Support discussion lock in the API

4 files changed, 14 insertions, 2 deletions

diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 52c49e5caa9..4b2ac1cce95 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -362,6 +362,7 @@ module API
       end
       expose :due_date
       expose :confidential
+      expose :discussion_locked
 
       expose :web_url do |issue, options|
         Gitlab::UrlBuilder.build(issue)
@@ -458,6 +459,7 @@ module API
       expose :diff_head_sha, as: :sha
       expose :merge_commit_sha
       expose :user_notes_count
+      expose :discussion_locked
       expose :should_remove_source_branch?, as: :should_remove_source_branch
       expose :force_remove_source_branch?, as: :force_remove_source_branch
 
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index 1729df2aad0..88b592083db 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -48,6 +48,7 @@ module API
         optional :labels, type: String, desc: 'Comma-separated list of label names'
         optional :due_date, type: String, desc: 'Date string in the format YEAR-MONTH-DAY'
         optional :confidential, type: Boolean, desc: 'Boolean parameter if the issue should be confidential'
+        optional :discussion_locked, type: Boolean, desc: "Boolean parameter if the issue's discussion should be locked"
       end
 
       params :issue_params do
@@ -193,7 +194,7 @@ module API
                               desc: 'Date time when the issue was updated. Available only for admins and project owners.'
         optional :state_event, type: String, values: %w[reopen close], desc: 'State of the issue'
         use :issue_params
-        at_least_one_of :title, :description, :assignee_ids, :assignee_id, :milestone_id,
+        at_least_one_of :title, :description, :assignee_ids, :assignee_id, :milestone_id, :discussion_locked,
                         :labels, :created_at, :due_date, :confidential, :state_event
       end
       put ':id/issues/:issue_iid' do
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index 56d72d511da..35395647fac 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -213,12 +213,14 @@ module API
           :remove_source_branch,
           :state_event,
           :target_branch,
-          :title
+          :title,
+          :discussion_locked
         ]
         optional :title, type: String, allow_blank: false, desc: 'The title of the merge request'
         optional :target_branch, type: String, allow_blank: false, desc: 'The target branch'
         optional :state_event, type: String, values: %w[close reopen],
                                desc: 'Status of the merge request'
+        optional :discussion_locked, type: Boolean, desc: 'Whether the MR discussion is locked'
 
         use :optional_params
         at_least_one_of(*at_least_one_of_ce)
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index d6e7203adaf..b3db366d875 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -71,6 +71,8 @@ module API
         post ":id/#{noteables_str}/:noteable_id/notes" do
           noteable = find_project_noteable(noteables_str, params[:noteable_id])
 
+          authorize! :create_note, user_project
+
           opts = {
             note: params[:body],
             noteable_type: noteables_str.classify,
@@ -82,6 +84,11 @@ module API
               opts[:created_at] = params[:created_at]
             end
 
+            noteable_type = opts[:noteable_type].to_s
+            noteable = Issue.find(opts[:noteable_id]) if noteable_type == 'Issue'
+            noteable = MergeRequest.find(opts[:noteable_id]) if noteable_type == 'MergeRequest'
+            authorize! :create_note, noteable if noteable
+
             note = ::Notes::CreateService.new(user_project, current_user, opts).execute
 
             if note.valid?