MR API: Allow `allow_{collaboration,maintainer_to_push}` to be updated

Signed-off-by: Rémy Coutable <remy@rymai.me>

changelogs/unreleased/fix-require-at-least-one-optional-param-in-mr-put-api.yml

+---
+title: 'MR API: Allow `allow_{collaboration,maintainer_to_push}` to be updated'
+merge_request: 41088
+author:
+type: fixed

lib/api/merge_requests.rb

@@ -29,11 +29,13 @@ module API
         remove_labels
         milestone_id
         remove_source_branch
-        state_event
+        allow_collaboration
+        allow_maintainer_to_push
+        squash
         target_branch
         title
+        state_event
         discussion_locked
-        squash
       ]
     end
 
@@ -154,13 +156,13 @@ module API
 
       helpers do
         params :optional_params do
-          optional :description, type: String, desc: 'The description of the merge request'
           optional :assignee_id, type: Integer, desc: 'The ID of a user to assign the merge request'
           optional :assignee_ids, type: Array[Integer], coerce_with: ::API::Validations::Types::CommaSeparatedToIntegerArray.coerce, desc: 'The array of user IDs to assign issue'
-          optional :milestone_id, type: Integer, desc: 'The ID of a milestone to assign the merge request'
+          optional :description, type: String, desc: 'The description of the merge request'
           optional :labels, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Comma-separated list of label names'
           optional :add_labels, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Comma-separated list of label names'
           optional :remove_labels, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Comma-separated list of label names'
+          optional :milestone_id, type: Integer, desc: 'The ID of a milestone to assign the merge request'
           optional :remove_source_branch, type: Boolean, desc: 'Remove source branch when merging'
           optional :allow_collaboration, type: Boolean, desc: 'Allow commits from members who can merge to the target branch'
           optional :allow_maintainer_to_push, type: Boolean, as: :allow_collaboration, desc: '[deprecated] See allow_collaboration'

spec/requests/api/merge_requests_spec.rb

@@ -2354,12 +2354,46 @@ RSpec.describe API::MergeRequests do
       expect(json_response['squash']).to be_truthy
     end
 
-    it "returns merge_request with renamed target_branch" do
+    it "updates target_branch and returns merge_request" do
       put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user), params: { target_branch: "wiki" }
       expect(response).to have_gitlab_http_status(:ok)
       expect(json_response['target_branch']).to eq('wiki')
     end
 
+    context "forked projects" do
+      let_it_be(:user2) { create(:user) }
+      let(:project) { create(:project, :public, :repository) }
+      let!(:forked_project) { fork_project(project, user2, repository: true) }
+      let(:merge_request) do
+        create(:merge_request,
+               source_project: forked_project,
+               target_project: project,
+               source_branch: "fixes")
+      end
+
+      shared_examples "update of allow_collaboration and allow_maintainer_to_push" do |request_value, expected_value|
+        %w[allow_collaboration allow_maintainer_to_push].each do |attr|
+          it "attempts to update #{attr} to #{request_value} and returns #{expected_value} for `allow_collaboration`" do
+            put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user2), params: { attr => request_value }
+
+            expect(response).to have_gitlab_http_status(:ok)
+            expect(json_response["allow_collaboration"]).to eq(expected_value)
+            expect(json_response["allow_maintainer_to_push"]).to eq(expected_value)
+          end
+        end
+      end
+
+      context "when source project is public (i.e. MergeRequest#collaborative_push_possible? == true)" do
+        it_behaves_like "update of allow_collaboration and allow_maintainer_to_push", true, true
+      end
+
+      context "when source project is private (i.e. MergeRequest#collaborative_push_possible? == false)" do
+        let(:project) { create(:project, :private, :repository) }
+
+        it_behaves_like "update of allow_collaboration and allow_maintainer_to_push", true, false
+      end
+    end
+
     it "returns merge_request that removes the source branch" do
       put api("/projects/#{project.id}/merge_requests/#{merge_request.iid}", user), params: { remove_source_branch: true }