FEATURE: Option to disallow moderators from removing staff notes

assets/javascripts/discourse/controllers/staff-notes.js.es6

@@ -41,7 +41,7 @@ export default Ember.Controller.extend({
         const notes = this.get('model');
         notes.removeObject(note);
         this._refreshCount();
-      });
+      }).catch(popupAjaxError);
     }
   }
 });

assets/javascripts/discourse/templates/modal/staff-notes.hbs

@@ -12,14 +12,15 @@
           <span class='username'>{{n.created_by.username}}</span>
           <span class='post-date'>{{age-with-tooltip n.created_at}}</span>
 
-          <span class='controls'>
-            {{d-button action="removeNote"
-                       actionParam=n
-                       icon="times"
-                       class="btn-small btn-danger"
-                       title="staff_notes.remove"}}
-          </span>
-
+          {{#if n.can_delete}}
+            <span class='controls'>
+              {{d-button action="removeNote"
+                         actionParam=n
+                         icon="times"
+                         class="btn-small btn-danger"
+                         title="staff_notes.remove"}}
+            </span>
+          {{/if}}
         </div>
 
         <div class='cooked'>

config/locales/server.en.yml

@@ -1,3 +1,4 @@
 en:
   site_settings:
     staff_notes_enabled: "Allow staff users to attach notes to users"
+    staff_notes_moderators_delete: "Allow moderators to delete staff notes"

config/settings.yml

@@ -2,3 +2,6 @@ plugins:
   staff_notes_enabled:
     default: false
     client: true
+  staff_notes_moderators_delete:
+    default: true
+    client: false

plugin.rb

@@ -56,7 +56,7 @@ after_initialize do
 
   require_dependency 'application_serializer'
   class ::StaffNoteSerializer < ApplicationSerializer
-    attributes :id, :user_id, :raw, :created_by, :created_at
+    attributes :id, :user_id, :raw, :created_by, :created_at, :can_delete
 
     def id
       object[:id]
@@ -77,6 +77,10 @@ after_initialize do
     def created_at
       object[:created_at]
     end
+
+    def can_delete
+      scope.can_delete_staff_notes?
+    end
   end
 
   require_dependency 'application_controller'
@@ -107,6 +111,8 @@ after_initialize do
       user = User.where(id: params[:user_id]).first
       raise Discourse::NotFound if user.blank?
 
+      raise Discourse::InvalidAccess.new unless guardian.can_delete_staff_notes?
+
       ::DiscourseStaffNotes.remove_note(user, params[:id])
       render json: success_json
     end
@@ -131,6 +137,10 @@ after_initialize do
 
   whitelist_staff_user_custom_field(STAFF_NOTE_COUNT_FIELD)
 
+  add_to_class(Guardian, :can_delete_staff_notes?) do
+    (SiteSetting.staff_notes_moderators_delete? && user.staff?) || user.admin?
+  end
+
   DiscourseStaffNotes::Engine.routes.draw do
     get '/' => 'staff_notes#index'
     post '/' => 'staff_notes#create'