diff --git a/spec/controllers/projects/queries_controller_spec.rb b/spec/controllers/projects/queries_controller_spec.rb
index defe6fb7a46c..d45bf41c802e 100644
--- a/spec/controllers/projects/queries_controller_spec.rb
+++ b/spec/controllers/projects/queries_controller_spec.rb
@@ -31,6 +31,23 @@
 RSpec.describe Projects::QueriesController do
   shared_let(:user) { create(:user) }
 
+  describe "#show" do
+    let(:query) { build_stubbed(:project_query, user:) }
+
+    before do
+      scope = instance_double(ActiveRecord::Relation)
+      allow(Queries::Projects::ProjectQuery).to receive(:visible).with(user:).and_return(scope)
+      allow(scope).to receive(:find).with(query.id.to_s).and_return(query)
+
+      login_as user
+    end
+
+    it "redirects to the projects page" do
+      get :show, params: { id: query.id }
+      expect(response).to redirect_to(projects_path(query_id: query.id))
+    end
+  end
+
   describe "#new" do
     it "requires login" do
       get "new"
@@ -211,6 +228,152 @@
     end
   end
 
+  describe "#publish" do
+    let(:service_class) { Queries::Projects::ProjectQueries::PublishService }
+
+    it "requires login" do
+      put "publish", params: { id: 42 }
+
+      expect(response).not_to be_successful
+    end
+
+    context "when logged in" do
+      let(:query) { build_stubbed(:project_query, user:) }
+      let(:query_id) { "42" }
+      let(:query_params) { { public: true } }
+      let(:service_instance) { instance_double(service_class) }
+      let(:service_result) { instance_double(ServiceResult, success?: success?, result: query) }
+      let(:success?) { true }
+
+      before do
+        allow(controller).to receive(:permitted_query_params).and_return(query_params)
+        scope = instance_double(ActiveRecord::Relation)
+        allow(Queries::Projects::ProjectQuery).to receive(:visible).and_return(scope)
+        allow(scope).to receive(:find).with(query_id).and_return(query)
+        allow(service_class).to receive(:new).with(model: query, user:).and_return(service_instance)
+        allow(service_instance).to receive(:call).with(query_params).and_return(service_result)
+
+        login_as user
+      end
+
+      it "calls publish service on query" do
+        put "publish", params: { id: 42 }
+
+        expect(service_instance).to have_received(:call).with(query_params)
+      end
+
+      context "when service call succeeds" do
+        it "redirects to projects" do
+          allow(I18n).to receive(:t).with("lists.publish.success").and_return("foo")
+
+          put "publish", params: { id: 42 }
+
+          expect(flash[:notice]).to eq("foo")
+          expect(response).to redirect_to(projects_path(query_id: query.id))
+        end
+      end
+
+      context "when service call fails" do
+        let(:success?) { false }
+        let(:errors) { instance_double(ActiveModel::Errors, full_messages: ["something", "went", "wrong"]) }
+
+        before do
+          allow(service_result).to receive(:errors).and_return(errors)
+        end
+
+        it "renders projects/index" do
+          allow(I18n).to receive(:t).with("lists.publish.failure", errors: "something\nwent\nwrong").and_return("bar")
+
+          put "publish", params: { id: 42 }
+
+          expect(flash[:error]).to eq("bar")
+          expect(response).to render_template("projects/index")
+        end
+
+        it "passes variables to template" do
+          allow(controller).to receive(:render).and_call_original
+
+          put "update", params: { id: 42 }
+
+          expect(controller).to have_received(:render).with(include(locals: { query:, state: :edit }))
+        end
+      end
+    end
+  end
+
+  describe "#unpublish" do
+    let(:service_class) { Queries::Projects::ProjectQueries::PublishService }
+
+    it "requires login" do
+      put "unpublish", params: { id: 42 }
+
+      expect(response).not_to be_successful
+    end
+
+    context "when logged in" do
+      let(:query) { build_stubbed(:project_query, user:) }
+      let(:query_id) { "42" }
+      let(:query_params) { { public: false } }
+      let(:service_instance) { instance_double(service_class) }
+      let(:service_result) { instance_double(ServiceResult, success?: success?, result: query) }
+      let(:success?) { true }
+
+      before do
+        allow(controller).to receive(:permitted_query_params).and_return(query_params)
+        scope = instance_double(ActiveRecord::Relation)
+        allow(Queries::Projects::ProjectQuery).to receive(:visible).and_return(scope)
+        allow(scope).to receive(:find).with(query_id).and_return(query)
+        allow(service_class).to receive(:new).with(model: query, user:).and_return(service_instance)
+        allow(service_instance).to receive(:call).with(query_params).and_return(service_result)
+
+        login_as user
+      end
+
+      it "calls publish service on query" do
+        put "unpublish", params: { id: 42 }
+
+        expect(service_instance).to have_received(:call).with(query_params)
+      end
+
+      context "when service call succeeds" do
+        it "redirects to projects" do
+          allow(I18n).to receive(:t).with("lists.unpublish.success").and_return("foo")
+
+          put "unpublish", params: { id: 42 }
+
+          expect(flash[:notice]).to eq("foo")
+          expect(response).to redirect_to(projects_path(query_id: query.id))
+        end
+      end
+
+      context "when service call fails" do
+        let(:success?) { false }
+        let(:errors) { instance_double(ActiveModel::Errors, full_messages: ["something", "went", "wrong"]) }
+
+        before do
+          allow(service_result).to receive(:errors).and_return(errors)
+        end
+
+        it "renders projects/index" do
+          allow(I18n).to receive(:t).with("lists.unpublish.failure", errors: "something\nwent\nwrong").and_return("bar")
+
+          put "unpublish", params: { id: 42 }
+
+          expect(flash[:error]).to eq("bar")
+          expect(response).to render_template("projects/index")
+        end
+
+        it "passes variables to template" do
+          allow(controller).to receive(:render).and_call_original
+
+          put "unpublish", params: { id: 42 }
+
+          expect(controller).to have_received(:render).with(include(locals: { query:, state: :edit }))
+        end
+      end
+    end
+  end
+
   describe "#destroy" do
     let(:service_class) { Queries::Projects::ProjectQueries::DeleteService }