SONAR-19850 Fix permissions on tests

12 files changed, 279 insertions, 189 deletions

diff --git a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentDbTester.java b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentDbTester.java
index dae0201910a..ec11da29f89 100644
--- a/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentDbTester.java
+++ b/server/sonar-db-dao/src/testFixtures/java/org/sonar/db/component/ComponentDbTester.java
@@ -120,8 +120,12 @@ public class ComponentDbTester {
     return insertComponentAndBranchAndProject(componentDto, false);
   }
 
-  public ProjectData insertPrivateProject(String uuid) {
-    return insertComponentAndBranchAndProject(ComponentTesting.newPrivateProjectDto(), true, defaults(), defaults(), p -> p.setUuid(uuid));
+  public ProjectData insertPrivateProject(String projectUuid) {
+    return insertComponentAndBranchAndProject(ComponentTesting.newPrivateProjectDto(), true, defaults(), defaults(), p -> p.setUuid(projectUuid));
+  }
+
+  public ProjectData insertPrivateProject(String projectUuid, ComponentDto mainBranch) {
+    return insertComponentAndBranchAndProject(mainBranch, true, defaults(), defaults(), p -> p.setUuid(projectUuid));
   }
 
   public final ProjectData insertPrivateProject(Consumer<ComponentDto> dtoPopulator) {
@@ -330,6 +334,13 @@ public class ComponentDbTester {
     addPortfolioProject(portfolio.uuid(), projectUuids);
   }
 
+  public void addPortfolioProject(ComponentDto portfolio, ProjectDto... projects) {
+    for (ProjectDto project : projects) {
+      dbClient.portfolioDao().addProject(dbSession, portfolio.uuid(), project.getUuid());
+    }
+    db.commit();
+  }
+
   public void addPortfolioProject(ComponentDto portfolio, ComponentDto... mainBranches) {
     List<BranchDto> branchDtos = dbClient.branchDao().selectByUuids(db.getSession(), Arrays.stream(mainBranches).map(ComponentDto::uuid).toList());
     addPortfolioProject(portfolio, branchDtos.stream().map(BranchDto::getProjectUuid).toArray(String[]::new));
diff --git a/server/sonar-webserver-auth/src/testFixtures/java/org/sonar/server/tester/UserSessionRule.java b/server/sonar-webserver-auth/src/testFixtures/java/org/sonar/server/tester/UserSessionRule.java
index b5a9a32cf0a..6f9daa71c4a 100644
--- a/server/sonar-webserver-auth/src/testFixtures/java/org/sonar/server/tester/UserSessionRule.java
+++ b/server/sonar-webserver-auth/src/testFixtures/java/org/sonar/server/tester/UserSessionRule.java
@@ -200,6 +200,11 @@ public class UserSessionRule implements TestRule, UserSession {
     return this;
   }
 
+  public UserSessionRule addPortfolioPermission(String projectPermission, ComponentDto... components) {
+    ensureAbstractMockUserSession().addProjectPermission(projectPermission, components);
+    return this;
+  }
+
   public UserSessionRule addProjectBranchMapping(String projectUuid, ComponentDto... branchComponents) {
     ensureAbstractMockUserSession().addProjectBranchMapping(projectUuid, branchComponents);
     return this;
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/MeasureActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/MeasureActionIT.java
index 311e9be3edc..294e1b9dc5c 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/MeasureActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/MeasureActionIT.java
@@ -369,7 +369,7 @@ public class MeasureActionIT {
 
   @Test
   public void return_error_on_private_project_without_token() throws ParseException {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
+    ProjectDto project = db.components().insertPrivateProject().getProjectDto();
     UserDto user = db.users().insertUser();
     userSession.logIn(user).addProjectPermission(USER, project);
     MetricDto metric = db.measures().insertMetric(m -> m.setKey(BUGS_KEY).setValueType(INT.name()));
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/QualityGateActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/QualityGateActionIT.java
index 0995757dd93..96b963bfbf1 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/QualityGateActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/badge/ws/QualityGateActionIT.java
@@ -272,7 +272,7 @@ public class QualityGateActionIT {
 
   @Test
   public void return_error_on_private_project() throws ParseException {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
+    ProjectDto project = db.components().insertPrivateProject().getProjectDto();
     UserDto user = db.users().insertUser();
     userSession.logIn(user).addProjectPermission(USER, project);
 
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/batch/ProjectDataLoaderIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/batch/ProjectDataLoaderIT.java
index c0d47cd8749..3a82f135a32 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/batch/ProjectDataLoaderIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/batch/ProjectDataLoaderIT.java
@@ -28,7 +28,9 @@ import org.sonar.db.DbClient;
 import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 import org.sonar.db.component.ComponentDto;
+import org.sonar.db.component.ProjectData;
 import org.sonar.db.component.ResourceTypesRule;
+import org.sonar.db.project.ProjectDto;
 import org.sonar.db.source.FileSourceDto;
 import org.sonar.scanner.protocol.input.FileData;
 import org.sonar.scanner.protocol.input.ProjectRepositories;
@@ -57,8 +59,10 @@ public class ProjectDataLoaderIT {
 
   @Test
   public void throws_NotFoundException_when_branch_does_not_exist() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.logIn().addProjectPermission(SCAN.getKey(), project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ProjectDto project = projectData.getProjectDto();
+    userSession.logIn().addProjectPermission(SCAN.getKey(), project)
+        .registerBranches(projectData.getMainBranchDto());
 
     assertThatThrownBy(() -> {
       underTest.load(ProjectDataQuery.create()
@@ -71,9 +75,11 @@ public class ProjectDataLoaderIT {
 
   @Test
   public void return_file_data_from_single_project() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.logIn().addProjectPermission(SCAN.getKey(), project);
-    ComponentDto file = db.components().insertComponent(newFileDto(project));
+    ProjectData projectData = db.components().insertPrivateProject();
+    ProjectDto project = projectData.getProjectDto();
+    userSession.logIn().addProjectPermission(SCAN.getKey(), project)
+      .registerBranches(projectData.getMainBranchDto());
+    ComponentDto file = db.components().insertComponent(newFileDto(projectData.getMainBranchComponent()));
     dbClient.fileSourceDao().insert(dbSession, newFileSourceDto(file).setSrcHash("123456"));
     db.commit();
 
@@ -86,16 +92,19 @@ public class ProjectDataLoaderIT {
 
   @Test
   public void return_file_data_from_branch() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    ComponentDto branch = db.components().insertProjectBranch(project, b -> b.setKey("my_branch"));
-    userSession.logIn().addProjectPermission(SCAN.getKey(), project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    ComponentDto branch = db.components().insertProjectBranch(mainBranch, b -> b.setKey("my_branch"));
+    userSession.logIn().addProjectPermission(SCAN.getKey(), projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto())
+      .addProjectBranchMapping(projectData.projectUuid(), branch);
     // File on branch
-    ComponentDto projectFile = db.components().insertComponent(newFileDto(branch, project.uuid()));
+    ComponentDto projectFile = db.components().insertComponent(newFileDto(branch, mainBranch.uuid()));
     dbClient.fileSourceDao().insert(dbSession, newFileSourceDto(projectFile).setSrcHash("123456"));
     dbSession.commit();
 
