14 files changed, 52 insertions, 16 deletions

diff --git a/app/assets/javascripts/runner/components/runner_update_form.vue b/app/assets/javascripts/runner/components/runner_update_form.vue
index e44450a2a8d..119e5236f85 100644
--- a/app/assets/javascripts/runner/components/runner_update_form.vue
+++ b/app/assets/javascripts/runner/components/runner_update_form.vue
@@ -138,7 +138,11 @@ export default {
     >
       {{ __('Lock to current projects') }}
       <template #help>
-        {{ s__('Runners|Use the runner for the currently assigned projects only.') }}
+        {{
+          s__(
+            'Runners|Use the runner for the currently assigned projects only. Only administrators can change the assigned projects.',
+          )
+        }}
       </template>
     </gl-form-checkbox>
 
diff --git a/app/assets/javascripts/runner/constants.js b/app/assets/javascripts/runner/constants.js
index c6afa728424..de0196e98a2 100644
--- a/app/assets/javascripts/runner/constants.js
+++ b/app/assets/javascripts/runner/constants.js
@@ -55,7 +55,9 @@ export const I18N_DELETE_DISABLED_UNKNOWN_REASON = s__(
 );
 export const I18N_DELETED_TOAST = s__('Runners|Runner %{name} was deleted');
 
-export const I18N_LOCKED_RUNNER_DESCRIPTION = s__('Runners|You cannot assign to other projects');
+export const I18N_LOCKED_RUNNER_DESCRIPTION = s__(
+  'Runners|Runner is locked and available for currently assigned projects only. Only administrators can change the assigned projects.',
+);
 
 // Runner details
 
diff --git a/app/controllers/sessions_controller.rb b/app/controllers/sessions_controller.rb
index e907e291eeb..abdc032167b 100644
--- a/app/controllers/sessions_controller.rb
+++ b/app/controllers/sessions_controller.rb
@@ -39,7 +39,7 @@ class SessionsController < Devise::SessionsController
   after_action :log_failed_login, if: :action_new_and_failed_login?
   after_action :verify_known_sign_in, only: [:create]
 
-  helper_method :captcha_enabled?, :captcha_on_login_required?
+  helper_method :captcha_enabled?, :captcha_on_login_required?, :arkose_labs_enabled?
 
   # protect_from_forgery is already prepended in ApplicationController but
   # authenticate_with_two_factor which signs in the user is prepended before
@@ -111,6 +111,10 @@ class SessionsController < Devise::SessionsController
     Gitlab::Recaptcha.enabled_on_login? && unverified_anonymous_user?
   end
 
+  def arkose_labs_enabled?
+    false
+  end
+
   # From https://github.com/plataformatec/devise/wiki/How-To:-Use-Recaptcha-with-Devise#devisepasswordscontroller
   def check_captcha
     return unless user_params[:password].present?
diff --git a/app/models/member.rb b/app/models/member.rb
index e00f82614c6..bd5713bf378 100644
--- a/app/models/member.rb
+++ b/app/models/member.rb
@@ -65,10 +65,10 @@ class Member < ApplicationRecord
 
   scope :in_hierarchy, ->(source) do
     groups = source.root_ancestor.self_and_descendants
-    group_members = Member.default_scoped.where(source: groups)
+    group_members = Member.default_scoped.where(source: groups).select(*Member.cached_column_list)
 
     projects = source.root_ancestor.all_projects
-    project_members = Member.default_scoped.where(source: projects)
+    project_members = Member.default_scoped.where(source: projects).select(*Member.cached_column_list)
 
     Member.default_scoped.from_union([
       group_members,
diff --git a/app/models/user.rb b/app/models/user.rb
index ae3a9888d0c..c683f5dd252 100644
--- a/app/models/user.rb
+++ b/app/models/user.rb
@@ -2104,8 +2104,8 @@ class User < ApplicationRecord
 
   def authorized_groups_without_shared_membership
     Group.from_union([
-      groups.select(Namespace.arel_table[Arel.star]),
-      authorized_projects.joins(:namespace).select(Namespace.arel_table[Arel.star])
+      groups.select(*Namespace.cached_column_list),
+      authorized_projects.joins(:namespace).select(*Namespace.cached_column_list)
     ])
   end
 
