API: make Merge Request approve/unapprove endpoints work with iid

All the other endpoints of `/project/:id/merge_request` work with
`:merge_request_iid`, except for `approvals`, `approve`, and
`unapprove`. This commit fixes that.

Closes gitlab-org/gitlab-ee#1875

doc/api/merge_requests.md

@@ -546,15 +546,15 @@ You can request information about a merge request's approval status using the
 following endpoint:
 
 ```
-GET /projects/:id/merge_requests/:merge_request_id/approvals
+GET /projects/:id/merge_requests/:merge_request_iid/approvals
 ```
 
 **Parameters:**
 
-| Attribute          | Type    | Required | Description         |
-|--------------------|---------|----------|---------------------|
-| `id`               | integer | yes      | The ID of a project |
-| `merge_request_id` | integer | yes      | The ID of MR        |
+| Attribute           | Type    | Required | Description         |
+|---------------------|---------|----------|---------------------|
+| `id`                | integer | yes      | The ID of a project |
+| `merge_request_iid` | integer | yes      | The IID of MR       |
 
 ```json
 {
@@ -592,15 +592,15 @@ If you are allowed to, you can approve a merge request using the following
 endpoint:
 
 ```
-POST /projects/:id/merge_requests/:merge_request_id/approve
+POST /projects/:id/merge_requests/:merge_request_iid/approve
 ```
 
 **Parameters:**
 
-| Attribute          | Type    | Required | Description         |
-|--------------------|---------|----------|---------------------|
-| `id`               | integer | yes      | The ID of a project |
-| `merge_request_id` | integer | yes      | The ID of MR        |
+| Attribute           | Type    | Required | Description         |
+|---------------------|---------|----------|---------------------|
+| `id`                | integer | yes      | The ID of a project |
+| `merge_request_iid` | integer | yes      | The IID of MR       |
 
 ```json
 {

lib/api/merge_requests.rb

@@ -249,14 +249,13 @@ module API
       #
       # Parameters:
       #   id (required)                 - The ID of a project
-      #   merge_request_id (required)   - ID of MR
+      #   merge_request_idd (required)  - IID of MR
       # Examples:
-      #   GET /projects/:id/merge_requests/:merge_request_id/approvals
+      #   GET /projects/:id/merge_requests/:merge_request_iid/approvals
       #
-      get ':id/merge_requests/:merge_request_id/approvals' do
-        merge_request = user_project.merge_requests.find(params[:merge_request_id])
+      get ':id/merge_requests/:merge_request_iid/approvals' do
+        merge_request = find_merge_request_with_access(params[:merge_request_iid])
 
-        authorize! :read_merge_request, merge_request
         present merge_request, with: Entities::MergeRequestApprovals, current_user: current_user
       end
 
@@ -264,12 +263,12 @@ module API
       #
       # Parameters:
       #   id (required)                 - The ID of a project
-      #   merge_request_id (required)   - ID of MR
+      #   merge_request_iid (required)  - IID of MR
       # Examples:
-      #   POST /projects/:id/merge_requests/:merge_request_id/approvals
+      #   POST /projects/:id/merge_requests/:merge_request_iid/approve
       #
-      post ':id/merge_requests/:merge_request_id/approve' do
-        merge_request = user_project.merge_requests.find(params[:merge_request_id])
+      post ':id/merge_requests/:merge_request_iid/approve' do
+        merge_request = find_project_merge_request(params[:merge_request_iid])
 
         unauthorized! unless merge_request.can_approve?(current_user)
 
@@ -280,8 +279,8 @@ module API
         present merge_request, with: Entities::MergeRequestApprovals, current_user: current_user
       end
 
-      delete ':id/merge_requests/:merge_request_id/unapprove' do
-        merge_request = user_project.merge_requests.find(params[:merge_request_id])
+      delete ':id/merge_requests/:merge_request_iid/unapprove' do
+        merge_request = find_project_merge_request(params[:merge_request_iid])
 
         not_found! unless merge_request.has_approved?(current_user)
 
@@ -298,8 +297,8 @@ module API
       params do
         use :pagination
       end
-      get ':id/merge_requests/:merge_request_id/closes_issues' do
-        merge_request = find_merge_request_with_access(params[:merge_request_id])
+      get ':id/merge_requests/:merge_request_iid/closes_issues' do
+        merge_request = find_merge_request_with_access(params[:merge_request_iid])
         issues = ::Kaminari.paginate_array(merge_request.closes_issues(current_user))
         present paginate(issues), with: issue_entity(user_project), current_user: current_user
       end

spec/requests/api/merge_requests_spec.rb

@@ -838,7 +838,7 @@ describe API::MergeRequests, api: true  do
     end
   end
 
-  describe 'GET :id/merge_requests/:merge_request_id/approvals' do
+  describe 'GET :id/merge_requests/:merge_request_iid/approvals' do
     it 'retrieves the approval status' do
       approver = create :user
       project.update_attribute(:approvals_before_merge, 2)
@@ -846,7 +846,7 @@ describe API::MergeRequests, api: true  do
       project.team << [create(:user), :developer]
       merge_request.approvals.create(user: approver)
 
-      get api("/projects/#{project.id}/merge_requests/#{merge_request.id}/approvals", user)
+      get api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/approvals", user)
 
       expect(response.status).to eq(200)
       expect(json_response['approvals_required']).to eq 2
@@ -857,11 +857,11 @@ describe API::MergeRequests, api: true  do
     end
   end
 
-  describe 'POST :id/merge_requests/:merge_request_id/approve' do
+  describe 'POST :id/merge_requests/:merge_request_iid/approve' do
     before { project.update_attribute(:approvals_before_merge, 2) }
 
     context 'as the author of the merge request' do
-      before { post api("/projects/#{project.id}/merge_requests/#{merge_request.id}/approve", user) }
+      before { post api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/approve", user) }
 
       it 'returns a 401' do
         expect(response).to have_http_status(401)
@@ -875,7 +875,7 @@ describe API::MergeRequests, api: true  do
         project.team << [approver, :developer]
         project.team << [create(:user), :developer]
 
-        post api("/projects/#{project.id}/merge_requests/#{merge_request.id}/approve", approver)
+        post api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/approve", approver)
       end
 
       it 'approves the merge request' do
@@ -887,7 +887,7 @@ describe API::MergeRequests, api: true  do
     end
   end
 
-  describe 'DELETE :id/merge_requests/:merge_request_id/unapprove' do
+  describe 'DELETE :id/merge_requests/:merge_request_iid/unapprove' do
     before { project.update_attribute(:approvals_before_merge, 2) }
 
     context 'as a user who has approved the merge request' do
@@ -901,7 +901,7 @@ describe API::MergeRequests, api: true  do
         merge_request.approvals.create(user: approver)
         merge_request.approvals.create(user: unapprover)
 
-        delete api("/projects/#{project.id}/merge_requests/#{merge_request.id}/unapprove", unapprover)
+        delete api("/projects/#{project.id}/merge_requests/#{merge_request.iid}/unapprove", unapprover)
       end
 
       it 'unapproves the merge request' do