     ProjectRepositories ref = underTest.load(ProjectDataQuery.create()
-      .setProjectKey(project.getKey())
+      .setProjectKey(mainBranch.getKey())
       .setBranch("my_branch"));
 
     assertThat(ref.fileDataByPath(projectFile.path()).hash()).isEqualTo("123456");
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/branch/ws/ListActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/branch/ws/ListActionIT.java
index 213a55e283d..258c1f4f0c7 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/branch/ws/ListActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/branch/ws/ListActionIT.java
@@ -279,9 +279,10 @@ public class ListActionIT {
 
   @Test
   public void fail_if_not_a_reference_on_project() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    ComponentDto file = db.components().insertComponent(ComponentTesting.newFileDto(project));
-    userSession.logIn().addProjectPermission(USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    ComponentDto file = db.components().insertComponent(ComponentTesting.newFileDto(mainBranch));
+    userSession.logIn().addProjectPermission(USER, projectData.getProjectDto());
     TestRequest request = ws.newRequest().setParam("project", file.getKey());
     assertThatThrownBy(request::execute)
       .isInstanceOf(NotFoundException.class)
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/BranchReportSubmitterIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/BranchReportSubmitterIT.java
index e41ad6f5ce9..26845b14251 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/BranchReportSubmitterIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/BranchReportSubmitterIT.java
@@ -21,6 +21,7 @@ package org.sonar.server.ce.queue;
 
 import com.google.common.collect.ImmutableMap;
 import com.tngtech.java.junit.dataprovider.DataProviderRunner;
+import java.awt.event.ComponentEvent;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
 import java.util.Map;
@@ -45,6 +46,8 @@ import org.sonar.db.component.BranchDto;
 import org.sonar.db.component.BranchType;
 import org.sonar.db.component.ComponentDto;
 import org.sonar.db.component.ComponentTesting;
+import org.sonar.db.component.ProjectData;
+import org.sonar.db.project.ProjectDto;
 import org.sonar.db.user.UserDto;
 import org.sonar.server.component.ComponentCreationData;
 import org.sonar.server.component.ComponentUpdater;
@@ -82,6 +85,7 @@ import static org.sonar.db.permission.GlobalPermission.SCAN;
 @RunWith(DataProviderRunner.class)
 public class BranchReportSubmitterIT {
 
+  private static final String PROJECT_UUID = "PROJECT_UUID";
   @Rule
   public final UserSessionRule userSession = UserSessionRule.standalone();
   @Rule
@@ -106,105 +110,113 @@ public class BranchReportSubmitterIT {
 
   @Test
   public void submit_does_not_use_delegate_if_characteristics_are_empty() {
-    ComponentDto project = db.components().insertPublicProject().getMainBranchComponent();
+    ProjectData projectData = db.components().insertPublicProject();
+    ProjectDto project = projectData.getProjectDto();
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(SCAN.getKey(), project);
+    userSession.logIn(user).addProjectPermission(SCAN.getKey(), project)
+        .registerBranches(projectData.getMainBranchDto());
     mockSuccessfulPrepareSubmitCall();
     InputStream reportInput = IOUtils.toInputStream("{binary}", StandardCharsets.UTF_8);
 
-    underTest.submit(project.getKey(), project.name(), emptyMap(), reportInput);
+    underTest.submit(project.getKey(), project.getName(), emptyMap(), reportInput);
 
     verifyNoInteractions(branchSupportDelegate);
   }
 
   @Test
   public void submit_a_report_on_existing_branch() {
-    ComponentDto project = db.components().insertPublicProject().getMainBranchComponent();
-    ComponentDto branch = db.components().insertProjectBranch(project, b -> b.setKey("branch1"));
+    ProjectData projectData = db.components().insertPublicProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    ComponentDto branch = db.components().insertProjectBranch(mainBranch, b -> b.setKey("branch1"));
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(SCAN.getKey(), project).addProjectBranchMapping(project.uuid(), branch);
+    userSession.logIn(user).addProjectPermission(SCAN.getKey(), projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto())
+      .addProjectBranchMapping(projectData.projectUuid(), branch);
     Map<String, String> randomCharacteristics = randomNonEmptyMap();
-    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(project.getKey(), "branch1");
-    when(branchSupportDelegate.createComponentKey(project.getKey(), randomCharacteristics)).thenReturn(componentKey);
+    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(mainBranch.getKey(), "branch1");
+    when(branchSupportDelegate.createComponentKey(mainBranch.getKey(), randomCharacteristics)).thenReturn(componentKey);
     InputStream reportInput = IOUtils.toInputStream("{binary}", StandardCharsets.UTF_8);
     String taskUuid = mockSuccessfulPrepareSubmitCall();
 
-    underTest.submit(project.getKey(), project.name(), randomCharacteristics, reportInput);
+    underTest.submit(mainBranch.getKey(), mainBranch.name(), randomCharacteristics, reportInput);
 
     verifyNoInteractions(permissionTemplateService);
     verifyNoInteractions(favoriteUpdater);
     verify(branchSupport, times(0)).createBranchComponent(any(), any(), any(), any());
-    verify(branchSupportDelegate).createComponentKey(project.getKey(), randomCharacteristics);
+    verify(branchSupportDelegate).createComponentKey(mainBranch.getKey(), randomCharacteristics);
     verify(branchSupportDelegate, times(0)).createBranchComponent(any(), any(), any(), any());
     verifyNoMoreInteractions(branchSupportDelegate);
-    verifyQueueSubmit(project, branch, user, randomCharacteristics, taskUuid);
+    verifyQueueSubmit(mainBranch, branch, user, randomCharacteristics, taskUuid);
   }
 
   @Test
   public void submit_a_report_on_missing_branch_but_existing_project() {
-    ComponentDto existingProject = db.components().insertPublicProject().getMainBranchComponent();
-    BranchDto exitingProjectMainBranch = db.getDbClient().branchDao().selectByUuid(db.getSession(), existingProject.uuid()).get();
+    ProjectData projectData = db.components().insertPublicProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    BranchDto exitingProjectMainBranch = db.getDbClient().branchDao().selectByUuid(db.getSession(), mainBranch.uuid()).get();
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(SCAN.getKey(), existingProject);
+    userSession.logIn(user).addProjectPermission(SCAN.getKey(), projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
     Map<String, String> randomCharacteristics = randomNonEmptyMap();
-    ComponentDto createdBranch = createButDoNotInsertBranch(existingProject);
-    userSession.addProjectBranchMapping(existingProject.uuid(), createdBranch);
-    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(existingProject.getKey(), "branch1");
-    when(branchSupportDelegate.createComponentKey(existingProject.getKey(), randomCharacteristics)).thenReturn(componentKey);
-    when(branchSupportDelegate.createBranchComponent(any(DbSession.class), same(componentKey), eq(existingProject), eq(exitingProjectMainBranch))).thenReturn(createdBranch);
+    ComponentDto createdBranch = createButDoNotInsertBranch(mainBranch, projectData.projectUuid());
+    userSession.addProjectBranchMapping(projectData.projectUuid(), createdBranch);
+    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(mainBranch.getKey(), "branch1");
+    when(branchSupportDelegate.createComponentKey(mainBranch.getKey(), randomCharacteristics)).thenReturn(componentKey);
+    when(branchSupportDelegate.createBranchComponent(any(DbSession.class), same(componentKey), eq(mainBranch), eq(exitingProjectMainBranch))).thenReturn(createdBranch);
     InputStream reportInput = IOUtils.toInputStream("{binary}", StandardCharsets.UTF_8);
     String taskUuid = mockSuccessfulPrepareSubmitCall();
 
