1 files changed, 17 insertions, 3 deletions
diff --git a/app/services/merge_requests/merge_to_ref_service.rb b/app/services/merge_requests/merge_to_ref_service.rb
index 8670b9ccf3d..87147d90c32 100644
--- a/app/services/merge_requests/merge_to_ref_service.rb
+++ b/app/services/merge_requests/merge_to_ref_service.rb
@@ -20,14 +20,20 @@ module MergeRequests
 
       raise_error('Conflicts detected during merge') unless commit_id
 
-      success(commit_id: commit_id)
-    rescue MergeError, ArgumentError => error
+      commit = project.commit(commit_id)
+      target_id, source_id = commit.parent_ids
+
+      success(commit_id: commit.id,
+              target_id: target_id,
+              source_id: source_id)
+    rescue MergeError => error
       error(error.message)
     end
 
     private
 
     def validate!
+      authorization_check!
       error_check!
     end
 
@@ -37,13 +43,21 @@ module MergeRequests
       error =
         if !hooks_validation_pass?(merge_request)
           hooks_validation_error(merge_request)
-        elsif source.blank?
+        elsif !@merge_request.mergeable_to_ref?
+          "Merge request is not mergeable to #{target_ref}"
+        elsif !source
           'No source for merge'
         end
 
       raise_error(error) if error
     end
 
+    def authorization_check!
+      unless Ability.allowed?(current_user, :admin_merge_request, project)
+        raise_error("You are not allowed to merge to this ref")
+      end
+    end
+
     def target_ref
       merge_request.merge_ref_path
     end