href="/" target="_blank">{{ content }}</gl-link>
+          </template>
+        </gl-sprintf>
+      </p>
+    </div>
+    <div v-else data-testid="modal-description">
       <p>
-        {{ errorMessage }}
+        <gl-sprintf
+          :message="
+            s__(
+              `CICD|You're about to add all entries from the authentication log to the allowlist for %{projectName}. Duplicate entries will be ignored.`,
+            )
+          "
+        >
+          <template #projectName>
+            <b>{{ projectName }}</b>
+          </template>
+        </gl-sprintf>
       </p>
-    </gl-alert>
-    <p>
-      <gl-sprintf
-        :message="
+      <p>
+        {{
           s__(
-            `CICD|You're about to add all entries from the authentication log to the allowlist for %{projectName}. Duplicate entries will be ignored.`,
+            'CICD|Groups and projects on the allowlist are authorized to use a CI/CD job token to authenticate requests to this project. Entries added from the authentication log can be removed later if needed.',
           )
-        "
-      >
-        <template #projectName>
-          <b>{{ projectName }}</b>
-        </template>
-      </gl-sprintf>
-    </p>
-    <p>
-      {{
-        s__(
-          'CICD|Groups and projects on the allowlist are authorized to use a CI/CD job token to authenticate requests to this project. Entries added from the authentication log can be removed later if needed.',
-        )
-      }}
-    </p>
-    <p>
-      {{
-        s__(
-          'CICD|The process to add entries could take a moment to complete with large logs or allowlists.',
-        )
-      }}
-    </p>
+        }}
+      </p>
+      <p>
+        {{
+          s__(
+            'CICD|The process to add entries could take a moment to complete with large logs or allowlists.',
+          )
+        }}
+      </p>
+    </div>
   </gl-modal>
 </template>
diff --git a/app/assets/javascripts/token_access/components/inbound_token_access.vue b/app/assets/javascripts/token_access/components/inbound_token_access.vue
index 5409c101a3fd5f..0d86b9ea4ec79f 100644
--- a/app/assets/javascripts/token_access/components/inbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/inbound_token_access.vue
@@ -23,6 +23,7 @@ import inboundUpdateCIJobTokenScopeMutation from '../graphql/mutations/inbound_u
 import inboundGetCIJobTokenScopeQuery from '../graphql/queries/inbound_get_ci_job_token_scope.query.graphql';
 import inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery from '../graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql';
 import getCiJobTokenScopeAllowlistQuery from '../graphql/queries/get_ci_job_token_scope_allowlist.query.graphql';
+import getAuthLogCountQuery from '../graphql/queries/get_auth_log_count.query.graphql';
 import {
   JOB_TOKEN_FORM_ADD_GROUP_OR_PROJECT,
   JOB_TOKEN_FORM_AUTOPOPULATE_AUTH_LOG,
@@ -94,8 +95,24 @@ export default {
     GlTooltip: GlTooltipDirective,
   },
   mixins: [glFeatureFlagsMixin()],
-  inject: ['enforceAllowlist', 'fullPath'],
+  inject: ['enforceAllowlist', 'fullPath', 'projectAllowlistLimit'],
   apollo: {
+    authLogCount: {
+      query: getAuthLogCountQuery,
+      variables() {
+        return {
+          fullPath: this.fullPath,
+        };
+      },
+      update({ project }) {
+        return project.ciJobTokenAuthLogs?.count;
+      },
+      error() {
+        createAlert({
+          message: s__('CICD|There was a problem fetching authorization logs count.'),
+        });
+      },
+    },
     inboundJobTokenScopeEnabled: {
       query: inboundGetCIJobTokenScopeQuery,
       variables() {
@@ -152,6 +169,7 @@ export default {
   },
   data() {
     return {
+      authLogCount: 0,
       inboundJobTokenScopeEnabled: null,
       isUpdating: false,
       groupsAndProjectsWithAccess: { groups: [], projects: [] },
@@ -162,6 +180,9 @@ export default {
     };
   },
   computed: {
+    authLogExceedsLimit() {
+      return this.projectCount + this.groupCount + this.authLogCount >= this.projectAllowlistLimit;
+    },
     isJobTokenPoliciesEnabled() {
       return this.glFeatures.addPoliciesToCiJobToken;
     },
@@ -300,6 +321,8 @@ export default {
 <template>
   <div class="gl-mt-5">
     <autopopulate-allowlist-modal
+      :auth-log-exceeds-limit="authLogExceedsLimit"
+      :project-allowlist-limit="projectAllowlistLimit"
       :project-name="projectName"
       :show-modal="showAutopopulateModal"
       @hide="hideSelectedAction"
diff --git a/app/assets/javascripts/token_access/graphql/queries/get_auth_log_count.query.graphql b/app/assets/javascripts/token_access/graphql/queries/get_auth_log_count.query.graphql
new file mode 100644
index 00000000000000..123b76930b1162
--- /dev/null
+++ b/app/assets/javascripts/token_access/graphql/queries/get_auth_log_count.query.graphql
@@ -0,0 +1,8 @@
+query getAuthLogCount($fullPath: ID!) {
+  project(fullPath: $fullPath) {
+    id
+    ciJobTokenAuthLogs {
+      count
+    }
+  }
+}
diff --git a/app/assets/javascripts/token_access/index.js b/app/assets/javascripts/token_access/index.js
index 8a459fd8483c5c..f2c0eb6f502539 100644
--- a/app/assets/javascripts/token_access/index.js
+++ b/app/assets/javascripts/token_access/index.js
@@ -19,16 +19,18 @@ export const initTokenAccess = (containerId = 'js-ci-token-access-app') => {
     return false;
   }
 