diff --git a/app/services/projects/participants_service.rb b/app/services/projects/participants_service.rb
index 152590fffff..c7a34afffb3 100644
--- a/app/services/projects/participants_service.rb
+++ b/app/services/projects/participants_service.rb
@@ -39,6 +39,7 @@ module Projects
       GroupMember
         .active_without_invites_and_requests
         .with_source_id(visible_groups.self_and_ancestors.pluck_primary_key)
+        .select(*GroupMember.cached_column_list)
     end
 
     def visible_groups
@@ -52,11 +53,12 @@ module Projects
     end
 
     def project_members_through_ancestral_groups
-      project.group.present? ? project.group.members_with_parents : Member.none
+      members = project.group.present? ? project.group.members_with_parents : Member.none
+      members.select(*GroupMember.cached_column_list)
     end
 
     def individual_project_members
-      project.project_members
+      project.project_members.select(*GroupMember.cached_column_list)
     end
 
     def project_owner?
diff --git a/app/views/devise/sessions/_new_base.html.haml b/app/views/devise/sessions/_new_base.html.haml
index 96ba06a8323..91d8483b933 100644
--- a/app/views/devise/sessions/_new_base.html.haml
+++ b/app/views/devise/sessions/_new_base.html.haml
@@ -16,7 +16,7 @@
         - else
           = link_to _('Forgot your password?'), new_password_path(:user)
     %div
-    - if Feature.enabled?(:arkose_labs_login_challenge)
+    - if arkose_labs_enabled?
       = render_if_exists 'devise/sessions/arkose_labs'
     - elsif captcha_enabled? || captcha_on_login_required?
       = recaptcha_tags nonce: content_security_policy_nonce
diff --git a/app/views/projects/_transfer.html.haml b/app/views/projects/_transfer.html.haml
index 9f9daa7ec6f..9e6648c71fc 100644
--- a/app/views/projects/_transfer.html.haml
+++ b/app/views/projects/_transfer.html.haml
@@ -9,6 +9,11 @@
     .form-group
       - link_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: help_page_path('user/project/settings/index', anchor: 'transferring-an-existing-project-into-another-namespace') }
       %p= _("Transfer your project into another namespace. %{link_start}Learn more.%{link_end}").html_safe % { link_start: link_start, link_end: '</a>'.html_safe }
+      %p= _('When you transfer your project to a group, you can easily manage multiple projects, view usage quotas for storage, pipeline minutes, and users, and start a trial or upgrade to a paid tier.')
+      %p
+        = _("Don't have a group?")
+        = link_to _('Create one'), new_group_path, target: '_blank'
+      = _('Things to be aware of before transferring:')
       %ul
         %li= _("Be careful. Changing the project's namespace can have unintended side effects.")
         %li= _('You can only transfer the project to namespaces you manage.')
diff --git a/doc/development/sql.md b/doc/development/sql.md
index e2208caf35a..c1f4ad39650 100644
--- a/doc/development/sql.md
+++ b/doc/development/sql.md
@@ -376,7 +376,7 @@ Explicit column list definition:
 
 ```ruby
 # Good, the SELECT columns are consistent
-columns = User.cached_column_names # The helper returns fully qualified (table.column) column names (Arel)
+columns = User.cached_column_list # The helper returns fully qualified (table.column) column names (Arel)
 scope1 = User.select(*columns).where(id: [1, 2, 3]) # selects the columns explicitly
 scope2 = User.select(*columns).where(id: [10, 11, 12]) # uses SELECT users.*
 
diff --git a/doc/user/project/members/index.md b/doc/user/project/members/index.md
index 799ff25a239..f9bad604768 100644
--- a/doc/user/project/members/index.md
+++ b/doc/user/project/members/index.md
@@ -145,7 +145,11 @@ In this example:
 - **Administrator** is the [Owner](../../permissions.md) and member of all groups.
   They have inherited their role from the **demo** group.
 
-If a user is a direct member of a project, the expiration date can be updated. If membership is inherited from a parent group, the expiration date can be updated only from the parent group itself.
+If a user is a:
+
+- Direct member of a project, the **Expiration** and **Max role** fields can be updated directly on the project.
