Returns new_blob_path only when user can push_code to project

2 files changed, 22 insertions, 3 deletions

diff --git a/app/serializers/merge_request_entity.rb b/app/serializers/merge_request_entity.rb
index d31057c030c..a49f4d834cd 100644
--- a/app/serializers/merge_request_entity.rb
+++ b/app/serializers/merge_request_entity.rb
@@ -98,9 +98,11 @@ class MergeRequestEntity < IssuableEntity
   end
 
   expose :new_blob_path do |merge_request|
-    namespace_project_new_blob_path(merge_request.project.namespace,
-                                    merge_request.project,
-                                    merge_request.source_branch)
+    if can?(current_user, :push_code, merge_request.project)
+      namespace_project_new_blob_path(merge_request.project.namespace,
+                                      merge_request.project,
+                                      merge_request.source_branch)
+    end
   end
 
   expose :conflict_resolution_path do |merge_request|
diff --git a/spec/serializers/merge_request_entity_spec.rb b/spec/serializers/merge_request_entity_spec.rb
index bb6e83ae4bd..b75c73e78c2 100644
--- a/spec/serializers/merge_request_entity_spec.rb
+++ b/spec/serializers/merge_request_entity_spec.rb
@@ -65,6 +65,23 @@ describe MergeRequestEntity do
       .to eq(resource.merge_commit_message(include_description: true))
   end
 
+  describe 'new_blob_path' do
+    context 'when user can push to project' do
+      it 'returns path' do
+        project.add_developer(user)
+
+        expect(subject[:new_blob_path])
+          .to eq("/#{resource.project.full_path}/new/#{resource.source_branch}")
+      end
+    end
+
+    context 'when user cannot push to project' do
+      it 'returns nil' do
+        expect(subject[:new_blob_path]).to be_nil
+      end
+    end
+  end
+
   describe 'diff_head_sha' do
     before do
       allow(resource).to receive(:diff_head_sha) { 'sha' }