-  const { fullPath, csvDownloadPath, enforceAllowlist } = containerEl.dataset;
+  const { csvDownloadPath, enforceAllowlist, fullPath, projectAllowlistLimit } =
+    containerEl.dataset;
 
   return new Vue({
     el: containerEl,
     name: 'TokenAccessAppsRoot',
     apolloProvider,
     provide: {
+      csvDownloadPath,
       enforceAllowlist: JSON.parse(enforceAllowlist),
       fullPath,
-      csvDownloadPath,
+      projectAllowlistLimit: Number(projectAllowlistLimit),
     },
     render(createElement) {
       return createElement(TokenAccessApp);
diff --git a/app/views/ci/token_access/_index.html.haml b/app/views/ci/token_access/_index.html.haml
index 7a01cbeecd3fff..ba57ac0d1ab034 100644
--- a/app/views/ci/token_access/_index.html.haml
+++ b/app/views/ci/token_access/_index.html.haml
@@ -1 +1,8 @@
-#js-ci-token-access-app{ data: { full_path: @project.full_path, csv_download_path: export_job_token_authorizations_namespace_project_settings_ci_cd_path(@project.namespace, @project), enforce_allowlist: Gitlab::CurrentSettings.enforce_ci_inbound_job_token_scope_enabled?.to_s } }
+#js-ci-token-access-app{
+  data: {
+    full_path: @project.full_path,
+    csv_download_path: export_job_token_authorizations_namespace_project_settings_ci_cd_path(@project.namespace, @project),
+    enforce_allowlist: Gitlab::CurrentSettings.enforce_ci_inbound_job_token_scope_enabled?.to_s,
+    project_allowlist_limit: Ci::JobToken::ProjectScopeLink::PROJECT_LINK_DIRECTIONAL_LIMIT,
+  }
+}
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 68a528dca2d2f0..4ab0dcd9a4d382 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -11080,9 +11080,15 @@ msgstr ""
 msgid "CICD|Add an existing project to the scope"
 msgstr ""
 
+msgid "CICD|Add log entries and compact the allowlist"
+msgstr ""
+
 msgid "CICD|Added from log."
 msgstr ""
 
+msgid "CICD|Adding all entries from the authentication log would exceed this limit. GitLab can compact the allowlist with common groups until the entries are within the limit. %{linkStart}What is the compaction algorithm?%{linkEnd}"
+msgstr ""
+
 msgid "CICD|Additional permissions"
 msgstr ""
 
@@ -11224,6 +11230,9 @@ msgstr ""
 msgid "CICD|The Auto DevOps pipeline runs if no alternative CI configuration file is found."
 msgstr ""
 
+msgid "CICD|The allowlist can contain a maximum of %{projectAllowlistLimit} groups and projects."
+msgstr ""
+
 msgid "CICD|The process to add entries could take a moment to complete with large logs or allowlists."
 msgstr ""
 
@@ -11236,6 +11245,9 @@ msgstr ""
 msgid "CICD|There was a problem fetching authentication logs."
 msgstr ""
 