-    underTest.submit(existingProject.getKey(), existingProject.name(), randomCharacteristics, reportInput);
+    underTest.submit(mainBranch.getKey(), mainBranch.name(), randomCharacteristics, reportInput);
 
     verifyNoInteractions(permissionTemplateService);
     verifyNoInteractions(favoriteUpdater);
-    verify(branchSupport).createBranchComponent(any(DbSession.class), same(componentKey), eq(existingProject), eq(exitingProjectMainBranch));
-    verify(branchSupportDelegate).createComponentKey(existingProject.getKey(), randomCharacteristics);
-    verify(branchSupportDelegate).createBranchComponent(any(DbSession.class), same(componentKey), eq(existingProject), eq(exitingProjectMainBranch));
+    verify(branchSupport).createBranchComponent(any(DbSession.class), same(componentKey), eq(mainBranch), eq(exitingProjectMainBranch));
+    verify(branchSupportDelegate).createComponentKey(mainBranch.getKey(), randomCharacteristics);
+    verify(branchSupportDelegate).createBranchComponent(any(DbSession.class), same(componentKey), eq(mainBranch), eq(exitingProjectMainBranch));
     verifyNoMoreInteractions(branchSupportDelegate);
     verify(componentUpdater, times(0)).commitAndIndex(any(), any());
-    verifyQueueSubmit(existingProject, createdBranch, user, randomCharacteristics, taskUuid);
+    verifyQueueSubmit(mainBranch, createdBranch, user, randomCharacteristics, taskUuid);
   }
 
   @Test
   public void submit_report_on_missing_branch_of_missing_project_provisions_project_when_PROVISION_PROJECT_perm() {
-    ComponentDto nonExistingProject = newPrivateProjectDto();
+    ComponentDto nonExistingBranch = newPrivateProjectDto();
     UserDto user = db.users().insertUser();
     userSession.logIn(user)
       .addPermission(PROVISION_PROJECTS)
       .addPermission(SCAN);
 
     Map<String, String> randomCharacteristics = randomNonEmptyMap();
-    ComponentDto createdBranch = createButDoNotInsertBranch(nonExistingProject);
-    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(nonExistingProject.getKey());
-    when(branchSupportDelegate.createComponentKey(nonExistingProject.getKey(), randomCharacteristics)).thenReturn(componentKey);
+    ComponentDto createdBranch = createButDoNotInsertBranch(nonExistingBranch, PROJECT_UUID);
+    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(nonExistingBranch.getKey());
+    when(branchSupportDelegate.createComponentKey(nonExistingBranch.getKey(), randomCharacteristics)).thenReturn(componentKey);
     ComponentCreationData componentCreationData = mock(ComponentCreationData.class);
     when(componentCreationData.mainBranchComponent())
-      .thenAnswer((Answer<ComponentDto>) invocation -> db.components().insertPrivateProject(nonExistingProject).getMainBranchComponent());
+      .thenAnswer((Answer<ComponentDto>) invocation -> db.components().insertPrivateProject(PROJECT_UUID, nonExistingBranch).getMainBranchComponent());
     when(componentUpdater.createWithoutCommit(any(), any(), eq(user.getUuid()), eq(user.getLogin())))
       .thenReturn(componentCreationData);
-    when(branchSupportDelegate.createBranchComponent(any(DbSession.class), same(componentKey), eq(nonExistingProject), any())).thenReturn(createdBranch);
-    when(permissionTemplateService.wouldUserHaveScanPermissionWithDefaultTemplate(any(DbSession.class), any(), eq(nonExistingProject.getKey()))).thenReturn(true);
+    when(branchSupportDelegate.createBranchComponent(any(DbSession.class), same(componentKey), any(), any())).thenReturn(createdBranch);
+    when(permissionTemplateService.wouldUserHaveScanPermissionWithDefaultTemplate(any(DbSession.class), any(), eq(nonExistingBranch.getKey()))).thenReturn(true);
     String taskUuid = mockSuccessfulPrepareSubmitCall();
     InputStream reportInput = IOUtils.toInputStream("{binary}", StandardCharsets.UTF_8);
 
-    underTest.submit(nonExistingProject.getKey(), nonExistingProject.name(), randomCharacteristics, reportInput);
+    underTest.submit(nonExistingBranch.getKey(), nonExistingBranch.name(), randomCharacteristics, reportInput);
 
-    BranchDto exitingProjectMainBranch = db.getDbClient().branchDao().selectByUuid(db.getSession(), nonExistingProject.uuid()).get();
-    verify(branchSupport).createBranchComponent(any(DbSession.class), same(componentKey), eq(nonExistingProject), eq(exitingProjectMainBranch));
-    verify(branchSupportDelegate).createComponentKey(nonExistingProject.getKey(), randomCharacteristics);
-    verify(branchSupportDelegate).createBranchComponent(any(DbSession.class), same(componentKey), eq(nonExistingProject), eq(exitingProjectMainBranch));
+    BranchDto exitingProjectMainBranch = db.getDbClient().branchDao().selectByUuid(db.getSession(), nonExistingBranch.uuid()).get();
+    verify(branchSupport).createBranchComponent(any(DbSession.class), same(componentKey), eq(nonExistingBranch), eq(exitingProjectMainBranch));
+    verify(branchSupportDelegate).createComponentKey(nonExistingBranch.getKey(), randomCharacteristics);
+    verify(branchSupportDelegate).createBranchComponent(any(DbSession.class), same(componentKey), eq(nonExistingBranch), eq(exitingProjectMainBranch));
     verifyNoMoreInteractions(branchSupportDelegate);
-    verifyQueueSubmit(nonExistingProject, createdBranch, user, randomCharacteristics, taskUuid);
+    verifyQueueSubmit(nonExistingBranch, createdBranch, user, randomCharacteristics, taskUuid);
     verify(componentUpdater).commitAndIndex(any(DbSession.class), eq(componentCreationData));
   }
 
   @Test
   public void submit_fails_if_branch_support_delegate_createComponentKey_throws_an_exception() {
-    ComponentDto project = db.components().insertPublicProject().getMainBranchComponent();
+    ProjectData projectData = db.components().insertPublicProject();
+    ComponentDto project = projectData.getMainBranchComponent();
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(SCAN.getKey(), project);
+    userSession.logIn(user).addProjectPermission(SCAN.getKey(), projectData.getProjectDto());
     Map<String, String> randomCharacteristics = randomNonEmptyMap();
     InputStream reportInput = IOUtils.toInputStream("{binary}", StandardCharsets.UTF_8);
     RuntimeException expected = new RuntimeException("Faking an exception thrown by branchSupportDelegate");
@@ -220,27 +232,27 @@ public class BranchReportSubmitterIT {
 