+- Inherited member from a parent group, the **Expiration** and **Max role** fields must be updated on the parent group.
+If a user is an `inherited member` from a parent group, the `Expiration` date and `Max role` can be updated only from the parent group itself.
 
 ## Remove a member from a project
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 1c96ca2ccc8..e67fb96da60 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -10538,6 +10538,9 @@ msgstr ""
 msgid "Create new project"
 msgstr ""
 
+msgid "Create one"
+msgstr ""
+
 msgid "Create or import your first project"
 msgstr ""
 
@@ -13271,6 +13274,9 @@ msgstr ""
 msgid "Domain Name"
 msgstr ""
 
+msgid "Don't have a group?"
+msgstr ""
+
 msgid "Don't have an account yet?"
 msgstr ""
 
@@ -32438,6 +32444,9 @@ msgstr ""
 msgid "Runners|Runner has never contacted this instance"
 msgstr ""
 
+msgid "Runners|Runner is locked and available for currently assigned projects only. Only administrators can change the assigned projects."
+msgstr ""
+
 msgid "Runners|Runner is offline; last contact was %{runner_contact} ago"
 msgstr ""
 
@@ -32528,7 +32537,7 @@ msgstr ""
 msgid "Runners|Use the runner for jobs without tags, in addition to tagged jobs."
 msgstr ""
 
-msgid "Runners|Use the runner for the currently assigned projects only."
+msgid "Runners|Use the runner for the currently assigned projects only. Only administrators can change the assigned projects."
 msgstr ""
 
 msgid "Runners|Use the runner on pipelines for protected branches only."
@@ -32555,9 +32564,6 @@ msgstr ""
 msgid "Runners|You can set up a specific runner to be used by multiple projects but you cannot make this a shared runner."
 msgstr ""
 
-msgid "Runners|You cannot assign to other projects"
-msgstr ""
-
 msgid "Runners|You have used %{quotaUsed} out of %{quotaLimit} of your shared Runners pipeline minutes."
 msgstr ""
 
@@ -38128,6 +38134,9 @@ msgstr ""
 msgid "These will be sent to %{email} in an attachment once finished."
 msgstr ""
 
+msgid "Things to be aware of before transferring:"
+msgstr ""
+
 msgid "Third Party Advisory Link"
 msgstr ""
 
@@ -42298,6 +42307,9 @@ msgstr[1] ""
 msgid "When using the %{code_open}http://%{code_close} or %{code_open}https://%{code_close} protocols, please provide the exact URL to the repository. HTTP redirects will not be followed."
 msgstr ""
 
+msgid "When you transfer your project to a group, you can easily manage multiple projects, view usage quotas for storage, pipeline minutes, and users, and start a trial or upgrade to a paid tier."
+msgstr ""
+
 msgid "When:"
 msgstr ""
 
diff --git a/spec/frontend/fixtures/sessions.rb b/spec/frontend/fixtures/sessions.rb
index bb73bf3215c..a84a56e4d01 100644
--- a/spec/frontend/fixtures/sessions.rb
+++ b/spec/frontend/fixtures/sessions.rb
@@ -12,6 +12,7 @@ RSpec.describe 'Sessions (JavaScript fixtures)' do
 
     before do
       set_devise_mapping(context: @request)
+      allow(controller).to receive(:arkose_labs_enabled?).and_return(true)
     end
 
     it 'sessions/new.html' do
diff --git a/spec/views/devise/sessions/new.html.haml_spec.rb b/spec/views/devise/sessions/new.html.haml_spec.rb
index e8232a2c067..1cbef9538be 100644
--- a/spec/views/devise/sessions/new.html.haml_spec.rb
+++ b/spec/views/devise/sessions/new.html.haml_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe 'devise/sessions/new' do
     before do
       stub_devise
       disable_captcha
+      allow(view).to receive(:arkose_labs_enabled?).and_return(false)
       allow(Gitlab).to receive(:com?).and_return(true)
     end
 
diff --git a/spec/views/devise/shared/_signin_box.html.haml_spec.rb b/spec/views/devise/shared/_signin_box.html.haml_spec.rb
index 8b1af1866dc..8488a786bdd 100644
--- a/spec/views/devise/shared/_signin_box.html.haml_spec.rb
+++ b/spec/views/devise/shared/_signin_box.html.haml_spec.rb
@@ -11,6 +11,7 @@ RSpec.describe 'devise/shared/_signin_box' do
       allow(view).to receive(:captcha_enabled?).and_return(false)
       allow(view).to receive(:captcha_on_login_required?).and_return(false)
       allow(view).to receive(:experiment_enabled?).and_return(false)
+      allow(view).to receive(:arkose_labs_enabled?).and_return(false)
     end
 
     it 'is shown when Crowd is enabled' do