<!--IssueSummary start--> <details> <summary> Everyone can contribute. [Help move this issue forward](https://handbook.gitlab.com/handbook/marketing/developer-relations/contributor-success/community-contributors-workflows/#contributor-links) while earning points, leveling up and collecting rewards. </summary> - [Work on this issue](https://contributors.gitlab.com/manage-issue?action=work&projectId=278964&issueIid=285119) - [Close this issue](https://contributors.gitlab.com/manage-issue?action=close&projectId=278964&issueIid=285119) </details> <!--IssueSummary end--> File: `ee/lib/api/project_approval_rules.rb` Authorization: `authorize_create_merge_request_in_project` The following discussion from !47823 should be addressed: - [ ] @reprazent started a [discussion](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/47823#note_450565117): > This authorization is a bit weird, here we're checking if the user is allowed to create merge requests in order to decide if they can see an approval rule for a specific project. > > Further down the line, for [creating](https://gitlab.com/gitlab-org/gitlab/blob/83e89f4fdc7eccb7d4f9c0acadcd7c6eca4ff9cf/ee/lib/api/helpers/project_approval_rules_helpers.rb#L32) or [updating](https://gitlab.com/gitlab-org/gitlab/blob/83e89f4fdc7eccb7d4f9c0acadcd7c6eca4ff9cf/ee/lib/api/helpers/project_approval_rules_helpers.rb#L48) approval rules. > > I think this is somewhat confusing since we have policies for the different kinds of approval rules ([`ApprovalProjectRulePolicy`](https://gitlab.com/gitlab-org/gitlab/blob/83e89f4fdc7eccb7d4f9c0acadcd7c6eca4ff9cf/ee/app/policies/approval_project_rule_policy.rb#L3) and [`ApprovalMergeRequestRulePolicy`](https://gitlab.com/gitlab-org/gitlab/blob/83e89f4fdc7eccb7d4f9c0acadcd7c6eca4ff9cf/ee/app/policies/approval_merge_request_rule_policy.rb#L3)). > > I understand this is not part of this MR, but would you mind creating an issue so we can discuss this with ~"group::source code"? If a change is made, it would need to be updated on both the `index` endpoint and `show` endpoint