   @Test
   public void submit_report_on_missing_branch_of_missing_project_fails_with_ForbiddenException_if_only_scan_permission() {
-    ComponentDto nonExistingProject = newPrivateProjectDto();
+    ComponentDto nonExistingBranch = newPrivateProjectDto();
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(SCAN.getKey(), nonExistingProject);
+
     Map<String, String> randomCharacteristics = randomNonEmptyMap();
-    ComponentDto createdBranch = createButDoNotInsertBranch(nonExistingProject);
-    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(nonExistingProject.getKey());
-    String nonExistingProjectDbKey = nonExistingProject.getKey();
+    ComponentDto createdBranch = createButDoNotInsertBranch(nonExistingBranch, PROJECT_UUID);
+    BranchSupport.ComponentKey componentKey = createComponentKeyOfBranch(nonExistingBranch.getKey());
+    String nonExistingProjectDbKey = nonExistingBranch.getKey();
     when(branchSupportDelegate.createComponentKey(nonExistingProjectDbKey, randomCharacteristics)).thenReturn(componentKey);
-    when(branchSupportDelegate.createBranchComponent(any(DbSession.class), same(componentKey), eq(nonExistingProject), any())).thenReturn(createdBranch);
+    when(branchSupportDelegate.createBranchComponent(any(DbSession.class), same(componentKey), any(), any())).thenReturn(createdBranch);
     InputStream reportInput = IOUtils.toInputStream("{binary}", StandardCharsets.UTF_8);
 
-    String name = nonExistingProject.name();
+    String name = nonExistingBranch.name();
     assertThatThrownBy(() -> underTest.submit(nonExistingProjectDbKey, name, randomCharacteristics, reportInput))
       .isInstanceOf(ForbiddenException.class)
       .hasMessage("Insufficient privileges");
   }
 
-  private static ComponentDto createButDoNotInsertBranch(ComponentDto project) {
+  private static ComponentDto createButDoNotInsertBranch(ComponentDto mainBranch, String projectUuid) {
     BranchType randomBranchType = BranchType.values()[new Random().nextInt(BranchType.values().length)];
-    BranchDto branchDto = newBranchDto(project.branchUuid(), randomBranchType);
-    return ComponentTesting.newBranchComponent(project, branchDto);
+    BranchDto branchDto = newBranchDto(projectUuid, randomBranchType);
+    return ComponentTesting.newBranchComponent(mainBranch, branchDto);
   }
 
   private String mockSuccessfulPrepareSubmitCall() {
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/ReportSubmitterIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/ReportSubmitterIT.java
index 8eb6efbc793..ec0a9ac2a18 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/ReportSubmitterIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/queue/ReportSubmitterIT.java
@@ -37,6 +37,7 @@ import org.sonar.db.DbSession;
 import org.sonar.db.DbTester;
 import org.sonar.db.ce.CeTaskTypes;
 import org.sonar.db.component.ComponentDto;
+import org.sonar.db.component.ProjectData;
 import org.sonar.db.permission.GlobalPermission;
 import org.sonar.db.project.ProjectDto;
 import org.sonar.db.user.UserDto;
@@ -261,7 +262,7 @@ public class ReportSubmitterIT {
   @Test
   public void fail_if_component_is_not_a_project() {
     ComponentDto component = db.components().insertPublicPortfolio();
-    userSession.logIn().addProjectPermission(SCAN.getKey(), component);
+    userSession.logIn().addPortfolioPermission(SCAN.getKey(), component);
     mockSuccessfulPrepareSubmitCall();
 
     String dbKey = component.getKey();
@@ -275,8 +276,9 @@ public class ReportSubmitterIT {
 
   @Test
   public void fail_if_project_key_already_exists_as_other_component() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    ComponentDto dir = db.components().insertComponent(newDirectory(project, "path"));
+    ProjectData projectData = db.components().insertPrivateProject();
+    ProjectDto project = projectData.getProjectDto();
+    ComponentDto dir = db.components().insertComponent(newDirectory(projectData.getMainBranchComponent(), "path"));
     userSession.logIn().addProjectPermission(SCAN.getKey(), project);
     mockSuccessfulPrepareSubmitCall();
 
@@ -303,8 +305,8 @@ public class ReportSubmitterIT {
 
   @Test
   public void fail_with_forbidden_exception_on_new_project_when_only_project_scan_permission() {
-    ComponentDto component = db.components().insertPrivateProject(PROJECT_UUID).getMainBranchComponent();
-    userSession.addProjectPermission(SCAN.getKey(), component);
+    ProjectDto project = db.components().insertPrivateProject(PROJECT_UUID).getProjectDto();
+    userSession.addProjectPermission(SCAN.getKey(), project);
     mockSuccessfulPrepareSubmitCall();
 
     Map<String, String> emptyMap = emptyMap();
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/ActivityActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/ActivityActionIT.java
index 0f06e7200be..fc866c680e0 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/ActivityActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/ActivityActionIT.java
@@ -381,7 +381,7 @@ public class ActivityActionIT {
     // is reserved to roots
     PortfolioData view = db.components().insertPrivatePortfolioData();
     insertActivity("T1", view, SUCCESS);
-    userSession.logIn().addProjectPermission(UserRole.ADMIN, view.getRootComponent());
+    userSession.logIn().addPortfolioPermission(UserRole.ADMIN, view.getPortfolioDto());
 
     TestRequest request = ws.newRequest().setParam(TEXT_QUERY, "T1");
     assertThatThrownBy(() -> call(request))
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/TaskActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/TaskActionIT.java
index 425e40f5ceb..6cab61c6135 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/TaskActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/ce/ws/TaskActionIT.java
@@ -57,6 +57,7 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatThrownBy;
 import static org.sonar.api.web.UserRole.ADMIN;
 import static org.sonar.api.web.UserRole.SCAN;
+import static org.sonar.api.web.UserRole.USER;
 import static org.sonar.db.ce.CeTaskCharacteristicDto.BRANCH_KEY;
 import static org.sonar.db.ce.CeTaskCharacteristicDto.BRANCH_TYPE_KEY;
 import static org.sonar.db.component.BranchType.BRANCH;
@@ -75,13 +76,16 @@ public class TaskActionIT {
   private final TaskAction underTest = new TaskAction(db.getDbClient(), formatter, userSession);
   private final WsActionTester ws = new WsActionTester(underTest);
 
-  private ComponentDto privateProject;
+  private ComponentDto privateProjectMainBranch;
   private ComponentDto publicProjectMainBranch;
   private ProjectDto publicProject;
+  private ProjectDto privateProject;
 
   @Before
   public void setUp() {
-    privateProject = db.components().insertPrivateProject().getMainBranchComponent();
+    ProjectData privateProjectData = db.components().insertPrivateProject();
+    privateProject = privateProjectData.getProjectDto();
+    privateProjectMainBranch = privateProjectData.getMainBranchComponent();
     userSession.logIn().addProjectPermission(ADMIN, privateProject);
     ProjectData publicProjectData = db.components().insertPublicProject();
     publicProject = publicProjectData.getProjectDto();
@@ -91,12 +95,12 @@ public class TaskActionIT {
   @Test
   public void task_is_in_queue() {
     UserDto user = db.users().insertUser();
-    userSession.addProjectPermission(SCAN, privateProject);
+    loginAndAddProjectPermission(null, SCAN);
 
