Developers can merge MR if target branch is not protected

app/controllers/merge_requests_controller.rb

@@ -81,7 +81,8 @@ class MergeRequestsController < ProjectResourceController
   end
   def automerge
-    return access_denied! unless can?(current_user, :accept_mr, @project)
+    return access_denied! unless allowed_to_merge?
+
     if @merge_request.opened? && @merge_request.can_be_merged?
       @merge_request.should_remove_source_branch = params[:should_remove_source_branch]
       @merge_request.automerge!(current_user)
@@ -143,5 +144,18 @@ class MergeRequestsController < ProjectResourceController
     # or from cache if already merged
     @commits = @merge_request.commits
     @commits = CommitDecorator.decorate(@commits)
+
+    @allowed_to_merge = allowed_to_merge?
+    @show_merge_controls = @merge_request.opened? && @commits.any? && @allowed_to_merge
+  end
+
+  def allowed_to_merge?
+    action = if project.protected_branch?(@merge_request.target_branch)
+               :push_code_to_protected_branches
+             else
+               :push_code
+             end
+
+    can?(current_user, action, @project)
   end
 end

app/models/ability.rb

@@ -91,7 +91,6 @@ class Ability
         :admin_team_member,
         :admin_merge_request,
         :admin_note,
-        :accept_mr,
         :admin_wiki,
         :admin_project
       ]

app/services/git_push_service.rb

@@ -19,6 +19,8 @@ class GitPushService
     # Collect data for this git push
     @push_data = post_receive_data(oldrev, newrev, ref)
+    create_push_event
+
     project.ensure_satellite_exists
     project.discover_default_branch
@@ -27,8 +29,6 @@ class GitPushService
       project.execute_hooks(@push_data.dup)
       project.execute_services(@push_data.dup)
     end
-
-    create_push_event
   end
   # This method provide a sample data

app/views/merge_requests/show/_mr_accept.html.haml

-- unless can?(current_user, :accept_mr, @project)
+- unless @allowed_to_merge
   .alert
-    %strong Only masters can accept MR
-- if @merge_request.opened? && @commits.any? && can?(current_user, :accept_mr, @project)
+    %strong You don't have enough permissions to merge this MR
+- if @show_merge_controls
   .automerge_widget.can_be_merged{style: "display:none"}
     .alert.alert-success
       %span