Returns new_blob_path only when user can push_code to project

app/serializers/merge_request_entity.rb

@@ -98,10 +98,12 @@ class MergeRequestEntity < IssuableEntity
   end
 
   expose :new_blob_path do |merge_request|
+    if can?(current_user, :push_code, merge_request.project)
       namespace_project_new_blob_path(merge_request.project.namespace,
                                       merge_request.project,
                                       merge_request.source_branch)
     end
+  end
 
   expose :conflict_resolution_path do |merge_request|
     presenter(merge_request).conflict_resolution_path

spec/serializers/merge_request_entity_spec.rb

@@ -65,6 +65,23 @@ describe MergeRequestEntity do
       .to eq(resource.merge_commit_message(include_description: true))
   end
 
+  describe 'new_blob_path' do
+    context 'when user can push to project' do
+      it 'returns path' do
+        project.add_developer(user)
+
+        expect(subject[:new_blob_path])
+          .to eq("/#{resource.project.full_path}/new/#{resource.source_branch}")
+      end
+    end
+
+    context 'when user cannot push to project' do
+      it 'returns nil' do
+        expect(subject[:new_blob_path]).to be_nil
+      end
+    end
+  end
+
   describe 'diff_head_sha' do
     before do
       allow(resource).to receive(:diff_head_sha) { 'sha' }