     CeQueueDto queueDto = new CeQueueDto();
     queueDto.setTaskType(CeTaskTypes.REPORT);
     queueDto.setUuid(SOME_TASK_UUID);
-    queueDto.setComponentUuid(privateProject.uuid());
+    queueDto.setComponentUuid(privateProjectMainBranch.uuid());
     queueDto.setStatus(CeQueueDto.Status.PENDING);
     queueDto.setSubmitterUuid(user.getUuid());
     persist(queueDto);
@@ -107,9 +111,9 @@ public class TaskActionIT {
     assertThat(taskResponse.getTask().getId()).isEqualTo(SOME_TASK_UUID);
     assertThat(taskResponse.getTask().getStatus()).isEqualTo(Ce.TaskStatus.PENDING);
     assertThat(taskResponse.getTask().getSubmitterLogin()).isEqualTo(user.getLogin());
-    assertThat(taskResponse.getTask().getComponentId()).isEqualTo(privateProject.uuid());
-    assertThat(taskResponse.getTask().getComponentKey()).isEqualTo(privateProject.getKey());
-    assertThat(taskResponse.getTask().getComponentName()).isEqualTo(privateProject.name());
+    assertThat(taskResponse.getTask().getComponentId()).isEqualTo(privateProjectMainBranch.uuid());
+    assertThat(taskResponse.getTask().getComponentKey()).isEqualTo(privateProjectMainBranch.getKey());
+    assertThat(taskResponse.getTask().getComponentName()).isEqualTo(privateProjectMainBranch.name());
     assertThat(taskResponse.getTask().hasExecutionTimeMs()).isFalse();
     assertThat(taskResponse.getTask().getWarningCount()).isZero();
     assertThat(taskResponse.getTask().getWarningsList()).isEmpty();
@@ -141,7 +145,7 @@ public class TaskActionIT {
   @Test
   public void task_is_archived() {
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(SCAN, privateProject);
+    loginAndAddProjectPermission(user, GlobalPermission.SCAN.getKey());
 
     CeActivityDto activityDto = createActivityDto(SOME_TASK_UUID);
     persist(activityDto);
@@ -152,9 +156,9 @@ public class TaskActionIT {
     Ce.Task task = taskResponse.getTask();
     assertThat(task.getId()).isEqualTo(SOME_TASK_UUID);
     assertThat(task.getStatus()).isEqualTo(Ce.TaskStatus.FAILED);
-    assertThat(task.getComponentId()).isEqualTo(privateProject.uuid());
-    assertThat(task.getComponentKey()).isEqualTo(privateProject.getKey());
-    assertThat(task.getComponentName()).isEqualTo(privateProject.name());
+    assertThat(task.getComponentId()).isEqualTo(privateProjectMainBranch.uuid());
+    assertThat(task.getComponentKey()).isEqualTo(privateProjectMainBranch.getKey());
+    assertThat(task.getComponentName()).isEqualTo(privateProjectMainBranch.name());
     assertThat(task.getAnalysisId()).isEqualTo(activityDto.getAnalysisUuid());
     assertThat(task.getExecutionTimeMs()).isEqualTo(500L);
     assertThat(task.getWarningCount()).isZero();
@@ -164,12 +168,13 @@ public class TaskActionIT {
   @Test
   public void branch_in_past_activity() {
     logInAsSystemAdministrator();
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.addProjectPermission(UserRole.USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(UserRole.USER, projectData.getProjectDto());
     String branchName = randomAlphanumeric(248);
-    ComponentDto branch = db.components().insertProjectBranch(project, b -> b.setBranchType(BRANCH).setKey(branchName));
+    ComponentDto branch = db.components().insertProjectBranch(mainBranch, b -> b.setBranchType(BRANCH).setKey(branchName));
     db.components().insertSnapshot(branch);
-    CeActivityDto activity = createAndPersistArchivedTask(project);
+    CeActivityDto activity = createAndPersistArchivedTask(mainBranch);
     insertCharacteristic(activity, BRANCH_KEY, branchName);
     insertCharacteristic(activity, BRANCH_TYPE_KEY, BRANCH.name());
 
@@ -303,8 +308,8 @@ public class TaskActionIT {
   @Test
   public void get_project_queue_task_with_scan_permission_on_project() {
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(GlobalPermission.SCAN.getKey(), privateProject);
-    CeQueueDto task = createAndPersistQueueTask(privateProject, user);
+    loginAndAddProjectPermission(user, GlobalPermission.SCAN.getKey());
+    CeQueueDto task = createAndPersistQueueTask(privateProjectMainBranch, user);
 
     call(task.getUuid());
   }
@@ -324,7 +329,7 @@ public class TaskActionIT {
   public void get_project_queue_task_of_private_project_with_user_permission_fails_with_ForbiddenException() {
     UserDto user = db.users().insertUser();
     userSession.logIn().addProjectPermission(UserRole.USER, privateProject);
-    CeQueueDto task = createAndPersistQueueTask(privateProject, user);
+    CeQueueDto task = createAndPersistQueueTask(privateProjectMainBranch, user);
 
     String uuid = task.getUuid();
     assertThatThrownBy(() -> call(uuid))
@@ -334,25 +339,35 @@ public class TaskActionIT {
   @Test
   public void get_project_queue_task_on_public_project() {
     UserDto user = db.users().insertUser();
-    userSession.logIn(user).addProjectPermission(GlobalPermission.SCAN.getKey(), privateProject);
-    CeQueueDto task = createAndPersistQueueTask(privateProject, user);
+    loginAndAddProjectPermission(user, GlobalPermission.SCAN.getKey());
+    CeQueueDto task = createAndPersistQueueTask(privateProjectMainBranch, user);
 
     call(task.getUuid());
   }
 
+  private void loginAndAddProjectPermission(@Nullable UserDto user, String permission) {
+    if (user != null) {
+      userSession.logIn(user);
+    } else {
+      userSession.logIn();
+    }
+    userSession.addProjectPermission(permission, privateProject)
+      .addProjectBranchMapping(privateProject.getUuid(), privateProjectMainBranch);
+  }
+
   @Test
   public void get_project_queue_task_with_scan_permission_but_not_on_project() {
     UserDto user = db.users().insertUser();
     userSession.logIn(user).addPermission(GlobalPermission.SCAN);
-    CeQueueDto task = createAndPersistQueueTask(privateProject, user);
+    CeQueueDto task = createAndPersistQueueTask(privateProjectMainBranch, user);
 
     call(task.getUuid());
   }
 
   @Test
   public void get_project_queue_task_with_project_admin_permission() {
-    userSession.logIn().addProjectPermission(ADMIN, privateProject);
-    CeActivityDto task = createAndPersistArchivedTask(privateProject);
+    loginAndAddProjectPermission(null, ADMIN);
+    CeActivityDto task = createAndPersistArchivedTask(privateProjectMainBranch);
 
     call(task.getUuid());
   }
@@ -361,7 +376,7 @@ public class TaskActionIT {
   public void getting_project_queue_task_throws_ForbiddenException_if_no_admin_nor_scan_permissions() {
     UserDto user = db.users().insertUser();
     userSession.logIn(user);
-    CeQueueDto task = createAndPersistQueueTask(privateProject, user);
+    CeQueueDto task = createAndPersistQueueTask(privateProjectMainBranch, user);
 
     String uuid = task.getUuid();
     assertThatThrownBy(() -> call(uuid))
@@ -390,8 +405,8 @@ public class TaskActionIT {
 