+msgid "CICD|There was a problem fetching authorization logs count."
+msgstr ""
+
 msgid "CICD|Unprotected branches will not have access to the cache from protected branches."
 msgstr ""
 
diff --git a/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js b/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js
index ed3b405335190d..1d94bee2f7632e 100644
--- a/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js
+++ b/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js
@@ -1,4 +1,4 @@
-import { GlAlert, GlModal } from '@gitlab/ui';
+import { GlAlert, GlLink, GlModal, GlSprintf } from '@gitlab/ui';
 import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
 import { createMockDirective } from 'helpers/vue_mock_directive';
@@ -22,6 +22,7 @@ describe('AutopopulateAllowlistModal component', () => {
 
   const findAlert = () => wrapper.findComponent(GlAlert);
   const findModal = () => wrapper.findComponent(GlModal);
+  const findLink = () => wrapper.findComponent(GlLink);
 
   const createComponent = ({ props } = {}) => {
     const handlers = [[AutopopulateAllowlistMutation, mockAutopopulateMutation]];
@@ -39,10 +40,15 @@ describe('AutopopulateAllowlistModal component', () => {
         GlTooltip: createMockDirective('gl-tooltip'),
       },
       propsData: {
+        authLogExceedsLimit: false,
+        projectAllowlistLimit: 4,
         projectName,
         showModal: true,
         ...props,
       },
+      stubs: {
+        GlSprintf,
+      },
     });
   };
 
@@ -55,8 +61,27 @@ describe('AutopopulateAllowlistModal component', () => {
       createComponent();
     });
 
-    it('does not render alert by default', () => {
+    it('does not render alert or help link by default', () => {
       expect(findAlert().exists()).toBe(false);
+      expect(findLink().exists()).toBe(false);
+    });
+
+    describe('when autopopulating will exceed the allowlist limit', () => {
+      beforeEach(() => {
+        createComponent({ props: { authLogExceedsLimit: true } });
+      });
+
+      it('renders warning alert', () => {
+        expect(findAlert().text()).toBe(
+          'The allowlist can contain a maximum of 4 groups and projects.',
+        );
+      });
+
+      // TODO: Test for help link
+      // See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180827#note_2342623907
+      it('renders help link', () => {
+        expect(findLink().text()).toBe('What is the compaction algorithm?');
+      });
     });
   });
 
diff --git a/spec/frontend/token_access/inbound_token_access_spec.js b/spec/frontend/token_access/inbound_token_access_spec.js
index 556e650a867e9b..d9cebf98f9901f 100644
--- a/spec/frontend/token_access/inbound_token_access_spec.js
+++ b/spec/frontend/token_access/inbound_token_access_spec.js
@@ -17,6 +17,7 @@ import inboundRemoveProjectCIJobTokenScopeMutation from '~/token_access/graphql/
 import inboundUpdateCIJobTokenScopeMutation from '~/token_access/graphql/mutations/inbound_update_ci_job_token_scope.mutation.graphql';
 import inboundGetCIJobTokenScopeQuery from '~/token_access/graphql/queries/inbound_get_ci_job_token_scope.query.graphql';
 import inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery from '~/token_access/graphql/queries/inbound_get_groups_and_projects_with_ci_job_token_scope.query.graphql';
+import getAuthLogCountQuery from '~/token_access/graphql/queries/get_auth_log_count.query.graphql';
 import getCiJobTokenScopeAllowlistQuery from '~/token_access/graphql/queries/get_ci_job_token_scope_allowlist.query.graphql';
 import { createMockDirective, getBinding } from 'helpers/vue_mock_directive';
 import ConfirmActionModal from '~/vue_shared/components/confirm_action_modal.vue';
@@ -29,6 +30,7 @@ import {
   inboundGroupsAndProjectsWithScopeResponse,
   inboundRemoveNamespaceSuccess,
   inboundUpdateScopeSuccessResponse,
+  mockAuthLogsCountResponse,
 } from './mock_data';
 
 const projectPath = 'root/my-repo';
@@ -42,6 +44,7 @@ jest.mock('~/alert');
 describe('TokenAccess component', () => {
   let wrapper;
 
