API: Expose if the user can merge a given merge request

4 files changed, 24 insertions, 0 deletions

diff --git a/changelogs/unreleased/44740-api-to-verify-a-given-user-has-right-to-merge-a-given-mergerequest.yml b/changelogs/unreleased/44740-api-to-verify-a-given-user-has-right-to-merge-a-given-mergerequest.yml
new file mode 100644
index 00000000000..1c739130fcc
--- /dev/null
+++ b/changelogs/unreleased/44740-api-to-verify-a-given-user-has-right-to-merge-a-given-mergerequest.yml
@@ -0,0 +1,5 @@
+---
+title: 'API: Expose if the current user can merge a MR'
+merge_request: 25207
+author: Robert Schilling
+type: added
diff --git a/doc/api/merge_requests.md b/doc/api/merge_requests.md
index d58cd45538d..ffeceabc680 100644
--- a/doc/api/merge_requests.md
+++ b/doc/api/merge_requests.md
@@ -435,6 +435,9 @@ Parameters:
     "avatar_url": null,
     "web_url" : "https://gitlab.example.com/admin"
   },
+  "user" : {
+    "can_merge" : false
+   }
   "assignee": {
     "id": 1,
     "name": "Administrator",
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index f3ff7e10eb7..af788a4ed73 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -732,6 +732,12 @@ module API
       def build_available?(options)
         options[:project]&.feature_available?(:builds, options[:current_user])
       end
+
+      expose :user do
+        expose :can_merge do |merge_request, options|
+          merge_request.can_be_merged_by?(options[:current_user])
+        end
+      end
     end
 
     class MergeRequestChanges < MergeRequest
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 0f5f6e38819..b8426126bc6 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -372,6 +372,7 @@ describe API::MergeRequests do
       expect(json_response['force_close_merge_request']).to be_falsy
       expect(json_response['changes_count']).to eq(merge_request.merge_request_diff.real_size)
       expect(json_response['merge_error']).to eq(merge_request.merge_error)
+      expect(json_response['user']['can_merge']).to be_truthy
       expect(json_response).not_to include('rebase_in_progress')
     end
 
@@ -499,6 +500,15 @@ describe API::MergeRequests do
         expect(json_response['allow_maintainer_to_push']).to be_truthy
       end
     end
+
+    it 'indicates if a user cannot merge the MR' do
+      user2 = create(:user)
+      project.add_reporter(user2)
+
+      get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user2)
+
+      expect(json_response['user']['can_merge']).to be_falsy
+    end
   end
 
   describe 'GET /projects/:id/merge_requests/:merge_request_iid/participants' do