   @Test
   public void get_project_archived_task_with_scan_permission_on_project() {
-    userSession.logIn().addProjectPermission(GlobalPermission.SCAN.getKey(), privateProject);
-    CeActivityDto task = createAndPersistArchivedTask(privateProject);
+    loginAndAddProjectPermission(null, SCAN);
+    CeActivityDto task = createAndPersistArchivedTask(privateProjectMainBranch);
 
     call(task.getUuid());
   }
@@ -409,7 +424,7 @@ public class TaskActionIT {
   @Test
   public void get_project_archived_task_with_scan_permission_but_not_on_project() {
     userSession.logIn().addPermission(GlobalPermission.SCAN);
-    CeActivityDto task = createAndPersistArchivedTask(privateProject);
+    CeActivityDto task = createAndPersistArchivedTask(privateProjectMainBranch);
 
     call(task.getUuid());
   }
@@ -417,7 +432,7 @@ public class TaskActionIT {
   @Test
   public void getting_project_archived_task_throws_ForbiddenException_if_no_admin_nor_scan_permissions() {
     userSession.logIn();
-    CeActivityDto task = createAndPersistArchivedTask(privateProject);
+    CeActivityDto task = createAndPersistArchivedTask(privateProjectMainBranch);
 
     String uuid = task.getUuid();
     assertThatThrownBy(() -> call(uuid))
@@ -462,23 +477,23 @@ public class TaskActionIT {
   public void get_warnings_on_private_project_archived_task_if_user_fails_with_ForbiddenException() {
     userSession.logIn().addProjectPermission(UserRole.USER, privateProject);
 
-    CeActivityDto persistArchivedTask = createAndPersistArchivedTask(privateProject);
+    CeActivityDto persistArchivedTask = createAndPersistArchivedTask(privateProjectMainBranch);
     assertThatThrownBy(() -> insertWarningsCallEndpointAndAssertWarnings(persistArchivedTask))
       .isInstanceOf(ForbiddenException.class);
   }
 
   @Test
   public void get_warnings_on_private_project_archived_task_if_scan() {
-    userSession.logIn().addProjectPermission(GlobalPermission.SCAN.getKey(), privateProject);
+    loginAndAddProjectPermission(null, GlobalPermission.SCAN.getKey());
 
-    insertWarningsCallEndpointAndAssertWarnings(createAndPersistArchivedTask(privateProject));
+    insertWarningsCallEndpointAndAssertWarnings(createAndPersistArchivedTask(privateProjectMainBranch));
   }
 
   @Test
   public void get_warnings_on_private_project_archived_task_if_global_scan_permission() {
     userSession.logIn().addPermission(GlobalPermission.SCAN);
 
-    insertWarningsCallEndpointAndAssertWarnings(createAndPersistArchivedTask(privateProject));
+    insertWarningsCallEndpointAndAssertWarnings(createAndPersistArchivedTask(privateProjectMainBranch));
   }
 
   @Test
@@ -549,7 +564,7 @@ public class TaskActionIT {
     CeQueueDto queueDto = new CeQueueDto();
     queueDto.setTaskType(CeTaskTypes.REPORT);
     queueDto.setUuid(uuid);
-    queueDto.setComponentUuid(privateProject.uuid());
+    queueDto.setComponentUuid(privateProjectMainBranch.uuid());
     return queueDto;
   }
 
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/AppActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/AppActionIT.java
index 3f4fc3ffe47..7d84ef45769 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/AppActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/AppActionIT.java
@@ -74,7 +74,8 @@ public class AppActionIT {
   public void file_info() {
     ComponentDto directory = db.components().insertComponent(newDirectory(mainBranchComponent, "src"));
     ComponentDto file = db.components().insertComponent(newFileDto(mainBranchComponent, directory));
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", file.getKey())
@@ -100,7 +101,8 @@ public class AppActionIT {
   public void file_on_module() {
     ComponentDto directory = db.components().insertComponent(newDirectory(mainBranchComponent, "src"));
     ComponentDto file = db.components().insertComponent(newFileDto(mainBranchComponent, directory));
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", file.getKey())
@@ -125,7 +127,8 @@ public class AppActionIT {
   @Test
   public void file_without_measures() {
     ComponentDto file = db.components().insertComponent(newFileDto(mainBranchComponent));
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", file.getKey())
@@ -153,7 +156,9 @@ public class AppActionIT {
     db.measures().insertLiveMeasure(file, issues, m -> m.setValue(231d));
     MetricDto coverage = db.measures().insertMetric(m -> m.setKey(COVERAGE_KEY));
     db.measures().insertLiveMeasure(file, coverage, m -> m.setValue(95.4d));
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
+
 
     String result = ws.newRequest()
       .setParam("component", file.getKey())
@@ -176,7 +181,8 @@ public class AppActionIT {
     ComponentDto file = db.components().insertComponent(newFileDto(mainBranchComponent, mainBranchComponent));
     MetricDto coverage = db.measures().insertMetric(m -> m.setKey(COVERAGE_KEY));
     db.measures().insertLiveMeasure(file, coverage, m -> m.setValue(95.4d));
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", file.getKey())
@@ -194,7 +200,8 @@ public class AppActionIT {
 
   @Test
   public void canMarkAsFavorite_is_true_when_logged() {
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", mainBranchComponent.getKey())
@@ -208,7 +215,8 @@ public class AppActionIT {
 
   @Test
   public void canMarkAsFavorite_is_false_when_not_logged() {
-    userSession.addProjectPermission(USER, mainBranchComponent);
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", mainBranchComponent.getKey())
@@ -241,7 +249,8 @@ public class AppActionIT {
 
   @Test
   public void component_is_not_favorite() {
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     String result = ws.newRequest()
       .setParam("component", mainBranchComponent.getKey())
@@ -255,10 +264,10 @@ public class AppActionIT {
 
   @Test
   public void branch() {
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto());
     String branchName = randomAlphanumeric(248);
     ComponentDto branch = db.components().insertProjectBranch(mainBranchComponent, b -> b.setKey(branchName));
-    userSession.addProjectBranchMapping(mainBranchComponent.uuid(), branch);
+    userSession.addProjectBranchMapping(projectData.getProjectDto().getUuid(), branch);
     ComponentDto directory = db.components().insertComponent(newDirectory(branch, "src"));
     ComponentDto file = db.components().insertComponent(newFileDto(mainBranchComponent.uuid(), branch, directory));
     MetricDto coverage = db.measures().insertMetric(m -> m.setKey(COVERAGE_KEY));
@@ -298,10 +307,10 @@ public class AppActionIT {
 
   @Test
   public void component_and_branch_parameters_provided() {
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto());
     String branchName = randomAlphanumeric(248);
     ComponentDto branch = db.components().insertProjectBranch(mainBranchComponent, b -> b.setKey(branchName));
-    userSession.addProjectBranchMapping(mainBranchComponent.uuid(), branch);
+    userSession.addProjectBranchMapping(projectData.projectUuid(), branch);
     ComponentDto file = db.components().insertComponent(newFileDto(branch, mainBranchComponent.uuid()));
 
