Only show Merge Request button when user can create a MR

The Create Merge Request button only should be shown when the user is
allowed to create a Merge request.

5 files changed, 191 insertions, 0 deletions

diff --git a/app/helpers/compare_helper.rb b/app/helpers/compare_helper.rb
index aa54ee07bdc..8fcb82f17d5 100644
--- a/app/helpers/compare_helper.rb
+++ b/app/helpers/compare_helper.rb
@@ -4,6 +4,7 @@ module CompareHelper
       to.present? &&
       from != to &&
       project.feature_available?(:merge_requests, current_user) &&
+      can?(current_user, :create_merge_request, project) &&
       project.repository.branch_names.include?(from) &&
       project.repository.branch_names.include?(to)
   end
diff --git a/changelogs/unreleased/tc-only-mr-button-if-allowed.yml b/changelogs/unreleased/tc-only-mr-button-if-allowed.yml
new file mode 100644
index 00000000000..a7f5dcb560c
--- /dev/null
+++ b/changelogs/unreleased/tc-only-mr-button-if-allowed.yml
@@ -0,0 +1,4 @@
+---
+title: Only show Merge Request button when user can create a MR
+merge_request: 8639
+author:
diff --git a/spec/features/projects/branches/merge_request_buttons_spec.rb b/spec/features/projects/branches/merge_request_buttons_spec.rb
new file mode 100644
index 00000000000..6864113fcb4
--- /dev/null
+++ b/spec/features/projects/branches/merge_request_buttons_spec.rb
@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+feature 'Merge Request buttons on branches page', feature: true do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+
+  context 'not logged in' do
+    it 'does not show merge request buttons' do
+      visit namespace_project_branches_path(project.namespace, project)
+
+      expect(page).to have_no_link('Merge Request')
+    end
+  end
+
+  context 'logged in a developer' do
+    before do
+      login_as(user)
+      project.team << [user, :developer]
+    end
+
+    it 'shows merge request buttons' do
+      href = new_namespace_project_merge_request_path(project.namespace,
+                                                      project,
+                                                      merge_request: { source_branch: 'feature',
+                                                                       target_branch: 'master' })
+
+      visit namespace_project_branches_path(project.namespace, project)
+
+      expect(page).to have_link('Merge Request', href: href)
+    end
+  end
+
+  context 'logged in as non-member' do
+    before do
+      login_as(user)
+    end
+
+    it 'does not show merge request buttons' do
+      visit namespace_project_branches_path(project.namespace, project)
+
+      expect(page).to have_no_link('Merge Request')
+    end
+
+    context 'on own fork of project' do
+      let(:forked_project) do
+        create(:project, forked_from_project: project)
+      end
+      let(:user) { forked_project.owner }
+
+      it 'shows merge request buttons' do
+        href = new_namespace_project_merge_request_path(forked_project.namespace,
+                                                        forked_project,
+                                                        merge_request: { source_branch: 'feature',
+                                                                         target_branch: 'master' })
+
+        visit namespace_project_branches_path(forked_project.namespace, forked_project)
+
+        expect(page).to have_link('Merge Request', href: href)
+      end
+    end
+  end
+end
diff --git a/spec/features/projects/commits/merge_request_button_spec.rb b/spec/features/projects/commits/merge_request_button_spec.rb
new file mode 100644
index 00000000000..c986d087eba
--- /dev/null
+++ b/spec/features/projects/commits/merge_request_button_spec.rb
@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+feature 'Merge Request button on commits page', feature: true do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+
+  context 'not logged in' do
+    it 'does not show Create Merge Request button' do
+      visit namespace_project_commits_path(project.namespace, project, 'feature')
+
+      expect(page).to have_no_link('Create Merge Request')
+    end
+  end
+
+  context 'logged in a developer' do
+    before do
+      login_as(user)
+      project.team << [user, :developer]
+    end
+
+    it 'shows Create Merge Request button' do
+      href = new_namespace_project_merge_request_path(project.namespace,
+                                                      project,
+                                                      merge_request: { source_branch: 'feature',
+                                                                       target_branch: 'master' })
+
+      visit namespace_project_commits_path(project.namespace, project, 'feature')
+
+      expect(page).to have_link('Create Merge Request', href: href)
+    end
+  end
+
+  context 'logged in as non-member' do
+    before do
+      login_as(user)
+    end
+
+    it 'does not show Create Merge Request button' do
+      visit namespace_project_commits_path(project.namespace, project, 'feature')
+
+      expect(page).to have_no_link('Create Merge Request')
+    end
+
+    context 'on own fork of project' do
+      let(:forked_project) do
+        create(:project, forked_from_project: project)
+      end
+      let(:user) { forked_project.owner }
+
+      it 'shows Create Merge Request button' do
+        href = new_namespace_project_merge_request_path(forked_project.namespace,
+                                                        forked_project,
+                                                        merge_request: { source_branch: 'feature',
+                                                                         target_branch: 'master' })
+
+        visit namespace_project_commits_path(forked_project.namespace, forked_project, 'feature')
+
+        expect(page).to have_link('Create Merge Request', href: href)
+      end
+    end
+  end
+end
diff --git a/spec/features/projects/compare/merge_request_button_spec.rb b/spec/features/projects/compare/merge_request_button_spec.rb
new file mode 100644
index 00000000000..2b49c394759
--- /dev/null
+++ b/spec/features/projects/compare/merge_request_button_spec.rb
@@ -0,0 +1,62 @@
+require 'spec_helper'
+
+feature 'Merge Request button on commits page', feature: true do
+  let(:user) { create(:user) }
+  let(:project) { create(:project) }
+
+  context 'not logged in' do
+    it 'does not show Create Merge Request button' do
+      visit namespace_project_compare_path(project.namespace, project, from: 'master', to: 'feature')
+
+      expect(page).to have_no_link('Create Merge Request')
+    end
+  end
+
+  context 'logged in a developer' do
+    before do
+      login_as(user)
+      project.team << [user, :developer]
+    end
+
+    it 'shows Create Merge Request button' do
+      href = new_namespace_project_merge_request_path(project.namespace,
+                                                      project,
+                                                      merge_request: { source_branch: 'feature',
+                                                                       target_branch: 'master' })
+
+      visit namespace_project_compare_path(project.namespace, project, from: 'master', to: 'feature')
+
+      expect(page).to have_link('Create Merge Request', href: href)
+    end
+  end
+
+  context 'logged in as non-member' do
+    before do
+      login_as(user)
+    end
+
+    it 'does not show Create Merge Request button' do
+      visit namespace_project_compare_path(project.namespace, project, from: 'master', to: 'feature')
+
+      expect(page).to have_no_link('Create Merge Request')
+    end
+
+    context 'on own fork of project' do
+      let(:forked_project) do
+        create(:project, forked_from_project: project)
+      end
+      let(:user) { forked_project.owner }
+
+      it 'shows Create Merge Request button' do
+        href = new_namespace_project_merge_request_path(forked_project.namespace,
+                                                        forked_project,
+                                                        merge_request: { source_branch: 'feature',
+                                                                         target_branch: 'master' })
+
+        visit namespace_project_compare_path(forked_project.namespace, forked_project, from: 'master', to: 'feature')
+
+        expect(page).to have_link('Create Merge Request', href: href)
+      end
+    end
+  end
+end