hide parent manipulation controlls if user lacks permission

app/assets/javascripts/angular/work_packages/view_models/relations-handler.js

@@ -183,8 +183,8 @@ angular.module('openproject.viewModels')
         handler.isSingletonRelation = true;
         handler.relationsId = relationsId;
 
-        handler.canAddRelation = function() { return !!this.workPackage.links.update; };
+        handler.canAddRelation = function() { return !!this.workPackage.links.changeParent; };
-        handler.canDeleteRelation = function() { return !!this.workPackage.links.update; };
+        handler.canDeleteRelation = function() { return !!this.workPackage.links.changeParent; };
         handler.getRelatedWorkPackage = function(workPackage, relation) { return relation.fetch() };
         handler.addRelation = function(scope) {
             WorkPackageService.updateWorkPackage(this.workPackage, {parentId: scope.relationToAddId}).then(function(workPackage) {

doc/apiv3-documentation.apib

@@ -878,6 +878,7 @@ Updates an activity's comment and, on success, returns the updated activity.
 |:------:|-------------| ---- | ----------- | -------------------- |
 | self   | This work package | WorkPackage | not null | READ |
 | author | The person that created the work package | User | not null | READ |
+| changeParent | Endpoint to change the parent (only if the user has the manage_subtasks permission) | | | READ |
 
 ## Properties:
 | Property | Description | Type | Constraints | Example | Supported operations |
@@ -973,6 +974,11 @@ Updates an activity's comment and, on success, returns the updated activity.
                         "method": "post",
                         "title": "Add relation"
                     },
+                    "changeParent": {
+                      "href": "/api/v3/work_packages/694",
+                      "method": "patch",
+                      "title": "Change parent of Bug in OpenProject"
+                    },
                     "addComment": {
                         "href": "/api/v3/work_packages/1528/activities",
                         "method": "post",

lib/api/v3/work_packages/work_package_representer.rb

@@ -176,6 +176,14 @@ module API
           } if current_user_allowed_to(:add_work_packages, represented.model)
         end
 
+        link :changeParent do
+          {
+            href: "#{root_path}api/v3/work_packages/#{represented.model.id}",
+            method: :patch,
+            title: "Change parent of #{represented.subject}"
+          } if current_user_allowed_to(:manage_subtasks, represented.model)
+        end
+
         link :addComment do
           {
               href: "#{root_path}api/v3/work_packages/#{represented.model.id}/activities",

spec/lib/api/v3/work_packages/work_package_representer_spec.rb

@@ -312,6 +312,13 @@ describe ::API::V3::WorkPackages::WorkPackageRepresenter do
           let(:permission) { :move_work_packages }
         end
       end
+
+      describe 'changeParent' do
+        it_behaves_like 'action link' do
+          let(:action) { 'changeParent' }
+          let(:permission) { :manage_subtasks }
+        end
+      end
     end
 
     describe '_embedded' do