     String result = ws.newRequest()
@@ -328,10 +337,11 @@ public class AppActionIT {
 
   @Test
   public void component_and_pull_request_parameters_provided() {
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
     String pullRequestKey = RandomStringUtils.randomAlphanumeric(100);
     ComponentDto branch = db.components().insertProjectBranch(mainBranchComponent, b -> b.setBranchType(PULL_REQUEST).setKey(pullRequestKey));
-    userSession.addProjectBranchMapping(mainBranchComponent.uuid(), branch);
+    userSession.addProjectBranchMapping(projectData.projectUuid(), branch);
     ComponentDto file = db.components().insertComponent(newFileDto(branch, mainBranchComponent.uuid()));
 
     String result = ws.newRequest()
@@ -358,7 +368,7 @@ public class AppActionIT {
 
   @Test
   public void fail_if_component_and_pull_request_and_branch_parameters_provided() {
-    userSession.logIn("john").addProjectPermission(USER, mainBranchComponent);
+    userSession.logIn("john").addProjectPermission(USER, projectData.getProjectDto());
     ComponentDto branch = db.components().insertProjectBranch(mainBranchComponent, b -> b.setBranchType(PULL_REQUEST));
     ComponentDto file = db.components().insertComponent(newFileDto(branch, mainBranchComponent.uuid()));
 
diff --git a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/ShowActionIT.java b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/ShowActionIT.java
index 38a3ae9daec..a99b7cdba70 100644
--- a/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/ShowActionIT.java
+++ b/server/sonar-webserver-webapi/src/it/java/org/sonar/server/component/ws/ShowActionIT.java
@@ -125,75 +125,87 @@ public class ShowActionIT {
 
   @Test
   public void show_with_browse_permission() {
-    ComponentDto project = newPrivateProjectDto("project-uuid");
-    db.components().insertProjectAndSnapshot(project);
-    userSession.addProjectPermission(USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    db.components().insertSnapshot(mainBranch);
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
-    ShowWsResponse response = newRequest(project.getKey());
+    ShowWsResponse response = newRequest(mainBranch.getKey());
 
-    assertThat(response.getComponent().getKey()).isEqualTo(project.getKey());
+    assertThat(response.getComponent().getKey()).isEqualTo(mainBranch.getKey());
   }
 
   @Test
   public void show_with_ancestors_when_not_project() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    ComponentDto directory = db.components().insertComponent(newDirectory(project, "dir"));
-    ComponentDto file = db.components().insertComponent(newFileDto(project, directory));
-    userSession.addProjectPermission(USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    ComponentDto directory = db.components().insertComponent(newDirectory(mainBranch, "dir"));
+    ComponentDto file = db.components().insertComponent(newFileDto(mainBranch, directory));
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     ShowWsResponse response = newRequest(file.getKey());
 
     assertThat(response.getComponent().getKey()).isEqualTo(file.getKey());
-    assertThat(response.getAncestorsList()).extracting(Component::getKey).containsOnly(directory.getKey(), project.getKey());
+    assertThat(response.getAncestorsList()).extracting(Component::getKey).containsOnly(directory.getKey(), mainBranch.getKey());
   }
 
   @Test
   public void show_without_ancestors_when_project() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.addProjectPermission(USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
-    ShowWsResponse response = newRequest(project.getKey());
+    ShowWsResponse response = newRequest(mainBranch.getKey());
 
-    assertThat(response.getComponent().getKey()).isEqualTo(project.getKey());
+    assertThat(response.getComponent().getKey()).isEqualTo(mainBranch.getKey());
     assertThat(response.getAncestorsList()).isEmpty();
   }
 
   @Test
   public void show_with_last_analysis_date() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
     db.components().insertSnapshots(
-      newAnalysis(project).setCreatedAt(1_000_000_000L).setLast(false),
-      newAnalysis(project).setCreatedAt(2_000_000_000L).setLast(false),
-      newAnalysis(project).setCreatedAt(3_000_000_000L).setLast(true));
-    userSession.addProjectPermission(USER, project);
+      newAnalysis(mainBranch).setCreatedAt(1_000_000_000L).setLast(false),
+      newAnalysis(mainBranch).setCreatedAt(2_000_000_000L).setLast(false),
+      newAnalysis(mainBranch).setCreatedAt(3_000_000_000L).setLast(true));
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
-    ShowWsResponse response = newRequest(project.getKey());
+    ShowWsResponse response = newRequest(mainBranch.getKey());
 
     assertThat(response.getComponent().getAnalysisDate()).isNotEmpty().isEqualTo(formatDateTime(new Date(3_000_000_000L)));
   }
 
   @Test
   public void show_with_new_code_period_date() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
     db.components().insertSnapshots(
-      newAnalysis(project).setPeriodDate(1_000_000_000L).setLast(false),
-      newAnalysis(project).setPeriodDate(2_000_000_000L).setLast(false),
-      newAnalysis(project).setPeriodDate(3_000_000_000L).setLast(true));
+      newAnalysis(mainBranch).setPeriodDate(1_000_000_000L).setLast(false),
+      newAnalysis(mainBranch).setPeriodDate(2_000_000_000L).setLast(false),
+      newAnalysis(mainBranch).setPeriodDate(3_000_000_000L).setLast(true));
 
-    userSession.addProjectPermission(USER, project);
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
-    ShowWsResponse response = newRequest(project.getKey());
+    ShowWsResponse response = newRequest(mainBranch.getKey());
 
     assertThat(response.getComponent().getLeakPeriodDate()).isNotEmpty().isEqualTo(formatDateTime(new Date(3_000_000_000L)));
   }
 
   @Test
   public void show_with_ancestors_and_analysis_date() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    db.components().insertSnapshot(newAnalysis(project).setCreatedAt(3_000_000_000L).setLast(true));
-    ComponentDto directory = db.components().insertComponent(newDirectory(project, "dir"));
-    ComponentDto file = db.components().insertComponent(newFileDto(project, directory));
-    userSession.addProjectPermission(USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    db.components().insertSnapshot(newAnalysis(mainBranch).setCreatedAt(3_000_000_000L).setLast(true));
+    ComponentDto directory = db.components().insertComponent(newDirectory(mainBranch, "dir"));
+    ComponentDto file = db.components().insertComponent(newFileDto(mainBranch, directory));
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     ShowWsResponse response = newRequest(file.getKey());
 
@@ -204,10 +216,12 @@ public class ShowActionIT {
 
   @Test
   public void should_return_visibility_for_private_project() {
-    ComponentDto privateProject = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.addProjectPermission(USER, privateProject);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
-    ShowWsResponse result = newRequest(privateProject.getKey());
+    ShowWsResponse result = newRequest(mainBranch.getKey());
     assertThat(result.getComponent().hasVisibility()).isTrue();
     assertThat(result.getComponent().getVisibility()).isEqualTo("private");
   }
@@ -228,7 +242,7 @@ public class ShowActionIT {
   @Test
   public void should_return_visibility_for_portfolio() {
     ComponentDto view = db.components().insertPrivatePortfolio();
-    userSession.addProjectPermission(USER, view);
+    userSession.addPortfolioPermission(USER, view);
 
     ShowWsResponse result = newRequest(view.getKey());
     assertThat(result.getComponent().hasVisibility()).isTrue();
@@ -236,11 +250,13 @@ public class ShowActionIT {
 