+  const authLogCountResponseHandler = jest.fn().mockResolvedValue(mockAuthLogsCountResponse(4));
   const inboundJobTokenScopeEnabledResponseHandler = jest
     .fn()
     .mockResolvedValue(inboundJobTokenScopeEnabledResponse);
@@ -83,6 +86,7 @@ describe('TokenAccess component', () => {
       addPoliciesToCiJobToken = false,
       authenticationLogsMigrationForAllowlist = false,
       enforceAllowlist = false,
+      projectAllowlistLimit = 2,
       stubs = {},
     } = {},
   ) => {
@@ -90,6 +94,7 @@ describe('TokenAccess component', () => {
       provide: {
         fullPath: projectPath,
         enforceAllowlist,
+        projectAllowlistLimit,
         glFeatures: { addPoliciesToCiJobToken, authenticationLogsMigrationForAllowlist },
       },
       apolloProvider: createMockApollo(requestHandlers),
@@ -126,6 +131,60 @@ describe('TokenAccess component', () => {
     });
   });
 
+  describe('setting allowlist limit', () => {
+    // in the following tests, group count is 1, project count is 1, and auth log count is 4.
+    describe('when fetching auth log count is successful', () => {
+      const createComponentWithAllowlistLimit = async (projectAllowlistLimit) => {
+        await createComponent(
+          [
+            [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
+            [
+              inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+              inboundGroupsAndProjectsWithScopeResponseHandler,
+            ],
+            [getAuthLogCountQuery, authLogCountResponseHandler],
+          ],
+          { projectAllowlistLimit },
+        );
+      };
+
+      it('calls the query with the expected variables', async () => {
+        await createComponentWithAllowlistLimit(6);
+
+        expect(authLogCountResponseHandler).toHaveBeenCalledWith({ fullPath: 'root/my-repo' });
+      });
+
+      it('passes the correct limit values to the autopopulation modal when allowlist limit is not exceeded', async () => {
+        await createComponentWithAllowlistLimit(6);
+
+        expect(findAutopopulateAllowlistModal().props('authLogExceedsLimit')).toBe(true);
+        expect(findAutopopulateAllowlistModal().props('projectAllowlistLimit')).toBe(6);
+      });
+
+      it('passes the correct limit values to the autopopulation modal when allowlist limit is exceeded', async () => {
+        await createComponentWithAllowlistLimit(10);
+
+        expect(findAutopopulateAllowlistModal().props('authLogExceedsLimit')).toBe(false);
+        expect(findAutopopulateAllowlistModal().props('projectAllowlistLimit')).toBe(10);
+      });
+    });
+
+    it('handles fetches auth log count error correctly', async () => {
+      await createComponent([
+        [inboundGetCIJobTokenScopeQuery, inboundJobTokenScopeEnabledResponseHandler],
+        [
+          inboundGetGroupsAndProjectsWithCIJobTokenScopeQuery,
+          inboundGroupsAndProjectsWithScopeResponseHandler,
+        ],
+        [getAuthLogCountQuery, failureHandler],
+      ]);
+
+      expect(createAlert).toHaveBeenCalledWith({
+        message: 'There was a problem fetching authorization logs count.',
+      });
+    });
+  });
+
   describe('fetching groups and projects and scope', () => {
     it('fetches groups and projects and scope correctly', () => {
       const expectedVariables = {
diff --git a/spec/frontend/token_access/mock_data.js b/spec/frontend/token_access/mock_data.js
index 5bfbc3d1101d93..5bb8ed560a6b79 100644
--- a/spec/frontend/token_access/mock_data.js
+++ b/spec/frontend/token_access/mock_data.js
@@ -256,6 +256,19 @@ export const mockPermissionsMutationResponse = ({
   },
 });
 
+export const mockAuthLogsCountResponse = (count) => ({
+  data: {
+    project: {
+      id: 'gid://gitlab/Project/26',
+      __typename: 'Project',
+      ciJobTokenAuthLogs: {
+        __typename: 'CiJobTokenAuthLogConnection',
+        count,
+      },
+    },
+  },
+});
+
 export const mockAuthLogsResponse = (hasNextPage = false) => ({
   data: {
     project: {
-- 
GitLab


From 9272839b3564d7dae4bc8addbfcc485c7045c931 Mon Sep 17 00:00:00 2001
From: Mireya Andres <mandres@gitlab.com>
Date: Sun, 16 Feb 2025 15:03:46 +0800
Subject: [PATCH 2/2] Fix modal title conditional and allowlist limit
 computation

