Summary

Developers can merge pull requests. Per the role permissions matrix, Developer role is scoped to push, create PRs, and manage issues. Merge is not listed as a Developer permission and should be restricted to Maintainer and Owner only.

Steps to Reproduce

1. Add a user to a project as Developer
2. Log in as that user
3. Create a PR and merge it

Expected Behavior

Merge button should not be available to Developer role. Only Maintainer and Owner should be able to merge PRs.

Actual Behavior

Developer (rk) was able to merge a PR successfully.

Affected Components

• PR merge endpoint authorization
• PR merge button visibility in frontend