   @Test
   public void display_version() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    ComponentDto directory = db.components().insertComponent(newDirectory(project, "dir"));
-    ComponentDto file = db.components().insertComponent(newFileDto(project, directory));
-    db.components().insertSnapshot(project, s -> s.setProjectVersion("1.1"));
-    userSession.addProjectPermission(USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    ComponentDto directory = db.components().insertComponent(newDirectory(mainBranch, "dir"));
+    ComponentDto file = db.components().insertComponent(newFileDto(mainBranch, directory));
+    db.components().insertSnapshot(mainBranch, s -> s.setProjectVersion("1.1"));
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     ShowWsResponse response = newRequest(file.getKey());
 
@@ -252,13 +268,14 @@ public class ShowActionIT {
 
   @Test
   public void branch() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.addProjectPermission(UserRole.USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(UserRole.USER, projectData.getProjectDto());
     String branchKey = "my_branch";
-    ComponentDto branch = db.components().insertProjectBranch(project, b -> b.setKey(branchKey));
-    userSession.addProjectBranchMapping(project.uuid(), branch);
-    ComponentDto directory = db.components().insertComponent(newDirectoryOnBranch(branch, "dir", project.uuid()));
-    ComponentDto file = db.components().insertComponent(newFileDto(project.uuid(), branch, directory));
+    ComponentDto branch = db.components().insertProjectBranch(mainBranch, b -> b.setKey(branchKey));
+    userSession.addProjectBranchMapping(projectData.projectUuid(), branch);
+    ComponentDto directory = db.components().insertComponent(newDirectoryOnBranch(branch, "dir", mainBranch.uuid()));
+    ComponentDto file = db.components().insertComponent(newFileDto(mainBranch.uuid(), branch, directory));
     db.components().insertSnapshot(branch, s -> s.setProjectVersion("1.1"));
 
     ShowWsResponse response = ws.newRequest()
@@ -277,28 +294,31 @@ public class ShowActionIT {
 
   @Test
   public void dont_show_branch_if_main_branch() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.addProjectPermission(UserRole.USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(UserRole.USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
 
     ShowWsResponse response = ws.newRequest()
-      .setParam(PARAM_COMPONENT, project.getKey())
+      .setParam(PARAM_COMPONENT, mainBranch.getKey())
       .setParam(PARAM_BRANCH, DEFAULT_MAIN_BRANCH_NAME)
       .executeProtobuf(ShowWsResponse.class);
 
     assertThat(response.getComponent())
       .extracting(Component::getKey, Component::getBranch)
-      .containsExactlyInAnyOrder(project.getKey(), "");
+      .containsExactlyInAnyOrder(mainBranch.getKey(), "");
   }
 
   @Test
   public void pull_request() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    userSession.addProjectPermission(UserRole.USER, project);
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(UserRole.USER, projectData.getProjectDto());
     String pullRequest = "pr-1234";
-    ComponentDto branch = db.components().insertProjectBranch(project, b -> b.setKey(pullRequest).setBranchType(PULL_REQUEST));
-    userSession.addProjectBranchMapping(project.uuid(), branch);
-    ComponentDto directory = db.components().insertComponent(newDirectoryOnBranch(branch, "dir", project.uuid()));
-    ComponentDto file = db.components().insertComponent(newFileDto(project.uuid(), branch, directory));
+    ComponentDto branch = db.components().insertProjectBranch(mainBranch, b -> b.setKey(pullRequest).setBranchType(PULL_REQUEST));
+    userSession.addProjectBranchMapping(projectData.projectUuid(), branch);
+    ComponentDto directory = db.components().insertComponent(newDirectoryOnBranch(branch, "dir", mainBranch.uuid()));
+    ComponentDto file = db.components().insertComponent(newFileDto(mainBranch.uuid(), branch, directory));
     db.components().insertSnapshot(branch, s -> s.setProjectVersion("1.1"));
 
     ShowWsResponse response = ws.newRequest()
@@ -414,10 +434,11 @@ public class ShowActionIT {
 
   @Test
   public void fail_if_component_is_removed() {
-    ComponentDto privateProjectDto = newPrivateProjectDto();
-    ComponentDto project = db.components().insertComponent(privateProjectDto);
-    userSession.addProjectPermission(USER, project);
-    db.components().insertComponent(newFileDto(project).setKey("file-key").setEnabled(false));
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(USER, mainBranch)
+      .registerBranches(projectData.getMainBranchDto());
+    db.components().insertComponent(newFileDto(mainBranch).setKey("file-key").setEnabled(false));
 
     assertThatThrownBy(() -> newRequest("file-key"))
       .isInstanceOf(NotFoundException.class)
@@ -426,10 +447,12 @@ public class ShowActionIT {
 
   @Test
   public void fail_if_branch_does_not_exist() {
-    ComponentDto project = db.components().insertPrivateProject().getMainBranchComponent();
-    ComponentDto file = db.components().insertComponent(newFileDto(project));
-    userSession.addProjectPermission(UserRole.USER, project);
-    db.components().insertProjectBranch(project, b -> b.setKey("my_branch"));
+    ProjectData projectData = db.components().insertPrivateProject();
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    ComponentDto file = db.components().insertComponent(newFileDto(mainBranch));
+    userSession.addProjectPermission(UserRole.USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
+    db.components().insertProjectBranch(mainBranch, b -> b.setKey("my_branch"));
 
     TestRequest request = ws.newRequest()
       .setParam(PARAM_COMPONENT, file.getKey())
@@ -449,19 +472,21 @@ public class ShowActionIT {
   }
 
   private void insertJsonExampleComponentsAndSnapshots() {
-    ComponentDto project = db.components().insertPrivateProject(c -> c.setUuid("AVIF98jgA3Ax6PH2efOW")
+    ProjectData projectData = db.components().insertPrivateProject(c -> c.setUuid("AVIF98jgA3Ax6PH2efOW")
         .setBranchUuid("AVIF98jgA3Ax6PH2efOW")
         .setKey("com.sonarsource:java-markdown")
         .setName("Java Markdown")
         .setDescription("Java Markdown Project")
         .setQualifier(Qualifiers.PROJECT),
-      p -> p.setTagsString("language, plugin")).getMainBranchComponent();
-    userSession.addProjectPermission(USER, project);
-    db.components().insertSnapshot(project, snapshot -> snapshot
+      p -> p.setTagsString("language, plugin"));
+    ComponentDto mainBranch = projectData.getMainBranchComponent();
+    userSession.addProjectPermission(USER, projectData.getProjectDto())
+      .registerBranches(projectData.getMainBranchDto());
+    db.components().insertSnapshot(mainBranch, snapshot -> snapshot
       .setProjectVersion("1.1")
       .setCreatedAt(parseDateTime("2017-03-01T11:39:03+0100").getTime())
       .setPeriodDate(parseDateTime("2017-01-01T11:39:03+0100").getTime()));
-    ComponentDto directory = newDirectory(project, "AVIF-FfgA3Ax6PH2efPF", "src/main/java/com/sonarsource/markdown/impl")
+    ComponentDto directory = newDirectory(mainBranch, "AVIF-FfgA3Ax6PH2efPF", "src/main/java/com/sonarsource/markdown/impl")
       .setKey("com.sonarsource:java-markdown:src/main/java/com/sonarsource/markdown/impl")
       .setName("src/main/java/com/sonarsource/markdown/impl")
       .setQualifier(Qualifiers.DIRECTORY);