---
 .../components/autopopulate_allowlist_modal.vue      |  4 ++--
 .../token_access/components/inbound_token_access.vue |  2 +-
 .../autopopulate_allowlist_modal_spec.js             | 12 +++++++++++-
 .../token_access/inbound_token_access_spec.js        |  6 +++---
 4 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue b/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue
index b5346bbe2a998a..31f86d1eea9d02 100644
--- a/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue
+++ b/app/assets/javascripts/token_access/components/autopopulate_allowlist_modal.vue
@@ -68,7 +68,7 @@ export default {
       };
     },
     modalTitle() {
-      if (this.authLogExceedsLimitMessage) {
+      if (this.authLogExceedsLimit) {
         return s__('CICD|Add log entries and compact the allowlist');
       }
 
@@ -139,7 +139,7 @@ export default {
       </gl-alert>
       <p data-testid="modal-description">
         <!-- TODO: Update documentation link -->
-        <!-- See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180827#note_2342623907 -->
+        <!-- See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/181294 -->
         <gl-sprintf
           :message="
             s__(
diff --git a/app/assets/javascripts/token_access/components/inbound_token_access.vue b/app/assets/javascripts/token_access/components/inbound_token_access.vue
index 0d86b9ea4ec79f..014b0a1d55dc44 100644
--- a/app/assets/javascripts/token_access/components/inbound_token_access.vue
+++ b/app/assets/javascripts/token_access/components/inbound_token_access.vue
@@ -181,7 +181,7 @@ export default {
   },
   computed: {
     authLogExceedsLimit() {
-      return this.projectCount + this.groupCount + this.authLogCount >= this.projectAllowlistLimit;
+      return this.projectCount + this.groupCount + this.authLogCount > this.projectAllowlistLimit;
     },
     isJobTokenPoliciesEnabled() {
       return this.glFeatures.addPoliciesToCiJobToken;
diff --git a/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js b/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js
index 1d94bee2f7632e..2a3a59f53d2b1e 100644
--- a/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js
+++ b/spec/frontend/token_access/autopopulate_allowlist_modal_spec.js
@@ -66,11 +66,21 @@ describe('AutopopulateAllowlistModal component', () => {
       expect(findLink().exists()).toBe(false);
     });
 
+    it('renders the default title', () => {
+      expect(findModal().props('title')).toBe(
+        'Add all authentication log entries to the allowlist',
+      );
+    });
+
     describe('when autopopulating will exceed the allowlist limit', () => {
       beforeEach(() => {
         createComponent({ props: { authLogExceedsLimit: true } });
       });
 
+      it('renders the correct title', () => {
+        expect(findModal().props('title')).toBe('Add log entries and compact the allowlist');
+      });
+
       it('renders warning alert', () => {
         expect(findAlert().text()).toBe(
           'The allowlist can contain a maximum of 4 groups and projects.',
@@ -78,7 +88,7 @@ describe('AutopopulateAllowlistModal component', () => {
       });
 
       // TODO: Test for help link
-      // See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/180827#note_2342623907
+      // See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/181294
       it('renders help link', () => {
         expect(findLink().text()).toBe('What is the compaction algorithm?');
       });
diff --git a/spec/frontend/token_access/inbound_token_access_spec.js b/spec/frontend/token_access/inbound_token_access_spec.js
index d9cebf98f9901f..45f99c7348fc73 100644
--- a/spec/frontend/token_access/inbound_token_access_spec.js
+++ b/spec/frontend/token_access/inbound_token_access_spec.js
@@ -149,16 +149,16 @@ describe('TokenAccess component', () => {
       };
 
       it('calls the query with the expected variables', async () => {
-        await createComponentWithAllowlistLimit(6);
+        await createComponentWithAllowlistLimit(5);
 
         expect(authLogCountResponseHandler).toHaveBeenCalledWith({ fullPath: 'root/my-repo' });
       });
 
       it('passes the correct limit values to the autopopulation modal when allowlist limit is not exceeded', async () => {
-        await createComponentWithAllowlistLimit(6);
+        await createComponentWithAllowlistLimit(5);
 
         expect(findAutopopulateAllowlistModal().props('authLogExceedsLimit')).toBe(true);
-        expect(findAutopopulateAllowlistModal().props('projectAllowlistLimit')).toBe(6);
+        expect(findAutopopulateAllowlistModal().props('projectAllowlistLimit')).toBe(5);
       });
 
       it('passes the correct limit values to the autopopulation modal when allowlist limit is exceeded', async () => {
-- 
GitLab