API: Expose if the user can merge a given merge request

changelogs/unreleased/44740-api-to-verify-a-given-user-has-right-to-merge-a-given-mergerequest.yml

+---
+title: 'API: Expose if the current user can merge a MR'
+merge_request: 25207
+author: Robert Schilling
+type: added

doc/api/merge_requests.md

@@ -435,6 +435,9 @@ Parameters:
     "avatar_url": null,
     "web_url" : "https://gitlab.example.com/admin"
   },
+  "user" : {
+    "can_merge" : false
+   }
   "assignee": {
     "id": 1,
     "name": "Administrator",

lib/api/entities.rb

@@ -732,6 +732,12 @@ module API
       def build_available?(options)
         options[:project]&.feature_available?(:builds, options[:current_user])
       end
+
+      expose :user do
+        expose :can_merge do |merge_request, options|
+          merge_request.can_be_merged_by?(options[:current_user])
+        end
+      end
     end
 
     class MergeRequestChanges < MergeRequest

spec/requests/api/merge_requests_spec.rb

@@ -372,6 +372,7 @@ describe API::MergeRequests do
       expect(json_response['force_close_merge_request']).to be_falsy
       expect(json_response['changes_count']).to eq(merge_request.merge_request_diff.real_size)
       expect(json_response['merge_error']).to eq(merge_request.merge_error)
+      expect(json_response['user']['can_merge']).to be_truthy
       expect(json_response).not_to include('rebase_in_progress')
     end
 
@@ -499,6 +500,15 @@ describe API::MergeRequests do
         expect(json_response['allow_maintainer_to_push']).to be_truthy
       end
     end
+
+    it 'indicates if a user cannot merge the MR' do
+      user2 = create(:user)
+      project.add_reporter(user2)
+
+      get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user2)
+
+      expect(json_response['user']['can_merge']).to be_falsy
+    end
   end
 
   describe 'GET /projects/:id/merge_requests/:merge_request_iid/participants' do