Check who may manage a merge request on the server

José M. Requena Plensrequested to merge
gitlab-community/gitlab-org/developer-relations/contributor-success/contributors-gitlab-com:jmrp-manage-merge-request-authorization into main

What does this MR do and why?

The manage merge request page offers its actions to approved community members, team members, and the merge request's author, assignees and reviewers. On the server, the help, label and request_review API actions only checked that the user was signed in, while the issue actions also check membership.

  • Api::V1::ManageMergeRequestController runs ensure_authorized before those three actions. Community and team members pass as before; anyone else passes only if GitLab lists them as the merge request's author, an assignee or a reviewer. Otherwise the action answers 403 and posts nothing.
  • GET /manage-merge-request/request-help redirects to the page's Help action instead of posting a thread. Nothing links to it now, but the triage-ops thank-you note did from August 2024 to April 2025, so those links keep working.
  • get_merge_request_web_url becomes get_merge_request, which returns the merge request, or nil when GitLab does not return it.
  • doc/openapi.yaml and the generated types gain the 403 of the three actions.

Members cost no extra request; for anyone else the check is one GitLab API read. !2840 (merged) also changes request_help, so whichever merges second rebases.

Closes #815

Screenshots or screen recordings

Nothing changes for the people the page already shows the actions to.

Validation steps

  1. bundle exec rspec spec/requests/api/v1/manage_merge_request_controller_spec.rb spec/requests/manage_merge_request_controller_spec.rb spec/services/gitlab_rest_service_spec.rb
  2. Signed in as a user who is not a member or a participant, the three actions answer 403; as the merge request's author they work as before.
  3. /manage-merge-request/request-help?project_id=<id>&merge_request_iid=<iid> opens the page with Help expanded.
Checks run locally

In the CI images (ruby:4.0.9-bookworm, postgres:18.4-alpine3.23, Node 26.13.0):

  • On main, the new examples that expect 403 get 200, and request_help posts a thread; with this change they pass.
  • bundle exec rspec: 2364 examples, 0 failures.
  • bundle exec rubocop: no offenses.
  • bin/generate_api_types leaves no diff, and npm run typecheck passes.

Merge request reports