Merge pull request #265 from neinteractiveliterature/can-update-admin-notes

Allow admins to update event proposal admin notes

Author: nbudin

crates/intercode_events/src/partial_objects/ability_events_fields.rs

@@ -181,6 +181,21 @@ impl AbilityEventsFields {
       .await
   }
 
+  #[graphql(name = "can_update_admin_notes_on_event_proposal")]
+  async fn can_update_admin_notes_on_event_proposal(
+    &self,
+    ctx: &Context<'_>,
+    event_proposal_id: ID,
+  ) -> Result<bool, Error> {
+    self
+      .can_perform_event_proposal_action(
+        ctx,
+        event_proposal_id,
+        &EventProposalAction::UpdateAdminNotes,
+      )
+      .await
+  }
+
   #[graphql(name = "can_update_event_proposal")]
   async fn can_update_event_proposal(
     &self,

crates/intercode_graphql/src/api/merged_objects/event_proposal_type.rs

@@ -43,5 +43,6 @@ merged_model_backed_type!(
   event_proposals::Model,
   "EventProposal",
   EventProposalGlueFields,
+  EventProposalEventsFields,
   EventProposalFormsFields
 );

crates/intercode_policies/src/policies/event_proposal_policy.rs

@@ -183,10 +183,15 @@ impl Policy<AuthorizationInfo, (conventions::Model, event_proposals::Model)>
               .await?
                 || principal.site_admin_read()))),
       ),
-      EventProposalAction::ReadAdminNotes => Ok(
+      EventProposalAction::ReadAdminNotes | EventProposalAction::UpdateAdminNotes => Ok(
         (principal.has_scope("read_events")
-          && has_applicable_permission("read_admin_notes", principal, convention, event_proposal)
-            .await?)
+          && has_applicable_permission(
+            "access_admin_notes",
+            principal,
+            convention,
+            event_proposal,
+          )
+          .await?)
           || principal.site_admin_read(),
       ),
       EventProposalAction::Update => Ok(